| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet Explorer und sein EigenlebenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.09.2010, 08:49
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Internet Explorer und sein Eigenleben Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
01.09.2010, 19:30
| #17 |
 | Internet Explorer und sein Eigenleben All processes killed
__________________========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Ceron ->Temp folder emptied: 27764026 bytes ->Temporary Internet Files folder emptied: 74894687 bytes ->Java cache emptied: 257175 bytes ->FireFox cache emptied: 97142113 bytes ->Opera cache emptied: 89909 bytes ->Flash cache emptied: 3944 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 538574 bytes RecycleBin emptied: 282 bytes Total Files Cleaned = 191,00 mb OTL by OldTimer - Version 3.2.11.0 log created on 09012010_202512 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
02.09.2010, 09:38
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer und sein Eigenleben Dann bitte jetzt CF ausführen:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ |
|
03.09.2010, 18:28
| #19 |
| | Internet Explorer und sein Eigenleben Combofix Logfile: Code:
ATTFilter ComboFix 10-09-02.04 - Ceron 03.09.2010 19:18:20.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1033.18.1918.1038 [GMT 2:00]
ausgeführt von:: c:\users\Ceron\Desktop\Cofi.exe
.
((((((((((((((((((((((( Dateien erstellt von 2010-08-03 bis 2010-09-03 ))))))))))))))))))))))))))))))
.
2010-09-03 17:22 . 2010-09-03 17:22 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-09-03 17:22 . 2010-09-03 17:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-03 15:53 . 2010-09-03 15:53 81408 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-09-03 15:53 . 2010-09-03 15:53 17408 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\drivers\MijUfilt.sys
2010-09-03 15:53 . 2010-09-03 15:53 398 ----a-w- c:\programdata\MotioninJoy\DS3tool\update.bat
2010-09-03 15:53 . 2010-09-03 15:53 24576 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\drivers\MijBThid.sys
2010-09-03 15:52 . 2010-09-03 15:52 -------- d-----w- c:\users\Ceron\AppData\Roaming\MotioninJoy
2010-09-03 15:52 . 2010-09-03 15:52 -------- d-----w- c:\programdata\MotioninJoy
2010-09-03 15:52 . 2009-03-30 14:44 90112 ----a-w- c:\windows\system32\MijFrc.dll
2010-09-03 15:52 . 2010-09-03 15:52 -------- d-----w- c:\program files\MotioninJoy
2010-09-03 15:52 . 2009-10-06 22:21 24576 ----a-w- c:\windows\system32\drivers\MijBThid.sys
2010-09-03 15:52 . 2009-10-03 15:05 17408 ----a-w- c:\windows\system32\drivers\MijUfilt.sys
2010-09-03 15:52 . 2008-12-13 11:41 1459752 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2010-09-03 15:31 . 2005-03-09 18:50 33792 ----a-w- c:\windows\system32\drivers\libusb0.sys
2010-09-03 15:31 . 2005-03-09 18:50 46592 ----a-w- c:\windows\system32\libusb0.dll
2010-09-01 20:02 . 2010-09-01 20:02 0 ---ha-w- c:\users\Ceron\AppData\Roaming\.D80ED304EEAEFFC1.sys
2010-09-01 19:55 . 2010-09-01 20:06 -------- d-----w- c:\program files\Elastik
2010-09-01 18:25 . 2010-09-01 18:25 -------- d-----w- C:\_OTL
2010-08-31 14:32 . 2010-08-31 14:32 -------- d-----w- c:\windows\Sun
2010-08-31 14:31 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-29 16:36 . 2010-08-29 16:36 388096 ----a-r- c:\users\Ceron\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-29 16:36 . 2010-08-29 16:36 -------- d-----w- c:\program files\Trend Micro
2010-08-29 16:24 . 2010-08-29 16:24 -------- d-----w- c:\users\Ceron\AppData\Roaming\Avira
2010-08-29 16:19 . 2010-08-29 16:19 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-08-29 13:57 . 2010-03-01 07:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-08-29 13:57 . 2010-02-16 11:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-08-29 13:57 . 2009-05-11 09:49 17016 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-08-29 13:57 . 2010-08-29 13:57 -------- d-----w- c:\programdata\Avira
2010-08-29 13:57 . 2010-08-29 13:57 -------- d-----w- c:\program files\Avira
2010-08-29 13:57 . 2009-05-11 09:49 51992 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-08-29 11:36 . 2010-08-29 11:36 -------- d-----w- c:\users\Ceron\AppData\Roaming\WhiteSmokeTranslator
2010-08-29 11:35 . 2010-08-29 11:35 -------- d-----w- c:\program files\AutocompletePro
2010-08-29 11:35 . 2010-08-29 16:19 -------- d-----w- c:\program files\Search Advisor
2010-08-29 11:35 . 2010-08-29 11:35 -------- d-----w- c:\program files\Quick Web Player
2010-08-28 17:32 . 2010-03-05 11:51 208896 ----a-w- c:\windows\system\lame_enc.dll
2010-08-28 13:26 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-08-28 13:26 . 2006-09-28 14:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-08-28 13:26 . 2010-08-28 13:26 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-08-28 13:26 . 2010-08-28 13:28 -------- d-----w- c:\users\Ceron\AppData\Roaming\Winamp
2010-08-28 13:26 . 2010-08-28 13:26 -------- d-----w- c:\program files\Winamp
2010-08-28 07:43 . 2010-08-28 07:43 -------- d-----w- c:\program files\BeatPack
2010-08-27 17:13 . 2010-08-27 17:13 -------- d-----w- c:\program files\WinSCP
2010-08-25 18:08 . 2010-08-25 18:08 -------- d-----w- c:\programdata\ATI
2010-08-25 16:51 . 2010-08-25 16:51 1 ----a-w- c:\users\Ceron\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-25 16:51 . 2010-08-25 16:51 -------- d-----w- c:\users\Ceron\AppData\Roaming\OpenOffice.org
2010-08-25 16:49 . 2010-08-25 16:49 -------- d-----w- c:\program files\JRE
2010-08-25 16:49 . 2010-08-25 16:49 -------- d-----w- c:\program files\OpenOffice.org 3
2010-08-25 15:06 . 2010-04-07 07:10 571904 ----a-w- c:\windows\system32\oleaut32.dll
2010-08-23 19:24 . 2010-08-23 19:24 -------- d-----w- c:\program files\Common Files\Java
2010-08-23 19:23 . 2010-08-23 19:22 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-23 19:22 . 2010-08-25 16:48 -------- d-----w- c:\program files\Java
2010-08-22 16:35 . 2010-08-22 16:35 54 ----a-w- c:\programdata\Last.fm\Client\uninst2.bat
2010-08-22 16:35 . 2010-08-22 16:35 683801 ----a-w- c:\programdata\Last.fm\Client\UninstITW\unins000.exe
2010-08-22 16:35 . 2010-08-22 16:35 -------- d-----w- c:\programdata\Last.fm
2010-08-18 18:25 . 2010-08-18 18:25 -------- d-----w- c:\users\Ceron\AppData\Roaming\DVDVideoSoftIEHelpers
2010-08-18 18:25 . 2010-08-29 16:14 -------- d-----w- c:\program files\DVDVideoSoft
2010-08-18 18:25 . 2010-08-29 16:14 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-08-18 17:15 . 2010-08-18 18:31 -------- d-----w- c:\users\Ceron\AppData\Local\iRinger
2010-08-16 18:47 . 2010-08-16 19:58 -------- d-----w- c:\users\Ceron\AppData\Local\Adobe
2010-08-16 18:45 . 2010-08-16 18:45 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-15 17:28 . 2010-08-15 07:50 -------- d-----w- c:\windows\Panther
2010-08-15 17:22 . 2010-08-15 17:22 -------- d-----w- C:\Windows.old
2010-08-15 16:31 . 2010-08-15 16:31 0 ----a-w- c:\windows\ativpsrm.bin
2010-08-15 14:21 . 2010-08-15 14:21 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-15 14:19 . 2010-08-15 14:19 -------- d-----w- c:\program files\Microsoft.NET
2010-08-15 14:18 . 2010-08-15 14:19 -------- d-----w- c:\users\Ceron\AppData\Local\Microsoft Games
2010-08-15 14:11 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-08-15 14:10 . 2010-08-25 17:19 651768 ----a-w- c:\windows\system32\perfh007.dat
2010-08-15 14:10 . 2010-08-25 17:19 129468 ----a-w- c:\windows\system32\perfc007.dat
2010-08-15 14:10 . 2010-08-15 14:10 38104 ----a-w- c:\windows\system32\perfd007.dat
2010-08-15 14:10 . 2010-08-15 14:10 295922 ----a-w- c:\windows\system32\perfi007.dat
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\de-DE
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\system32\XPSViewer
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\system32\drivers\de-DE
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\system32\0407
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\system32\de
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\system32\wbem\de-DE
2010-08-15 14:10 . 2010-08-15 14:10 -------- d-----w- c:\windows\system32\Spool\prtprocs\w32x86\de-DE
2010-08-15 13:56 . 2010-08-15 13:56 44646 ----a-w- c:\windows\system32\FlashMenu.sys
2010-08-15 13:55 . 2007-01-12 08:54 10848 ----a-w- c:\windows\system32\drivers\WinFlash.sys
2010-08-15 13:55 . 2010-08-15 13:55 -------- d-----w- c:\program files\U-ABIT
2010-08-15 13:41 . 2010-08-15 13:42 -------- d-----w- c:\users\Ceron\AppData\Roaming\GetRightToGo
2010-08-15 12:59 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-08-15 12:58 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-08-15 12:58 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-08-15 12:58 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-08-15 12:58 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-08-15 12:58 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-08-15 12:54 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-08-15 12:52 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys
2010-08-15 10:32 . 2009-09-04 15:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2010-08-15 10:32 . 2007-04-04 16:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2010-08-15 09:52 . 2010-08-15 09:52 -------- d-----w- c:\program files\Common Files\Steam
2010-08-15 09:30 . 2010-08-15 09:30 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-15 09:29 . 2010-08-15 09:30 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-08-15 09:29 . 2010-04-12 12:33 825344 ----a-w- c:\users\Ceron\AppData\Roaming\Gutscheinmieze\uninstall.exe
2010-08-15 09:29 . 2010-03-19 07:51 714240 ----a-w- c:\users\Ceron\AppData\Roaming\Gutscheinmieze\toolbar.dll
2010-08-15 09:29 . 2010-08-15 09:29 -------- d-----w- c:\users\Ceron\AppData\Roaming\Gutscheinmieze
2010-08-15 09:28 . 2010-08-15 09:28 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-08-15 09:27 . 2010-08-15 09:27 -------- d-----w- c:\users\Ceron\AppData\Roaming\ATI
2010-08-15 09:27 . 2010-08-15 09:27 -------- d-----w- c:\users\Ceron\AppData\Local\ATI
2010-08-15 09:26 . 2010-08-25 18:04 -------- d-----w- c:\program files\ATI Technologies
2010-08-15 09:26 . 2010-08-25 18:05 -------- d-----w- c:\program files\ATI
2010-08-15 09:19 . 2010-08-15 09:19 -------- d-----w- c:\windows\system32\RTCOM
2010-08-15 09:10 . 2010-08-15 09:10 -------- d-----w- c:\windows\system32\Macromed
2010-08-15 09:02 . 2010-08-15 09:02 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-15 08:58 . 2007-10-04 08:14 307200 ----a-w- c:\windows\system32\nvexpbar.dll
