Nach Entfernung von HDD Repair mit MBAM findet GMER noch Root-Kit

ChronoJon · 29.08.2011, 17:19

Hallo an alle Virenjäger!

Mein Stiefvater hat sich MALWARE namens "HDD Repair" eingefangen und jetzt darf ich mich damit herumschlagen. Erstmal waren alle Dateien auf dem Desktop, im Explorer, in der Schnellstartleiste "weg". Task-Manager konnte ich nicht öffnen, die Rechte waren entzogen. Ein Fenster eines "Programms" HDD Repair erschien und forderte zum Bezahlen auf, um den Verlust von Daten auf der Festplatte vorzubeugen. Ebenso erschienen Fake-Meldungen, die Windowsmeldungen vorgaukelten und meinten, dass verschiedene Cluster der Festplatte kaputt seien etc.

System: Win XP SP3

Mein Vorgehen:

Ich habe SpyBot laufen lassen, da es eh schon installiert war und ich während des Suchlaufs mich im Internet informieren konnte. Spybot hat einige verdächtige Registryeinträge/Dateien gefunden und korrigiert/gelöscht. Danach konnte ich den Task-Manager wieder benutzen und HDD Repair schien wegzusein. Ist jedoch nach ca. 10 min wieder aufgetaucht.
Ich habe einige Anleitungen zur Entfernung von HDD Repair gefunden, doch wirkten manche nicht seriös, waren in schlechtem Englisch geschrieben und rieten zum Download von extra Programmen auf. Habe mich dann an dieses Forum gehalten, doch leider war hier nichts bezüglich HDD Repair zu finden. Im Folgenden habe ich mich deswegen an die Anleitung zum Entfernen von HDD Plus gehalten.
Habe rkill.com laufen lassen und die geschlossenen Prozesse anschließend per Hand gelöscht. Anschließend habe ich die restliche Malware mit MBAM entfernt. Danach habe ich nochmal Avira durchlaufen lassen, der auch nochmal einiges gelöscht hat. Im Anschluss hat GMER mir noch gemeldet das wohl noch ein Root-Kit auf der HDD ist, weshalb ich jetzt hier bin. Nachdem das Root-Kit weg ist, werde ich den Rechner formatieren und neuinstallieren.
Habe dann noch defogger benutzt und OTL durchlaufen lassen. Alle Logs sind in der angehängten ZIP-Datei (inkl. Spybot, Avira).

Vielden Dank im Vorraus

cosinus · 30.08.2011, 11:14

Zitat:

Datenbank Version: 7577

Ganz aktuell war es aber nicht? Bitte Malwarebytes updaten und einen neuen Vollscan bitte machen.

ChronoJon · 30.08.2011, 13:04

Hier der aktuelle Scan:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7609

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

30.08.2011 13:26:55
mbam-log-2011-08-30 (13-26-55).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 248837
Laufzeit: 46 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus · 30.08.2011, 15:27

Führe auch bitte ESET aus, danach sehen wir weiter.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

n.

ChronoJon · 30.08.2011, 17:50

Nichts gefunden:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6aba623a80218c438ac436ab037f0700
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-30 04:44:55
# local_time=2011-08-30 06:44:55 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775141 100 93 10492 51252295 59569 0
# compatibility_mode=8192 67108863 100 0 448 448 0 0
# scanned=94386
# found=0
# cleaned=0
# scan_time=7259

cosinus · 31.08.2011, 10:36

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

ChronoJon · 31.08.2011, 12:40

Hier das OTL-Log:

Code:

ATTFilter

OTL logfile created on: 31.08.2011 12:56:07 - Run 4
OTL by OldTimer - Version 3.2.26.5     Folder = C:\Dokumente und Einstellungen\**USERNAME**\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1015,42 Mb Total Physical Memory | 612,76 Mb Available Physical Memory | 60,35% Memory free
2,39 Gb Paging File | 2,07 Gb Available in Paging File | 86,75% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 127,34 Gb Free Space | 85,44% Space Free | Partition Type: NTFS
Drive E: | 74,53 Gb Total Space | 34,59 Gb Free Space | 46,41% Space Free | Partition Type: NTFS
 
Computer Name: **PC-NAME** | User Name: **USERNAME** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTH.scr (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) --  File not found
SRV - (AppMgmt) --  File not found
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (LiveUpdate Notice Service) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (CLSched) CyberLink Task Scheduler (CTS) -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
SRV - (CyberLink Media Library Service) -- c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (USBDeviceService) -- C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe ()
SRV - (UleadBurningHelper) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (STI Simulator) -- C:\WINDOWS\system32\PAStiSvc.exe ()
SRV - (AOL ACS) -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe (America Online, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (eeCtrl) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\eengine\eectrl.sys (Symantec Corporation)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (TridVid) -- C:\WINDOWS\system32\drivers\TridVid.sys (Trident Multimedia Technologies Co.,Ltd)
DRV - (BVRPMPR5) -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (BVRP Software)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (PAC207) -- C:\WINDOWS\system32\drivers\pfc027.sys ()
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (glauiad) -- C:\WINDOWS\system32\drivers\glauiad.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.hamburg-magazin.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.08.21 08:55:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.08.14 12:38:41 | 000,000,000 | ---D | M]
 
