| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundestrojaner win xp 32Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
27.09.2011, 13:46
| #1 |
 |  Bundestrojaner win xp 32 Hallo liebes Kompetenzteam, auf dem Laptop eines Bekannten befindet sich der Bundestrojaner. Ich habe srep.exe ausgeführt und wieder Zugriff auf den Laptop. Welche Schritte brauche ich noch für ein sauberes System? Im Voraus schon mal vielen Dank. Nachfolgend noch die shell.txt: WIN_XP X86 Modified HKLM shell extension. Current Shell File = C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\jashla.exe File C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\jashla.exe moved to E:\ infected or not found HKCU\..\Winlogon; Shell not found No action taken HKLM\..\Run[RTHDCPL] = RTHDCPL.EXE HKLM\..\Run[Alcmtr] = ALCMTR.EXE HKLM\..\Run[igfxhkcmd] = C:\WINDOWS\system32\hkcmd.exe HKLM\..\Run[igfxpers] = C:\WINDOWS\system32\igfxpers.exe HKLM\..\Run[LoadFUJ02E3] = C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe HKLM\..\Run[IndicatorUtility] = C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe HKLM\..\Run[LoadFujitsuQuickTouch] = C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe HKLM\..\Run[LoadBtnHnd] = C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe HKLM\..\Run[AGRSMMSG] = AGRSMMSG.exe HKLM\..\Run[F-Secure Manager] = "C:\Programme\F-Secure\Common\FSM32.EXE" /splash HKLM\..\Run[F-Secure TNB] = "C:\Programme\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW HKLM\..\Run[StatusClient 2.6] = C:\Programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto HKLM\..\Run[TomcatStartup 2.5] = C:\Programme\Hewlett-Packard\Toolbox\hpbpsttp.exe HKLM\..\Run[OrderReminder] = C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe HKLM\..\Run[HP Software Update] = C:\Programme\Hp\HP Software Update\HPWuSchd2.exe HKLM\..\Run[TkBellExe] = "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot HKLM\..\Run[myLinker] = C:\PROGRA~2\myLinker\myLinker.exe /B HKLM\..\Run[Adobe Photo Downloader] = "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" HKLM\..\Run[SunJavaUpdateSched] = "C:\Programme\Java\jre1.5.0_10\bin\jusched.exe" HKLM\..\Run[Dr.Fasoo] = "C:\Programme\Fasoo DRM\f_drscan.exe" HKLM\..\Run[FPH Exe] = "C:\PROGRA~1\FASOOD~1\fph.exe" HKLM\..\Run[Adobe Reader Speed Launcher] = "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" HKLM\..\Run[Adobe ARM] = "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" HKCU\..\Run[CTFMON.EXE] = C:\WINDOWS\system32\ctfmon.exe HKCU\..\Run[MSMSGS] = "C:\Programme\Messenger\msmsgs.exe" /background HKCU\..\Run[swg] = "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" HKU\.DEFAULT\Winlogon; Shell = HKU\S-1-5-20\Winlogon; Shell = HKU\S-1-5-20_Classes\Winlogon; Shell = HKU\S-1-5-21-3333913869-70301218-1339301055-1005\Winlogon; Shell = HKU\S-1-5-21-3333913869-70301218-1339301055-1005_Classes\Winlogon; Shell = HKU\S-1-5-18\Winlogon; Shell = |
|
27.09.2011, 15:20
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Bundestrojaner win xp 32 Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Führe danach auch bitte ESET aus, danach sehen wir weiter. ESET Online Scanner
n.
__________________ |
|
27.09.2011, 18:51
| #3 |
| | Bundestrojaner win xp 32 Hier ist der Malwarebytes Bericht:
__________________Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 7809 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 27.09.2011 19:43:36 mbam-log-2011-09-27 (19-43-36).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 251469 Laufzeit: 1 Stunde(n), 10 Minute(n), 41 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 9 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{4AAA2F98-2D2F-4938-AFB1-3EC1B51C41D9} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{487B489F-95C2-44C1-B31F-F7FD71FFA5BE} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3474531E-CCF0-494B-8EC5-254E93EFFAF9} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\F_webdc.xWebDC.1 (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\F_webdc.xWebDC (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AAA2F98-2D2F-4938-AFB1-3EC1B51C41D9} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4AAA2F98-2D2F-4938-AFB1-3EC1B51C41D9} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{8E9D2F33-4585-4404-AA57-15B2B03707F4} (Rogue.VirusProtectPro) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{02910A3C-5D77-4A3E-8A13-FDF81AC7FECD} (Rogue.VirusProtectPro) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\programme\fasoo drm\f_webdc.dll (Trojan.BHO) -> Delete on reboot. c:\dokumente und einstellungen\dr.maria-anna kim\startmenü\programme\autostart\drantispy.lnk (Rogue.DrAntispy) -> Quarantined and deleted successfully. Der Eset Scan kommt anschließend |
|
27.09.2011, 20:49
| #4 |
| | Bundestrojaner win xp 32 Und der eset log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=ac7149b2e775214bb4901a91ba2dbc01 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-27 07:00:58 # local_time=2011-09-27 09:00:58 (+0100, Westeuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=2304 16777191 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 233 233 0 0 # scanned=75411 # found=4 # cleaned=0 # scan_time=2646 C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\worms.jar-77b7e1d4-20cfb462.zip Java/Agent.DJ trojan (unable to clean) 00000000000000000000000000000000 I C:\Program Files\myLinker\MLCaller.dll Win32/Adware.MyLinker application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\myLinker\myLinker.exe a variant of Win32/Adware.MyLinker.A application (unable to clean) 00000000000000000000000000000000 I ${Memory} a variant of Win32/Adware.MyLinker.A application 00000000000000000000000000000000 I
__________________ Gruß Christian |
|
27.09.2011, 20:53
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundestrojaner win xp 32 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
28.09.2011, 20:03
| #6 |
| | Bundestrojaner win xp 32 Hallo, folgend der otl.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 28.09.2011 20:52:13 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1013,86 Mb Total Physical Memory | 634,60 Mb Available Physical Memory | 62,59% Memory free 1,63 Gb Paging File | 1,34 Gb Available in Paging File | 82,26% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 74,52 Gb Total Space | 61,19 Gb Free Space | 82,12% Space Free | Partition Type: NTFS Computer Name: KIM-NOTEBOOK | User Name: Dr.Maria-Anna Kim | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.27 22:22:49 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\OTL.exe PRC - [2011.06.09 13:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2009.02.17 17:20:08 | 001,345,536 | ---- | M] (ILKYUNG Co.,Ltd.) -- C:\Program Files\myLinker\myLinker.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.08.09 09:27:52 | 000,073,728 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe PRC - [2007.07.12 21:31:07 | 000,098,304 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe PRC - [2007.01.17 16:18:55 | 000,032,807 | ---- | M] (F-Secure Automatic Update) -- C:\Programme\F-Secure\BackWeb\7681197\program\ServiceWrapper-7681197.exe PRC - [2007.01.17 16:18:55 | 000,032,807 | ---- | M] (F-Secure Automatic Update) -- C:\Programme\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe PRC - [2006.06.23 11:24:12 | 000,343,552 | ---- | M] (AVM Berlin GmbH) -- C:\Programme\avmwlanstick\FRITZWLanMini.exe PRC - [2006.04.20 14:08:00 | 000,073,728 | ---- | M] (FUJITSU LIMITED) -- C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe PRC - [2005.10.31 12:01:30 | 000,208,959 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\FWES\program\fsdfwd.exe PRC - [2005.10.26 03:55:24 | 000,110,642 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FNRB32.exe PRC - [2005.10.26 03:55:24 | 000,057,393 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FIH32.exe PRC - [2005.10.26 03:52:00 | 000,065,585 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FCH32.EXE PRC - [2005.10.26 03:51:58 | 000,270,387 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FAMEH32.EXE PRC - [2005.10.26 03:51:58 | 000,180,274 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FSMB32.EXE PRC - [2005.10.26 03:51:58 | 000,122,929 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FSM32.EXE PRC - [2005.10.26 03:51:58 | 000,061,490 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FSMA32.EXE PRC - [2005.10.24 17:09:08 | 000,270,428 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe PRC - [2005.10.12 11:52:12 | 000,233,537 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\FSGUI\fsguidll.exe PRC - [2005.10.11 18:16:02 | 000,176,128 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\FSAV32.exe PRC - [2005.10.03 15:10:44 | 000,159,804 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\FSRW.exe PRC - [2005.09.22 14:29:38 | 000,289,792 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\Anti-Virus\fsgk32.exe PRC - [2005.09.09 15:30:16 | 000,247,296 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\Anti-Virus\fssm32.exe PRC - [2005.08.09 11:53:06 | 000,081,920 | ---- | M] (FUJITSU LIMITED) -- C:\Addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe PRC - [2005.07.21 15:21:58 | 000,353,792 | ---- | M] (FUJITSU LIMITED) -- C:\Addon\Fujitsu\Application Panel\QuickTouch.exe PRC - [2005.07.21 15:20:46 | 000,061,440 | ---- | M] (FUJITSU LIMITED) -- C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe PRC - [2005.05.09 10:52:52 | 000,086,064 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Spyware\FSAW.exe PRC - [2005.04.13 15:02:40 | 000,032,826 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\fsqh.exe PRC - [2005.04.08 18:18:37 | 000,151,552 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe PRC - [2001.09.04 11:15:22 | 000,045,056 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe ========== Modules (No Company Name) ========== MOD - [2007.01.17 16:18:49 | 000,151,589 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\bwfiles.dll MOD - [2007.01.17 16:18:49 | 000,061,496 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\clntutil.dll MOD - [2007.01.17 16:18:48 | 000,163,908 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\ServiceWrapper.dll MOD - [2005.10.24 17:06:46 | 000,053,248 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\program\fsbwres.deu MOD - [2005.10.12 11:57:52 | 000,090,112 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\fsesres.dll MOD - [2005.10.12 11:47:08 | 000,012,288 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\avabtres.eng MOD - [2005.10.12 11:47:04 | 000,352,256 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\av550about.dll MOD - [2005.10.12 11:46:10 | 000,086,016 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\fsesres.deu MOD - [2005.10.12 11:46:10 | 000,016,384 