2010-08-15 08:58 . 2007-10-04 08:14 1073152 ----a-w- c:\windows\system32\nvcpluir.dll
2010-08-15 08:58 . 2007-06-28 16:15 1732 ----a-w- c:\windows\system32\drivers\nvphy.bin
2010-08-15 08:32 . 2010-05-21 12:14 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-08-15 08:32 . 2010-09-03 16:01 -------- d-----w- c:\users\Ceron\Tracing
2010-08-15 08:31 . 2010-08-15 08:31 -------- d-----w- c:\program files\Microsoft
2010-08-15 08:30 . 2010-08-15 08:30 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-08-15 08:30 . 2010-08-15 09:30 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-08-15 08:30 . 2010-08-15 09:34 -------- d-----w- c:\users\Ceron\AppData\Roaming\DAEMON Tools Lite
2010-08-15 08:30 . 2010-08-15 08:31 -------- d-----w- c:\program files\Windows Live
2010-08-15 08:30 . 2010-08-15 08:30 -------- d-----w- c:\windows\PCHEALTH
2010-08-15 08:28 . 2010-08-15 08:28 -------- d-----w- c:\program files\Common Files\Windows Live
2010-08-15 08:26 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-08-15 08:26 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-08-15 08:26 . 2010-08-15 08:26 -------- d-----w- c:\program files\iPod
2010-08-15 08:26 . 2010-08-22 16:35 -------- d-----w- c:\program files\iTunes
2010-08-15 08:26 . 2010-08-15 08:26 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-15 08:25 . 2010-08-29 18:21 -------- d-----w- c:\program files\QuickTime
2010-08-15 08:25 . 2010-08-15 08:25 -------- d-----w- c:\users\Ceron\AppData\Local\Opera
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-03 15:58 . 2010-09-03 15:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_MijUfilt_01009.Wdf
2010-08-18 15:54 . 2010-08-18 15:54 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-08-15 16:30 . 2010-08-15 16:30 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-08-15 14:10 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Sidebar
2010-08-15 14:10 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-08-15 14:10 . 2009-07-14 07:50 -------- d-----w- c:\program files\Windows Journal
2010-08-15 14:10 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Photo Viewer
2010-08-15 14:10 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Defender
2010-08-15 14:10 . 2009-07-14 04:52 -------- d-----w- c:\program files\DVD Maker
2010-08-15 14:10 . 2010-08-15 14:10 38104 ----a-w- c:\windows\inf\PERFLIB\0407\perfd.dat
2010-08-15 14:10 . 2010-08-15 14:10 38104 ----a-w- c:\windows\inf\PERFLIB\0407\perfc.dat
2010-08-15 14:10 . 2010-08-15 14:10 295922 ----a-w- c:\windows\inf\PERFLIB\0407\perfi.dat
2010-08-15 14:10 . 2010-08-15 14:10 295922 ----a-w- c:\windows\inf\PERFLIB\0407\perfh.dat
2010-08-15 09:19 . 2010-08-15 09:18 -------- d--h--w- c:\program files\Temp
2010-08-15 09:18 . 2010-08-15 09:18 -------- d-----w- c:\program files\Realtek
2010-08-15 09:06 . 2010-08-15 08:57 319456 ----a-w- c:\windows\DIFxAPI.dll
2010-08-04 02:21 . 2010-08-04 02:21 6096384 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-08-04 01:55 . 2010-08-04 01:55 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-04 01:54 . 2010-07-07 01:54 519680 ----a-w- c:\windows\system32\aticfx32.dll
2010-08-04 01:52 . 2010-08-04 01:52 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-08-04 01:51 . 2010-08-04 01:51 380928 ----a-w- c:\windows\system32\atieclxx.exe
2010-08-04 01:51 . 2010-08-04 01:51 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-08-04 01:50 . 2010-08-04 01:50 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-08-04 01:49 . 2010-08-04 01:49 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-08-04 01:49 . 2010-08-04 01:49 15845888 ----a-w- c:\windows\system32\atioglxx.dll
2010-08-04 01:49 . 2010-08-04 01:49 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2010-08-04 01:49 . 2010-08-04 01:49 11776 ----a-w- c:\windows\system32\atimuixx.dll
2010-08-04 01:49 . 2010-08-04 01:49 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-08-04 01:46 . 2009-07-13 22:09 3899392 ----a-w- c:\windows\system32\atidxx32.dll
2010-08-04 01:28 . 2010-07-07 01:28 4021760 ----a-w- c:\windows\system32\atiumdag.dll
2010-08-04 01:26 . 2010-08-04 01:26 46080 ----a-w- c:\windows\system32\aticalrt.dll
2010-08-04 01:25 . 2010-08-04 01:25 44032 ----a-w- c:\windows\system32\aticalcl.dll
2010-08-04 01:24 . 2010-08-04 01:24 4341248 ----a-w- c:\windows\system32\aticaldd.dll
2010-08-04 01:23 . 2010-07-07 01:24 65536 ----a-w- c:\windows\system32\coinst.dll
2010-08-04 01:21 . 2010-07-07 01:23 3324416 ----a-w- c:\windows\system32\atiumdva.dll
2010-08-04 01:16 . 2010-08-04 01:16 241664 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-04 01:15 . 2010-08-04 01:15 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-08-04 01:15 . 2010-08-04 01:15 16896 ----a-w- c:\windows\system32\atigktxx.dll
2010-08-04 01:15 . 2010-08-04 01:15 214016 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-08-04 01:15 . 2010-07-07 01:14 30208 ----a-w- c:\windows\system32\atiuxpag.dll
2010-08-04 01:14 . 2010-07-07 01:14 27648 ----a-w- c:\windows\system32\atiu9pag.dll
2010-08-04 01:14 . 2010-08-04 01:14 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-08-04 01:09 . 2010-08-04 01:09 52736 ----a-w- c:\windows\system32\atimpc32.dll
2010-08-04 01:09 . 2010-08-04 01:09 52736 ----a-w- c:\windows\system32\amdpcom32.dll
2010-07-29 06:30 . 2010-08-15 12:52 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-15 12:52 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-28 16:23 . 2010-08-15 09:18 3154920 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys
2010-07-28 16:23 . 2010-08-15 09:18 1829992 ----a-w- c:\windows\system32\RtkPgExt.dll
2010-07-28 16:23 . 2010-08-15 09:18 64616 ----a-w- c:\windows\system32\RtkCoInst.dll
2010-07-28 16:23 . 2010-08-15 09:18 367208 ----a-w- c:\windows\system32\RtkApoApi.dll
2010-07-28 16:23 . 2010-08-15 09:18 3604584 ----a-w- c:\windows\system32\RtkAPO.dll
2010-07-28 16:23 . 2010-08-15 09:18 371816 ----a-w- c:\windows\system32\RCoRes.dat
2010-07-27 11:54 . 2010-08-15 09:18 1251944 ----a-w- c:\windows\RtlExUpd.dll
2010-07-22 14:48 . 2010-08-15 09:18 214352 ----a-w- c:\windows\system32\SFNHK.dll
2010-07-22 14:48 . 2010-08-15 09:18 68944 ----a-w- c:\windows\system32\SFAPO.dll
2010-07-22 14:48 . 2010-08-15 09:18 74064 ----a-w- c:\windows\system32\SFCOM.dll
2010-07-22 14:37 . 2010-08-15 09:18 175200 ----a-w- c:\windows\system32\AERTACap.dll
2010-07-15 12:47 . 2010-07-15 12:47 101904 ----a-w- c:\windows\system32\drivers\AtihdW73.sys
2010-07-06 09:48 . 2010-08-15 09:18 1327104 ----a-w- c:\windows\system32\MaxxAudioRealtek.dll
2010-07-01 11:43 . 2010-08-15 09:18 104160 ----a-w- c:\windows\system32\DTSGFXAPONS.dll
2010-07-01 11:43 . 2010-08-15 09:18 104672 ----a-w- c:\windows\system32\DTSGFXAPO.dll
2010-07-01 11:43 . 2010-08-15 09:18 104672 ----a-w- c:\windows\system32\DTSLFXAPO.dll
2010-06-30 06:25 . 2010-08-15 12:53 978432 ----a-w- c:\windows\system32\wininet.dll
2010-06-27 15:15 . 2010-08-15 09:18 252928 ----a-w- c:\windows\system32\MaxxAudioAPO30.dll
2010-06-22 02:47 . 2010-08-15 12:52 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-15 12:52 307200 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-15 12:52 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-15 12:53 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-15 12:53 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-15 12:52 37376 ----a-w- c:\windows\system32\rtutils.dll
2010-06-16 13:22 . 2010-06-16 13:22 219348 ----a-w- c:\windows\system32\atiicdxx.dat
2010-06-16 05:48 . 2010-08-15 12:52 224256 ----a-w- c:\windows\system32\schannel.dll
2010-06-15 22:28 . 2010-06-15 22:28 2857 ----a-w- c:\windows\system32\atipblag.dat
2010-06-14 06:12 . 2010-08-15 12:53 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-08 06:02 . 2010-08-15 12:52 1233920 ----a-w- c:\windows\system32\msxml3.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-09-03_16.46.09 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-08-15 07:43 . 2010-09-03 15:52 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-08-15 07:43 . 2010-09-03 16:42 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-08-15 07:43 . 2010-09-03 15:52 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-08-15 07:43 . 2010-09-03 16:42 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:41 . 2010-09-03 15:52 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2010-09-03 16:42 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-08-15 13:00 . 2010-09-03 16:09 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2010-08-15 13:00 . 2010-09-03 17:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2010-08-15 13:00 . 2010-09-03 17:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2010-08-15 13:00 . 2010-09-03 16:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2010-08-15 13:00 . 2010-09-03 17:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
- 2010-08-15 13:00 . 2010-09-03 16:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
+ 2010-08-15 07:56 . 2010-09-03 17:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-08-15 07:56 . 2010-09-03 16:39 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Steam"="c:\programme\Valve\Steam\Steam.exe" [2010-08-28 1242448]
"Search Advisor"="c:\program files\Search Advisor\adgui.exe" [2010-08-23 2562432]
"DS3 Tool"="c:\program files\MotioninJoy\ds3\DS3_Tool.exe" [2009-10-09 67584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\LCDMon.exe" [2007-04-26 774168]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
"Diamondback"="c:\program files\Razer\Diamondback 3G\razerhid.exe" [2007-08-01 147456]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-07-28 9398888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-03 98304]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-07-12 74752]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-07-13 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
" Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\users\Ceron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
R3 MotioninJoyUSBFilter;MotioninJoy USB Filter Driver;c:\windows\system32\DRIVERS\MijUfilt.sys [2009-10-03 17408]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-08-15 691696]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-04 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-04 6096384]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-04 214016]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-07-15 101904]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Free YouTube to Mp3 Converter - c:\users\Ceron\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