[2011.08.07 20:26:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla\Extensions
[2011.08.08 15:47:00 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla\Firefox\Profiles\f50jem8k.default\extensions
[2011.08.07 20:56:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla\Firefox\Profiles\f50jem8k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.08.22 20:58:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.08.22 20:51:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.08.22 20:58:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011.08.22 20:51:12 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.08.21 08:55:10 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CXMon] C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [DetectorApp] C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe ()
O4 - HKLM..\Run: [DSLAGENTEXE]  File not found
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Nokia FastStart] C:\Programme\Nokia\Nokia Music\NokiaMusic.exe (Nokia)
O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
O4 - HKLM..\Run: [PCMService] c:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SVRemote] c:\Program Files\SVRemote\USB20Remote.exe ()
O4 - HKLM..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe (MacroGaming LTD.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [WinDVR SchSvr] C:\Programme\Gemeinsame Dateien\InterVideo\SchSvr\SchSvr.exe (InterVideo Inc.)
O4 - HKLM..\Run: [WinRemote] C:\Programme\InterVideo\WinDVR3\WinRemote.exe ()
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [NokiaOviSuite2] C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKCU..\Run: [SmpcSys] C:\APPS\SMP\SMPSYS.EXE (Packard Bell BV)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe (MacroGaming LTD.)
O4 - HKCU..\Run: [wlVsRfSnQB]  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\**USERNAME**\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175972806015 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {FA81E151-CFE7-4B18-8B9E-8B96E62BAC11} https://de.web.sonynetservices.com/portal/applets/DownloadManager.cab (DownloadManager)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Programme\PixiePack Codec Pack\InstallerHelper.exe
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.dvacm - C:\Programme\Gemeinsame Dateien\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp -  File not found
Drivers32: msacm.mpegacm - C:\Programme\Gemeinsame Dateien\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.ulmp3acm - C:\Programme\Gemeinsame Dateien\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.ACDV - ACDV.dll File not found
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.31 10:39:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mobile Partner
[2011.08.30 16:36:31 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2011.08.29 16:55:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\7-Zip
[2011.08.29 16:55:13 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2011.08.29 15:18:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Logs
[2011.08.26 15:15:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Malwarebytes
[2011.08.26 15:15:35 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.08.26 15:15:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.08.26 15:15:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.08.26 15:15:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.08.26 15:13:32 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Kopie von **PC-NAME**2.exe
[2011.08.26 15:12:46 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTH.scr
[2011.08.26 15:07:20 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTL.exe
[2011.08.26 15:05:06 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**2.exe
[2011.08.26 14:45:15 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Recent
[2011.08.26 10:57:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.08.22 21:03:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OpenOffice.org
[2011.08.22 20:54:51 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice.org 3.3
[2011.08.22 20:52:04 | 000,000,000 | ---D | C] -- C:\Programme\OpenOffice.org 3
[2011.08.22 20:51:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
[2011.08.21 09:43:47 | 000,000,000 | ---D | C] -- C:\Programme\Panasonic
[2011.08.21 09:43:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Panasonic
[2011.08.17 07:29:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\Downloads
[2011.08.14 21:22:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\GARMIN
[2011.08.14 13:41:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\Ovi
[2011.08.14 13:08:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2011.08.14 13:02:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
[2011.08.14 12:38:31 | 000,018,816 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2011.08.14 12:38:19 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2011.08.14 12:37:47 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys
[2011.08.14 12:37:46 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys
[2011.08.14 12:37:44 | 000,023,168 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys
[2011.08.14 12:37:42 | 000,605,696 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcocls.dll
[2011.08.14 12:37:42 | 000,123,904 | ---- | C] (Nokia) -- C:\WINDOWS\System32\ccdcmbwu.dll
[2011.08.14 12:37:42 | 000,018,176 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys
[2011.08.14 12:34:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2011.08.07 20:26:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2011.08.07 20:26:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla
[2011.08.07 20:26:06 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011.08.07 20:13:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Dream Aquarium
[2011.08.07 09:45:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy
[2011.08.07 09:27:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\Download
[2011.08.04 12:39:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2011.08.04 12:39:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Application Data
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.31 12:40:02 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.31 12:01:02 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.08.31 09:44:28 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.31 09:43:28 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.31 09:43:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.31 09:43:13 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.29 16:56:11 | 000,030,644 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Logs.zip
[2011.08.29 15:32:57 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\defogger_reenable
[2011.08.29 15:32:23 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Defogger.exe
[2011.08.27 17:44:33 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\up17z5mu.exe
[2011.08.26 19:07:29 | 000,000,759 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.26 15:12:48 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTH.scr
[2011.08.26 15:07:23 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTL.exe
[2011.08.26 15:05:06 | 009,466,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Kopie von **PC-NAME**2.exe
[2011.08.26 15:05:06 | 009,466,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**2.exe
[2011.08.26 15:01:51 | 000,684,297 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\unhide.exe
[2011.08.26 14:49:23 | 001,008,092 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\rkill.com
[2011.08.26 14:49:23 | 001,008,092 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**.exe
[2011.08.24 13:12:27 | 000,092,160 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.22 21:05:49 | 000,000,839 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
[2011.08.22 21:00:05 | 000,300,440 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.22 20:54:53 | 000,000,861 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.3.lnk
[2011.08.22 20:46:53 | 168,166,968 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2011.08.21 09:43:54 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\FZ100 Bedienungsanleitung.lnk
[2011.08.14 13:03:31 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.08.14 13:03:29 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.08.11 13:12:06 | 000,467,414 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.08.11 13:12:06 | 000,449,716 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.08.11 13:12:06 | 000,088,048 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.08.11 13:12:06 | 000,074,782 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.08.08 16:38:42 | 000,000,699 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.08.08 16:35:14 | 000,000,976 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\wklnhst.dat
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.29 16:56:11 | 000,030,644 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Logs.zip
[2011.08.29 15:32:57 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\defogger_reenable
[2011.08.29 15:32:18 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Defogger.exe
[2011.08.27 17:44:36 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\up17z5mu.exe
[2011.08.26 15:15:35 | 000,000,759 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.26 15:12:04 | 000,000,861 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.3.lnk
[2011.08.26 15:12:04 | 000,000,699 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.08.26 15:12:04 | 000,000,657 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2011.08.26 15:11:41 | 000,001,750 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk
[2011.08.26 15:11:38 | 000,001,683 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Works-Start.lnk
[2011.08.26 15:11:38 | 000,000,705 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2011.08.26 15:11:38 | 000,000,665 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Movie Maker.lnk
[2011.08.26 15:11:38 | 000,000,621 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Messenger.lnk
[2011.08.26 15:11:37 | 000,002,056 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop Album Starter Edition 3.2.lnk
[2011.08.26 15:11:37 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader 8.lnk
[2011.08.26 15:11:37 | 000,001,767 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Office PowerPoint Viewer 2003.lnk
[2011.08.26 15:11:37 | 000,001,619 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\IncrediMail.lnk
[2011.08.26 15:11:37 | 000,000,550 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Acrobat Reader 5.0.lnk
[2011.08.26 15:01:49 | 000,684,297 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\unhide.exe
[2011.08.26 14:57:52 | 001,008,092 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\rkill.com
[2011.08.26 14:49:16 | 001,008,092 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**.exe
[2011.08.22 21:05:49 | 000,000,839 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
[2011.08.22 20:45:43 | 168,166,968 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2011.08.21 09:43:54 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\FZ100 Bedienungsanleitung.lnk
[2011.08.14 13:03:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.08.14 13:03:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010.12.15 09:48:25 | 000,000,145 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT
[2010.08.27 16:32:00 | 000,000,072 | ---- | C] () -- C:\WINDOWS\Pex.INI
[2010.07.21 22:51:10 | 000,000,119 | ---- | C] () -- C:\WINDOWS\Podcasts.INI
[2010.07.07 10:20:57 | 000,323,360 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.06.12 11:27:33 | 000,125,440 | ---- | C] () -- C:\WINDOWS\dx7ogl32.dll
[2009.11.25 13:40:50 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009.04.24 12:25:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2009.04.24 12:25:50 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2009.04.24 12:25:50 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2009.04.24 12:25:50 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2009.04.24 12:25:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2009.04.24 12:25:50 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2007.02.21 20:46:37 | 000,000,043 | ---- | C] () -- C:\WINDOWS\TC.INI
[2007.02.21 20:41:08 | 000,246,784 | ---- | C] () -- C:\WINDOWS\UN160407.EXE
[2007.02.21 19:51:22 | 000,000,046 | ---- | C] () -- C:\WINDOWS\DFamily.ini
[2007.01.30 23:15:07 | 000,006,063 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\NMM-MetaData.db
[2007.01.30 22:48:36 | 000,000,158 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.01.15 13:47:43 | 000,025,601 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2007.01.15 13:32:28 | 000,000,509 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007.01.08 19:30:33 | 000,000,026 | ---- | C] () -- C:\WINDOWS\neosetup.INI
[2007.01.06 13:42:07 | 000,002,387 | ---- | C] () -- C:\WINDOWS\gshh04.ini
[2007.01.06 13:42:07 | 000,000,438 | ---- | C] () -- C:\WINDOWS\retrieve.ini
[2007.01.03 20:24:43 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PAStiSvc.exe
[2006.12.19 23:18:25 | 000,092,160 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.12.17 17:13:45 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\ldf252.dll
[2006.12.17 16:57:51 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS5y.DLL
[2006.12.17 16:38:27 | 000,000,976 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\wklnhst.dat
[2006.12.16 21:40:39 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\CoInst.dll
[2006.12.16 21:40:38 | 000,015,080 | ---- | C] () -- C:\WINDOWS\wwdslcfg.ini
[2006.12.16 18:56:13 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.09.29 11:38:09 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.09.29 11:22:59 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2006.09.29 11:18:12 | 000,000,626 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI
[2006.09.29 11:13:46 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006.09.29 11:11:40 | 000,006,929 | ---- | C] () -- C:\WINDOWS\HDReg.ini
[2006.09.29 11:10:06 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006.09.29 10:56:14 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2006.09.29 10:56:14 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2006.03.23 14:24:10 | 000,006,399 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006.01.12 12:23:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005.12.07 13:31:00 | 000,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2005.04.08 11:46:18 | 000,162,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\pfc027.sys
[2005.01.25 16:15:42 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\PA207Usd.dll
[2004.08.11 19:13:19 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.08.11 19:10:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004.08.11 19:03:37 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.11 18:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.11 18:56:16 | 000,300,440 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.08.11 18:48:09 | 000,467,414 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.11 18:48:09 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.11 18:48:09 | 000,088,048 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.11 18:48:09 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.11 18:47:49 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.11 18:47:46 | 000,449,716 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.11 18:47:46 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.11 18:47:46 | 000,074,782 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.11 18:47:46 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.11 18:47:45 | 000,004,613 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.11 18:47:43 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.11 18:47:41 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.08.11 18:47:34 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.11 18:47:34 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.11 18:47:25 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.11 18:47:16 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.01.13 19:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
 