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\guilares.deu MOD - [2005.06.15 14:04:44 | 000,565,345 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fm4av.dll MOD - [2005.05.24 12:13:58 | 000,053,248 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fsavhres.deu MOD - [2005.05.12 17:20:48 | 000,081,920 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fsavures.eng MOD - [2005.05.11 14:26:50 | 000,098,304 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fsavures.deu MOD - [2002.05.03 23:40:32 | 000,094,274 | ---- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (nosGetPlusHelper) getPlus(R) SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2007.08.09 09:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2007.01.17 16:18:55 | 000,032,807 | ---- | M] (F-Secure Automatic Update) [Auto | Running] -- C:\Programme\F-Secure\BackWeb\7681197\program\ServiceWrapper-7681197.exe -- (BackWeb Plug-in - 7681197) SRV - [2005.10.31 12:01:30 | 000,208,959 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Programme\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD) SRV - [2005.10.26 03:55:24 | 000,110,642 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Programme\F-Secure\Common\FNRB32.EXE -- (F-Secure Network Request Broker) SRV - [2005.10.26 03:51:58 | 000,061,490 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Programme\F-Secure\Common\FSMA32.EXE -- (FSMA) SRV - [2005.10.24 17:09:08 | 000,270,428 | ---- | M] (F-Secure Corp.) [Auto | Running] -- C:\Programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe -- (fsbwsys) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2001.09.04 11:15:22 | 000,045,056 | ---- | M] (F-Secure Corp.) [Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter) ========== Driver Services (SafeList) ========== DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2008.04.13 20:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx) DRV - [2006.07.06 08:56:00 | 000,248,832 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2006.06.29 12:13:08 | 001,160,320 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.04.06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB) DRV - [2006.03.08 03:27:12 | 004,246,016 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005.10.31 12:01:44 | 000,070,896 | ---- | M] (F-Secure Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\fsdfw.sys -- (FSFW) DRV - [2005.10.06 16:30:56 | 000,048,256 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\win2k\fsgk.sys -- (F-Secure Gatekeeper) DRV - [2005.08.19 15:37:40 | 000,048,816 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\win2k\FSfilter.sys -- (F-Secure Filter) DRV - [2005.08.19 15:37:40 | 000,016,720 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\win2k\FSrec.sys -- (F-Secure Recognizer) DRV - [2005.07.21 15:20:46 | 000,021,120 | ---- | M] (FUJITSU LIMITED) [Kernel | Auto | Running] -- C:\Programme\Fujitsu\BtnHnd\BtnHnd.sys -- (BtnHnd) DRV - [2005.01.26 11:10:14 | 000,004,598 | ---- | M] (Fasoo.com) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\f_kp.sys -- (f_kp) DRV - [2004.10.18 22:08:00 | 000,005,632 | ---- | M] (Fujitsu Limited) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\FUJ02E1.sys -- (FUJ02E1) DRV - [2004.08.04 14:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb) DRV - [2004.08.04 14:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx) DRV - [2004.08.03 23:29:52 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB) DRV - [2004.01.17 11:15:20 | 000,004,864 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fuj02e3.sys -- (FUJ02E3) DRV - [2001.08.18 05:35:52 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA) DRV - [2001.08.01 19:00:22 | 000,005,248 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fuj02b1.sys -- (FUJ02B1) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "www.t-online.de" FF - prefs.js..network.proxy.type: 4 FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+(R),version=1.6.2.91: C:\Programme\NOS\bin\np_gp.dll File not found FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2852: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2910: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1662: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2008.12.19 13:03:42 | 000,000,000 | ---D | M] [2007.07.12 16:07:25 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Mozilla\Firefox\Profiles\f9g9d26b.default\extensions [2008.12.25 20:20:03 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2008.12.25 20:20:02 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.07.23 12:41:48 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\GOOGLE-GGIC@PARTNERS.MOZILLA.COM O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH) O4 - HKLM..\Run: [F-Secure Manager] C:\Programme\F-Secure\Common\FSM32.EXE (F-Secure Corporation) O4 - HKLM..\Run: [F-Secure TNB] C:\Programme\F-Secure\TNB\TNBUtil.exe (F-Secure Corporation) O4 - HKLM..\Run: [IndicatorUtility] C:\Addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LoadBtnHnd] C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LoadFUJ02E3] C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Addon\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [myLinker] C:\Program Files\myLinker\myLinker.exe (ILKYUNG Co.,Ltd.) O4 - HKLM..\Run: [OrderReminder] C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe (Hewlett-Packard) O4 - HKLM..\Run: [StatusClient 2.6] C:\Programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure Automatic Update.lnk = C:\Programme\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe (F-Secure Automatic Update) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Block this popup - C:\Programme\F-Secure\Anti-Spyware\blockpopups.htm () O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.) O9 - Extra Button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programme\F-Secure\Anti-Spyware\ieshield.dll (F-Secure Corporation) O9 - Extra 'Tools' menuitem : IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programme\F-Secure\Anti-Spyware\ieshield.dll (F-Secure Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation) O16 - DPF: {579CC802-2AF6-436B-8B9C-10F0B6C99FFE} hxxp://sso.kisti.re.kr/auth/kisti_client.cab (egKisti Class) O16 - DPF: {6989C944-3529-4DA8-8C60-187E95F580E2} hxxp://leeum.samsungfoundation.org/book/include/SecuiJoinsIE.cab (SecureSession Class) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\FJWSEL: DllName - (FJWSWNP.dll) - C:\WINDOWS\System32\FJWSWNP.dll (FUJITSU LIMITED) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O30 - LSA: Authentication Packages - (nwprovau) -C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.01.30 21:58:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^InterVideo WinCinema Manager.lnk - C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe - (InterVideo Inc.) MsConfig - StartUpReg: Adobe Photo Downloader - hkey= - key= - C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Dr.Fasoo - hkey= - key= - C:\Programme\Fasoo DRM\f_drscan.exe (Fasoo.com) MsConfig - StartUpReg: FPH Exe - hkey= - key= - C:\Programme\Fasoo DRM\fph.exe (Fasoo.com) MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Programme\hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) MsConfig - StartUpReg: TomcatStartup 2.5 - hkey= - key= - C:\Programme\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447) ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.09.28 19:47:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2011.09.28 19:46:20 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Recent [2011.09.28 19:44:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner [2011.09.28 19:44:00 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2011.09.28 19:36:27 | 000,000,000 | ---D | C] -- C:\8d9f9912f9ff686dd6f0de495492 [2011.09.27 22:22:49 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\OTL.exe [2011.09.27 22:13:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun [2011.09.27 22:13:17 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java [2011.09.27 20:12:59 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2011.09.27 18:05:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Malwarebytes [2011.09.27 17:07:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2011.09.27 17:07:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2011.09.27 17:07:23 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011.09.27 17:07:11 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.09.27 16:53:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FRITZ!WLAN [2011.09.27 16:53:18 | 000,000,000 | ---D | C] -- C:\Programme\avmwlanstick [2011.09.27 16:53:15 | 000,264,704 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\drivers\fwlanusb.sys [2011.09.27 16:53:15 | 000,055,808 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\avmadd32.dll [2011.09.27 16:53:15 | 000,033,792 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\avmcowlan.dll [2011.09.27 16:53:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\AVM_Driver [2011.09.27 16:53:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\AVM_Driver [7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.28 20:47:27 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{1EBC1426-FAA4-4422-90BC-2CCB319C66D1}.job [2011.09.28 20:44:57 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.09.28 20:44:42 | 000,001,035 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure Automatic Update.lnk [2011.09.28 20:44:33 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.09.28 20:44:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.09.28 20:44:22 | 1063,178,240 | -HS- | M] () -- C:\hiberfil.sys [2011.09.28 19:46:48 | 000,123,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Eigene Dateien\cc_20110928_194643.reg [2011.09.28 19:44:01 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk [2011.09.28 19:33:01 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.09.28 19:15:48 | 000,000,566 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled scanning task.job [2011.09.27 22:22:49 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\OTL.exe [2011.09.27 19:59:53 | 000,395,074 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.09.27 19:59:53 | 000,383,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.09.27 19:59:53 | 000,064,994 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.09.27 19:59:53 | 000,053,942 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.09.27 17:07:41 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.09.27 15:20:28 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\Microsoft Office Word 2003.lnk [2011.09.27 14:13:54 | 000,000,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\Arbeitsplatz.lnk [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.28 20:24:15 | 1063,178,240 | -HS- | C] () -- C:\hiberfil.sys [2011.09.28 19:46:46 | 