FF - ProfilePath - c:\users\Ceron\AppData\Roaming\Mozilla\Firefox\Profiles\k8kwbqpc.default\
FF - prefs.js: browser.search.selectedEngine - foxsearch
FF - prefs.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmieze.dll
---- FIREFOX Richtlinien ----
FF - user.js: browser.search.selectedEngine - foxsearch
FF - user.js: browser.search.order.1 - foxsearch
FF - user.js: browser.search.defaultenginename - foxsearch
FF - user.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - user.js: privacy.item.cookies - false
FF - user.js: privacy.sanitize.promptOnSanitize - false
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-09-03 19:24:25
ComboFix-quarantined-files.txt 2010-09-03 17:24
ComboFix2.txt 2010-09-03 16:47
Vor Suchlauf: 22 Verzeichnis(se), 328.389.365.760 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 328.337.715.200 Bytes frei
- - End Of File - - 4BBB45BFCBBEE9181CE4895B8F13F7E7
|
|
03.09.2010, 19:20
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer und sein EigenlebenCode:
ATTFilter 2010-09-03 15:53 . 2010-09-03 15:53 81408 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-09-03 15:53 . 2010-09-03 15:53 17408 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\drivers\MijUfilt.sys
2010-09-03 15:53 . 2010-09-03 15:53 398 ----a-w- c:\programdata\MotioninJoy\DS3tool\update.bat
2010-09-03 15:53 . 2010-09-03 15:53 24576 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\drivers\MijBThid.sys
Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus. Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen. Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.09.2010, 19:45
| #21 |
| | Internet Explorer und sein Eigenleben Ja habe ich Installiert ist ein Programm um Ps3 Controller am Pc zu nutzen GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-03 20:44:32
Windows 6.1.7600
Running: b4edo547.exe; Driver: C:\Users\Ceron\AppData\Local\Temp\kxdyqpow.sys
---- System - GMER 1.0.15 ----
INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C27AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C27104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C273F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C0F634
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C0F898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C271DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C27958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C276F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C27F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C281A8
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C87599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CABF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8EC2E000, 0x331A84, 0xE8000020]
.text peauth.sys 9A03CC9D 28 Bytes [4F, 90, 0D, 04, 03, 04, E6, ...]
.text peauth.sys 9A03CCC1 28 Bytes [4F, 90, 0D, 04, 03, 04, E6, ...]
? C:\Users\Ceron\AppData\Local\Temp\catchme.sys Das System kann die angegebene Datei nicht finden. !
? C:\Windows\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
? C:\Users\Ceron\AppData\Local\Temp\mbr.sys Das System kann die angegebene Datei nicht finden. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipAlloc] [743F2494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusStartup] [743D5624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusShutdown] [743D56E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipFree] [743F250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDeleteGraphics] [743E8573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDisposeImage] [743E4D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageWidth] [743E50CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageHeight] [743E51A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [743E66D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateFromHDC] [743E82CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetCompositingMode] [743E8819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetInterpolationMode] [743E907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDrawImageRectI] [743EE21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3520] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCloneImage] [743E4C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device \Driver\ACPI_HAL \Device\00000045 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x3C 0x01 0x58 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xCB 0x83 0xD8 0x33 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x25 0x19 0x87 0xE6 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x3C 0x01 0x58 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xCB 0x83 0xD8 0x33 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x25 0x19 0x87 0xE6 ...
---- EOF - GMER 1.0.15 ----
|
|
03.09.2010, 19:48
| #22 |
| | Internet Explorer und sein Eigenleben OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 20:48:09 on 03.09.2010 OS: Windows 7 Ultimate Edition (Build 7600), 32-bit Default Browser: Opera Software Opera Internet Browser 10.61 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( %SystemRoot%\system32 )----- "diamondback.cpl" - "Razer Inc." - C:\Windows\system32\diamondback.cpl "nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "lgLcdCpl" - "Logitech Inc." - C:\Program Files\Common Files\Logitech\LCD Manager\LgLcdCpl.cpl "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\Users\Ceron\AppData\Local\Temp\catchme.sys (File not found) "kxdyqpow" (kxdyqpow) - ? - C:\Users\Ceron\AppData\Local\Temp\kxdyqpow.sys (Hidden registry entry, rootkit activity | File not found) "LibUsb-Win32 - Kernel Driver, Version 0.1.10.1" (libusb0) - ? - C:\Windows\System32\drivers\libusb0.sys "mbr" (mbr) - ? - C:\Users\Ceron\AppData\Local\Temp\mbr.sys (Hidden registry entry, rootkit activity | File not found) "Memctl" (Memctl) - ? - C:\Program Files\U-ABIT\FlashMenu\Memctl.sys (File found, but it contains no detailed information) "MotioninJoy USB Filter Driver" (MotioninJoyUSBFilter) - "MotioninJoy" - C:\Windows\System32\DRIVERS\MijUfilt.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "WINFLASH" (WINFLASH) - ? - C:\Program Files\U-ABIT\FlashMenu\WinFlash.sys (File found, but it contains no detailed information) [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {EBDF1F20-C829-11D1-8233-0020AF3E97A9} "4shared_Desktop" - ? - (File not found | COM-object registry key not found) {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "Gutscheinmieze" - "Synatix GmbH" - C:\Users\Ceron\AppData\Roaming\Gutscheinmieze\toolbar.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10i.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} "Gutscheinmieze" - "Synatix GmbH" - C:\Users\Ceron\AppData\Roaming\Gutscheinmieze\toolbar.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {0FB6A909-6086-458F-BD92-1F8EE10042A0} "AC-Pro" - "SimplyGen" - C:\Program Files\AutocompletePro\AutocompletePro.dll {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Ceron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "OpenOffice.org 3.2.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe (Shortcut exists | File found, but it contains no detailed information | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun "DS3 Tool" - "www.motioninjoy.com" - C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe -mini "msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background "Search Advisor" - ? - C:\Program Files\Search Advisor\adgui.exe "Steam" - "Valve Corporation" - "C:\Programme\Valve\Steam\Steam.exe" -silent -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe "ATICustomerCare" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe" "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "Diamondback" - ? - C:\Program Files\Razer\Diamondback 3G\razerhid.exe "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" "Launch LCDMon" - "Logitech Inc." - "C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe" "Launch LGDCore" - "Logitech Inc." - "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE " Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript "QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime "StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" "WinampAgent" - "Nullsoft, Inc." - "C:\Program Files\Winamp\winampa.exe" [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
03.09.2010, 19:50
| #23 |
| | Internet Explorer und sein Eigenleben .\debug.cpp(238) : Debug log started at 03.09.2010 - 18:50:32 .\boot_cleaner.cpp(527) : Bootkit Remover .\boot_cleaner.cpp(528) : (c) 2009 eSage Lab .\boot_cleaner.cpp(529) : www.esagelab.com .\boot_cleaner.cpp(533) : Program version: 1.2.0.0 .\boot_cleaner.cpp(540) : OS Version: Microsoft Windows 7 Ultimate Edition (build 7600), 32-bit .\debug.cpp(248) : ********************************************** .\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] *********** .\debug.cpp(250) : ********************************************** .\debug.cpp(256) : 0x82c44000 0x00410000 "\SystemRoot\system32\ntkrnlpa.exe" .\debug.cpp(256) : 0x82c0d000 0x00037000 "\SystemRoot\system32\halmacpi.dll" .\debug.cpp(256) : 0x80ba6000 0x00008000 "\SystemRoot\system32\kdcom.dll" .\debug.cpp(256) : 0x83216000 0x00078000 "\SystemRoot\system32\mcupdate_GenuineIntel.dll" .\debug.cpp(256) : 0x8328e000 0x00011000 "\SystemRoot\system32\PSHED.dll" .\debug.cpp(256) : 0x8329f000 0x00008000 "\SystemRoot\system32\BOOTVID.dll" .\debug.cpp(256) : 0x832a7000 0x00042000 "\SystemRoot\system32\CLFS.SYS" .\debug.cpp(256) : 0x832e9000 0x000ab000 "\SystemRoot\system32\CI.dll" .\debug.cpp(256) : 0x88625000 0x00071000 "\SystemRoot\system32\drivers\Wdf01000.sys" .\debug.cpp(256) : 0x88696000 0x0000e000 "\SystemRoot\system32\drivers\WDFLDR.SYS" .\debug.cpp(256) : 0x886a4000 0x00048000 "\SystemRoot\system32\DRIVERS\ACPI.sys" .\debug.cpp(256) : 0x886ec000 0x00009000 "\SystemRoot\system32\DRIVERS\WMILIB.SYS" .\debug.cpp(256) : 0x886f5000 0x00008000 "\SystemRoot\system32\DRIVERS\msisadrv.sys" .\debug.cpp(256) : 0x886fd000 0x0000b000 "\SystemRoot\system32\DRIVERS\vdrvroot.sys" .\debug.cpp(256) : 0x88708000 0x0002a000 "\SystemRoot\system32\DRIVERS\pci.sys" .\debug.cpp(256) : 0x88732000 0x00011000 "\SystemRoot\System32\drivers\partmgr.sys" .\debug.cpp(256) : 0x88743000 0x00010000 "\SystemRoot\system32\DRIVERS\volmgr.sys" .\debug.cpp(256) : 0x88753000 0x0004b000 "\SystemRoot\System32\drivers\volmgrx.sys" .