========== LOP Check ==========
 
[2011.08.14 20:09:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2011.02.25 19:42:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2007.01.30 22:34:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations
[2009.04.24 12:27:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\InterVideo
[2011.08.14 13:08:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2011.08.14 12:34:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2009.09.08 12:02:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaMusic
[2006.09.29 11:17:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OD2
[2009.09.08 12:12:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011.07.15 11:01:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RapidSolution
[2006.09.29 11:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SmartSound Software Inc
[2007.01.15 13:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanAppDataDir
[2007.01.15 13:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanWizard
[2010.08.27 16:31:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2006.09.29 11:11:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2006.12.17 17:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ACD Systems
[2011.07.13 10:52:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\AskToolbar
[2007.01.15 14:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Canon
[2007.02.21 19:52:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\D-Info
[2007.01.30 22:42:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Datalayer
[2011.08.14 14:50:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Dream Aquarium
[2011.08.14 21:22:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\GARMIN
[2007.01.15 13:27:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\InterTrust
[2007.02.25 16:27:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Leadertech
[2009.09.08 12:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia
[2007.02.08 22:56:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia Multimedia Player
[2006.12.21 06:47:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Norman
[2009.09.08 12:11:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nseries
[2006.12.17 08:14:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OD2
[2011.08.22 21:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OpenOffice.org
[2006.12.17 17:12:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ordner HP Share-to-Web
[2011.08.14 13:08:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\PC Suite
[2009.07.04 22:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RapidSolution
[2007.09.23 06:33:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RTPlayer
[2007.01.15 13:32:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ScanSoft
[2006.12.17 16:45:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Template
[2010.08.27 16:31:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ulead Systems
[2011.08.31 12:01:02 | 000,000,228 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2006.12.17 17:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ACD Systems
[2007.08.09 14:24:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Adobe
[2007.01.16 10:17:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\AdobeUM
[2009.06.25 07:59:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Arcsoft
[2011.07.13 10:52:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\AskToolbar
[2010.10.21 18:15:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Avira
[2007.01.15 14:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Canon
[2006.12.18 14:57:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\CyberLink
[2007.02.21 19:52:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\D-Info
[2007.01.30 22:42:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Datalayer
[2011.08.14 14:50:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Dream Aquarium
[2011.08.14 21:22:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\GARMIN
[2007.06.08 05:39:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Google
[2006.12.21 16:50:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Help
[2004.08.11 19:11:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Identities
[2007.01.15 13:27:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\InterTrust
[2007.01.09 17:10:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Lavasoft
[2007.02.25 16:27:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Leadertech
[2006.12.16 20:37:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Macromedia
[2011.08.26 15:15:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Malwarebytes
[2007.01.01 22:54:57 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft
[2011.08.07 20:26:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla
[2009.09.08 12:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia
[2007.02.08 22:56:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia Multimedia Player
[2006.12.21 06:47:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Norman
[2009.09.08 12:11:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nseries
[2006.12.17 08:14:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OD2
[2011.08.22 21:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OpenOffice.org
[2006.12.17 17:12:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ordner HP Share-to-Web
[2011.08.14 13:08:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\PC Suite
[2009.07.04 22:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RapidSolution
[2007.09.23 06:33:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RTPlayer
[2007.01.15 13:32:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ScanSoft
[2008.02.25 13:23:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Skype
[2007.02.25 16:41:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Sonic
[2006.12.17 08:21:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Sun
[2006.12.17 16:45:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Template
[2010.08.27 16:31:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ulead Systems
[2006.09.29 11:11:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\You've Got Pictures Screensaver
 
< %APPDATA%\*.exe /s >
[2007.01.15 21:25:43 | 023,813,608 | ---- | M] (                            ) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe
[2006.09.29 11:22:06 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft\Installer\{5E8A1B08-0FBD-4543-9646-F2C2D0D05750}\ARPPRODUCTICON.exe
[2007.02.08 19:50:35 | 000,002,670 | R--- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft\Installer\{B123C187-8673-4B48-A3F0-24D50E1B03C6}\_18be6784.exe
[2007.02.08 19:50:35 | 000,002,670 | R--- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft\Installer\{B123C187-8673-4B48-A3F0-24D50E1B03C6}\_294823.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >

cosinus · 31.08.2011, 15:32

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

ATTFilter

:OTL
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [DSLAGENTEXE]  File not found
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe (MacroGaming LTD.)
O4 - HKCU..\Run: [wlVsRfSnQB]  File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
:Commands
[emptytemp]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

ChronoJon · 31.08.2011, 15:55

Hier das Log nach dem Fix:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DSLAGENTEXE deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM deleted successfully.
C:\Programme\Macrogaming\SweetIM\SweetIM.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wlVsRfSnQB deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c1a920-caec-11df-954f-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403950-cf05-11df-9592-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403950-cf05-11df-9592-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403954-cf05-11df-9592-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403954-cf05-11df-9592-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817af-d823-11df-9568-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
File E:\AutoRun.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: **USERNAME**
->Temp folder emptied: 2623743 bytes
->Temporary Internet Files folder emptied: 52211806 bytes
->Java cache emptied: 521 bytes
->FireFox cache emptied: 50531587 bytes
->Google Chrome cache emptied: 11244928 bytes
->Flash cache emptied: 470 bytes
 
User: Besitzer
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 14490782 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33233 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19096 bytes
RecycleBin emptied: 167895 bytes
 
Total Files Cleaned = 125,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.26.5 log created on 08312011_164433

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus · 31.08.2011, 16:18

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

ChronoJon · 31.08.2011, 17:15

Es wurde ein Root-Kit gefunden und entfernt:

Code:

ATTFilter

2011/08/31 17:35:18.0328 0532	TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/31 17:35:20.0328 0532	================================================================================
2011/08/31 17:35:20.0328 0532	SystemInfo:
2011/08/31 17:35:20.0328 0532	
2011/08/31 17:35:20.0328 0532	OS Version: 5.1.2600 ServicePack: 3.0
2011/08/31 17:35:20.0328 0532	Product type: Workstation
2011/08/31 17:35:20.0328 0532	ComputerName: **PC-NAME**
2011/08/31 17:35:20.0328 0532	UserName: **USERNAME**
2011/08/31 17:35:20.0328 0532	Windows directory: C:\WINDOWS
2011/08/31 17:35:20.0328 0532	System windows directory: C:\WINDOWS
2011/08/31 17:35:20.0328 0532	Processor architecture: Intel x86
2011/08/31 17:35:20.0328 0532	Number of processors: 1
2011/08/31 17:35:20.0328 0532	Page size: 0x1000
2011/08/31 17:35:20.0328 0532	Boot type: Normal boot
2011/08/31 17:35:20.0328 0532	================================================================================
2011/08/31 17:35:22.0296 0532	Initialize success
2011/08/31 17:35:31.0125 0268	================================================================================
2011/08/31 17:35:31.0125 0268	Scan started
2011/08/31 17:35:31.0125 0268	Mode: Manual; 
2011/08/31 17:35:31.0125 0268	================================================================================
2011/08/31 17:35:32.0328 0268	abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/08/31 17:35:32.0390 0268	ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/31 17:35:32.0468 0268	ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/08/31 17:35:32.0500 0268	adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/08/31 17:35:32.0546 0268	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/31 17:35:32.0656 0268	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/31 17:35:32.0718 0268	agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/31 17:35:32.0765 0268	agpCPQ          (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/08/31 17:35:32.0812 0268	Aha154x         (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/08/31 17:35:32.0859 0268	aic78u2         (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/08/31 17:35:32.0890 0268	aic78xx         (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/08/31 17:35:32.0968 0268	AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/08/31 17:35:33.0000 0268	alim1541        (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/08/31 17:35:33.0031 0268	amdagp          (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/08/31 17:35:33.0062 0268	amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/08/31 17:35:33.0156 0268	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/31 17:35:33.0234 0268	asc             (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/08/31 17:35:33.0265 0268	asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/08/31 17:35:33.0296 0268	asc3550         (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/08/31 17:35:33.0343 0268	ASCTRM          (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
2011/08/31 17:35:33.0421 0268	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/31 17:35:33.0468 0268	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/31 17:35:33.0546 0268	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/31 17:35:33.0578 0268	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/31 17:35:33.0703 0268	avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/08/31 17:35:33.0781 0268	avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/08/31 17:35:33.0828 0268	avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/08/31 17:35:33.0921 0268	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/31 17:35:34.0015 0268	BVRPMPR5        (2120b6607cbbe426ce821643838ea1d3) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/08/31 17:35:34.0078 0268	cbidf           (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/08/31 17:35:34.0109 0268	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/31 17:35:34.0171 0268	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/31 17:35:34.0218 0268	cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/08/31 17:35:34.0265 0268	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/31 17:35:34.0328 0268	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/31 17:35:34.0390 0268	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/31 17:35:34.0515 0268	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/31 17:35:34.0562 0268	CmdIde          (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/08/31 17:35:34.0593 0268	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/31 17:35:34.0640 0268	Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/08/31 17:35:34.0671 0268	dac2w2k         (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/08/31 17:35:34.0703 0268	dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/08/31 17:35:34.0750 0268	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/31 17:35:34.0812 0268	dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/31 17:35:34.0875 0268	dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/31 17:35:34.0937 0268	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/31 17:35:34.0968 0268	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/31 17:35:35.0015 0268	dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/08/31 17:35:35.0046 0268	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/31 17:35:35.0171 0268	eeCtrl          (e89cc1363cb7f5320ae3b41c1333d0c3) C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
2011/08/31 17:35:35.0453 0268	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/31 17:35:35.0546 0268	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/08/31 17:35:35.0625 0268	Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/31 17:35:35.0687 0268	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/31 17:35:35.0765 0268	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/08/31 17:35:35.0843 0268	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/31 17:35:35.0937 0268	Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/31 17:35:36.0046 0268	glauiad         (3ebd3017f1c8aa111ba5df3243829aa0) C:\WINDOWS\system32\DRIVERS\glauiad.sys
2011/08/31 17:35:36.0156 0268	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/31 17:35:36.0281 0268	HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys
2011/08/31 17:35:36.0390 0268	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/31 17:35:36.0500 0268	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/31 17:35:36.0578 0268	hpn             (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/08/31 17:35:36.0671 0268	HSFHWAZL        (14b15d0d803ef4ab9b525b7e2da303ef) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
2011/08/31 17:35:36.0781 0268	HSF_DPV         (cbf6831420a97e8fbb91e5f52b707ef7) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2011/08/31 17:35:36.0953 0268	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/31 17:35:37.0203 0268	i2omgmt         (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/08/31 17:35:37.0281 0268	i2omp           (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/08/31 17:35:37.0359 0268	i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/31 17:35:37.0500 0268	ialm            (afa7c99d211a2aff21a287bc4264cde6) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/08/31 17:35:37.0671 0268	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/31 17:35:37.0734 0268	ini910u         (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/08/31 17:35:37.0906 0268	IntcAzAudAddService (b3ed6daa38bdffa48e453d7d6007ce1b) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/08/31 17:35:38.0171 0268	IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/31 17:35:38.0218 0268	intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/31 17:35:38.0281 0268	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/08/31 17:35:38.0328 0268	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/31 17:35:38.0406 0268	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/31 17:35:38.0437 0268	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/31 17:35:38.0515 0268	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/31 17:35:38.0562 0268	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/31 17:35:38.0625 0268	isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/31 17:35:38.0687 0268	Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/31 17:35:38.0718 0268	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/31 17:35:38.0796 0268	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/31 17:35:38.0937 0268	mdmxsdk         (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/08/31 17:35:38.0984 0268	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/31 17:35:39.0046 0268	Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/31 17:35:39.0078 0268	Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/31 17:35:39.0140 0268	mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/31 17:35:39.0203 0268	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/31 17:35:39.0234 0268	mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/08/31 17:35:39.0265 0268	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/31 17:35:39.0328 0268	MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/31 17:35:39.0406 0268	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/31 17:35:39.0453 0268	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/31 17:35:39.0515 0268	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/31 17:35:39.0546 0268	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/31 17:35:39.0609 0268	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/31 17:35:39.0640 0268	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/31 17:35:39.0703 0268	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/31 17:35:39.0750 0268	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/31 17:35:39.0812 0268	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/31 17:35:39.0859 0268	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/31 17:35:39.0937 0268	NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/31 17:35:39.0984 0268	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/31 17:35:40.0015 0268	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/31 17:35:40.0078 0268	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/31 17:35:40.0125 0268	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/31 17:35:40.0171 0268	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/31 17:35:40.0265 0268	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/31 17:35:40.0343 0268	nmwcd           (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/08/31 17:35:40.0406 0268	nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/08/31 17:35:40.0468 0268	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/31 17:35:40.0500 0268	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/31 17:35:40.0593 0268	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/31 17:35:40.0640 0268	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/31 17:35:40.0703 0268	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/31 17:35:40.0781 0268	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/31 17:35:40.0843 0268	PAC207          (5489b567cdd6ae216519caca7cc700e9) C:\WINDOWS\system32\DRIVERS\pfc027.sys