000,123,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Eigene Dateien\cc_20110928_194643.reg [2011.09.28 19:44:01 | 000,000,660 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk [2011.09.27 19:54:00 | 000,001,035 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure Automatic Update.lnk [2011.09.27 17:07:41 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.09.27 16:53:16 | 000,097,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin [2011.09.27 14:13:54 | 000,000,104 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\Arbeitsplatz.lnk [2009.10.15 17:17:20 | 000,001,553 | ---- | C] () -- C:\WINDOWS\Uninstall.ini [2009.10.15 17:17:19 | 000,002,638 | ---- | C] () -- C:\WINDOWS\f_ProductMgr.ini [2009.10.15 17:17:18 | 000,002,380 | ---- | C] () -- C:\WINDOWS\f_ch_tbl.ini [2007.09.13 12:24:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2007.08.17 12:28:55 | 000,005,632 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.07.15 00:23:27 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007.07.12 21:30:18 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\jst.dll [2007.07.12 21:30:18 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\PMLJNI.dll [2007.07.12 21:25:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\hpbprnfx.exe [2007.07.12 21:24:50 | 000,013,451 | ---- | C] () -- C:\WINDOWS\hpbins01.dat [2007.07.12 21:24:50 | 000,001,380 | ---- | C] () -- C:\WINDOWS\hpbmdl01.dat [2007.07.12 21:24:45 | 000,000,750 | ---- | C] () -- C:\WINDOWS\hpbvnstp.ini [2007.07.12 21:24:36 | 000,221,184 | R--- | C] () -- C:\WINDOWS\System32\HP3AIOZ6.dll [2007.07.12 21:24:36 | 000,000,412 | R--- | C] () -- C:\WINDOWS\System32\HP3AIOZ6.dat [2007.07.12 21:21:46 | 000,012,541 | ---- | C] () -- C:\WINDOWS\hplj3380.ini [2007.07.12 17:22:36 | 000,099,970 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe [2007.07.12 16:07:13 | 000,003,179 | ---- | C] () -- C:\WINDOWS\mozver.dat [2007.07.12 16:03:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2007.04.17 13:52:04 | 000,239,360 | ---- | C] () -- C:\WINDOWS\System32\TrustNETTray.exe [2007.02.09 10:27:32 | 000,000,122 | ---- | C] () -- C:\WINDOWS\KGOleSrv.INI [2007.02.08 17:42:22 | 000,007,918 | ---- | C] () -- C:\WINDOWS\Accord50.Ini [2007.01.18 14:50:02 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2007.01.18 14:50:02 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2007.01.18 14:50:02 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2007.01.18 14:50:02 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2007.01.18 14:50:01 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2007.01.18 14:50:01 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2007.01.17 16:27:17 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007.01.17 16:18:49 | 000,118,842 | R--- | C] () -- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe [2007.01.17 16:03:54 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2007.01.09 11:22:01 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006.01.30 22:20:28 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006.01.30 22:02:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2006.01.30 21:55:20 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006.01.30 21:49:20 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006.01.30 21:48:22 | 000,259,048 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2006.01.30 21:41:40 | 000,001,052 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2006.01.30 21:41:23 | 000,395,074 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2006.01.30 21:41:23 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2006.01.30 21:41:23 | 000,064,994 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2006.01.30 21:41:23 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2006.01.30 21:41:04 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2006.01.30 21:41:01 | 000,383,588 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006.01.30 21:41:01 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2006.01.30 21:41:01 | 000,053,942 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006.01.30 21:41:01 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2006.01.30 21:40:59 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2006.01.30 21:40:59 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2006.01.30 21:40:56 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2006.01.30 21:40:48 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2006.01.30 21:40:48 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2006.01.30 21:40:39 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2006.01.30 21:40:29 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2005.01.24 19:00:50 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\egKisti.dll [2003.09.26 14:42:46 | 000,002,421 | ---- | C] () -- C:\WINDOWS\System32\scrubber.ini [2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002.05.03 23:40:32 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL ========== LOP Check ========== [2007.01.17 16:18:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\F-Secure [2008.06.21 20:39:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Altiris [2007.01.17 16:22:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\F-Secure [2007.02.09 20:27:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\InterVideo [2008.07.05 10:08:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Leadertech [2009.01.14 13:57:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\MSNInstaller [2009.01.13 17:00:52 | 000,000,474 | ---- | M] () -- C:\WINDOWS\Tasks\AeX Local Job 597.job [2009.01.14 13:30:00 | 000,000,450 | ---- | M] () -- C:\WINDOWS\Tasks\AeX Local Job 598.job [2011.09.28 19:15:48 | 000,000,566 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled scanning task.job [2011.09.28 20:47:27 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{1EBC1426-FAA4-4422-90BC-2CCB319C66D1}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2007.01.17 16:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Adobe [2007.01.18 14:08:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\AdobeUM [2008.12.25 17:54:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Ahead [2008.06.21 20:39:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Altiris [2007.01.17 16:22:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\F-Secure [2007.07.22 11:43:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Google [2007.02.09 10:27:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Help [2006.01.31 07:33:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Identities [2007.02.09 20:27:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\InterVideo [2007.01.17 16:15:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Lavasoft [2008.07.05 10:08:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Leadertech [2007.07.12 18:52:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Macromedia [2011.09.27 18:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Malwarebytes [2009.03.15 19:28:24 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Microsoft [2007.07.12 16:03:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Mozilla [2009.01.14 13:57:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\MSNInstaller [2010.12.08 14:56:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Real [2007.01.18 14:08:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Sun [2007.07.12 16:07:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Talkback < %APPDATA%\*.exe /s > [2007.07.20 16:26:58 | 023,813,608 | ---- | M] ( ) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe [2011.01.29 12:13:26 | 000,510,120 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Real\Update\setup3.13\setup.exe [2011.08.28 11:57:57 | 000,310,400 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Real\Update\UpgradeHelper\RealPlayer\8.00\rnupgagent.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys [2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004.08.04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys < MD5 for: ATAPI.SYS > [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys [2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: IASTOR.SYS > [2005.10.12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\Drivers\iastor\iastor.sys [2005.10.12 10:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\Drivers\Sata\iastor.sys [2005.10.12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\drivers\iaStor.sys < MD5 for: NETLOGON.DLL > [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < MD5 for: USER32.DLL > [2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll [2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.01.30 22:47:43 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2006.01.30 22:47:43 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2006.01.30 22:47:43 | 000,409,600 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < > < End of report >
__________________ --> Bundestrojaner win xp 32 |
|
28.09.2011, 20:24
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundestrojaner win xp 32 Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
PRC - [2009.02.17 17:20:08 | 001,345,536 | ---- | M] (ILKYUNG Co.,Ltd.) -- C:\Program Files\myLinker\myLinker.exe
O4 - HKLM..\Run: [myLinker] C:\Program Files\myLinker\myLinker.exe (ILKYUNG Co.,Ltd.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.01.30 21:58:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
:Files
C:\Program Files\myLinker
:Commands
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.09.2011, 22:05
| #8 |