\debug.cpp(256) : 0x8879e000 0x00007000 "\SystemRoot\system32\DRIVERS\pciide.sys" .\debug.cpp(256) : 0x887a5000 0x0000e000 "\SystemRoot\system32\DRIVERS\PCIIDEX.SYS" .\debug.cpp(256) : 0x887b3000 0x00016000 "\SystemRoot\System32\drivers\mountmgr.sys" .\debug.cpp(256) : 0x887c9000 0x00009000 "\SystemRoot\system32\DRIVERS\atapi.sys" .\debug.cpp(256) : 0x887d2000 0x00023000 "\SystemRoot\system32\DRIVERS\ataport.SYS" .\debug.cpp(256) : 0x887f5000 0x00009000 "\SystemRoot\system32\DRIVERS\amdxata.sys" .\debug.cpp(256) : 0x83394000 0x00034000 "\SystemRoot\system32\drivers\fltmgr.sys" .\debug.cpp(256) : 0x88600000 0x00011000 "\SystemRoot\system32\drivers\fileinfo.sys" .\debug.cpp(256) : 0x88812000 0x0012f000 "\SystemRoot\System32\Drivers\Ntfs.sys" .\debug.cpp(256) : 0x88941000 0x0002b000 "\SystemRoot\System32\Drivers\msrpc.sys" .\debug.cpp(256) : 0x8896c000 0x00013000 "\SystemRoot\System32\Drivers\ksecdd.sys" .\debug.cpp(256) : 0x8897f000 0x0005d000 "\SystemRoot\System32\Drivers\cng.sys" .\debug.cpp(256) : 0x889dc000 0x0000e000 "\SystemRoot\System32\drivers\pcw.sys" .\debug.cpp(256) : 0x889ea000 0x00009000 "\SystemRoot\System32\Drivers\Fs_Rec.sys" .\debug.cpp(256) : 0x88a0c000 0x000b7000 "\SystemRoot\system32\drivers\ndis.sys" .\debug.cpp(256) : 0x88ac3000 0x0003e000 "\SystemRoot\system32\drivers\NETIO.SYS" .\debug.cpp(256) : 0x88b01000 0x00025000 "\SystemRoot\System32\Drivers\ksecpkg.sys" .\debug.cpp(256) : 0x88c2a000 0x00149000 "\SystemRoot\System32\drivers\tcpip.sys" .\debug.cpp(256) : 0x88d73000 0x00031000 "\SystemRoot\System32\drivers\fwpkclnt.sys" .\debug.cpp(256) : 0x88da4000 0x00009000 "\SystemRoot\system32\DRIVERS\vmstorfl.sys" .\debug.cpp(256) : 0x88dad000 0x0003f000 "\SystemRoot\system32\DRIVERS\volsnap.sys" .\debug.cpp(256) : 0x88dec000 0x00008000 "\SystemRoot\System32\Drivers\spldr.sys" .\debug.cpp(256) : 0x88b26000 0x0002d000 "\SystemRoot\System32\drivers\rdyboost.sys" .\debug.cpp(256) : 0x88c00000 0x00010000 "\SystemRoot\System32\Drivers\mup.sys" .\debug.cpp(256) : 0x88c10000 0x00008000 "\SystemRoot\System32\drivers\hwpolicy.sys" .\debug.cpp(256) : 0x88b53000 0x00032000 "\SystemRoot\System32\DRIVERS\fvevol.sys" .\debug.cpp(256) : 0x88c18000 0x00011000 "\SystemRoot\system32\DRIVERS\disk.sys" .\debug.cpp(256) : 0x88b85000 0x00025000 "\SystemRoot\system32\DRIVERS\CLASSPNP.SYS" .\debug.cpp(256) : 0x88bd1000 0x0001f000 "\SystemRoot\system32\DRIVERS\cdrom.sys" .\debug.cpp(256) : 0x88bf0000 0x00007000 "\SystemRoot\System32\Drivers\Null.SYS" .\debug.cpp(256) : 0x88bf7000 0x00007000 "\SystemRoot\System32\Drivers\Beep.SYS" .\debug.cpp(256) : 0x88a00000 0x0000c000 "\SystemRoot\System32\drivers\vga.sys" .\debug.cpp(256) : 0x833c8000 0x00021000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS" .\debug.cpp(256) : 0x889f3000 0x0000d000 "\SystemRoot\System32\drivers\watchdog.sys" .\debug.cpp(256) : 0x88800000 0x00008000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys" .\debug.cpp(256) : 0x88808000 0x00008000 "\SystemRoot\system32\drivers\rdpencdd.sys" .\debug.cpp(256) : 0x88611000 0x00008000 "\SystemRoot\system32\drivers\rdprefmp.sys" .\debug.cpp(256) : 0x88619000 0x0000b000 "\SystemRoot\System32\Drivers\Msfs.SYS" .\debug.cpp(256) : 0x833e9000 0x0000e000 "\SystemRoot\System32\Drivers\Npfs.SYS" .\debug.cpp(256) : 0x8e22e000 0x00017000 "\SystemRoot\system32\DRIVERS\tdx.sys" .\debug.cpp(256) : 0x8e245000 0x0000b000 "\SystemRoot\system32\DRIVERS\TDI.SYS" .\debug.cpp(256) : 0x8e250000 0x0005a000 "\SystemRoot\system32\drivers\afd.sys" .\debug.cpp(256) : 0x8e2aa000 0x00032000 "\SystemRoot\System32\DRIVERS\netbt.sys" .\debug.cpp(256) : 0x8e2dc000 0x00007000 "\SystemRoot\system32\DRIVERS\wfplwf.sys" .\debug.cpp(256) : 0x8e2e3000 0x0001f000 "\SystemRoot\system32\DRIVERS\pacer.sys" .\debug.cpp(256) : 0x8e302000 0x0000e000 "\SystemRoot\system32\DRIVERS\netbios.sys" .\debug.cpp(256) : 0x8e310000 0x00013000 "\SystemRoot\system32\DRIVERS\wanarp.sys" .\debug.cpp(256) : 0x8e323000 0x00010000 "\SystemRoot\system32\DRIVERS\termdd.sys" .\debug.cpp(256) : 0x8e333000 0x00006000 "\SystemRoot\system32\DRIVERS\ssmdrv.sys" .\debug.cpp(256) : 0x8e339000 0x00041000 "\SystemRoot\system32\DRIVERS\rdbss.sys" .\debug.cpp(256) : 0x8e37a000 0x0000a000 "\SystemRoot\system32\drivers\nsiproxy.sys" .\debug.cpp(256) : 0x8e384000 0x0000a000 "\SystemRoot\system32\DRIVERS\mssmbios.sys" .\debug.cpp(256) : 0x8e38e000 0x0000c000 "\SystemRoot\System32\drivers\discache.sys" .\debug.cpp(256) : 0x8e39a000 0x00064000 "\SystemRoot\system32\drivers\csc.sys" .\debug.cpp(256) : 0x8e200000 0x00018000 "\SystemRoot\System32\Drivers\dfsc.sys" .\debug.cpp(256) : 0x8e218000 0x0000e000 "\SystemRoot\system32\DRIVERS\blbdrive.sys" .\debug.cpp(256) : 0x8d205000 0x00022000 "\SystemRoot\system32\DRIVERS\avipbb.sys" .\debug.cpp(256) : 0x8d227000 0x00021000 "\SystemRoot\system32\DRIVERS\tunnel.sys" .\debug.cpp(256) : 0x8d248000 0x00012000 "\SystemRoot\system32\DRIVERS\intelppm.sys" .\debug.cpp(256) : 0x8d25a000 0x0000b000 "\SystemRoot\system32\DRIVERS\fdc.sys" .\debug.cpp(256) : 0x8d265000 0x0000a000 "\SystemRoot\system32\DRIVERS\usbohci.sys" .\debug.cpp(256) : 0x8d26f000 0x0004b000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS" .\debug.cpp(256) : 0x8d2ba000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbehci.sys" .\debug.cpp(256) : 0x8d2c9000 0x00006000 "\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys" .\debug.cpp(256) : 0x8d2cf000 0x0001f000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys" .\debug.cpp(256) : 0x8d2ee000 0x00039000 "\SystemRoot\system32\DRIVERS\atikmpag.sys" .\debug.cpp(256) : 0x8ec2d000 0x00620000 "\SystemRoot\system32\DRIVERS\atikmdag.sys" .\debug.cpp(256) : 0x8f24d000 0x000b7000 "\SystemRoot\System32\drivers\dxgkrnl.sys" .\debug.cpp(256) : 0x8f304000 0x00039000 "\SystemRoot\System32\drivers\dxgmms1.sys" .\debug.cpp(256) : 0x92a01000 0x000fc000 "\SystemRoot\system32\DRIVERS\nvmfdx32.sys" .\debug.cpp(256) : 0x9323e000 0x00911000 "\SystemRoot\system32\DRIVERS\nvlddmkm.sys" .\debug.cpp(256) : 0x93b4f000 0x00002000 "\SystemRoot\system32\DRIVERS\nvBridge.kmd" .\debug.cpp(256) : 0x93b51000 0x00009000 "\SystemRoot\system32\DRIVERS\wmiacpi.sys" .\debug.cpp(256) : 0x93b5a000 0x0000d000 "\SystemRoot\system32\DRIVERS\CompositeBus.sys" .\debug.cpp(256) : 0x93b67000 0x00012000 "\SystemRoot\system32\DRIVERS\AgileVpn.sys" .\debug.cpp(256) : 0x93b79000 0x00018000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys" .\debug.cpp(256) : 0x93b91000 0x0000b000 "\SystemRoot\system32\DRIVERS\ndistapi.sys" .\debug.cpp(256) : 0x93b9c000 0x00022000 "\SystemRoot\system32\DRIVERS\ndiswan.sys" .\debug.cpp(256) : 0x93bbe000 0x00018000 "\SystemRoot\system32\DRIVERS\raspppoe.sys" .\debug.cpp(256) : 0x93bd6000 0x00017000 "\SystemRoot\system32\DRIVERS\raspptp.sys" .\debug.cpp(256) : 0x93200000 0x00017000 "\SystemRoot\system32\DRIVERS\rassstp.sys" .\debug.cpp(256) : 0x93217000 0x0000a000 "\SystemRoot\system32\DRIVERS\rdpbus.sys" .\debug.cpp(256) : 0x93221000 0x0000d000 "\SystemRoot\system32\DRIVERS\kbdclass.sys" .\debug.cpp(256) : 0x9322e000 0x0000d000 "\SystemRoot\system32\DRIVERS\mouclass.sys" .\debug.cpp(256) : 0x9323b000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys" .\debug.cpp(256) : 0x92afd000 0x00034000 "\SystemRoot\system32\DRIVERS\ks.sys" .\debug.cpp(256) : 0x93bed000 0x0000e000 "\SystemRoot\system32\DRIVERS\umbus.sys" .\debug.cpp(256) : 0x92b31000 0x00044000 "\SystemRoot\system32\DRIVERS\usbhub.sys" .\debug.cpp(256) : 0x92b75000 0x00011000 "\SystemRoot\System32\Drivers\NDProxy.SYS" .\debug.cpp(256) : 0x94e14000 0x00301000 "\SystemRoot\system32\drivers\RTKVHDA.sys" .\debug.cpp(256) : 0x95115000 0x0002f000 "\SystemRoot\system32\drivers\portcls.sys" .\debug.cpp(256) : 0x95144000 0x00019000 "\SystemRoot\system32\drivers\drmk.sys" .\debug.cpp(256) : 0x9515d000 0x0001d000 "\SystemRoot\system32\drivers\AtihdW73.sys" .\debug.cpp(256) : 0x952c0000 0x0024a000 "\SystemRoot\System32\win32k.sys" .\debug.cpp(256) : 0x9517a000 0x0000a000 "\SystemRoot\System32\drivers\Dxapi.sys" .\debug.cpp(256) : 0x95184000 0x00017000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS" .\debug.cpp(256) : 0x9519b000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS" .\debug.cpp(256) : 0x9519d000 0x0000b000 "\SystemRoot\system32\DRIVERS\monitor.sys" .\debug.cpp(256) : 0x951a8000 0x0000b000 "\SystemRoot\system32\DRIVERS\hidusb.sys" .\debug.cpp(256) : 0x951b3000 0x00013000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS" .\debug.cpp(256) : 0x951c6000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS" .\debug.cpp(256) : 0x951cd000 0x0000b000 "\SystemRoot\system32\DRIVERS\mouhid.sys" .\debug.cpp(256) : 0x95520000 0x00009000 "\SystemRoot\System32\TSDDD.dll" .\debug.cpp(256) : 0x95550000 0x0001e000 "\SystemRoot\System32\cdd.dll" .\debug.cpp(256) : 0x951d8000 0x00017000 "\SystemRoot\system32\DRIVERS\usbccgp.sys" .\debug.cpp(256) : 0x951ef000 0x0000c000 "\SystemRoot\system32\DRIVERS\kbdhid.sys" .\debug.cpp(256) : 0x92b86000 0x0001b000 "\SystemRoot\system32\drivers\luafv.sys" .\debug.cpp(256) : 0x92ba1000 0x00015000 "\SystemRoot\system32\DRIVERS\avgntflt.sys" .\debug.cpp(256) : 0x92bb6000 0x0001a000 "\SystemRoot\system32\drivers\WudfPf.sys" .\debug.cpp(256) : 0x94e00000 0x00010000 "\SystemRoot\system32\DRIVERS\lltdio.sys" .\debug.cpp(256) : 0x92bd0000 0x00013000 "\SystemRoot\system32\DRIVERS\rspndr.sys" .\debug.cpp(256) : 0x8f33d000 0x00085000 "\SystemRoot\system32\drivers\HTTP.sys" .\debug.cpp(256) : 0x8d327000 0x00040000 "\SystemRoot\system32\DRIVERS\udfs.sys" .\debug.cpp(256) : 0x92be3000 0x00019000 "\SystemRoot\system32\DRIVERS\bowser.sys" .\debug.cpp(256) : 0x8f3c2000 0x00012000 "\SystemRoot\System32\drivers\mpsdrv.sys" .\debug.cpp(256) : 0x8f3d4000 0x00023000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys" .\debug.cpp(256) : 0x8d367000 0x0003b000 "\SystemRoot\system32\DRIVERS\mrxsmb10.sys" .\debug.cpp(256) : 0x8ec00000 0x0001b000 "\SystemRoot\system32\DRIVERS\mrxsmb20.sys" .\debug.cpp(256) : 0x9a037000 0x00097000 "\SystemRoot\system32\drivers\peauth.sys" .\debug.cpp(256) : 0x9a0ce000 0x0000a000 "\SystemRoot\System32\Drivers\secdrv.SYS" .\debug.cpp(256) : 0x9a0d8000 0x00021000 "\SystemRoot\System32\DRIVERS\srvnet.sys" .\debug.cpp(256) : 0x9a0f9000 0x0000d000 "\SystemRoot\System32\drivers\tcpipreg.sys" .\debug.cpp(256) : 0x9a170000 0x0004f000 "\SystemRoot\System32\DRIVERS\srv2.sys" .\debug.cpp(256) : 0x8d3a2000 0x00051000 "\SystemRoot\System32\DRIVERS\srv.sys" .\debug.cpp(256) : 0x9a1bf000 0x00016000 "\SystemRoot\system32\DRIVERS\cdfs.sys" .