2011/08/31 17:35:40.0921 0268	Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/31 17:35:40.0984 0268	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/31 17:35:41.0046 0268	ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/31 17:35:41.0125 0268	pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/08/31 17:35:41.0203 0268	PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/31 17:35:41.0296 0268	PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/31 17:35:41.0343 0268	Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/08/31 17:35:41.0546 0268	perc2           (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/08/31 17:35:41.0593 0268	perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/08/31 17:35:41.0703 0268	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/31 17:35:41.0765 0268	Processor       (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/08/31 17:35:41.0828 0268	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/31 17:35:41.0875 0268	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/31 17:35:41.0968 0268	PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/31 17:35:42.0015 0268	ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/08/31 17:35:42.0062 0268	Ql10wnt         (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/08/31 17:35:42.0093 0268	ql12160         (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/08/31 17:35:42.0140 0268	ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/08/31 17:35:42.0187 0268	ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/08/31 17:35:42.0250 0268	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/31 17:35:42.0328 0268	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/31 17:35:42.0375 0268	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/31 17:35:42.0421 0268	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/31 17:35:42.0484 0268	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/31 17:35:42.0562 0268	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/31 17:35:42.0640 0268	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/31 17:35:42.0765 0268	RDPWD           (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/31 17:35:42.0828 0268	redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/31 17:35:42.0937 0268	RTL8023xp       (7f0413bdd7d53eb4c7a371e7f6f84df1) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
2011/08/31 17:35:43.0031 0268	sdbus           (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/08/31 17:35:43.0125 0268	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/31 17:35:43.0218 0268	Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
2011/08/31 17:35:43.0312 0268	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/31 17:35:43.0421 0268	sisagp          (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/08/31 17:35:43.0468 0268	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/31 17:35:43.0515 0268	Sparrow         (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/08/31 17:35:43.0562 0268	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/31 17:35:43.0593 0268	sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/31 17:35:43.0671 0268	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/31 17:35:43.0734 0268	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/08/31 17:35:43.0796 0268	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/31 17:35:43.0859 0268	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/31 17:35:43.0890 0268	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/31 17:35:43.0937 0268	symc810         (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/08/31 17:35:43.0968 0268	symc8xx         (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/08/31 17:35:44.0000 0268	sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/08/31 17:35:44.0031 0268	sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/08/31 17:35:44.0093 0268	SynTP           (b47954850ab7eab09961df08cc747852) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/08/31 17:35:44.0156 0268	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/31 17:35:44.0250 0268	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/31 17:35:44.0296 0268	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/31 17:35:44.0359 0268	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/31 17:35:44.0406 0268	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/31 17:35:44.0500 0268	tifm21          (046ea1353dd599dac9abdcd13504b06c) C:\WINDOWS\system32\drivers\tifm21.sys
2011/08/31 17:35:44.0578 0268	TosIde          (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/08/31 17:35:44.0671 0268	TridVid         (fa76138a8015e9c14542ad6bd2ad6d4b) C:\WINDOWS\system32\DRIVERS\TridVid.sys
2011/08/31 17:35:44.0781 0268	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/31 17:35:44.0859 0268	ultra           (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/08/31 17:35:44.0921 0268	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/31 17:35:45.0031 0268	upperdev        (ec01da44b090d2651fc032c8b9257232) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/08/31 17:35:45.0125 0268	usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/31 17:35:45.0203 0268	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/31 17:35:45.0281 0268	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/31 17:35:45.0328 0268	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/31 17:35:45.0406 0268	usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/08/31 17:35:45.0468 0268	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/31 17:35:45.0515 0268	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/31 17:35:45.0578 0268	usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/08/31 17:35:45.0656 0268	UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/08/31 17:35:45.0734 0268	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/31 17:35:45.0781 0268	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/31 17:35:45.0828 0268	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/31 17:35:45.0890 0268	viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/08/31 17:35:45.0921 0268	ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/08/31 17:35:45.0968 0268	VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/31 17:35:46.0171 0268	w29n51          (c89da341fcc883a3d79dc11727484fc2) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2011/08/31 17:35:46.0453 0268	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/31 17:35:46.0578 0268	wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2011/08/31 17:35:46.0687 0268	wceusbsh        (2e8ba025d65dd49d15ea66973e2a15df) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2011/08/31 17:35:46.0796 0268	Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/08/31 17:35:46.0937 0268	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/31 17:35:47.0046 0268	winachsf        (59d043485a6eda2ed2685c81489ae5bd) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/08/31 17:35:47.0281 0268	WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/08/31 17:35:47.0328 0268	WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/08/31 17:35:47.0390 0268	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/31 17:35:47.0453 0268	WudfPf          (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/31 17:35:47.0515 0268	WudfRd          (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/31 17:35:47.0578 0268	MBR (0x1B8)     (6f9a1d528242bc09104b85e0becf5554) \Device\Harddisk0\DR0
2011/08/31 17:35:47.0578 0268	\Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.a (0)
2011/08/31 17:35:47.0984 0268	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR2
2011/08/31 17:35:48.0031 0268	Boot (0x1200)   (abb922844b9e07469eeaec194750ccbd) \Device\Harddisk0\DR0\Partition0
2011/08/31 17:35:48.0046 0268	Boot (0x1200)   (de82ebab7c67ae63c7bfbfe90878740d) \Device\Harddisk1\DR2\Partition0
2011/08/31 17:35:48.0078 0268	================================================================================
2011/08/31 17:35:48.0078 0268	Scan finished
2011/08/31 17:35:48.0078 0268	================================================================================
2011/08/31 17:35:48.0093 3780	Detected object count: 1
2011/08/31 17:35:48.0093 3780	Actual detected object count: 1
2011/08/31 17:36:00.0609 3780	\Device\Harddisk0\DR0 (Rootkit.Boot.SST.a) - will be cured after reboot
2011/08/31 17:36:00.0609 3780	\Device\Harddisk0\DR0 - ok
2011/08/31 17:36:00.0609 3780	Rootkit.Boot.SST.a(\Device\Harddisk0\DR0) - User select action: Cure 
2011/08/31 17:36:28.0437 0236	Deinitialize success

