| |
| |||||||
Log-Analyse und Auswertung: Ständiger Neustart bei Netzwerkverbindung Otl logWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
16.08.2010, 15:48
| #1 |
 |  Ständiger Neustart bei Netzwerkverbindung Otl log hallo habe gelesen das einige leute das selbe problem haben habe grade wie von markusg vorgeschlagen einen otl scan gemacht und hier das log dazu OTL Logfile: Code:
ATTFilter OTL logfile created on: 16.08.2010 15:45:29 - Run 1 OTL by OldTimer - Version 3.2.10.0 Folder = I:\ An unknown product (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 73,00% Memory free 7,00 Gb Paging File | 6,00 Gb Available in Paging File | 86,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,79 Gb Total Space | 132,20 Gb Free Space | 56,79% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 207,53 Gb Free Space | 89,11% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded Drive H: | 995,77 Mb Total Space | 244,28 Mb Free Space | 24,53% Space Free | Partition Type: FAT32 Drive I: | 3,82 Gb Total Space | 0,27 Gb Free Space | 7,04% Space Free | Partition Type: FAT32 Computer Name: PIT-PC Current User Name: Pit Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - I:\OTL.exe (OldTimer Tools) PRC - C:\Programme\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) PRC - C:\Programme\Panda Security\WAC\PsCtrlS.exe (Panda Security) PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Programme\Panda Security\WAC\avengine.exe (Panda Security, S.L.) PRC - C:\Programme\Panda Security\WAC\pavsrvx86.exe (Panda Security, S.L.) PRC - C:\Programme\Panda Security\WAC\WEBPROXY.EXE (Panda Security International) PRC - C:\Programme\Panda Security\WAC\PsCtrlC.exe (Panda Security) PRC - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) PRC - C:\Programme\Panda Security\WAC\psksvc.exe (Panda Software International) PRC - C:\Programme\Panda Security\WAC\PSIMSVC.EXE (Panda Security S.L.) PRC - C:\Programme\Panda Security\WaAgent\WasAgent\WasAgent.exe (Panda Security) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\spool\drivers\w32x86\3\HP1006MC.EXE (Software 2000 Limited) PRC - C:\Programme\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe (Panda Security) PRC - C:\Programme\Panda Security\WaAgent\WasWD\WasWD.exe (Panda Security) PRC - C:\Programme\Panda Security\WaAgent\Scheduler\PavSched.exe (Panda Security) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) PRC - c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) ========== Modules (SafeList) ========== MOD - I:\OTL.exe (OldTimer Tools) MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation) MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation) MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation) MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation) MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation) MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation) MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation) MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Panda Software Controller) -- C:\Program Files\Panda Security\WAC\PsCtrlS.exe (Panda Security) SRV - (PavSrv) -- C:\Program Files\Panda Security\WAC\pavsrvx86.exe (Panda Security, S.L.) SRV - (PskSvc) -- C:\Program Files\Panda Security\WAC\psksvc.exe (Panda Software International) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (PSImSvc) -- C:\Program Files\Panda Security\WAC\PSIMSVC.EXE (Panda Security S.L.) SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (WASAgent) -- C:\Programme\Panda Security\WaAgent\WasAgent\WasAgent.exe (Panda Security) SRV - (PavWASLpMng) -- C:\Program Files\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe (Panda Security) SRV - (WASWD) -- C:\Programme\Panda Security\WaAgent\WasWD\WasWD.exe (Panda Security) SRV - (PavAt3Scheduler) -- C:\Program Files\Panda Security\WaAgent\Scheduler\PavSched.exe (Panda Security) SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation) SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation) SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation) SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation) SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation) SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation) SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation) SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation) SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation) SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) ========== Driver Services (SafeList) ========== DRV - (catchme) -- C:\Users\Pit\AppData\Local\Temp\catchme.sys File not found DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (AmFSM) -- C:\Windows\System32\drivers\amm8660.sys (Panda Security, S.L.) DRV - (NSFIM) -- C:\Windows\System32\drivers\nsfim.sys (Panda Security, S.L.) DRV - (NETIMFLT01060042) -- C:\Windows\System32\drivers\neti1642.sys (Panda Security, S.L.) DRV - (RTL8187) -- C:\Windows\System32\drivers\RTL8187.sys (Realtek Semiconductor Corporation ) DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.) DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.) DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.) DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.) DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices) DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.) DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices) DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation) DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation) DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation) DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation) DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation) DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation) DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation) DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex) DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.) DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company) DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation) DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation) DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation) DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation) DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.) DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation) DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation) DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems) DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation) DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.) DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology) DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.) DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation) DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation) DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation) DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation) DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation) DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation) DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation) DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation) DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation) DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation) DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation) DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation) DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation) DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation) DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation) DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation) DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation) DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation) DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys () DRV - (NVNET) -- C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (AsIO) -- C:\Windows\System32\drivers\AsIO.sys () DRV - (TT1724ht) -- C:\Windows\System32\drivers\TT1724ht.sys (TerraTec Electronic GmbH) DRV - (TT1724sa) -- C:\Windows\System32\drivers\TT1724sa.sys (Sensaura) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 89 4A 20 5B 03 AB CA 01 [binary data] IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.06.07 19:13:16 | 000,000,000 | ---D | M] O1 HOSTS File: ([2010.08.16 11:23:20 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O3 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [Panda Software Controller Client] C:\Program Files\Panda Security\WAC\PSCtrlC.exe (Panda Security) O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.104.254 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - c:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.08.11 13:11:50 | 000,000,000 | ---D | M] - I:\Autosys -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation) NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation) SafeBootMin: Primary disk - Driver Group SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation) SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) ========== Files/Folders - Created Within 30 Days ========== [2010.08.16 15:06:09 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy [2010.08.16 15:06:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2010.08.16 11:56:48 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Roaming\Malwarebytes [2010.08.16 11:56:28 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Toolbar [2010.08.16 11:55:50 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Lite [2010.08.16 11:53:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.08.16 11:53:02 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.08.16 11:53:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.08.16 11:53:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.08.16 11:25:33 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2010.08.16 11:25:32 | 000,000,000 | ---D | C] -- C:\Windows\temp [2010.08.16 11:25:32 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Local\temp [2010.08.16 11:05:48 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2010.08.16 11:05:44 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2010.08.16 11:05:44 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2010.08.16 11:05:32 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2010.08.16 11:03:38 | 000,000,000 | ---D | C] -- C:\Qoobox [2010.08.16 11:03:21 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe [2010.08.13 18:36:19 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Local\jjfmlsxmc [2010.08.12 17:17:27 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\Molly Hatchet - 25th Anniversary Best Of Re-Recorded [2010.08.11 14:35:09 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll [2010.08.11 14:35:09 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll [2010.08.11 14:35:08 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll [2010.08.11 14:35:04 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.08.11 14:35:04 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.08.11 14:35:02 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.08.11 14:35:02 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.08.11 14:35:02 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.08.11 14:35:02 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.08.11 14:35:02 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.08.11 14:35:02 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.08.11 14:35:02 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.08.11 14:35:02 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.08.11 14:34:56 | 002,326,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.08.05 16:09:46 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Works [2010.08.05 16:09:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio [2010.08.05 16:09:27 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DESIGNER [2010.08.05 16:09:06 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.08.05 16:07:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 8 [2010.08.05 16:06:43 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2010.08.05 16:06:13 | 000,000,000 | R--D | C] -- C:\MSOCache [2010.07.28 21:52:15 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\Green Day - Greatest Hits 2010 2 CD-2010 [2010.07.24 13:55:54 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Roaming\vlc [2010.07.24 13:55:29 | 000,000,000 | ---D | C] -- C:\Programme\VideoLAN [2010.07.24 13:43:44 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\NEUE ALBEN-Bearbeit [2010.07.17 23:46:41 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\Prince-20ten-RETAIL- [2005.01.08 22:45:30 | 000,643,120 | ---- | C] (Snelg Enterprises) -- C:\Programme\MP3GainGUI.exe ========== Files - Modified Within 30 Days ========== [2010.08.16 15:47:04 | 000,783,872 | ---- | M] () -- C:\Windows\System32\drivers\wmqdfixt.sys [2010.08.16 15:46:25 | 000,014,624 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.08.16 15:46:25 | 000,014,624 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.08.16 15:43:26 | 001,507,106 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.08.16 15:43:26 | 000,657,438 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.08.16 15:43:26 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.08.16 15:43:26 | 000,130,810 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.08.16 15:43:26 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.08.16 15:40:52 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.08.16 15:39:15 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.08.16 15:39:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.08.16 15:38:58 | 2717,257,728 | -HS- | M] () -- C:\hiberfil.sys [2010.08.16 15:38:23 | 002,883,584 | -HS- | M] () -- C:\Users\Pit\NTUSER.DAT [2010.08.16 15:25:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.08.16 15:06:13 | 000,001,216 | ---- | M] () -- C:\Users\Pit\Desktop\Spybot - Search & Destroy.lnk [2010.08.16 14:35:51 | 004,976,695 | -H-- | M] () -- C:\Users\Pit\AppData\Local\IconCache.db [2010.08.16 11:56:27 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2010.08.16 11:56:13 | 000,691,696 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys [2010.08.16 11:53:05 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.08.16 11:23:25 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini [2010.08.16 11:23:20 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2010.08.16 10:26:26 | 000,002,828 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys [2010.08.13 18:36:09 | 000,000,000 | ---- | M] () -- C:\zrpt.xml [2010.08.12 03:20:20 | 004,784,696 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.08.11 17:31:41 | 000,722,606 | ---- | M] () -- C:\Users\Pit\Desktop\Urlaub-Abrechnung.cdr [2010.08.11 16:23:43 | 000,021,083 | ---- | M] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_PITS-GROSS.cdr [2010.08.10 18:11:07 | 000,027,708 | ---- | M] () -- C:\Users\Pit\Desktop\Montreaux.cdr [2010.08.10 17:55:12 | 000,020,963 | ---- | M] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_Sicherungskopie_von_PITS-GROSS.cdr [2010.08.07 13:43:35 | 000,337,097 | ---- | M] () -- C:\Users\Pit\Desktop\FRANK.cdr [2010.08.06 18:10:16 | 000,337,935 | ---- | M] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_FRANK.cdr [2010.08.06 17:30:03 | 000,077,998 | ---- | M] () -- C:\Users\Pit\Desktop\banner-iokai-trans_0a5b3cf8cb[1].jpg [2010.08.06 15:38:37 | 000,624,240 | ---- | M] () -- C:\Users\Pit\AppData\Local\GDIPFONTCACHEV1.DAT [2010.08.06 03:01:32 | 000,000,478 | ---- | M] () -- C:\Windows\win.ini [2010.08.06 02:47:00 | 000,007,018 | ---- | M] () -- C:\Users\Pit\Desktop\Angebot_AN0030.rtf [2010.07.29 08:30:49 | 000,197,632 | ---- | M] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll [2010.07.29 08:30:34 | 000,082,944 | ---- | M] (Radius Inc.) -- C:\Windows\System32\iccvid.dll [2010.07.27 21:09:29 | 002,239,182 | ---- | M] () -- C:\Users\Pit\Desktop\Plan Alter Markt.bmp [2010.07.24 13:55:39 | 000,001,024 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2010.07.23 16:01:42 | 008,317,039 | ---- | M] () -- C:\Users\Pit\Desktop\Wishbone Ash - Argus [2002 Remaster] - 08 - Jail Bait (Bonus Live Track).mp3 [2010.07.19 15:22:09 | 005,325,745 | ---- | M] () -- C:\Users\Pit\Desktop\Grafik1.cdr ========== Files Created - No Company Name ========== [2010.08.16 15:06:13 | 000,001,216 | ---- | C] () -- C:\Users\Pit\Desktop\Spybot - Search & Destroy.lnk [2010.08.16 11:56:27 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2010.08.16 11:53:05 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.08.16 11:05:48 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2010.08.16 11:05:44 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2010.08.16 11:05:44 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.08.16 11:05:44 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.08.16 11:05:44 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2010.08.13 18:35:28 | 000,783,872 | ---- | C] () -- C:\Windows\System32\drivers\wmqdfixt.sys [2010.08.13 18:35:20 | 000,000,000 | ---- | C] () -- C:\zrpt.xml [2010.08.11 17:31:41 | 000,722,606 | ---- | C] () -- C:\Users\Pit\Desktop\Urlaub-Abrechnung.cdr [2010.08.10 18:11:07 | 000,027,708 | ---- | C] () -- C:\Users\Pit\Desktop\Montreaux.cdr [2010.08.10 17:52:37 | 000,020,963 | ---- | C] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_Sicherungskopie_von_PITS-GROSS.cdr [2010.08.06 17:56:54 | 000,337,935 | ---- | C] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_FRANK.cdr [2010.08.06 17:28:02 | 000,077,998 | ---- | C] () -- C:\Users\Pit\Desktop\banner-iokai-trans_0a5b3cf8cb[1].jpg [2010.08.06 17:24:21 | 000,337,097 | ---- | C] () -- C:\Users\Pit\Desktop\FRANK.cdr [2010.08.06 01:47:29 | 000,007,018 | ---- | C] () -- C:\Users\Pit\Desktop\Angebot_AN0030.rtf [2010.07.27 21:09:29 | 002,239,182 | ---- | C] () -- C:\Users\Pit\Desktop\Plan Alter Markt.bmp [2010.07.24 13:55:39 | 000,001,024 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2010.07.24 13:33:35 | 008,317,039 | ---- | C] () -- C:\Users\Pit\Desktop\Wishbone Ash - Argus [2002 Remaster] - 08 - Jail Bait (Bonus Live Track).mp3 [2010.06.09 16:43:44 | 000,001,456 | ---- | C] () -- C:\Users\Pit\AppData\Local\Adobe Für Web speichern 12.0 Prefs [2010.06.07 19:01:24 | 000,000,899 | ---- | C] () -- C:\Windows\WINCMD.INI [2010.06.07 18:57:31 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2010.06.01 00:43:23 | 000,007,605 | ---- | C] () -- C:\Users\Pit\AppData\Local\Resmon.ResmonCfg [2010.04.30 00:15:17 | 000,003,262 | ---- | C] () -- C:\Programme\MP3GainGUIErrors.log [2010.04.21 00:40:32 | 000,136,714 | ---- | C] () -- C:\Programme\MP3GainGUIChanges.log [2010.04.19 17:29:51 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI [2010.02.12 18:47:04 | 000,039,789 | ---- | C] () -- C:\Programme\uninst-mp3gain.exe [2010.02.12 17:46:33 | 000,065,536 | ---- | C] () -- C:\Windows\System32\HPPLVS.dll [2010.02.12 16:01:43 | 000,000,133 | ---- | C] () -- C:\Windows\AdminIE.ini [2010.02.12 15:57:47 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys [2010.02.12 15:57:47 | 000,000,088 | RHS- | C] () -- C:\ProgramData\0A6367044D.sys [2010.02.12 15:06:24 | 000,303,104 | ---- | C] () -- C:\Windows\System32\CmiInstallResAll.dll [2010.02.12 15:06:24 | 000,002,754 | ---- | C] () -- C:\Windows\cmudax3.ini [2010.02.12 14:17:00 | 000,704,512 | R--- | C] () -- C:\Windows\System32\cohelper.dll [2010.02.12 14:15:21 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2010.02.12 14:15:18 | 000,016,051 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2010.02.12 12:24:35 | 000,024,576 | R--- | C] () -- C:\Windows\System32\AsIO.dll [2010.02.12 12:24:35 | 000,012,400 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.05.13 13:11:34 | 000,006,504 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys [2009.04.02 14:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS [2005.01.09 01:58:09 | 000,131,127 | ---- | C] () -- C:\Programme\mp3gain.exe [2004.11.02 18:05:44 | 000,330,954 | ---- | C] () -- C:\Programme\MP3Gain.chm ========== LOP Check ========== [2010.02.17 18:05:16 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Bitstream [2010.06.07 19:01:21 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\DAEMON Tools Lite [2010.03.30 18:12:51 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Opera [2010.06.08 17:06:12 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.02.12 18:33:46 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TeamViewer [2010.02.17 19:18:38 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TuneUp Software [2010.02.17 19:45:08 | 000,032,128 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.06.08 22:04:41 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Adobe [2010.06.08 17:06:13 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Adobe Mini Bridge CS5 [2010.02.12 18:07:20 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Ahead [2010.02.17 18:05:16 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Bitstream [2010.06.01 17:17:17 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Corel [2010.06.07 19:01:21 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\DAEMON Tools Lite [2010.02.12 14:18:43 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Download Manager [2010.06.08 15:12:25 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Google [2010.02.11 12:15:56 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Identities [2010.02.11 17:41:25 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Macromedia [2010.08.16 11:56:48 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Malwarebytes [2009.07.14 10:56:56 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Media Center Programs [2010.06.26 14:26:03 | 000,000,000 | --SD | M] -- C:\Users\Pit\AppData\Roaming\Microsoft [2010.03.30 18:12:51 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Opera [2010.06.08 17:06:12 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.02.12 18:33:46 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TeamViewer [2010.02.17 19:18:38 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TuneUp Software [2010.07.28 21:46:48 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\vlc [2010.02.13 02:11:48 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2010.06.07 19:10:20 | 000,010,134 | R--- | M] () -- C:\Users\Pit\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2009.07.14 04:38:05 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\AGP440.sys [2009.07.14 04:38:05 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 04:38:05 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\ERDNT\cache\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\hddold\Windows\System32\drivers\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\hddold\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\hddold\Windows\System32\drivers\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2009.07.14 04:38:05 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\atapi.sys [2009.07.14 04:38:05 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 04:38:05 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\ERDNT\cache\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.02.13 21:05:07 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2008.02.13 21:05:07 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2008.02.13 21:05:07 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\hddold\$WINDOWS.~BT\Windows\System32\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\hddold\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\hddold\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTORV.SYS > [2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\hddold\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\hddold\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2009.07.14 04:38:05 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\iaStorV.sys [2009.07.14 04:38:05 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 04:38:05 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\hddold\Windows\System32\drivers\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\hddold\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\hddold\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\hddold\Windows\System32\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\hddold\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.19 00:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\hddold\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\hddold\$WINDOWS.~BT\Windows\System32\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\ERDNT\cache\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\nvstor.sys [2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_29af12c5857181b0\nvstor.sys [2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvstor.inf_x86_neutral_5d3b5edfbebeb7c4\nvstor.sys [2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\Windows\System32\drivers\nvstor.sys [2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys [2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvstor.inf_bd7fd3de\nvstor.sys [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\hddold\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys [2009.07.14 04:38:05 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 04:38:05 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: NVSTOR32.SYS > [2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=2A0CC26D67B38460CC7563BC8313C1D6 -- C:\hddold\NVIDIA\nForceWinVista\15.23\IS\IDE\WinVista\sataraid\nvstor32.sys [2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\nvstor32.sys [2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_b900095f3aa53048\nvstor32.sys [2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\NVIDIA\nForceWinVista\15.23\IS\IDE\WinVista\sata_ide\nvstor32.sys [2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvstor32.inf_d87a3a1f\nvstor32.sys [2007.07.03 01:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_73e25653bed8b986\nvstor32.sys [2007.07.03 01:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvstor32.inf_efe24208\nvstor32.sys [2006.11.10 13:41:46 | 000,097,064 | ---- | M] (NVIDIA Corporation) MD5=C090FF5B6F1E25CBE0D9627A7F407E89 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_73983f1ccfea7d8f\nvstor32.sys [2006.11.10 13:41:46 | 000,097,064 | ---- | M] (NVIDIA Corporation) MD5=C090FF5B6F1E25CBE0D9627A7F407E89 -- C:\hddold\Windows\System32\drivers\nvstor32.sys [2006.11.10 13:41:46 | 000,097,064 | ---- | M] (NVIDIA Corporation) MD5=C090FF5B6F1E25CBE0D9627A7F407E89 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_f0461979\nvstor32.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\hddold\$WINDOWS.~BT\Windows\System32\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\ERDNT\cache\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2008.01.19 00:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\hddold\Windows\System32\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\hddold\$WINDOWS.~BT\Windows\System32\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\ERDNT\cache\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2007.04.04 15:21:50 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\hddold\Windows\System32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll [2007.04.04 15:21:50 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll [2008.01.19 00:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\hddold\Windows\System32\userinit.exe [2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\hddold\$WINDOWS.~BT\Windows\System32\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\ERDNT\cache\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\ERDNT\cache\winlogon.exe [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\hddold\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\hddold\$WINDOWS.~BT\Windows\System32\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe [2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\hddold\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe [2008.01.19 00:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys [2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\hddold\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys [2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\hddold\Windows\System32\drivers\ws2ifsl.sys [2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\hddold\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > [2010.08.16 11:56:13 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys [2010.08.16 15:58:06 | 000,783,872 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\wmqdfixt.sys < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.07.14 03:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll [2009.07.14 03:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll [2009.07.14 03:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\LocationApi.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:DD4DD9B9 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:1493A0EF < End of report > |
|
16.08.2010, 16:02
| #2 |
| /// Malware-holic   | Ständiger Neustart bei Netzwerkverbindung Otl log bitte erstelle und poste ein combofix log.