| | Bundestrojaner win xp 32 Der Fix ist durch All processes killed ========== OTL ========== No active process named myLinker.exe was found! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\myLinker deleted successfully. C:\Program Files\myLinker\myLinker.exe moved successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\AUTOEXEC.BAT moved successfully. ========== FILES ========== C:\Program Files\myLinker\8DOTDTSF\925 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\923 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\922 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\921 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\905 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\904 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\903 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\901 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\861 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\741 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\726 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\724 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\721 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\708 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\704 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\703 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\666 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\664 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\663 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\661 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\642 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\624 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\623 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\615 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\614 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\610 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\608 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\606 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\604 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\561 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\541 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\502 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\486 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\484 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\422 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\41 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\401 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\382 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\381 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\371 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\369 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\366 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\365 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\364 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\363 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\362 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\349 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\342 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\322 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\321 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\301 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\241 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\23 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\22 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\161 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15766 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15726 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15706 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15687 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15686 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15666 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15646 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15628 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15627 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15626 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15606 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15589 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15588 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15587 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15571 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15568 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15567 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15551 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15550 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15549 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15547 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15546 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15526 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15510 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15508 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15507 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15506 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15488 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15486 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15468 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15467 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15429 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15407 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15387 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15386 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15326 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15306 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15226 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15086 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15066 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15046 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\15026 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14986 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14966 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14946 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14928 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14927 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14926 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14906 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14886 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14866 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14826 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14806 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14769 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14768 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14767 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14766 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14746 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14706 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14686 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14666 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14647 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14626 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14606 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14587 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14566 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14526 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14507 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14486 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14466 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14427 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14426 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14406 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14328 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14327 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14326 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14266 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14249 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14248 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14247 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14246 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14228 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14227 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14226 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14186 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14166 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14106 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14066 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14026 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\14006 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13986 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13946 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13906 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13888 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13887 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13886 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13867 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13866 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13846 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13826 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13806 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13786 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13766 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13746 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13706 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13686 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13646 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13626 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13606 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13566 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13546 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13507 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13486 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13446 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13427 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13327 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13326 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13287 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13266 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13187 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13186 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13166 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13146 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13126 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13106 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13066 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13026 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13009 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\13007 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12986 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12906 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12826 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12806 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12786 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12726 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12606 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12586 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12526 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12466 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12448 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12446 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12429 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12427 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12426 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12386 