cosinus · 31.08.2011, 21:47

Da wurde was gefunden und entfernt. Bitte Windows neu starten und zur Kontrolle ein neues Log mit dem Kaspersky-TDSS-Killer machen.

ChronoJon · 01.09.2011, 11:50

2. TDSSKiller Log:

Code:

ATTFilter

2011/08/31 17:41:20.0171 1468	TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/31 17:41:20.0187 1468	================================================================================
2011/08/31 17:41:20.0187 1468	SystemInfo:
2011/08/31 17:41:20.0187 1468	
2011/08/31 17:41:20.0187 1468	OS Version: 5.1.2600 ServicePack: 3.0
2011/08/31 17:41:20.0187 1468	Product type: Workstation
2011/08/31 17:41:20.0187 1468	ComputerName: BERND
2011/08/31 17:41:20.0187 1468	UserName: Bernie
2011/08/31 17:41:20.0187 1468	Windows directory: C:\WINDOWS
2011/08/31 17:41:20.0187 1468	System windows directory: C:\WINDOWS
2011/08/31 17:41:20.0187 1468	Processor architecture: Intel x86
2011/08/31 17:41:20.0187 1468	Number of processors: 1
2011/08/31 17:41:20.0187 1468	Page size: 0x1000
2011/08/31 17:41:20.0187 1468	Boot type: Normal boot
2011/08/31 17:41:20.0187 1468	================================================================================
2011/08/31 17:41:22.0078 1468	Initialize success
2011/08/31 17:41:23.0765 2164	================================================================================
2011/08/31 17:41:23.0765 2164	Scan started
2011/08/31 17:41:23.0765 2164	Mode: Manual; 
2011/08/31 17:41:23.0765 2164	================================================================================
2011/08/31 17:41:25.0046 2164	abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/08/31 17:41:25.0125 2164	ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/31 17:41:25.0187 2164	ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/08/31 17:41:25.0265 2164	adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/08/31 17:41:25.0359 2164	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/31 17:41:25.0437 2164	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/31 17:41:25.0500 2164	agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/31 17:41:25.0546 2164	agpCPQ          (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/08/31 17:41:25.0578 2164	Aha154x         (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/08/31 17:41:25.0625 2164	aic78u2         (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/08/31 17:41:25.0656 2164	aic78xx         (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/08/31 17:41:25.0703 2164	AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/08/31 17:41:25.0750 2164	alim1541        (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/08/31 17:41:25.0796 2164	amdagp          (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/08/31 17:41:25.0843 2164	amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/08/31 17:41:26.0250 2164	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/31 17:41:26.0328 2164	asc             (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/08/31 17:41:26.0531 2164	asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/08/31 17:41:26.0671 2164	asc3550         (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/08/31 17:41:26.0718 2164	ASCTRM          (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
2011/08/31 17:41:26.0828 2164	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/31 17:41:26.0875 2164	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/31 17:41:26.0953 2164	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/31 17:41:27.0031 2164	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/31 17:41:27.0171 2164	avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/08/31 17:41:27.0265 2164	avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/08/31 17:41:27.0343 2164	avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/08/31 17:41:27.0437 2164	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/31 17:41:27.0531 2164	BVRPMPR5        (2120b6607cbbe426ce821643838ea1d3) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/08/31 17:41:27.0578 2164	cbidf           (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/08/31 17:41:27.0625 2164	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/31 17:41:27.0687 2164	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/31 17:41:27.0734 2164	cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/08/31 17:41:27.0781 2164	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/31 17:41:27.0843 2164	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/31 17:41:27.0890 2164	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/31 17:41:28.0015 2164	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/31 17:41:28.0062 2164	CmdIde          (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/08/31 17:41:28.0109 2164	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/31 17:41:28.0171 2164	Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/08/31 17:41:28.0234 2164	dac2w2k         (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/08/31 17:41:28.0281 2164	dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/08/31 17:41:28.0312 2164	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/31 17:41:28.0375 2164	dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/31 17:41:28.0421 2164	dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/31 17:41:28.0453 2164	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/31 17:41:28.0500 2164	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/31 17:41:28.0546 2164	dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/08/31 17:41:28.0593 2164	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/31 17:41:28.0687 2164	eeCtrl          (e89cc1363cb7f5320ae3b41c1333d0c3) C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
2011/08/31 17:41:28.0906 2164	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/31 17:41:28.0953 2164	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/08/31 17:41:29.0000 2164	Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/31 17:41:29.0062 2164	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/31 17:41:29.0109 2164	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/08/31 17:41:29.0171 2164	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/31 17:41:29.0234 2164	Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/31 17:41:29.0281 2164	glauiad         (3ebd3017f1c8aa111ba5df3243829aa0) C:\WINDOWS\system32\DRIVERS\glauiad.sys
2011/08/31 17:41:29.0343 2164	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/31 17:41:29.0437 2164	HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys
2011/08/31 17:41:29.0500 2164	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/31 17:41:29.0562 2164	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/31 17:41:29.0609 2164	hpn             (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/08/31 17:41:29.0687 2164	HSFHWAZL        (14b15d0d803ef4ab9b525b7e2da303ef) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
2011/08/31 17:41:29.0781 2164	HSF_DPV         (cbf6831420a97e8fbb91e5f52b707ef7) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2011/08/31 17:41:29.0875 2164	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/31 17:41:30.0062 2164	i2omgmt         (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/08/31 17:41:30.0109 2164	i2omp           (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/08/31 17:41:30.0156 2164	i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/31 17:41:30.0281 2164	ialm            (afa7c99d211a2aff21a287bc4264cde6) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/08/31 17:41:30.0375 2164	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/31 17:41:30.0453 2164	ini910u         (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/08/31 17:41:30.0640 2164	IntcAzAudAddService (b3ed6daa38bdffa48e453d7d6007ce1b) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/08/31 17:41:31.0046 2164	IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/31 17:41:31.0109 2164	intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/31 17:41:31.0187 2164	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/08/31 17:41:31.0281 2164	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/31 17:41:31.0359 2164	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/31 17:41:31.0421 2164	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/31 17:41:31.0468 2164	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/31 17:41:31.0515 2164	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/31 17:41:31.0593 2164	isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/31 17:41:31.0640 2164	Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/31 17:41:31.0703 2164	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/31 17:41:31.0765 2164	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/31 17:41:31.0984 2164	mdmxsdk         (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/08/31 17:41:32.0046 2164	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/31 17:41:32.0125 2164	Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/31 17:41:32.0156 2164	Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/31 17:41:32.0218 2164	mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/31 17:41:32.0265 2164	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/31 17:41:32.0328 2164	mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/08/31 17:41:32.0406 2164	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/31 17:41:32.0468 2164	MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/31 17:41:32.0546 2164	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/31 17:41:32.0609 2164	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/31 17:41:32.0656 2164	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/31 17:41:32.0703 2164	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/31 17:41:32.0765 2164	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/31 17:41:32.0812 2164	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/31 17:41:32.0890 2164	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/31 17:41:32.0937 2164	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/31 17:41:33.0000 2164	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/31 17:41:33.0062 2164	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/31 17:41:33.0109 2164	NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/31 17:41:33.0156 2164	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/31 17:41:33.0203 2164	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/31 17:41:33.0265 2164	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/31 17:41:33.0296 2164	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/31 17:41:33.0375 2164	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/31 17:41:33.0437 2164	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/31 17:41:33.0484 2164	nmwcd           (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/08/31 17:41:33.0546 2164	nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/08/31 17:41:33.0609 2164	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/31 17:41:33.0656 2164	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/31 17:41:33.0703 2164	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/31 17:41:33.0734 2164	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/31 17:41:33.0781 2164	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/31 17:41:33.0843 2164	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/31 17:41:33.0906 2164	PAC207          (5489b567cdd6ae216519caca7cc700e9) C:\WINDOWS\system32\DRIVERS\pfc027.sys
2011/08/31 17:41:33.0968 2164	Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/31 17:41:34.0015 2164	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/31 17:41:34.0062 2164	ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/31 17:41:34.0125 2164	pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/08/31 17:41:34.0171 2164	PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/31 17:41:34.0234 2164	PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/31 17:41:34.0281 2164	Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/08/31 17:41:34.0453 2164	perc2           (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/08/31 17:41:34.0484 2164	perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/08/31 17:41:34.0562 2164	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/31 17:41:34.0593 2164	Processor       (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/08/31 17:41:34.0625 2164	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/31 17:41:34.0656 2164	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/31 17:41:34.0718 2164	PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/31 17:41:34.0734 2164	ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/08/31 17:41:34.0765 2164	Ql10wnt         (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/08/31 17:41:34.0796 2164	ql12160         (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/08/31 17:41:34.0812 2164	ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/08/31 17:41:34.0843 2164	ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/08/31 17:41:34.0875 2164	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/31 17:41:34.0937 2164	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/31 17:41:34.0953 2164	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/31 17:41:34.0984 2164	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/31 17:41:35.0015 2164	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/31 17:41:35.0046 2164	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/31 17:41:35.0125 2164	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/31 17:41:35.0218 2164	RDPWD           (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/31 17:41:35.0296 2164	redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/31 17:41:35.0390 2164	RTL8023xp       (7f0413bdd7d53eb4c7a371e7f6f84df1) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
2011/08/31 17:41:35.0468 2164	sdbus           (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/08/31 17:41:35.0515 2164	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/31 17:41:35.0578 2164	Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
2011/08/31 17:41:35.0640 2164	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/31 17:41:35.0718 2164	sisagp          (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/08/31 17:41:35.0765 2164	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/31 17:41:35.0812 2164	Sparrow         (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/08/31 17:41:35.0875 2164	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/31 17:41:35.0921 2164	sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/31 17:41:36.0000 2164	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/31 17:41:36.0062 2164	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/08/31 17:41:36.0156 2164	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/31 17:41:36.0218 2164	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/31 17:41:36.0265 2164	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/31 17:41:36.0359 2164	symc810         (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/08/31 17:41:36.0406 2164	symc8xx         (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/08/31 17:41:36.0453 2164	sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/08/31 17:41:36.0484 2164	sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/08/31 17:41:36.0562 2164	SynTP           (b47954850ab7eab09961df08cc747852) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/08/31 17:41:36.0625 2164	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/31 17:41:36.0734 2164	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/31 17:41:36.0765 2164	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/31 17:41:36.0828 2164	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/31 17:41:36.0906 2164	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/31 17:41:37.0015 2164	tifm21          (046ea1353dd599dac9abdcd13504b06c) C:\WINDOWS\system32\drivers\tifm21.sys
2011/08/31 17:41:37.0062 2164	TosIde          (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/08/31 17:41:37.0156 2164	TridVid         (fa76138a8015e9c14542ad6bd2ad6d4b) C:\WINDOWS\system32\DRIVERS\TridVid.sys
2011/08/31 17:41:37.0234 2164	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/31 17:41:37.0281 2164	ultra           (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/08/31 17:41:37.0359 2164	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/31 17:41:37.0468 2164	upperdev        (ec01da44b090d2651fc032c8b9257232) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/08/31 17:41:37.0562 2164	usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/31 17:41:37.0609 2164	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/31 17:41:37.0687 2164	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/31 17:41:37.0750 2164	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/31 17:41:37.0796 2164	usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/08/31 17:41:37.0859 2164	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/31 17:41:37.0906 2164	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/31 17:41:37.0984 2164	usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/08/31 17:41:38.0062 2164	UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/08/31 17:41:38.0125 2164	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/31 17:41:38.0171 2164	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/31 17:41:38.0234 2164	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/31 17:41:38.0265 2164	viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/08/31 17:41:38.0312 2164	ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/08/31 17:41:38.0343 2164	VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/31 17:41:38.0500 2164	w29n51          (c89da341fcc883a3d79dc11727484fc2) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2011/08/31 17:41:38.0718 2164	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/31 17:41:38.0781 2164	wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2011/08/31 17:41:38.0828 2164	wceusbsh        (2e8ba025d65dd49d15ea66973e2a15df) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2011/08/31 17:41:38.0890 2164	Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/08/31 17:41:39.0015 2164	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/31 17:41:39.0125 2164	winachsf        (59d043485a6eda2ed2685c81489ae5bd) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/08/31 17:41:39.0296 2164	WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/08/31 17:41:39.0359 2164	WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/08/31 17:41:39.0421 2164	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/31 17:41:39.0500 2164	WudfPf          (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/31 17:41:39.0578 2164	WudfRd          (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/31 17:41:39.0671 2164	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/08/31 17:41:39.0859 2164	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR2
2011/08/31 17:41:39.0890 2164	Boot (0x1200)   (abb922844b9e07469eeaec194750ccbd) \Device\Harddisk0\DR0\Partition0
2011/08/31 17:41:39.0921 2164	Boot (0x1200)   (de82ebab7c67ae63c7bfbfe90878740d) \Device\Harddisk1\DR2\Partition0
2011/08/31 17:41:39.0937 2164	================================================================================
2011/08/31 17:41:39.0937 2164	Scan finished
2011/08/31 17:41:39.0937 2164	================================================================================
2011/08/31 17:41:39.0953 3888	Detected object count: 0
2011/08/31 17:41:39.0953 3888	Actual detected object count: 0
2011/08/31 17:41:49.0859 0400	Deinitialize success