__________________Ein Leitfaden und Tutorium zur Nutzung von ComboFix |
|
16.08.2010, 16:11
| #3 |
| | Ständiger Neustart bei Netzwerkverbindung Otl log so combofix hatte ich schon vorher laufen lassen hoffe das macht nichts
__________________Combofix Logfile: Code:
ATTFilter ComboFix 10-08-15.02 - Pit 16.08.2010 11:13:59.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.49.1031.18.3455.2751 [GMT 2:00]
ausgeführt von:: I:\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\$NtUninstallMTF1011$
c:\windows\$NtUninstallMTF1011$\apUninstall.exe
c:\windows\$NtUninstallMTF1011$\zrpt.xml
Infizierte Kopie von c:\windows\system32\drivers\pci.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
((((((((((((((((((((((( Dateien erstellt von 2010-07-16 bis 2010-08-16 ))))))))))))))))))))))))))))))
.
2010-08-13 16:36 . 2010-08-13 16:38 -------- d-----w- c:\users\Pit\AppData\Local\jjfmlsxmc
2010-08-13 16:36 . 2010-08-13 16:36 190464 ----a-w- c:\windows\Jqapya.exe
2010-08-11 12:34 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys
2010-08-11 12:34 . 2010-06-16 05:48 224256 ----a-w- c:\windows\system32\schannel.dll
2010-08-06 01:01 . 2010-08-06 01:01 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-08-05 15:09 . 2010-08-05 15:09 -------- d-----w- c:\users\Administrator\AppData\Local\Google
2010-08-05 14:09 . 2010-08-06 01:02 -------- d-----w- c:\program files\Microsoft Works
2010-08-05 14:09 . 2010-08-05 14:09 -------- d-----w- c:\windows\PCHEALTH
2010-08-05 14:07 . 2010-08-05 14:07 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-08-05 14:06 . 2010-08-05 14:06 -------- d-----r- C:\MSOCache
2010-07-24 11:55 . 2010-07-28 19:46 -------- d-----w- c:\users\Pit\AppData\Roaming\vlc
2010-07-24 11:55 . 2010-07-24 11:55 -------- d-----w- c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 09:16 . 2009-07-14 08:47 657438 ----a-w- c:\windows\system32\perfh007.dat
2010-08-16 09:16 . 2009-07-14 08:47 130810 ----a-w- c:\windows\system32\perfc007.dat
2010-08-16 08:26 . 2010-02-12 13:57 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2010-08-16 08:26 . 2010-02-12 13:57 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2010-08-13 16:30 . 2010-04-20 22:40 136714 ----a-w- c:\program files\MP3GainGUIChanges.log
2010-08-13 14:26 . 2010-02-11 15:39 -------- d-----w- c:\programdata\Microsoft Help
2010-08-06 13:38 . 2010-02-11 14:21 624240 ----a-w- c:\users\Pit\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-05 14:09 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild
2010-07-29 06:30 . 2010-08-11 12:35 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:35 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-19 14:55 . 2010-02-17 17:37 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-07-16 00:53 . 2010-04-29 22:15 3262 ----a-w- c:\program files\MP3GainGUIErrors.log
2010-07-12 13:21 . 2010-02-12 14:04 -------- d-----w- c:\programdata\sentinel
2010-07-06 11:26 . 2010-02-17 17:37 30528 ----a-w- c:\windows\system32\TURegOpt.exe
2010-07-06 11:20 . 2010-02-17 17:37 21312 ----a-w- c:\windows\system32\authuitu.dll
2010-07-06 11:20 . 2010-02-17 17:37 30016 ----a-w- c:\windows\system32\uxtuneup.dll
2010-06-30 06:25 . 2010-08-11 12:35 978432 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 01:00 . 2010-02-11 15:41 -------- d-----w- c:\program files\Microsoft.NET
2010-06-22 20:05 . 2010-06-22 20:05 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb6893.tmp.exe
2010-06-22 02:47 . 2010-08-11 12:35 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-11 12:35 307200 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-11 12:35 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-11 12:35 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-11 12:35 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-11 12:35 37376 ----a-w- c:\windows\system32\rtutils.dll
2010-06-14 06:12 . 2010-08-11 12:35 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-08 06:02 . 2010-08-11 12:35 1233920 ----a-w- c:\windows\system32\msxml3.dll
2010-06-07 17:10 . 2010-06-07 17:10 10134 ----a-r- c:\users\Pit\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
2010-06-07 17:08 . 2010-08-05 15:03 38784 ----a-w- c:\users\Administrator\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-07 17:08 . 2010-06-07 17:08 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-07 16:57 . 2010-06-07 16:57 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-03 12:17 . 2010-02-12 13:57 88 --sh--r- c:\programdata\0A6367044D.sys
2010-06-03 12:17 . 2010-02-12 13:57 88 --sh--r- c:\programdata\0A6367044D.sys
2010-06-01 15:20 . 2010-06-01 15:13 2828 --sha-w- c:\programdata\Protexis\KGyGaAvL.sys