\debug.cpp(256) : 0x9a1d5000 0x0000d000 "\SystemRoot\System32\Drivers\crashdmp.sys" .\debug.cpp(256) : 0x9a1e2000 0x0000b000 "\SystemRoot\System32\Drivers\dump_dumpata.sys" .\debug.cpp(256) : 0x9a1ed000 0x00009000 "\SystemRoot\System32\Drivers\dump_atapi.sys" .\debug.cpp(256) : 0x9a000000 0x00011000 "\SystemRoot\System32\Drivers\dump_dumpfve.sys" .\debug.cpp(256) : 0x9a011000 0x00008000 "\??\C:\Users\Ceron\AppData\Local\Temp\catchme.sys" .\debug.cpp(256) : 0x9a019000 0x00002000 "\??\C:\Windows\system32\Drivers\PROCEXP113.SYS" .\debug.cpp(256) : 0x9a01b000 0x00006000 "\??\C:\Users\Ceron\AppData\Local\Temp\mbr.sys" .\debug.cpp(256) : 0x9a106000 0x00017000 "\??\C:\Users\Ceron\AppData\Local\Temp\kxdyqpow.sys" .\debug.cpp(256) : 0x77510000 0x0013c000 "\Windows\System32\ntdll.dll" .\debug.cpp(256) : 0x48390000 0x00013000 "\Windows\System32\smss.exe" .\debug.cpp(256) : 0x77750000 0x00050000 "\Windows\System32\apisetschema.dll" .\debug.cpp(256) : 0x00f80000 0x000a6000 "\Windows\System32\autochk.exe" .\debug.cpp(256) : 0x77700000 0x00035000 "\Windows\System32\ws2_32.dll" .\debug.cpp(256) : 0x77670000 0x00083000 "\Windows\System32\clbcatq.dll" .\debug.cpp(256) : 0x77470000 0x000a0000 "\Windows\System32\advapi32.dll" .\debug.cpp(256) : 0x773d0000 0x0009d000 "\Windows\System32\usp10.dll" .\debug.cpp(256) : 0x77660000 0x00005000 "\Windows\System32\psapi.dll" .\debug.cpp(256) : 0x772d0000 0x000f4000 "\Windows\System32\wininet.dll" .\debug.cpp(256) : 0x77220000 0x000a1000 "\Windows\System32\rpcrt4.dll" .\debug.cpp(256) : 0x77080000 0x0019d000 "\Windows\System32\setupapi.dll" .\debug.cpp(256) : 0x76fd0000 0x000ac000 "\Windows\System32\msvcrt.dll" .\debug.cpp(256) : 0x76380000 0x00c49000 "\Windows\System32\shell32.dll" .\debug.cpp(256) : 0x76330000 0x0004e000 "\Windows\System32\gdi32.dll" .\debug.cpp(256) : 0x76260000 0x000cc000 "\Windows\System32\msctf.dll" .\debug.cpp(256) : 0x76190000 0x000c9000 "\Windows\System32\user32.dll" .\debug.cpp(256) : 0x77650000 0x0000a000 "\Windows\System32\lpk.dll" .\debug.cpp(256) : 0x76110000 0x0007b000 "\Windows\System32\comdlg32.dll" .\debug.cpp(256) : 0x760c0000 0x00045000 "\Windows\System32\Wldap32.dll" .\debug.cpp(256) : 0x75ec0000 0x001f9000 "\Windows\System32\iertutil.dll" .\debug.cpp(256) : 0x75d60000 0x0015c000 "\Windows\System32\ole32.dll" .\debug.cpp(256) : 0x75c80000 0x000d4000 "\Windows\System32\kernel32.dll" .\debug.cpp(256) : 0x75c70000 0x00003000 "\Windows\System32\normaliz.dll" .\debug.cpp(256) : 0x75c10000 0x00057000 "\Windows\System32\shlwapi.dll" .\debug.cpp(256) : 0x75ad0000 0x00135000 "\Windows\System32\urlmon.dll" .\debug.cpp(256) : 0x75ac0000 0x00006000 "\Windows\System32\nsi.dll" .\debug.cpp(256) : 0x75a30000 0x0008f000 "\Windows\System32\oleaut32.dll" .\debug.cpp(256) : 0x75a10000 0x00019000 "\Windows\System32\sechost.dll" .\debug.cpp(256) : 0x759e0000 0x0002a000 "\Windows\System32\imagehlp.dll" .\debug.cpp(256) : 0x759c0000 0x0001f000 "\Windows\System32\imm32.dll" .\debug.cpp(256) : 0x75960000 0x00052000 "\Windows\System32\difxapi.dll" .\debug.cpp(256) : 0x75940000 0x00012000 "\Windows\System32\devobj.dll" .\debug.cpp(256) : 0x75910000 0x0002d000 "\Windows\System32\wintrust.dll" .\debug.cpp(256) : 0x757f0000 0x0011c000 "\Windows\System32\crypt32.dll" .\debug.cpp(256) : 0x757a0000 0x0004a000 "\Windows\System32\KernelBase.dll" .\debug.cpp(256) : 0x75710000 0x00084000 "\Windows\System32\comctl32.dll" .\debug.cpp(256) : 0x756e0000 0x00027000 "\Windows\System32\cfgmgr32.dll" .\debug.cpp(256) : 0x756d0000 0x0000c000 "\Windows\System32\msasn1.dll" .\debug.cpp(263) : ********************************************** .\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] *********** .\debug.cpp(308) : ********************************************** .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{348dd5ed-a88a-11df-8938-806e6f6e6963}" .\debug.cpp(400) : Destination "\Device\HarddiskVolume2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1" .\debug.cpp(400) : Destination "\Device\Video0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3:" .\debug.cpp(400) : Destination "\Device\Ide\IdePort3" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000001" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\0000003a" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WUDFLpcDevice" .\debug.cpp(400) : Destination "\Device\WUDFLpcDevice" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS" .\debug.cpp(400) : Destination "\Device\Ndis" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:" .\debug.cpp(400) : Destination "\Device\CdRom0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2" .\debug.cpp(400) : Destination "\Device\Video1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AgileVPN" .\debug.cpp(400) : Destination "\Device\AgileVPN" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TEREDO#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000002" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000038" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\0000003b" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C221&MI_00#8&1df75866&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination "\Device\00000068" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_1532&PID_000D#6&36e9060d&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination "\Device\00000064" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy1" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3" .\debug.cpp(400) : Destination "\Device\Video2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:" .\debug.cpp(400) : Destination "\Device\HarddiskVolume2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIAdminDevice" .\debug.cpp(400) : Destination "\Device\WMIAdminDevice" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&1c7c9621&0&1#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\PciIde0Channel1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy2" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000039" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4" .\debug.cpp(400) : Destination "\Device\Video3" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#VSC7B21#5&3b1c8cea&0&UID512#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}" .\debug.cpp(400) : Destination "\Device\00000063" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VolMgrControl" .\debug.cpp(400) : Destination "\Device\VolMgrControl" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&22b08d29&0&1#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\PciIde1Channel1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy3" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy3" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{33CC635F-7AE9-435B-9205-90F629210582}" .\debug.cpp(400) : Destination "\Device\NDMP3" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{636FF46E-80FE-4314-BC84-DC7749EDE5B4}" .\debug.cpp(400) : Destination "\Device\NDMP4" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3112090d&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\0000005e" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY5" .\debug.cpp(400) : Destination "\Device\Video4" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ProcessManagement" .\debug.cpp(400) : Destination "\Device\ProcessManagement" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy4" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy4" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_07DC&SUBSYS_1C3E147B&REV_A2#3&2411e6fe&1&78#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0021" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY6" .\debug.cpp(400) : Destination "\Device\Video5" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#VSC7B21#5&3b1c8cea&0&UID512#{866519b5-3f07-4c97-b7df-24c5d8a8ccb8}" .\debug.cpp(400) : Destination "\Device\00000063" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_046D&PID_C222#6&34e5a00f&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination "\Device\USBPDO-6" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy5" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy5" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&187cc709&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination "\Device\USBPDO-1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY7" .\debug.cpp(400) : Destination "\Device\Video6" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C222&Col01#7&32504373&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination "\Device\0000006b" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy6" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy6" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_AGILEVPNMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000036" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY8" .\debug.cpp(400) : Destination "\Device\Video7" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SPDevice" .\debug.cpp(400) : Destination "\Device\SPDevice" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\TeredoTun" .\debug.cpp(400) : Destination "\Device\TeredoTun" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice" .\debug.cpp(400) : Destination "\Device\WMIDataDevice" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy7" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy7" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PEAuth" .\debug.cpp(400) : Destination "\Device\PEAuth" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgntflt" .\debug.cpp(400) : Destination "\FileSystem\Filters\avgntflt" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE" .\debug.cpp(400) : Destination "\Device\NamedPipe" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy8" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy8" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk0Partition1" .\debug.cpp(400) : Destination "\Device\HarddiskVolume1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy9" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy9" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Psched" .\debug.cpp(400) : Destination "\Device\Psched" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice" .\debug.cpp(400) : Destination "\Device\GEARAspiWDMDevice" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_07FE&SUBSYS_1C3E147B&REV_A1#3&2411e6fe&1&20#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0014" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC" .\debug.cpp(400) : Destination "\Device\Mup" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp" .