Habe auch noch ein Scan mit GMER gemacht:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-09-01 12:31:09
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST9160821A rev.3.ALA
Running: up17z5mu.exe; Driver: C:\DOKUME~1\**USERNAME**\LOKALE~1\Temp\pxldqpog.sys


---- System - GMER 1.0.15 ----

SSDT  F7BFDD8C                                ZwClose
SSDT  F7BFDD46                                ZwCreateKey
SSDT  F7BFDD96                                ZwCreateSection
SSDT  F7BFDD3C                                ZwCreateThread
SSDT  F7BFDD4B                                ZwDeleteKey
SSDT  F7BFDD55                                ZwDeleteValueKey
SSDT  F7BFDD87                                ZwDuplicateObject
SSDT  F7BFDD5A                                ZwLoadKey
SSDT  F7BFDD28                                ZwOpenProcess
SSDT  F7BFDD2D                                ZwOpenThread
SSDT  F7BFDD64                                ZwReplaceKey
SSDT  F7BFDD5F                                ZwRestoreKey
SSDT  F7BFDD9B                                ZwSetContextThread
SSDT  F7BFDD50                                ZwSetValueKey
SSDT  F7BFDD37                                ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

init  C:\WINDOWS\system32\drivers\tifm21.sys  entry point in "init" section [0xF6A2DDBF]

---- EOF - GMER 1.0.15 ----

cosinus · 01.09.2011, 14:58

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

ChronoJon · 01.09.2011, 15:41

Combo-Fix Log:

Code:

ATTFilter

ComboFix 11-09-01.02 - Bernie 01.09.2011  16:21:37.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1015.604 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Bernie\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Bernie\Anwendungsdaten\ACD Systems\ACDSee\ImageDB.ddf
c:\dokumente und einstellungen\Bernie\WINDOWS
c:\windows\IsUn0407.exe
c:\windows\system32\CddbCdda.dll
c:\windows\system32\comct332.ocx
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-08-01 bis 2011-09-01  ))))))))))))))))))))))))))))))
.
.
2011-08-31 14:44 . 2011-08-31 14:44	--------	d-----w-	C:\_OTL
2011-08-30 14:36 . 2011-08-30 14:36	--------	d-----w-	c:\programme\ESET
2011-08-29 14:55 . 2011-08-29 14:55	--------	d-----w-	c:\programme\7-Zip
2011-08-26 13:15 . 2011-08-26 13:15	--------	d-----w-	c:\dokumente und einstellungen\Bernie\Anwendungsdaten\Malwarebytes
2011-08-26 13:15 . 2011-07-06 17:52	41272	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-26 13:15 . 2011-08-26 13:15	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-08-26 13:15 . 2011-08-26 17:07	--------	d-----w-	c:\programme\Malwarebytes' Anti-Malware
2011-08-22 19:03 . 2011-08-22 19:03	--------	d-----w-	c:\dokumente und einstellungen\Bernie\Anwendungsdaten\OpenOffice.org
2011-08-22 18:52 . 2011-08-22 18:52	--------	d-----w-	c:\programme\OpenOffice.org 3
2011-08-22 18:51 . 2011-05-04 02:52	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-08-21 07:43 . 2011-08-21 07:43	--------	d-----w-	c:\programme\Panasonic
2011-08-16 15:16 . 2011-08-16 15:16	--------	d-----w-	c:\dokumente und einstellungen\Besitzer
2011-08-14 19:22 . 2011-08-14 19:22	--------	d-----w-	c:\dokumente und einstellungen\Bernie\Anwendungsdaten\GARMIN
2011-08-14 11:08 . 2011-08-14 11:08	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nokia
2011-08-14 11:02 . 2011-08-14 11:08	--------	d-----w-	c:\dokumente und einstellungen\Bernie\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
2011-08-14 10:38 . 2008-08-26 08:26	18816	----a-w-	c:\windows\system32\drivers\pccsmcfd.sys
2011-08-14 10:38 . 2011-08-14 10:38	--------	d-----w-	c:\programme\PC Connectivity Solution
2011-08-14 10:37 . 2011-05-18 08:12	8192	----a-w-	c:\windows\system32\drivers\usbser_lowerfltj.sys
2011-08-14 10:37 . 2011-05-18 08:12	8192	----a-w-	c:\windows\system32\drivers\usbser_lowerflt.sys
2011-08-14 10:37 . 2011-05-18 08:12	23168	----a-w-	c:\windows\system32\drivers\ccdcmbo.sys
2011-08-14 10:37 . 2011-05-18 08:13	123904	----a-w-	c:\windows\system32\ccdcmbwu.dll
2011-08-14 10:37 . 2011-05-18 08:13	605696	----a-w-	c:\windows\system32\nmwcdcocls.dll
2011-08-14 10:37 . 2011-05-18 08:12	18176	----a-w-	c:\windows\system32\drivers\ccdcmb.sys
2011-08-14 10:37 . 2011-05-18 08:09	1461992	----a-w-	c:\windows\system32\wdfcoinstaller01009.dll
2011-08-10 18:01 . 2011-06-24 14:10	139656	------w-	c:\windows\system32\dllcache\rdpwd.sys
2011-08-10 18:00 . 2011-07-08 14:02	10496	------w-	c:\windows\system32\dllcache\ndistapi.sys
2011-08-08 07:22 . 2008-04-14 00:52	32000	----a-w-	c:\windows\system32\drivers\wceusbsh.sys
2011-08-08 07:22 . 2008-04-14 00:52	32000	----a-w-	c:\windows\system32\dllcache\wceusbsh.sys
2011-08-07 18:26 . 2011-08-07 18:26	--------	d-----w-	c:\dokumente und einstellungen\Bernie\Lokale Einstellungen\Anwendungsdaten\Mozilla
2011-08-07 18:13 . 2011-08-14 12:50	--------	d-----w-	c:\dokumente und einstellungen\Bernie\Anwendungsdaten\Dream Aquarium
2011-08-04 10:39 . 2011-08-14 18:09	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\boost_interprocess
2011-08-02 17:27 . 2008-04-13 16:44	2560	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\USMT\iconlib.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-20 06:26 . 2011-05-24 15:44	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2004-08-11 16:47	456320	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-07-13 08:23 . 2010-04-26 18:49	66616	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-07-13 08:23 . 2010-04-26 18:49	138192	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-07-08 14:02 . 2004-08-11 16:47	10496	----a-w-	c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2004-08-11 17:02	139656	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2004-08-11 16:48	916480	----a-w-	c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2004-08-11 16:47	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2004-08-11 16:47	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-11 16:47	385024	----a-w-	c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-11 16:48	293888	----a-w-	c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2004-08-11 16:47	1859072	----a-w-	c:\windows\system32\win32k.sys
2011-08-31 11:35 . 2011-08-08 14:38	134104	----a-w-	c:\programme\mozilla firefox\components\browsercomps.dll
2004-08-04 12:00	94800	--sh--w-	c:\windows\twain.dll
2008-04-14 02:22	50688	--sh--w-	c:\windows\twain_32.dll
2011-02-08 13:33	978944	--sha-w-	c:\windows\system32\mfc42.dll
2008-04-14 02:22	57344	--sh--w-	c:\windows\system32\msvcirt.dll
2008-04-14 02:22	413696	--sha-w-	c:\windows\system32\msvcp60.dll
2008-04-14 02:22	343040	--sha-w-	c:\windows\system32\msvcrt.dll
2010-12-20 17:32	551936	--sh--w-	c:\windows\system32\oleaut32.dll
2008-04-14 02:22	84992	--sh--w-	c:\windows\system32\olepro32.dll
2008-04-14 02:22	12288	--sh--w-	c:\windows\system32\regsvr32.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-11-17 975360]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2011-08-04 966712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-05-04 14396416]
"AzMixerSel"="c:\programme\Realtek\InstallShield\AzMixerSel.exe" [2005-04-26 45056]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-08-24 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-08-24 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-08-24 114688]
"DetectorApp"="c:\programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
"ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"CXMon"="c:\programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-08-09 49152]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2006-09-29 98304]
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"Symantec PIF AlertEng"="c:\programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SVRemote"="c:\program files\SVRemote\USB20Remote.exe" [2007-01-26 24576]
"WinDVR SchSvr"="c:\programme\Gemeinsame Dateien\InterVideo\SchSvr\SchSvr.exe" [2005-08-15 106496]
"WinRemote"="c:\programme\InterVideo\WinDVR3\WinRemote.exe" [2005-08-15 208896]
"Nokia FastStart"="c:\programme\Nokia\Nokia Music\NokiaMusic.exe" [2009-02-26 2376992]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]
"ApnUpdater"="c:\programme\Ask.com\Updater\Updater.exe" [2011-07-09 397992]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Bernie\Startmen\Programme\Autostart\
OpenOffice.org 3.3.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
InterVideo WinCinema Manager.lnk - c:\programme\InterVideo\Common\Bin\WinCinemaMgr.exe [2009-4-24 208896]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Programme\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Programme\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
.
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [26.04.2010 20:49 136360]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [13.07.2011 10:24 428200]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\programme\Symantec\LiveUpdate\AluSchedulerSvc.exe [17.12.2006 00:13 100032]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [11.02.2010 20:18 135664]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [26.08.2011 15:15 366640]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys --> c:\windows\system32\DRIVERS\ewusbnet.sys [?]
S3 glauiad;Lucent USB IAD LAN Modem;c:\windows\system32\drivers\glauiad.sys [16.12.2006 21:40 30373]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [11.02.2010 20:18 135664]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\pfc027.sys [08.04.2005 11:46 162176]
S3 TridVid;SinoVideo Analog Video;c:\windows\system32\drivers\TridVid.sys [24.04.2009 12:20 75264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 17:02	114688	----a-w-	c:\programme\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-11 18:18]
.
2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-11 18:18]
.
2011-09-01 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programme\Ask.com\UpdateTask.exe [2011-07-09 05:13]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.arcor.de/
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
DPF: {FA81E151-CFE7-4B18-8B9E-8B96E62BAC11} - hxxps://de.web.sonynetservices.com/portal/applets/DownloadManager.cab
FF - ProfilePath - c:\dokumente und einstellungen\Bernie\Anwendungsdaten\Mozilla\Firefox\Profiles\f50jem8k.default\
FF - prefs.js: browser.startup.homepage - www.hamburg-magazin.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SweetIM - c:\programme\Macrogaming\SweetIM\SweetIM.exe
AddRemove-Ad-Aware SE Personal - e:\progra~1\Lavasoft\AD-AWA~1\UNWISE.EXE
AddRemove-Adobe Acrobat 5.0 - c:\windows\ISUN0407.EXE
AddRemove-Easy-WebPrint - c:\windows\IsUn0407.exe
AddRemove-HP Fotobearbeitungs-Programm - c:\windows\IsUn0407.exe
AddRemove-HP Fotodruck-Programm - c:\windows\IsUn0407.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-01 16:28
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
"ImagePath"="\"c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\02\00\00\00@
[%\00«Ô’|\00\00\00\00(n3\03\00\00\00\00\00T3\03\00\00,\03pè\13\00pè\13\00À\01"
.
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(696)
c:\programme\Avira\AntiVir Desktop\avsda.dll
.
Zeit der Fertigstellung: 2011-09-01  16:30:15
ComboFix-quarantined-files.txt  2011-09-01 14:30
.
Vor Suchlauf: 16 Verzeichnis(se), 136.702.918.656 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 136.790.564.864 Bytes frei
.
- - End Of File - - CE69D8BFEB1FDCD458DFE1AA8AB61913

31.08.2011, 21:47	#12
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Nach Entfernung von HDD Repair mit MBAM findet GMER noch Root-Kit Da wurde was gefunden und entfernt. Bitte Windows neu starten und zur Kontrolle ein neues Log mit dem Kaspersky-TDSS-Killer machen. __________________ Logfiles bitte immer in CODE-Tags posten

Nach Entfernung von HDD Repair mit MBAM findet GMER noch Root-Kit

Log-Analyse und Auswertung: Nach Entfernung von HDD Repair mit MBAM findet GMER noch Root-Kit