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12370 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12367 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12351 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12345 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12344 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12323 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12322 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12319 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12318 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12295 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12275 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12258 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12256 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12254 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12251 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12250 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12249 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12248 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12247 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12246 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12244 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12243 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12242 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12203 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12201 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12182 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12181 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12161 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12142 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12141 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12123 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12121 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\121 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12084 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12082 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12081 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12051 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12049 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12046 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12045 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12043 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12042 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12041 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12022 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12021 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12008 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12004 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12003 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF\12001 folder moved successfully. C:\Program Files\myLinker\8DOTDTSF folder moved successfully. C:\Program Files\myLinker folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes ->Flash cache emptied: 83 bytes User: Dr.Maria-Anna Kim ->Temp folder emptied: 115209632 bytes ->Temporary Internet Files folder emptied: 15658498 bytes ->Java cache emptied: 6861487 bytes ->FireFox cache emptied: 3093487 bytes ->Flash cache emptied: 470 bytes User: DR015A~1~MAR User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 14471998 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 3244423 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 290169324 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 428,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.29.1 log created on 09282011_225927 Files\Folders moved on Reboot... Registry entries deleted on Reboot...
__________________ Gruß Christian |
|
28.09.2011, 22:34
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundestrojaner win xp 32 Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.09.2011, 12:38
| #10 |
| | Bundestrojaner win xp 32 Hi, TDSS Killer ist fertig, Log läßt sich aber nicht posten, 6 Bedrohungen wurden in Quarantäne verschoben
__________________ Gruß Christian |
|
29.09.2011, 13:13
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundestrojaner win xp 32 Log zippen und hier anhängen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.09.2011, 14:29
| #12 |
| | Bundestrojaner win xp 32 Sorry, hier kommt der log 13:18:31.0703 3260 TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43 13:18:31.0718 3260 ============================================================ 13:18:31.0718 3260 Current date / time: 2011/09/29 13:18:31.0718 13:18:31.0718 3260 SystemInfo: 13:18:31.0718 3260 13:18:31.0718 3260 OS Version: 5.1.2600 ServicePack: 3.0 13:18:31.0718 3260 Product type: Workstation 13:18:31.0718 3260 ComputerName: KIM-NOTEBOOK 13:18:31.0718 3260 UserName: Dr.Maria-Anna Kim 13:18:31.0718 3260 Windows directory: C:\WINDOWS 13:18:31.0718 3260 System windows directory: C:\WINDOWS 13:18:31.0718 3260 Processor architecture: Intel x86 13:18:31.0718 3260 Number of processors: 2 13:18:31.0718 3260 Page size: 0x1000 13:18:31.0718 3260 Boot type: Normal boot 13:18:31.0718 3260 ============================================================ 13:18:32.0062 3260 Initialize success 13:22:15.0093 1660 ============================================================ 13:22:15.0093 1660 Scan started 13:22:15.0093 1660 Mode: Manual; SigCheck; TDLFS; 13:22:15.0093 1660 ============================================================ 13:22:15.0312 1660 Abiosdsk - ok 13:22:15.0328 1660 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS 13:22:18.0078 1660 abp480n5 - ok 13:22:18.0203 1660 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys 13:22:18.0359 1660 ACPI - ok 13:22:18.0406 1660 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 13:22:18.0546 1660 ACPIEC - ok 13:22:18.0578 1660 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys 13:22:18.0750 1660 adpu160m - ok 13:22:18.0812 1660 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 13:22:19.0015 1660 aec - ok 13:22:19.0125 1660 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys 13:22:19.0187 1660 AFD - ok 13:22:19.0281 1660 AgereSoftModem (90456051c422e09bc36e6340dd891f0c) C:\WINDOWS\system32\DRIVERS\AGRSM.sys 13:22:19.0468 1660 AgereSoftModem - ok 13:22:19.0562 1660 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys 13:22:19.0765 1660 agp440 - ok 13:22:19.0859 1660 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys 13:22:20.0062 1660 agpCPQ - ok 13:22:20.0156 1660 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys 13:22:20.0265 1660 Aha154x - ok 13:22:20.0328 1660 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys 13:22:20.0484 1660 aic78u2 - ok 13:22:20.0546 1660 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys 13:22:20.0703 1660 aic78xx - ok 13:22:20.0796 1660 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys 13:22:20.0953 1660 AliIde - ok 13:22:21.0046 1660 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys 13:22:21.0234 1660 alim1541 - ok 13:22:21.0343 1660 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys 13:22:21.0546 1660 amdagp - ok 13:22:21.0656 1660 AmdK7 (3a0dafac778236559c14c7203fb550eb) C:\WINDOWS\system32\DRIVERS\amdk7.sys 13:22:21.0843 1660 AmdK7 - ok 13:22:21.0953 1660 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys 13:22:22.0062 1660 amsint - ok 13:22:22.0156 1660 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 13:22:22.0328 1660 Arp1394 - ok 13:22:22.0437 1660 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys 13:22:22.0609 1660 asc - ok 13:22:22.0671 1660 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys 13:22:22.0781 1660 asc3350p - ok 13:22:22.0859 1660 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys 13:22:23.0015 1660 asc3550 - ok 13:22:23.0109 1660 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 13:22:23.0296 1660 AsyncMac - ok 13:22:23.0390 1660 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 13:22:23.0500 1660 atapi - ok 13:22:23.0515 1660 Atdisk - ok 13:22:23.0546 1660 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 13:22:23.0750 1660 Atmarpc - ok 13:22:23.0843 1660 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 13:22:24.0000 1660 audstub - ok 13:22:24.0078 1660 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 13:22:24.0234 1660 Beep - ok 13:22:24.0296 1660 BtnHnd (c84e0365e1b1d1f96ebdf3b403de5feb) C:\Programme\Fujitsu\BtnHnd\BtnHnd.sys 13:22:24.0343 1660 BtnHnd ( UnsignedFile.Multi.Generic ) - warning 13:22:24.0343 1660 BtnHnd - detected UnsignedFile.Multi.Generic (1) 13:22:24.0437 1660 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys 13:22:24.0609 1660 cbidf - ok 13:22:24.0640 1660 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 13:22:24.0765 1660 cbidf2k - ok 13:22:24.0812 1660 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys 13:22:24.0921 1660 cd20xrnt - ok 13:22:24.0984 1660 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 13:22:25.0156 1660 Cdaudio - ok 13:22:25.0218 1660 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 13:22:25.0328 1660 Cdfs - ok 13:22:25.0437 1660 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 13:22:25.0625 1660 Cdrom - ok 13:22:25.0718 1660 Changer - ok 13:22:25.0750 1660 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 13:22:25.0937 1660 CmBatt - ok 13:22:26.0031 1660 CmdIde (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys 13:22:26.0187 1660 CmdIde - ok 13:22:26.0218 1660 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys 13:22:26.0343 1660 Compbatt - ok 13:22:26.0406 1660 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys 13:22:26.0562 1660 Cpqarray - ok 13:22:26.0671 1660 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys 13:22:26.0843 1660 dac2w2k - ok 13:22:26.0921 1660 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys 13:22:27.0093 1660 dac960nt - ok 13:22:27.0187 1660 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 13:22:27.0296 1660 Disk - ok 13:22:27.0390 1660 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys 13:22:27.0671 1660 dmboot - ok 13:22:27.0765 1660 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys 13:22:27.0875 1660 dmio - ok 13:22:27.0968 1660 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 13:22:28.0078 1660 dmload - ok 13:22:28.0171 1660 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 13:22:28.0359 1660 DMusic - ok 13:22:28.0468 1660 Dot4 (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys 13:22:28.0671 1660 Dot4 - ok 13:22:28.0781 1660 Dot4Print (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys 13:22:28.0937 1660 Dot4Print - ok 13:22:29.0031 1660 Dot4Scan (bd05306428da63369692477ddc0f6f5f) C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys 13:22:29.0187 1660 Dot4Scan - ok 13:22:29.0296 1660 dot4usb (29e86af2f3457d0441348020fe3cfbd0) C:\WINDOWS\system32\DRIVERS\dot4usb.sys 13:22:29.0453 1660 dot4usb - ok 13:22:29.0562 1660 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys 13:22:29.0718 1660 dpti2o - ok 13:22:29.0796 1660 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 13:22:29.0968 1660 drmkaud - ok 13:22:30.0078 1660 F-Secure Filter (13eb491eec0f95ac76f7af26b7e14984) C:\Programme\F-Secure\Anti-Virus\Win2K\FSfilter.sys 13:22:30.0140 1660 F-Secure Filter ( UnsignedFile.Multi.Generic ) - warning 13:22:30.0140 1660 F-Secure Filter - detected UnsignedFile.Multi.Generic (1) 13:22:30.0156 1660 F-Secure Gatekeeper (f80fa8d1a625b037b3d3f9a61ece685e) C:\Programme\F-Secure\Anti-Virus\Win2K\FSgk.sys 13:22:30.0250 1660 F-Secure Gatekeeper ( UnsignedFile.Multi.Generic ) - warning 13:22:30.0250 1660 F-Secure Gatekeeper - detected UnsignedFile.Multi.Generic (1) 13:22:30.0359 1660 F-Secure Recognizer (9a92de4b13378f99b09a6bf8713a2829) C:\Programme\F-Secure\Anti-Virus\Win2K\FSrec.sys 13:22:30.0406 1660 F-Secure Recognizer ( UnsignedFile.Multi.Generic ) - warning 13:22:30.0406 1660 F-Secure Recognizer - detected UnsignedFile.Multi.Generic (1) 13:22:30.0500 1660 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 13:22:30.0671 1660 Fastfat - ok 13:22:30.0718 1660 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 13:22:30.0906 1660 Fdc - ok 13:22:31.0000 1660 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys 13:22:31.0156 1660 FETNDIS - ok 13:22:31.0250 1660 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys 13:22:31.0437 1660 Fips - ok 13:22:31.0531 1660 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 13:22:31.0734 1660 Flpydisk - ok 13:22:31.0828 1660 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 13:22:31.0953 1660 FltMgr - ok 13:22:32.0031 1660 FSFW (997719d16d6d60c4d4e5bd1afde5ddbb) C:\WINDOWS\system32\drivers\fsdfw.sys 13:22:32.0046 1660 FSFW ( UnsignedFile.Multi.Generic ) - warning 13:22:32.0046 1660 FSFW - detected UnsignedFile.Multi.Generic (1) 13:22:32.0109 1660 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 13:22:32.0265 1660 Fs_Rec - ok 13:22:32.0312 1660 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 13:22:32.0453 1660 Ftdisk - ok 13:22:32.0546 1660 FUJ02B1 (00845dcd64fe6348ddf7890c310c17b9) C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys 13:22:32.0625 1660 FUJ02B1 - ok 13:22:32.0656 1660 FUJ02E1 (c4942669fde5abd7bbe70027c9de1247) C:\WINDOWS\system32\Drivers\FUJ02E1.sys 13:22:32.0734 1660 FUJ02E1 - ok 13:22:32.0781 1660 FUJ02E3 (ef9f310f86fd504afcdcedf8280091fb) C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys 13:22:32.0843 1660 FUJ02E3 - ok 13:22:32.0906 1660 FWLANUSB (b45f1df1cce34e2af422f0ed78cd70ef) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys 13:22:33.0000 1660 FWLANUSB - ok 13:22:33.0078 1660 f_kp (fc34a7da8335a3c8e21366f0289722a1) C:\WINDOWS\system32\drivers\f_kp.sys 13:22:33.0125 1660 f_kp ( UnsignedFile.Multi.Generic ) - warning 13:22:33.0125 1660 f_kp - detected UnsignedFile.Multi.Generic (1) 13:22:33.0187 1660 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 13:22:33.0375 1660 Gpc - ok 13:22:33.0531 1660 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 13:22:33.0656 1660 HDAudBus - ok 13:22:33.0750 1660 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 13:22:33.0921 1660 HidUsb - ok 13:22:34.0031 1660 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys 13:22:34.0171 1660 hpn - ok 13:22:34.0250 1660 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 13:22:34.0296 1660 HTTP - ok 13:22:34.0328 1660 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys 13:22:34.0515 1660 i2omgmt - ok 13:22:34.0625 1660 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys 13:22:34.0812 1660 i2omp - ok 13:22:34.0921 1660 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 13:22:35.0062 1660 i8042prt - ok 13:22:35.0203 1660 ialm (81efe1c5542afb2570758f39ae3b1151) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 13:22:35.0406 1660 ialm - ok 13:22:35.0500 1660 iaStor (309c4d86d989fb1fcf64bd30dc81c51b) C:\WINDOWS\system32\DRIVERS\iaStor.sys 13:22:35.0578 1660 iaStor - ok 13:22:35.0640 1660 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 13:22:35.0828 1660 Imapi - ok 13:22:36.0140 1660 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys 13:22:36.0312 1660 ini910u - ok 13:22:37.0265 1660 IntcAzAudAddService (64be56b8858ca0153c725c720ffd194f) C:\WINDOWS\system32\drivers\RtkHDAud.sys 13:22:37.0718 1660 IntcAzAudAddService - ok 13:22:37.0921 1660 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys 13:22:38.0125 1660 IntelIde - ok 13:22:38.0156 1660 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys 13:22:38.0281 1660 intelppm - ok 13:22:38.0375 1660 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 13:22:38.0562 1660 Ip6Fw - ok 13:22:38.0609 1660 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 13:22:38.0765 1660 IpFilterDriver - ok 13:22:38.0843 1660 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 13:22:39.0015 1660 IpInIp - ok 13:22:39.0156 1660 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 13:22:39.0281 1660 IpNat - ok 13:22:39.0359 1660 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 13:22:39.0515 1660 IPSec - ok 13:22:39.0625 1660 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys 13:22:39.0812 1660 irda - ok 13:22:39.0921 1660 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 13:22:40.0093 1660 IRENUM - ok 13:22:40.0218 1660 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys 13:22:40.0343 1660 isapnp - ok 13:22:40.0406 1660 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 13:22:40.0593 1660 Kbdclass - ok 13:22:40.0671 1660 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 13:22:40.0875 1660 kmixer - ok 13:22:40.0968 1660 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 13:22:41.0031 1660 KSecDD - ok 13:22:41.0046 1660 lbrtfdc - ok 13:22:41.0109 1660 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys 13:22:41.0140 1660 MBAMProtector - ok 13:22:41.0171 1660 MBAMSwissArmy - ok 13:22:41.0218 1660 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 13:22:41.0375 1660 mnmdd - ok 13:22:41.0468 1660 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys 13:22:41.0593 1660 Modem - ok 13:22:41.0609 1660 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys 13:22:41.0796 1660 Mouclass - ok 13:22:41.0937 1660 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys 13:22:42.0093 1660 mouhid - ok 13:22:42.0234 1660 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 13:22:42.0328 1660 MountMgr - ok 13:22:42.0437 1660 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys 13:22:42.0593 1660 mraid35x - ok 13:22:42.0687 1660 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 13:22:42.0812 1660 MRxDAV - ok 13:22:42.0937 1660 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 13:22:43.0031 1660 MRxSmb - ok 13:22:43.0093 1660 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 13:22:43.0203 1660 Msfs - ok 13:22:43.0296 1660 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 13:22:43.0500 1660 MSKSSRV - ok 13:22:43.0593 1660 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 13:22:43.0765 1660 MSPCLOCK - ok 13:22:43.0906 1660 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 13:22:44.0093 1660 MSPQM - ok 13:22:44.0187 1660 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 13:22:44.0296 1660 mssmbios - ok 13:22:44.0375 1660 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 13:22:44.0437 1660 Mup - ok 13:22:44.0468 1660 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 13:22:44.0593 1660 NDIS - ok 13:22:44.0687 1660 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 13:22:44.0734 1660 NdisTapi - ok 13:22:44.0781 1660 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 13:22:44.0968 1660 Ndisuio - ok 13:22:45.0078 1660 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 13:22:45.0234 1660 NdisWan - ok 13:22:45.0343 1660 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 13:22:45.0421 1660 NDProxy - ok 13:22:45.0468 1660 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 13:22:45.0593 1660 NetBIOS - ok 13:22:45.0609 1660 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 13:22:45.0781 1660 NetBT - ok 13:22:45.0937 1660 NETw3x32 (e2f396f71a793a04839dbb6af304a026) C:\WINDOWS\system32\DRIVERS\NETw3x32.sys 13:22:46.0015 1660 NETw3x32 - ok 13:22:46.0093 1660 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys 13:22:46.0203 1660 NIC1394 - ok 13:22:46.0250 1660 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 13:22:46.0375 1660 Npfs - ok 13:22:46.0453 1660 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 13:22:46.0593 1660 Ntfs - ok 13:22:46.0703 1660 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 13:22:46.0859 1660 Null - ok 13:22:46.0953 1660 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 13:22:47.0109 1660 NwlnkFlt - ok 13:22:47.0187 1660 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 13:22:47.0343 1660 NwlnkFwd - ok 13:22:47.0453 1660 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys 13:22:47.0640 1660 NwlnkIpx - ok 13:22:47.0734 1660 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys 13:22:47.0906 1660 NwlnkNb - ok 13:22:47.0968 1660 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys 13:22:48.0125 1660 NwlnkSpx - ok 13:22:48.0234 1660 NWRDR (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys 13:22:48.0343 1660 NWRDR - ok 13:22:48.0390 1660 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 13:22:48.0500 1660 ohci1394 - ok 13:22:48.0562 1660 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys 13:22:48.0750 1660 Parport - ok 13:22:48.0859 1660 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 13:22:48.0968 1660 PartMgr - ok 13:22:49.0046 1660 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys 13:22:49.0203 1660 ParVdm - ok 13:22:49.0296 1660 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys 13:22:49.0406 1660 PCI - ok 13:22:49.0421 1660 PCIDump - ok 13:22:49.0468 1660 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys 13:22:49.0593 1660 PCIIde - ok 13:22:49.0671 1660 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys 13:22:49.0796 1660 Pcmcia - ok 13:22:49.0859 1660 PDCOMP - ok 13:22:49.0875 1660 PDFRAME - ok 13:22:49.0906 1660 PDRELI - ok 13:22:49.0906 1660 PDRFRAME - ok 13:22:49.0953 1660 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys 13:22:50.0109 1660 perc2 - ok 13:22:50.0218 1660 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys 13:22:50.0359 1660 perc2hib - ok 13:22:50.0484 1660 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 13:22:50.0640 1660 PptpMiniport - ok 13:22:50.0687 1660 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 13:22:50.0890 1660 PSched - ok 13:22:50.0984 1660 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 