\debug.cpp(400) : Destination "\Device\Tcp" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TEREDO#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\00000002" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_07DC&SUBSYS_1C3E147B&REV_A2#3&2411e6fe&1&78#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0021" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{C0DE3E38-8BA7-479F-8B75-833F294C5AA8}" .\debug.cpp(400) : Destination "\Device\NDMP10" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_1532&PID_000D#5&2e2a4dc0&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination "\Device\USBPDO-3" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_046D&PID_C221#6&34e5a00f&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination "\Device\USBPDO-5" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg" .\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0" .\debug.cpp(400) : Destination "\Device\USBFDO-0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#vdrvroot#0000#{2e34d650-5819-42ca-84ae-d30803bae505}" .\debug.cpp(400) : Destination "\Device\00000043" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1" .\debug.cpp(400) : Destination "\Device\USBFDO-1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\kxdyqpow" .\debug.cpp(400) : Destination "\Device\kxdyqpow" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomHL-DT-ST_DVD-RAM_GSA-H58N_______________1.00____#5&3a8ce30c&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T0L0-0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0" .\debug.cpp(400) : Destination "\Device\Harddisk0\DR0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&1#{4afa3d53-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination "\Device\0000004d" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume1" .\debug.cpp(400) : Destination "\Device\HarddiskVolume1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN" .\debug.cpp(400) : Destination "\DosDevices\LPT1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{0336AA4E-8EB0-4477-9EBE-7340CD83FBD1}" .\debug.cpp(400) : Destination "\Device\NDMP2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C221&MI_01&Col02#8&5dfe55c&0&0001#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination "\Device\0000006a" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&1c7c9621&0&0#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\PciIde0Channel0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap" .\debug.cpp(400) : Destination "\Device\FsWrap" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume2" .\debug.cpp(400) : Destination "\Device\HarddiskVolume2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDOSPDevice" .\debug.cpp(400) : Destination "\Device\IPSECDOSP" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#UMBUS#0000#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination "\Device\00000042" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1" .\debug.cpp(400) : Destination "\Device\Harddisk1\DR1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0" .\debug.cpp(400) : Destination "\Device\CdRom0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1002&DEV_9588&SUBSYS_22371787&REV_00#4&1616f558&0&0058#{1ca05180-a699-450a-9a0c-de4fbe3ddd89}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0023" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#volmgr#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\00000044" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\0000003c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_046D&PID_C223#5&2e2a4dc0&0&3#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination "\Device\USBPDO-4" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3112090d&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\0000005e" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\00000038" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global" .\debug.cpp(400) : Destination "\GLOBAL??" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\0000003d" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{86841137-ed8e-4d97-9975-f2ed56b4430e}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LOG:" .\debug.cpp(400) : Destination "\clfs" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_07E3&SUBSYS_1C3E147B&REV_A2#3&2411e6fe&1&80#{1ca05180-a699-450a-9a0c-de4fbe3ddd89}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0022" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THRM#{4afa3d51-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination "\Device\0000004c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy10" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy10" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\00000001" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_1E68&PID_001B#2008102418B4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination "\Device\USBPDO-2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_07E3&SUBSYS_1C3E147B&REV_A2#3&2411e6fe&1&80#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0022" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C221&MI_00#8&1df75866&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination "\Device\00000068" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Secdrv" .\debug.cpp(400) : Destination "\Device\Secdrv" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy11" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy11" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy12" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy12" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy13" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy13" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\0000003b" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E28D896F-9EA8-433A-9C10-66C97C19A921}" .\debug.cpp(400) : Destination "\Device\NDMP11" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\catchme" .\debug.cpp(400) : Destination "\Device\catchme" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy14" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy14" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\0000003d" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager" .\debug.cpp(400) : Destination "\Device\MountPointManager" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ssmctl" .\debug.cpp(400) : Destination "\Device\ssmctl" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{9F9A0B32-0FC4-4D6F-B929-2A9627CCFB47}" .\debug.cpp(400) : Destination "\Device\NDMP1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000037" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\00000039" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3112090d&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination "\Device\0000005e" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy15" .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy15" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{348dd5e5-a88a-11df-8938-806e6f6e6963}" .\debug.cpp(400) : Destination "\Device\CdRom0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PartmgrControl" .\debug.cpp(400) : Destination "\Device\PartmgrControl" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp" .\debug.cpp(400) : Destination "\Device\WANARP" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Nsi" .\debug.cpp(400) : Destination "\Device\Nsi" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&22b08d29&0&0#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\PciIde1Channel0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{483C9FF8-503D-414B-B402-E4C1F1F568CB}" .\debug.cpp(400) : Destination "\Device\NDMP5" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\00000037" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk1Partition1" .\debug.cpp(400) : Destination "\Device\HarddiskVolume2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C222&Col01#7&32504373&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination "\Device\0000006b" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NXTIPSECDevice" .\debug.cpp(400) : Destination "\Device\NXTIPSEC" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_TrekStor&Prod__DS_maxi_g.u&Rev_#2008102418B4&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\00000061" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP" .\debug.cpp(400) : Destination "\Device\NDMP7" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WFPDev" .\debug.cpp(400) : Destination "\Device\WFP" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomHL-DT-ST_DVD-RAM_GSA-H58N_______________1.00____#5&3a8ce30c&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T0L0-0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskSAMSUNG_HD501LJ_________________________CR100-12#5&37173061&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP2T0L0-3" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&1#{4afa3d53-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination "\Device\00000048" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArpV6" .\debug.cpp(400) : Destination "\Device\WANARPV6" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:" .\debug.cpp(400) : Destination "\Device\Ide\IdePort0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3112090d&0&0001#{dba43692-ad00-48aa-b1a7-ffa99a04ee17}" .\debug.cpp(400) : Destination "\Device\0000005e" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_056A&SUBSYS_1C3E147B&REV_A1#3&2411e6fe&1&21#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&621454f&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination "\Device\USBPDO-0" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3112090d&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}" .\debug.cpp(400) : Destination "\Device\0000005e" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&PrinterBusEnumerator#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination "\Device\0000006d" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C221&MI_01&Col01#8&5dfe55c&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination "\Device\00000069" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_AGILEVPNMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination "\Device\00000036" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\0000003c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}" .\debug.cpp(400) : Destination "\Device\00000041" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_x86_Family_6_Model_15_-_Intel(R)_Core(TM)2_Duo_CPU_____E6550__@_2.33GHz#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}" .