2010-06-01 15:20 . 2010-06-01 15:17 88 --sh--r- c:\programdata\Protexis\0A6367044D.sys
2010-05-27 07:24 . 2010-06-09 05:35 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-09 05:35 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2010-02-11 10:19 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 11:50 . 2010-07-12 13:21 54344 ----a-w- c:\windows\system32\drivers\amm8660.sys
2010-02-12 16:47 . 2010-02-12 16:47 39789 ----a-w- c:\program files\uninst-mp3gain.exe
2005-01-08 23:58 . 2005-01-08 23:58 131127 ----a-w- c:\program files\mp3gain.exe
2005-01-08 20:45 . 2005-01-08 20:45 643120 ----a-w- c:\program files\MP3GainGUI.exe
2004-11-02 16:05 . 2004-11-02 16:05 330954 ----a-w- c:\program files\MP3Gain.chm
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-08 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Panda Software Controller Client"="c:\program files\Panda Security\WAC\PSCtrlC.exe" [2010-04-09 143616]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 135664]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-07 375808]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TT1724ht;AureonWDM;c:\windows\system32\drivers\TT1724ht.sys [2004-12-01 73344]
R3 TT1724sa;TT1724sa;c:\windows\system32\drivers\TT1724sa.sys [2004-05-11 400640]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-06-07 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2010-05-21 54344]
S2 NSFIM;Network Shared Files Information Manager Plugin;c:\windows\system32\Drivers\NSFIM.SYS [2010-03-30 54792]
S2 PavAt3Scheduler;Panda Endpoint Scheduler;c:\program files\Panda Security\WaAgent\Scheduler\PavSched.exe [2009-09-17 140544]
S2 PavWASLpMng;Panda Endpoint Local Process Manager;c:\program files\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe [2009-09-17 295680]
S2 PskSvc;Panda Kernel Service;c:\program files\Panda Security\WAC\psksvc.exe [2010-03-31 27904]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-07-06 1051968]
S2 WASAgent;Panda Endpoint Communications Agent;c:\program files\Panda Security\WaAgent\WasAgent\WasAgent.exe [2009-12-31 320768]
S2 WASWD;Panda Endpoint Watchdog;c:\program files\Panda Security\WaAgent\WasWD\WasWD.exe [2009-09-17 206080]
S3 NETIMFLT01060042;PANDA NDIS IM Filter Miniport v1.6.0.42;c:\windows\system32\DRIVERS\neti1642.sys [2010-02-18 199688]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
--- Andere Dienste/Treiber im Speicher ---
*Deregistered* - wmqdfixt
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]
2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]
2010-08-16 c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
- c:\windows\Jqapya.exe [2010-08-13 16:36]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\WAC\pavlsp.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKLM-Run-sta - reaip.dll
AddRemove-$NtUninstallMTF1011$ - c:\windows\$NtUninstallMTF1011$\apUninstall.exe
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmqdfixt]
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2EDFD31B-F5E9-01F1-12DB-AD1F9A360B2B}*]
"hagcicajgnpkedjm"=hex:6b,61,62,69,68,6f,66,63,63,6f,65,6d,64,68,6f,6e,6e,62,
68,6b,67,70,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-08-16 11:25:30
ComboFix-quarantined-files.txt 2010-08-16 09:25
Vor Suchlauf: 12 Verzeichnis(se), 140.336.312.320 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 140.029.194.240 Bytes frei
- - End Of File - - BA001C82D2722BB188574774016F02F9
|
|
16.08.2010, 16:21
| #4 |
| /// Malware-holic | Ständiger Neustart bei Netzwerkverbindung Otl log start programme, zubehör, editor, kopiere rein: Killall:: Rootkit:: c:\windows\Jqapya.exe c:\windows\system32\drivers\wmqdfixt.sys c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job driver:: wmqdfixt Datei speichern unter, typ alle dateien, name cfscript.txt speicherort, dort wo sich combofix.exe befindet. ziehe cfscript auf combofix, programm startet, log posten. Download malwarebytes: Malwarebytes update das programm über die registerkarte aktualisierung, schalte nun alles an laufenden programmen ab, auch antivirus, trenne die internetverbindung. starte nen komplett scan, funde löschen, log posten. |
|
16.08.2010, 17:04
| #5 |
| | Ständiger Neustart bei Netzwerkverbindung Otl log so hier die log von combofix Combofix Logfile: Code:
ATTFilter ComboFix 10-08-15.02 - Pit 16.08.2010 17:41:19.2.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.49.1031.18.3455.2605 [GMT 2:00]
ausgeführt von:: H:\ComboFix.exe
Benutzte Befehlsschalter :: H:\cfscript.txt
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_WMQDFIXT
-------\Service_wmqdfixt
((((((((((((((((((((((( Dateien erstellt von 2010-07-16 bis 2010-08-16 ))))))))))))))))))))))))))))))
.