13:22:51.0140 1660 Ptilink - ok 13:22:51.0203 1660 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys 13:22:51.0218 1660 PxHelp20 - ok 13:22:51.0250 1660 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys 13:22:51.0406 1660 ql1080 - ok 13:22:51.0500 1660 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys 13:22:51.0656 1660 Ql10wnt - ok 13:22:51.0718 1660 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys 13:22:51.0875 1660 ql12160 - ok 13:22:51.0937 1660 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys 13:22:52.0078 1660 ql1240 - ok 13:22:52.0187 1660 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys 13:22:52.0343 1660 ql1280 - ok 13:22:52.0406 1660 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 13:22:52.0562 1660 RasAcd - ok 13:22:52.0687 1660 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys 13:22:52.0796 1660 Rasirda - ok 13:22:52.0875 1660 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 13:22:53.0031 1660 Rasl2tp - ok 13:22:53.0140 1660 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 13:22:53.0312 1660 RasPppoe - ok 13:22:53.0406 1660 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 13:22:53.0578 1660 Raspti - ok 13:22:53.0671 1660 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 13:22:53.0796 1660 Rdbss - ok 13:22:53.0890 1660 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 13:22:54.0031 1660 RDPCDD - ok 13:22:54.0125 1660 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 13:22:54.0328 1660 rdpdr - ok 13:22:54.0437 1660 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys 13:22:54.0484 1660 RDPWD - ok 13:22:54.0546 1660 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys 13:22:54.0734 1660 redbook - ok 13:22:54.0859 1660 S3SavageNB (0dbcc071a268e0340a2ba6bdd98bace4) C:\WINDOWS\system32\DRIVERS\s3gnbm.sys 13:22:55.0015 1660 S3SavageNB - ok 13:22:55.0125 1660 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 13:22:55.0312 1660 Secdrv - ok 13:22:55.0421 1660 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 13:22:55.0593 1660 Serenum - ok 13:22:55.0703 1660 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys 13:22:55.0843 1660 Serial - ok 13:22:55.0953 1660 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys 13:22:56.0140 1660 Sfloppy - ok 13:22:56.0203 1660 Simbad - ok 13:22:56.0265 1660 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys 13:22:56.0453 1660 sisagp - ok 13:22:56.0546 1660 SMCIRDA (d03a4cdb1b089e3f6c23501339506e5e) C:\WINDOWS\system32\DRIVERS\smcirda.sys 13:22:56.0656 1660 SMCIRDA - ok 13:22:56.0734 1660 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys 13:22:56.0875 1660 Sparrow - ok 13:22:56.0968 1660 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 13:22:57.0156 1660 splitter - ok 13:22:57.0265 1660 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys 13:22:57.0375 1660 sr - ok 13:22:57.0500 1660 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 13:22:57.0562 1660 Srv - ok 13:22:57.0625 1660 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 13:22:57.0828 1660 swenum - ok 13:22:57.0890 1660 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 13:22:58.0078 1660 swmidi - ok 13:22:58.0171 1660 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys 13:22:58.0312 1660 symc810 - ok 13:22:58.0390 1660 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys 13:22:58.0546 1660 symc8xx - ok 13:22:58.0609 1660 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys 13:22:58.0750 1660 sym_hi - ok 13:22:58.0828 1660 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys 13:22:58.0968 1660 sym_u3 - ok 13:22:59.0046 1660 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 13:22:59.0203 1660 sysaudio - ok 13:22:59.0312 1660 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 13:22:59.0406 1660 Tcpip - ok 13:22:59.0453 1660 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 13:22:59.0656 1660 TDPIPE - ok 13:22:59.0687 1660 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 13:22:59.0875 1660 TDTCP - ok 13:22:59.0984 1660 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 13:23:00.0171 1660 TermDD - ok 13:23:00.0281 1660 TosIde (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys 13:23:00.0421 1660 TosIde - ok 13:23:00.0562 1660 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 13:23:00.0750 1660 Udfs - ok 13:23:00.0859 1660 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys 13:23:00.0968 1660 ultra - ok 13:23:01.0062 1660 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 13:23:01.0281 1660 Update - ok 13:23:01.0390 1660 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 13:23:01.0593 1660 usbehci - ok 13:23:01.0671 1660 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 13:23:01.0859 1660 usbhub - ok 13:23:01.0953 1660 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 13:23:02.0062 1660 USBSTOR - ok 13:23:02.0171 1660 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 13:23:02.0359 1660 usbuhci - ok 13:23:02.0453 1660 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 13:23:02.0656 1660 VgaSave - ok 13:23:02.0687 1660 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys 13:23:02.0859 1660 viaagp - ok 13:23:02.0937 1660 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys 13:23:03.0125 1660 ViaIde - ok 13:23:03.0234 1660 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys 13:23:03.0359 1660 VolSnap - ok 13:23:03.0390 1660 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 13:23:03.0578 1660 Wanarp - ok 13:23:03.0656 1660 WDICA - ok 13:23:03.0703 1660 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 13:23:03.0859 1660 wdmaud - ok 13:23:03.0984 1660 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 13:23:04.0125 1660 WS2IFSL - ok 13:23:04.0234 1660 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 13:23:04.0343 1660 WudfPf - ok 13:23:04.0437 1660 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 13:23:04.0531 1660 WudfRd - ok 13:23:04.0625 1660 yukonwxp (05d48e56ea2612d39a4e7f0ecc17b917) C:\WINDOWS\system32\DRIVERS\yk51x86.sys 13:23:04.0656 1660 yukonwxp - ok 13:23:04.0687 1660 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 13:23:04.0890 1660 \Device\Harddisk0\DR0 - ok 13:23:04.0890 1660 MBR (0x1B8) (ddae9d649db12f6aff24483f2c298989) \Device\Harddisk1\DR2 13:23:04.0984 1660 \Device\Harddisk1\DR2 - ok 13:23:04.0984 1660 Boot (0x1200) (e1659763cfcf661227304dae08fd6bee) \Device\Harddisk0\DR0\Partition0 13:23:04.0984 1660 \Device\Harddisk0\DR0\Partition0 - ok 13:23:05.0000 1660 Boot (0x1200) (ff6211bdb425d5b4507320645a2d295e) \Device\Harddisk1\DR2\Partition0 13:23:05.0000 1660 \Device\Harddisk1\DR2\Partition0 - ok 13:23:05.0000 1660 ============================================================ 13:23:05.0000 1660 Scan finished 13:23:05.0000 1660 ============================================================ 13:23:05.0109 3460 Detected object count: 6 13:23:05.0109 3460 Actual detected object count: 6 13:23:50.0750 3460 C:\Programme\Fujitsu\BtnHnd\BtnHnd.sys - copied to quarantine 13:23:50.0781 3460 BtnHnd ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 13:23:50.0859 3460 C:\Programme\F-Secure\Anti-Virus\Win2K\FSfilter.sys - copied to quarantine 13:23:50.0890 3460 F-Secure Filter ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 13:23:50.0937 3460 C:\Programme\F-Secure\Anti-Virus\Win2K\FSgk.sys - copied to quarantine 13:23:50.0968 3460 F-Secure Gatekeeper ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 13:23:51.0000 3460 C:\Programme\F-Secure\Anti-Virus\Win2K\FSrec.sys - copied to quarantine 13:23:51.0046 3460 F-Secure Recognizer ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 13:23:51.0156 3460 C:\WINDOWS\system32\drivers\fsdfw.sys - copied to quarantine 13:23:51.0187 3460 FSFW ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 13:23:51.0234 3460 C:\WINDOWS\system32\drivers\f_kp.sys - copied to quarantine 13:23:51.0265 3460 f_kp ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 15:24:29.0109 3256 Deinitialize success
__________________ Gruß Christian |
|
29.09.2011, 14:41
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundestrojaner win xp 32 Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.09.2011, 16:13
| #14 |
| | Bundestrojaner win xp 32 Und nun das log von Combofix: Combofix Logfile: Code:
ATTFilter ComboFix 11-09-29.02 - Dr.Maria-Anna Kim 29.09.2011 16:44:18.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.1014.512 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Desktop\ComboFix.exe
AV: F-Secure Anti-Virus Client Security 6.01 *Disabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Anti-Virus Client Security 6.01 *Disabled* {D4747503-0346-49EB-9262-997542F79BF4}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokume~1\DR015A~1.MAR\LOKALE~1\Temp\IadHide5.dll
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\ngen.exe.2c05686e.ini
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL141.tmp.c0063f75.ini
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL2E8.tmp.b026640c.ini
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL87.tmp.e5b93eca.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\ngen.exe.2c05686e.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL141.tmp.c0063f75.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL2E8.tmp.b026640c.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL87.tmp.e5b93eca.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Temp\IadHide5.dll
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\WINDOWS
c:\progra~1\FASOOD~1\f_SPs.dll
c:\progra~1\FASOOD~1\fpH.exe
c:\programme\Fasoo DRM
c:\programme\Fasoo DRM\f_blksc.dll
c:\programme\Fasoo DRM\f_cm.dll
c:\programme\Fasoo DRM\f_diag.exe
c:\programme\Fasoo DRM\f_drscan.exe
c:\programme\Fasoo DRM\f_sps.dll
c:\programme\Fasoo DRM\f_swv.dll
c:\programme\Fasoo DRM\f_WEbdm.dll
c:\programme\Fasoo DRM\f_websn.dll
c:\programme\Fasoo DRM\fph.exe
c:\programme\Fasoo DRM\Log\21.log
c:\programme\Fasoo DRM\Log\70.log
c:\programme\google\common\google updater\googleupdaterservice.exe
c:\windows\bwUnin-6.3.2.116-7681197L.exe
c:\windows\ehome\medctrro.exe
c:\windows\f_ProductMgr.exe
c:\windows\f_ProductMgr.ini
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\f_kp.sys
c:\windows\system32\drivers\FSC__PI__LIFEBOOK S7110__FUJITSU_FJNB1B5__Default System BIOS_FUJ - 1210000_Version 1.21 .MRK
c:\windows\system32\f_crypto.dll
c:\windows\system32\f_iurc09.dll
c:\windows\system32\f_iurc12.dll
c:\windows\system32\f_kpi.dll
c:\windows\system32\f_pbrc09.dll
c:\windows\system32\f_pbrc12.dll
c:\windows\system32\f_swrc09.dll
c:\windows\system32\f_swrc12.dll
c:\windows\TEMP\IadHide5.dll
c:\windows\Uninstall.ini
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_f_kp
-------\Service_f_kp
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-08-28 bis 2011-09-29 ))))))))))))))))))))))))))))))
.
.