\debug.cpp(400) : Destination "\Device\00000046" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:" .\debug.cpp(400) : Destination "\Device\Ide\IdePort1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANBH" .\debug.cpp(400) : Destination "\Device\NDMP6" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan" .\debug.cpp(400) : Destination "\Device\NdisWan" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AscKmd" .\debug.cpp(400) : Destination "\Device\AscKmd" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_1532&PID_000D#6&36e9060d&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination "\Device\00000064" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MpsDevice" .\debug.cpp(400) : Destination "\Device\MPS" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl" .\debug.cpp(400) : Destination "\Device\VolMgrControl" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0662&SUBSYS_147B0000&REV_1001#4&3846030&0&0001#{9ff3b516-cd99-4eaf-8373-f2caf87ed26b}" .\debug.cpp(400) : Destination "\Device\0000005c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1002&DEV_9588&SUBSYS_22371787&REV_00#4&1616f558&0&0058#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}" .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0023" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr" .\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:" .\debug.cpp(400) : Destination "\Device\HarddiskVolume1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX" .\debug.cpp(400) : Destination "\DosDevices\COM1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIPV6" .\debug.cpp(400) : Destination "\Device\NDMP8" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{DB2B4279-B5CF-4626-9DBA-32D0ECE44C87}" .\debug.cpp(400) : Destination "\Device\NDMP9" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\mbr" .\debug.cpp(400) : Destination "\Device\mbr" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT" .\debug.cpp(400) : Destination "\Device\MailSlot" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#{348dd5ea-a88a-11df-8938-806e6f6e6963}#0000000000007E00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\HarddiskVolume2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VDRVROOT" .\debug.cpp(400) : Destination "\Device\00000043" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2:" .\debug.cpp(400) : Destination "\Device\Ide\IdePort2" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SstpDrv" .\debug.cpp(400) : Destination "\Device\SstpDrv" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination "\Device\00000040" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL" .\debug.cpp(400) : Destination "\Device\Null" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT" .\debug.cpp(400) : Destination "" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_046D&PID_C222&Col02#7&32504373&0&0001#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination "\Device\0000006c" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#{348dd5e0-a88a-11df-8938-806e6f6e6963}#0000000000007E00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination "\Device\HarddiskVolume1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_x86_Family_6_Model_15_-_Intel(R)_Core(TM)2_Duo_CPU_____E6550__@_2.33GHz#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0}" .\debug.cpp(400) : Destination "\Device\00000047" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination "\Device\0000003f" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WfpAle" .\debug.cpp(400) : Destination "\Device\WfpAle" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{348dd5e2-a88a-11df-8938-806e6f6e6963}" .\debug.cpp(400) : Destination "\Device\HarddiskVolume1" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination "\Device\0000003a" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3112090d&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}" .\debug.cpp(400) : Destination "\Device\0000005e" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avipbb" .\debug.cpp(400) : Destination "\Device\avipbb" .\debug.cpp(409) : -- .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PROCEXP113" .\debug.cpp(400) : Destination "\Device\PROCEXP113" .\debug.cpp(409) : -- .\debug.cpp(453) : ********************************************** .\boot_cleaner.cpp(565) : System volume is \\.\C: .\boot_cleaner.cpp(673) : main(): CreateFile() ERROR 5 .\boot_cleaner.cpp(674) : ERROR: Can't open volume device \\.\C: .\boot_cleaner.cpp(1151) : Done; |
|
03.09.2010, 19:53
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer und sein Eigenleben Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.09.2010, 14:26
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer und sein Eigenleben Log ist unvollständig. Der untere und entscheidende Teil fehlt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.09.2010, 15:45
| #26 |
| | Internet Explorer und sein Eigenleben MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows 7 Ultimate Edition Windows Information: (build 7600), 32-bit Base Board Manufacturer: hxxp://www.abit.com.tw/ BIOS Manufacturer: Phoenix Technologies, LTD System Manufacturer: Manufacter System Product Name: Product Logical Drives Mask: 0x0000001c Kernel Drivers (total 187): 0x82C40000 \SystemRoot\system32\ntkrnlpa.exe 0x82C09000 \SystemRoot\system32\halmacpi.dll 0x80BC6000 \SystemRoot\system32\kdcom.dll 0x83219000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x83291000 \SystemRoot\system32\PSHED.dll 0x832A2000 \SystemRoot\system32\BOOTVID.dll 0x832AA000 \SystemRoot\system32\CLFS.SYS 0x832EC000 \SystemRoot\system32\CI.dll 0x8862D000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8869E000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x886AC000 \SystemRoot\system32\DRIVERS\ACPI.sys 0x886F4000 \SystemRoot\system32\DRIVERS\WMILIB.SYS 0x886FD000 \SystemRoot\system32\DRIVERS\msisadrv.sys 0x88705000 \SystemRoot\system32\DRIVERS\vdrvroot.sys 0x88710000 \SystemRoot\system32\DRIVERS\pci.sys 0x8873A000 \SystemRoot\System32\drivers\partmgr.sys 0x8874B000 \SystemRoot\system32\DRIVERS\volmgr.sys 0x8875B000 \SystemRoot\System32\drivers\volmgrx.sys 0x887A6000 \SystemRoot\system32\DRIVERS\pciide.sys 0x887AD000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS 0x887BB000 \SystemRoot\System32\drivers\mountmgr.sys 0x887D1000 \SystemRoot\system32\DRIVERS\atapi.sys 0x887DA000 \SystemRoot\system32\DRIVERS\ataport.SYS 0x88600000 \SystemRoot\system32\DRIVERS\amdxata.sys 0x83397000 \SystemRoot\system32\drivers\fltmgr.sys 0x88609000 \SystemRoot\system32\drivers\fileinfo.sys 0x8883C000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8896B000 \SystemRoot\System32\Drivers\msrpc.sys 0x88996000 \SystemRoot\System32\Drivers\ksecdd.sys 0x88A09000 \SystemRoot\System32\Drivers\cng.sys 0x88A66000 \SystemRoot\System32\drivers\pcw.sys 0x88A74000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x88A7D000 \SystemRoot\system32\drivers\ndis.sys 0x88B34000 \SystemRoot\system32\drivers\NETIO.SYS 0x88B72000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x88C0A000 \SystemRoot\System32\drivers\tcpip.sys 0x88D53000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x88D84000 \SystemRoot\system32\DRIVERS\vmstorfl.sys 0x88D8D000 \SystemRoot\system32\DRIVERS\volsnap.sys 0x88DCC000 \SystemRoot\System32\Drivers\spldr.sys 0x88B97000 \SystemRoot\System32\drivers\rdyboost.sys 0x88DD4000 \SystemRoot\System32\Drivers\mup.sys 0x88DE4000 \SystemRoot\System32\drivers\hwpolicy.sys 0x88BC4000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x88DEC000 \SystemRoot\system32\DRIVERS\disk.sys 0x889A9000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x88800000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x88BF6000 \SystemRoot\System32\Drivers\Null.SYS 0x88A00000 \SystemRoot\System32\Drivers\Beep.SYS 0x8881F000 \SystemRoot\System32\drivers\vga.sys 0x833CB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8882B000 \SystemRoot\System32\drivers\watchdog.sys 0x889F7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x8861A000 \SystemRoot\system32\drivers\rdpencdd.sys 0x88622000 \SystemRoot\system32\drivers\rdprefmp.sys 0x833EC000 \SystemRoot\System32\Drivers\Msfs.SYS 0x83200000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8E00F000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8E026000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8E031000 \SystemRoot\system32\drivers\afd.sys 0x8E08B000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8E0BD000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x8E0C4000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8E0E3000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8E0F1000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x8E104000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8E114000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0x8E11A000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8E15B000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8E165000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8E16F000 \SystemRoot\System32\drivers\discache.sys 0x8E17B000 \SystemRoot\system32\drivers\csc.sys 0x8E1DF000 \SystemRoot\System32\Drivers\dfsc.sys 0x8E000000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x8D838000 \SystemRoot\system32\DRIVERS\avipbb.sys 0x8D85A000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8D87B000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x8D88D000 \SystemRoot\system32\DRIVERS\fdc.sys 0x8D898000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x8D8A2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8D8ED000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x8D8FC000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x8D902000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8D921000 \SystemRoot\system32\DRIVERS\atikmpag.sys 0x8EC25000 \SystemRoot\system32\DRIVERS\atikmdag.sys 0x8F245000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8F2FC000 \SystemRoot\System32\drivers\dxgmms1.sys 0x8E832000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys 0x8FA1F000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x90330000 \SystemRoot\system32\DRIVERS\nvBridge.kmd 0x90332000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x9033B000 \SystemRoot\system32\DRIVERS\CompositeBus.sys 