2010-08-16 15:53 . 2010-08-16 15:53 -------- d-----w- C:\Device
2010-08-16 15:48 . 2010-08-16 15:54 -------- d-----w- c:\users\Pit\AppData\Local\temp
2010-08-16 15:48 . 2010-08-16 15:48 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-08-16 15:48 . 2010-08-16 15:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-16 15:48 . 2010-08-16 15:48 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2010-08-16 13:06 . 2010-08-16 13:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-08-16 13:06 . 2010-08-16 13:06 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-16 09:56 . 2010-08-16 09:56 -------- d-----w- c:\users\Pit\AppData\Roaming\Malwarebytes
2010-08-16 09:56 . 2010-08-16 09:56 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-08-16 09:55 . 2010-08-16 09:56 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-16 09:53 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-16 09:53 . 2010-08-16 09:53 -------- d-----w- c:\programdata\Malwarebytes
2010-08-16 09:53 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-16 09:53 . 2010-08-16 09:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-13 16:36 . 2010-08-13 16:38 -------- d-----w- c:\users\Pit\AppData\Local\jjfmlsxmc
2010-08-13 16:35 . 2010-08-16 15:53 783872 ----a-w- c:\windows\system32\drivers\wmqdfixt.sys
2010-08-11 12:34 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys
2010-08-11 12:34 . 2010-06-16 05:48 224256 ----a-w- c:\windows\system32\schannel.dll
2010-08-06 01:01 . 2010-08-06 01:01 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-08-05 15:09 . 2010-08-05 15:09 -------- d-----w- c:\users\Administrator\AppData\Local\Google
2010-08-05 14:09 . 2010-08-06 01:02 -------- d-----w- c:\program files\Microsoft Works
2010-08-05 14:09 . 2010-08-05 14:09 -------- d-----w- c:\windows\PCHEALTH
2010-08-05 14:07 . 2010-08-05 14:07 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-08-05 14:06 . 2010-08-05 14:06 -------- d-----r- C:\MSOCache
2010-07-24 11:55 . 2010-07-28 19:46 -------- d-----w- c:\users\Pit\AppData\Roaming\vlc
2010-07-24 11:55 . 2010-07-24 11:55 -------- d-----w- c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 15:47 . 2009-07-14 08:47 657438 ----a-w- c:\windows\system32\perfh007.dat
2010-08-16 15:47 . 2009-07-14 08:47 130810 ----a-w- c:\windows\system32\perfc007.dat
2010-08-16 11:06 . 2010-02-17 17:17 -------- d-----w- c:\program files\TU2010TrialDE
2010-08-16 09:56 . 2010-06-07 16:57 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-08-16 08:26 . 2010-02-12 13:57 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2010-08-16 08:26 . 2010-02-12 13:57 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2010-08-13 16:30 . 2010-04-20 22:40 136714 ----a-w- c:\program files\MP3GainGUIChanges.log
2010-08-13 14:26 . 2010-02-11 15:39 -------- d-----w- c:\programdata\Microsoft Help
2010-08-06 13:38 . 2010-02-11 14:21 624240 ----a-w- c:\users\Pit\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-05 14:09 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild
2010-07-29 06:30 . 2010-08-11 12:35 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:35 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-16 00:53 . 2010-04-29 22:15 3262 ----a-w- c:\program files\MP3GainGUIErrors.log
2010-07-12 13:21 . 2010-02-12 14:04 -------- d-----w- c:\programdata\sentinel
2010-06-30 06:25 . 2010-08-11 12:35 978432 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 01:00 . 2010-02-11 15:41 -------- d-----w- c:\program files\Microsoft.NET
2010-06-22 20:05 . 2010-06-22 20:05 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb6893.tmp.exe
2010-06-22 02:47 . 2010-08-11 12:35 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-11 12:35 307200 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-11 12:35 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-11 12:35 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-11 12:35 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-11 12:35 37376 ----a-w- c:\windows\system32\rtutils.dll
2010-06-14 06:12 . 2010-08-11 12:35 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-08 06:02 . 2010-08-11 12:35 1233920 ----a-w- c:\windows\system32\msxml3.dll
2010-06-07 17:10 . 2010-06-07 17:10 10134 ----a-r- c:\users\Pit\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
2010-06-07 17:08 . 2010-08-05 15:03 38784 ----a-w- c:\users\Administrator\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-07 17:08 . 2010-06-07 17:08 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-03 12:17 . 2010-02-12 13:57 88 --sh--r- c:\programdata\0A6367044D.sys
2010-06-03 12:17 . 2010-02-12 13:57 88 --sh--r- c:\programdata\0A6367044D.sys
2010-06-01 15:20 . 2010-06-01 15:13 2828 --sha-w- c:\programdata\Protexis\KGyGaAvL.sys
2010-06-01 15:20 . 2010-06-01 15:17 88 --sh--r- c:\programdata\Protexis\0A6367044D.sys
2010-05-27 07:24 . 2010-06-09 05:35 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-09 05:35 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2010-02-11 10:19 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 11:50 . 2010-07-12 13:21 54344 ----a-w- c:\windows\system32\drivers\amm8660.sys
2010-02-12 16:47 . 2010-02-12 16:47 39789 ----a-w- c:\program files\uninst-mp3gain.exe
2005-01-08 23:58 . 2005-01-08 23:58 131127 ----a-w- c:\program files\mp3gain.exe
2005-01-08 20:45 . 2005-01-08 20:45 643120 ----a-w- c:\program files\MP3GainGUI.exe
2004-11-02 16:05 . 2004-11-02 16:05 330954 ----a-w- c:\program files\MP3Gain.chm
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-08-16_09.23.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-11 14:26 . 2010-08-16 15:41 32220 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2010-08-16 15:56 44170 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-02-11 10:46 . 2010-08-16 15:41 10800 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2289426193-355958968-1139114157-1000_UserData.bin
+ 2010-08-16 08:16 . 2010-08-16 14:47 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
- 2010-08-16 08:16 . 2010-08-16 08:31 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
- 2010-02-11 10:12 . 2010-08-16 09:05 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-11 10:12 . 2010-08-16 14:47 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-08-16 08:16 . 2010-08-16 14:47 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat
- 2010-08-16 08:16 . 2010-08-16 08:31 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat
+ 2010-02-11 10:12 . 2010-08-16 14:47 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-02-11 10:12 . 2010-08-16 09:05 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-08-16 08:16 . 2010-08-16 08:31 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat
+ 2010-08-16 08:16 . 2010-08-16 14:47 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat
- 2009-07-14 04:41 . 2010-08-16 09:05 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2010-08-16 14:47 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 10:16 . 2010-08-16 09:14 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-11 10:16 . 2010-08-16 15:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-11 10:16 . 2010-08-16 09:14 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 10:16 . 2010-08-16 15:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 10:16 . 2010-08-16 15:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 10:16 . 2010-08-16 09:14 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 12:01 . 2010-08-16 09:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-11 12:01 . 2010-08-16 15:43 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-12 15:22 . 2010-08-16 15:48 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-02-12 15:22 . 2010-08-16 09:01 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-12 15:22 . 2010-08-16 15:48 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2010-02-12 15:22 . 2010-08-16 09:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2010-02-12 15:22 . 2010-08-16 15:48 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
- 2010-02-12 15:22 . 2010-08-16 09:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
- 2010-02-11 12:01 . 2010-08-16 09:14 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 12:01 . 2010-08-16 15:48 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 12:01 . 2010-08-16 15:43 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 12:01 . 2010-08-16 09:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-08-16 15:40 . 2010-08-16 15:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-08-16 09:12 . 2010-08-16 09:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-08-16 09:12 . 2010-08-16 09:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-08-16 15:40 . 2010-08-16 15:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:05 . 2010-08-16 09:16 618714 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2010-08-16 15:47 618714 c:\windows\System32\perfh009.dat
- 2009-07-14 02:05 . 2010-08-16 09:16 107034 c:\windows\System32\perfc009.dat
+ 2009-07-14 02:05 . 2010-08-16 15:47 107034 c:\windows\System32\perfc009.dat
- 2009-07-14 02:03 . 2010-08-13 05:16 7077888 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:03 . 2010-08-16 09:26 7077888 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-08 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Panda Software Controller Client"="c:\program files\Panda Security\WAC\PSCtrlC.exe" [2010-04-09 143616]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 135664]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-07 375808]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TT1724ht;AureonWDM;c:\windows\system32\drivers\TT1724ht.sys [2004-12-01 73344]
R3 TT1724sa;TT1724sa;c:\windows\system32\drivers\TT1724sa.sys [2004-05-11 400640]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-08-16 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2010-05-21 54344]
S2 NSFIM;Network Shared Files Information Manager Plugin;c:\windows\system32\Drivers\NSFIM.SYS [2010-03-30 54792]
S2 PavAt3Scheduler;Panda Endpoint Scheduler;c:\program files\Panda Security\WaAgent\Scheduler\PavSched.exe [2009-09-17 140544]
S2 PavWASLpMng;Panda Endpoint Local Process Manager;c:\program files\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe [2009-09-17 295680]
S2 PskSvc;Panda Kernel Service;c:\program files\Panda Security\WAC\psksvc.exe [2010-03-31 27904]
S2 WASAgent;Panda Endpoint Communications Agent;c:\program files\Panda Security\WaAgent\WasAgent\WasAgent.exe [2009-12-31 320768]
S2 WASWD;Panda Endpoint Watchdog;c:\program files\Panda Security\WaAgent\WasWD\WasWD.exe [2009-09-17 206080]
S3 NETIMFLT01060042;PANDA NDIS IM Filter Miniport v1.6.0.42;c:\windows\system32\DRIVERS\neti1642.sys [2010-02-18 199688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]
2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\WAC\pavlsp.dll
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2EDFD31B-F5E9-01F1-12DB-AD1F9A360B2B}*]
"hagcicajgnpkedjm"=hex:6b,61,62,69,68,6f,66,63,63,6f,65,6d,64,68,6f,6e,6e,62,
68,6b,67,70,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Panda Security\WAC\pavsrvx86.exe
c:\program files\Panda Security\WAC\AVENGINE.EXE
c:\windows\system32\nvvsvc.exe
c:\program files\Panda Security\WAC\PsCtrlS.exe
c:\program files\Panda Security\WAC\PSIMSVC.EXE
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\windows\system32\conhost.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Panda Security\WAC\WebProxy.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-16 17:59:55 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-08-16 15:59
ComboFix2.txt 2010-08-16 09:25
Vor Suchlauf: 16 Verzeichnis(se), 141.577.547.776 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 140.883.243.008 Bytes frei
- - End Of File - - C0F47765C067BAAFAF3C21AEA825CD55
|
|
16.08.2010, 17:10
| #6 |
| /// Malware-holic | Ständiger Neustart bei Netzwerkverbindung Otl log ok weiter mit malwarebytes |
|
16.08.2010, 18:10
| #7 |
| | Ständiger Neustart bei Netzwerkverbindung Otl log schon mal vielen dank für die hilfe das problem ist behoben Malwarebytes läuft noch über 1 stunde und ich muss gleich weg kann ich erst morgen posten vielen dank nochmal |
|
16.08.2010, 18:12
| #8 |
| /// Malware-holic | Ständiger Neustart bei Netzwerkverbindung Otl log keine eile. bis morgen |
|
18.08.2010, 16:20
| #9 |
| | Ständiger Neustart bei Netzwerkverbindung Otl log so leider kann ich den log von mbam nicht mehr posten mein kumpel hat den gelöscht aber es wurde auch nichts mehr gefunden nochmal vielen dank an markusg für die schnelle und gute hilfe |
|
| Themen zu Ständiger Neustart bei Netzwerkverbindung Otl log |
| 4d36e972-e325-11ce-bfc1-08002be10318, adobe, alternate, bho, browser, c:\windows\system32\rundll32.exe, corp./icp, defender, desktop, error, excel.exe, firefox, fontcache, format, google, langs, local\temp, location, logfile, media center, mozilla, nodrives, nvlddmkm.sys, nvmf6232.sys, nvstor.sys, object, oldtimer, otl log, otl scan, otl.exe, port, problem, programdata, realtek, registry, rundll, safer networking, scan, security, senden, software, sptd.sys, ständiger neustart, taskhost.exe, temp, usb, vista, windows, wrapper |
Linear-Darstellung