2011-09-29 13:21 . 2011-09-29 13:21 -------- d-----w- c:\programme\7-Zip
2011-09-29 12:47 . 2011-09-29 12:47 -------- d-----w- c:\programme\Microsoft CAPICOM 2.1.0.2
2011-09-29 11:23 . 2011-09-29 11:23 -------- d-----w- C:\TDSSKiller_Quarantine
2011-09-28 21:34 . 2011-09-28 21:34 -------- d-sh--w- c:\dokumente und einstellungen\Administrator\IETldCache
2011-09-28 21:23 . 2011-09-28 21:23 -------- d--h--w- c:\windows\system32\GroupPolicy
2011-09-28 20:59 . 2011-09-28 20:59 -------- d-----w- C:\_OTL
2011-09-28 17:44 . 2011-09-28 17:44 -------- d-----w- c:\programme\CCleaner
2011-09-28 17:36 . 2011-09-28 17:36 -------- d-----w- C:\8d9f9912f9ff686dd6f0de495492
2011-09-27 20:13 . 2011-09-27 20:13 -------- d-----w- c:\programme\Gemeinsame Dateien\Java
2011-09-27 20:12 . 2011-09-27 20:12 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-09-27 20:12 . 2011-09-27 20:12 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-27 18:12 . 2011-09-27 18:12 -------- d-----w- c:\programme\ESET
2011-09-27 17:59 . 2011-09-27 17:59 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-27 16:05 . 2011-09-27 16:05 -------- d-----w- c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Malwarebytes
2011-09-27 15:07 . 2011-09-27 15:07 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-09-27 15:07 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-27 15:07 . 2011-09-27 15:07 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2011-09-27 14:54 . 2011-09-27 14:54 -------- d-sh--w- c:\dokumente und einstellungen\NetworkService\IETldCache
2011-09-27 14:53 . 2011-09-27 14:53 -------- d-----w- c:\programme\avmwlanstick
2011-09-27 14:53 . 2006-04-05 23:00 97312 ----a-w- c:\windows\system32\drivers\Fwusb1b.bin
2011-09-27 14:53 . 2011-09-27 14:53 -------- d-----w- c:\windows\AVM_Driver
2011-09-27 14:53 . 2006-04-05 23:00 55808 ----a-w- c:\windows\system32\avmadd32.dll
2011-09-27 14:53 . 2006-04-05 23:00 33792 ----a-w- c:\windows\system32\avmcowlan.dll
2011-09-27 14:53 . 2006-04-05 23:00 264704 ----a-w- c:\windows\system32\drivers\fwlanusb.sys
2011-09-27 14:53 . 2011-09-27 14:53 -------- d-----w- c:\dokumente und einstellungen\Dr.Maria-Anna Kim\AVM_Driver
2011-09-09 09:11 . 2011-09-09 09:11 604160 ------w- c:\windows\system32\dllcache\crypt32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-09 09:11 . 2006-01-30 19:40 604160 ----a-w- c:\windows\system32\crypt32.dll
2011-07-15 13:29 . 2006-01-30 19:40 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2006-01-30 19:40 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2008-04-24 14:26 . 2007-07-22 09:40 122880 ----a-w- c:\programme\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-15 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-07 16010240]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-03 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-03 118784]
"LoadFUJ02E3"="c:\programme\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-04-20 73728]
"IndicatorUtility"="c:\addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-08-09 81920]
"LoadFujitsuQuickTouch"="c:\addon\Fujitsu\Application Panel\QuickTouch.exe" [2005-07-21 353792]
"LoadBtnHnd"="c:\programme\Fujitsu\BtnHnd\BtnHnd.exe" [2005-07-21 61440]
"AGRSMMSG"="AGRSMMSG.exe" [2006-06-29 89541]
"F-Secure Manager"="c:\programme\F-Secure\Common\FSM32.EXE" [2005-10-26 122929]
"F-Secure TNB"="c:\programme\F-Secure\TNB\TNBUtil.exe" [2004-05-27 684032]
"StatusClient 2.6"="c:\programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2005-04-08 151552]
"OrderReminder"="c:\programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe" [2007-07-12 98304]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"AVMWlanClient"="c:\programme\avmwlanstick\FRITZWLANMini.exe" [2006-06-23 343552]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
F-Secure Automatic Update.lnk - c:\programme\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-1-17 32807]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\FJWSEL]
2006-06-29 12:45 32768 ----a-w- c:\windows\system32\FJWSWNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^InterVideo WinCinema Manager.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-16 10:45 63712 ----a-w- c:\programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-16 21:11 49152 ----a-w- c:\programme\hp\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2007-09-14 09:43 185632 ----a-w- c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5]
2004-05-20 16:37 188416 ----a-w- c:\programme\Hewlett-Packard\Toolbox\hpbpsttp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"c:\\Programme\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"=
.
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [17.01.2007 16:18 70896]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [17.01.2007 16:18 32807]
R2 F-Secure Filter;F-Secure File System Filter;c:\programme\F-Secure\Anti-Virus\win2k\FSfilter.sys [17.01.2007 16:18 48816]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\programme\F-Secure\Anti-Virus\win2k\fsgk.sys [17.01.2007 16:18 48256]
R2 F-Secure Recognizer;F-Secure File System Recognizer;c:\programme\F-Secure\Anti-Virus\win2k\FSrec.sys [17.01.2007 16:18 16720]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [27.09.2011 17:07 366152]
R3 FUJ02E1;%FUJ02E1.DeviceDesc%;c:\windows\system32\drivers\FUJ02E1.sys [09.01.2007 11:21 5632]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\drivers\fuj02e3.sys [09.01.2007 11:21 4864]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [27.09.2011 16:53 264704]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27.09.2011 17:07 22216]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [01.02.2010 13:45 135664]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [01.02.2010 13:45 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [30.01.2006 21:41 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-01 11:45]
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-01 11:45]
.
2011-09-29 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2007-01-17 14:42]
.
2011-09-29 c:\windows\Tasks\User_Feed_Synchronization-{1EBC1426-FAA4-4422-90BC-2CCB319C66D1}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
IE: &Block this popup - c:\programme\F-Secure\Anti-Spyware\blockpopups.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
DPF: {579CC802-2AF6-436B-8B9C-10F0B6C99FFE} - hxxp://sso.kisti.re.kr/auth/kisti_client.cab
DPF: {6989C944-3529-4DA8-8C60-187E95F580E2} - hxxp://leeum.samsungfoundation.org/book/include/SecuiJoinsIE.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Dr - c:\programme\Fasoo DRM\f_drscan.exe
MSConfigStartUp-FPH Exe - c:\progra~1\FASOOD~1\fph.exe
AddRemove-BackWeb-7681197 Uninstaller - c:\windows\BWUnin-6.3.2.116-7681197L.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-09-29 17:08
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1124)
c:\windows\system32\FJWSWNP.dll
.
- - - - - - - > 'explorer.exe'(3700)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\F-Secure\Anti-Virus\fsgk32st.exe
c:\programme\F-Secure\Anti-Virus\FSGK32.EXE
c:\programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe
c:\programme\F-Secure\Anti-Virus\fssm32.exe
c:\programme\F-Secure\Common\FSMA32.EXE
c:\programme\F-Secure\Common\FSMB32.EXE
c:\programme\Java\jre6\bin\jqs.exe
c:\windows\system32\hpzipm12.exe
c:\programme\F-Secure\Common\FCH32.EXE
c:\programme\F-Secure\Common\FAMEH32.EXE
c:\programme\F-Secure\Common\FNRB32.EXE
c:\programme\F-Secure\Anti-Virus\fsqh.exe
c:\programme\F-Secure\Anti-Virus\fsrw.exe
c:\programme\F-Secure\Common\FIH32.EXE
c:\programme\F-Secure\FWES\Program\fsdfwd.exe
c:\programme\F-Secure\Anti-Virus\fsav32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\AGRSMMSG.exe
c:\progra~1\F-Secure\ANTI-S~1\fsaw.exe
c:\programme\F-Secure\FSGUI\fsguidll.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-29 17:11:28 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-09-29 15:11
.
Vor Suchlauf: 20 Verzeichnis(se), 65.231.802.368 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 65.117.253.632 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 1B5584666CF4BEE1C5B106297DEB4389
__________________ Gruß Christian |
|
29.09.2011, 18:51
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundestrojaner win xp 32 Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Bundestrojaner win xp 32 |
| adobe, bundes, c:\windows, dateien, downloader, einstellungen, file, fsm, google, hotkey, infected, laptop, messenger, moved, not, photoshop, programme, shell.txt, software, srep.exe, system, system32, toolbox, update, win, win xp, windows, winlogon, zugriff |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