0x90348000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x9035A000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x90372000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x9037D000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x9039F000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x903B7000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x903CE000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x903E5000 \SystemRoot\system32\DRIVERS\rdpbus.sys 0x903EF000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x8FA00000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8FA0D000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8E92E000 \SystemRoot\system32\DRIVERS\ks.sys 0x8FA0F000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8E962000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8E9A6000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x8223C000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x8253D000 \SystemRoot\system32\drivers\portcls.sys 0x8256C000 \SystemRoot\system32\drivers\drmk.sys 0x82585000 \SystemRoot\system32\drivers\AtihdW73.sys 0x826F0000 \SystemRoot\System32\win32k.sys 0x825A2000 \SystemRoot\System32\drivers\Dxapi.sys 0x825AC000 \SystemRoot\System32\Drivers\crashdmp.sys 0x825B9000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x825C4000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x825CD000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x825DE000 \SystemRoot\system32\DRIVERS\MijUfilt.sys 0x825E8000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x82200000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x82213000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x8221A000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x8221C000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x82227000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x8E9B7000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0x825F3000 \SystemRoot\system32\DRIVERS\monitor.sys 0x82950000 \SystemRoot\System32\TSDDD.dll 0x82980000 \SystemRoot\System32\cdd.dll 0x8E9CE000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x8E9E5000 \SystemRoot\system32\drivers\luafv.sys 0x8E800000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0x8E815000 \SystemRoot\system32\drivers\WudfPf.sys 0x8F335000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x8F345000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x8F358000 \SystemRoot\system32\drivers\HTTP.sys 0x8F3DD000 \SystemRoot\system32\DRIVERS\bowser.sys 0x8EC00000 \SystemRoot\System32\drivers\mpsdrv.sys 0x8D95A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x8D97D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x8D9B8000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x9AE36000 \SystemRoot\system32\drivers\peauth.sys 0x9AECD000 \SystemRoot\System32\Drivers\secdrv.SYS 0x9AED7000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x9AEF8000 \SystemRoot\System32\drivers\tcpipreg.sys 0x9AF6F000 \SystemRoot\System32\DRIVERS\srv2.sys 0x9B630000 \SystemRoot\System32\DRIVERS\srv.sys 0x9B681000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x9B697000 \SystemRoot\system32\DRIVERS\udfs.sys 0x77CE0000 \Windows\System32\ntdll.dll 0x47AC0000 \Windows\System32\smss.exe 0x77F20000 \Windows\System32\apisetschema.dll 0x00C60000 \Windows\System32\autochk.exe 0x77F00000 \Windows\System32\normaliz.dll 0x77EF0000 \Windows\System32\psapi.dll 0x77EE0000 \Windows\System32\lpk.dll 0x77E80000 \Windows\System32\difxapi.dll 0x77B80000 \Windows\System32\ole32.dll 0x77AB0000 \Windows\System32\user32.dll 0x77A20000 \Windows\System32\clbcatq.dll 0x77E50000 \Windows\System32\imagehlp.dll 0x779A0000 \Windows\System32\comdlg32.dll 0x77900000 \Windows\System32\usp10.dll 0x77760000 \Windows\System32\setupapi.dll 0x77720000 \Windows\System32\ws2_32.dll 0x77670000 \Windows\System32\msvcrt.dll 0x77590000 \Windows\System32\kernel32.dll 0x77E30000 \Windows\System32\sechost.dll 0x77450000 \Windows\System32\urlmon.dll 0x77380000 \Windows\System32\msctf.dll 0x77E20000 \Windows\System32\nsi.dll 0x77180000 \Windows\System32\iertutil.dll 0x77130000 \Windows\System32\Wldap32.dll 0x770E0000 \Windows\System32\gdi32.dll 0x77040000 \Windows\System32\advapi32.dll 0x76F40000 \Windows\System32\wininet.dll 0x76EE0000 \Windows\System32\shlwapi.dll 0x76EC0000 \Windows\System32\imm32.dll 0x76E30000 \Windows\System32\oleaut32.dll 0x761E0000 \Windows\System32\shell32.dll 0x76130000 \Windows\System32\rpcrt4.dll 0x76100000 \Windows\System32\wintrust.dll 0x760B0000 \Windows\System32\KernelBase.dll 0x76080000 \Windows\System32\cfgmgr32.dll 0x75FF0000 \Windows\System32\comctl32.dll 0x75FD0000 \Windows\System32\devobj.dll 0x75EB0000 \Windows\System32\crypt32.dll 0x75EA0000 \Windows\System32\msasn1.dll Processes (total 71): 0 System Idle Process 4 System 264 C:\Windows\System32\smss.exe 380 csrss.exe 464 C:\Windows\System32\wininit.exe 476 csrss.exe 512 C:\Windows\System32\services.exe 552 C:\Windows\System32\winlogon.exe 564 C:\Windows\System32\lsass.exe 572 C:\Windows\System32\lsm.exe 696 C:\Windows\System32\svchost.exe 780 C:\Windows\System32\nvvsvc.exe 820 C:\Windows\System32\svchost.exe 876 C:\Windows\System32\atiesrxx.exe 952 C:\Windows\System32\svchost.exe 996 C:\Windows\System32\svchost.exe 1028 C:\Windows\System32\svchost.exe 1108 C:\Windows\System32\audiodg.exe 1180 C:\Windows\System32\svchost.exe 1252 C:\Windows\System32\atieclxx.exe 1440 C:\Windows\System32\svchost.exe 1572 C:\Windows\System32\spoolsv.exe 1600 C:\Program Files\Avira\AntiVir Desktop\sched.exe 1620 C:\Windows\System32\svchost.exe 1732 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1760 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1780 C:\Program Files\Bonjour\mDNSResponder.exe 1836 C:\Windows\System32\svchost.exe 1928 C:\Windows\System32\svchost.exe 1992 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe 2004 C:\Windows\System32\conhost.exe 2364 C:\Windows\System32\taskhost.exe 2512 C:\Windows\System32\dwm.exe 2580 C:\Windows\explorer.exe 2696 C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe 2704 C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe 2712 C:\Program Files\Razer\Diamondback 3G\razerhid.exe 2720 C:\Program Files\iTunes\iTunesHelper.exe 2772 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe 2780 C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe 2804 C:\Programme\Gemeinsame Dateien\Logitech\LCD Manager\Applets\lcdsirreal267\LCDSirReal.exe 2916 C:\Program Files\Common Files\Java\Java Update\jusched.exe 2948 C:\Program Files\Winamp\winampa.exe 3004 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 3088 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 3188 C:\Program Files\Razer\Diamondback 3G\razerofa.exe 3324 C:\Windows\System32\SearchIndexer.exe 3388 C:\Program Files\Search Advisor\adgui.exe 3408 C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe 3452 C:\Program Files\iPod\bin\iPodService.exe 3496 C:\Program Files\OpenOffice.org 3\program\soffice.exe 3552 C:\Program Files\OpenOffice.org 3\program\soffice.bin 3704 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 3796 C:\Program Files\Windows Media Player\wmpnetwk.exe 3064 C:\Windows\System32\svchost.exe 4176 C:\Windows\System32\svchost.exe 5728 C:\Program Files\Opera\opera.exe 5000 C:\Program Files\Last.fm\LastFM.exe 2448 C:\Program Files\Windows Live\Messenger\msnmsgr.exe 296 C:\Program Files\Windows Live\Contacts\wlcomm.exe 4120 C:\Program Files\iTunes\iTunes.exe 4156 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe 2208 C:\Windows\System32\conhost.exe 4796 C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe 4548 C:\Windows\System32\conhost.exe 4920 C:\Programme\Valve\Steam\Steam.exe 2292 C:\Windows\System32\SearchProtocolHost.exe 1612 C:\Windows\System32\SearchFilterHost.exe 1632 C:\Users\Ceron\Desktop\MBRCheck.exe 1384 C:\Windows\System32\conhost.exe 4024 C:\Windows\System32\dllhost.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: SAMSUNGHD501LJ, Rev: CR100-12 PhysicalDrive1 Model Number: TrekStorDS maxi g.u, Rev: Size Device Name MBR Status -------------------------------------------- 465 GB \\.\PhysicalDrive0 Windows 7 MBR code detected SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79 931 GB \\.\PhysicalDrive1 RE: Unknown MBR code SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done! |
|
04.09.2010, 16:10
| #27 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer und sein EigenlebenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.09.2010, 16:43
| #28 |
| | Internet Explorer und sein Eigenleben Ja da sind nur Sicherungs Datein drauf Images, Musik, Videos und ein paar Backups. |
|
05.09.2010, 14:28
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer und sein Eigenleben Dann siehts ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
05.09.2010, 22:11
| #30 |
| | Internet Explorer und sein Eigenleben SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 09/05/2010 at 10:45 PM Application Version : 4.42.1000 Core Rules Database Version : 5458 Trace Rules Database Version: 3270 Scan type : Complete Scan Total Scan Time : 04:33:15 Memory items scanned : 1083 Memory threats detected : 0 Registry items scanned : 8311 Registry threats detected : 0 File items scanned : 282735 File threats detected : 8 Adware.Tracking Cookie C:\Users\Ceron\AppData\Roaming\Microsoft\Windows\Cookies\ceron@atdmt[2].txt C:\Users\Ceron\AppData\Roaming\Microsoft\Windows\Cookies\ceron@tradedoubler[2].txt C:\Users\Ceron\AppData\Roaming\Microsoft\Windows\Cookies\ceron@doubleclick[1].txt files.youporn.com [ C:\Dokumente und Einstellungen\Ceron\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\5C45XZSG ] inwmedia.net [ C:\Users\Ceron\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\5MRTHD8Z ] Rootkit.Agent/Gen E:\ALLES ODER NIX\BACK UP\TEST\SHADOW.SYS E:\ALLES ODER NIX\BACK UP\TEST\ZNLRWEUEYR.SYS Trojan.Agent/Gen-Krpytik E:\SYSTEM VOLUME INFORMATION\_RESTORE{3E230D3E-01F7-4A68-95C3-AD25D747D929}\RP31\A0000754.EXE Habe auch keine eigenmächtigen vorkommnisse von dem Internet Explorer mehr gehabt. Die Trojaner bzw. rootkits auf E:\ sind oder ist ein Bot-Programm Malweare Bytes log kommt dann morgen Auf jedenfall schon einmal ein großes dankeschön, bin immer wieder fassziniert wie man aus solchen Daten die Viren und Trojaner rauslesen kann  |
|
| Themen zu Internet Explorer und sein Eigenleben |
| adobe, antivir, antivir guard, avg, avira, bho, bonjour, converter, desktop, eigenleben, explorer, hijack, hijackthis, internet, internet explorer, launch, local\temp, logfile, mp3, nvidia, object, realtek, rundll, software, system, temp, windows, öffnet, {dfefcdee-cf1a-4fc8-88ad-48514e463b27} |
Linear-Darstellung
