WTR Loader funktioniert nicht

reni0686 · 26.04.2011, 08:37

Hallo liebe Forum-Leser,

gestern hat sich ein Virus auf meinen Laptop eingeschlichen. Mein Antivirenscanner hat mir sofort eine Meldung geschickt und danach ging alles recht schnell.
Der Desktop-Bildschirm wurde schwarz, meine ganzen Dateien sind vom Desktop verschwunden und er hat mir die Nachtricht angezeigt, dass zuviel RAM verbraucht wird.
Daraufhin habe ich den Laptop heruntergefahren und wieder neu gestartet. Das Problem war natürlich immer noch da. Jetzt habe ich im Internet versucht herauszufinden, was ich machen kann und bin durch Zufall auf dieses Forum gestoßen.
Eine andere Posterin hatte dasselbe Problem und ihr wurde empfohlen, Malewarebytes herunterzuladen und einen Vollscan durchzufuhren. Das habe ich dann auch gemacht und bis jetzt hat der Scanner 10 infizierte Objekte gefunden.
Meine Frage ist jetzt, wie kann ich weiter vorgehen, nachdem der Vollscan sbgeschlossen wurde.

Ich wäre über jeden Tipp sehr dankbar

LG Verena

reni0686 · 26.04.2011, 09:25

So der Vollscan ist nun beendet und hier das Ergebnis:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6446

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

26.04.2011 10:22:48
mbam-log-2011-04-26 (10-22-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 242799
Laufzeit: 1 Stunde(n), 6 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 6
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7

Infizierte Speicherprozesse:
c:\programdata\lntuynxqpryn.exe (Trojan.FakeAlert) -> 2652 -> No action taken.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\ToolBand.XTTBPos00.1 (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\ToolBand.XTTBPos00 (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> No action taken.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lnTUynXQPRYn (Trojan.FakeAlert) -> Value: lnTUynXQPRYn -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{B922D405-6D13-4A2B-AE89-08A030DA4402}\COMPONENTS\PDFFORGETOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: PDFFORGETOOLBARFF.DLL -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\programdata\lntuynxqpryn.exe (Trojan.FakeAlert) -> No action taken.
c:\program files\daemon tools searchbar\Uninst.exe (Adware.WhenU) -> No action taken.
c:\program files\daemon tools searchbar\whse.exe (Adware.WhenU) -> No action taken.
c:\program files\mozilla firefox\extensions\{a89aed22-9133-424c-88e7-c8235c5ff302}\components\memedia_ff.dll (Adware.AdVantage) -> No action taken.
c:\program files\mozilla firefox\extensions\{b922d405-6d13-4a2b-ae89-08a030da4402}\components\pdfforgetoolbarff.dll (Adware.WidgiToolbar) -> No action taken.
c:\programdata\23519008.exe (Trojan.FakeAlert) -> No action taken.
c:\Users\Veri\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\U1PG51OO\calc[1].exe (Trojan.FakeAlert) -> No action taken.

reni0686 · 26.04.2011, 09:36

Daraufhin habe ich gerade ein Systemscan mit OTL durchgeführt.

Hier das Ergebnis:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 26.04.2011 10:30:07 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Veri\Desktop\Youtube
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 265,00 Mb Available Physical Memory | 26,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 47,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 4,28 Gb Free Space | 10,97% Space Free | Partition Type: NTFS
Drive D: | 108,52 Gb Total Space | 108,43 Gb Free Space | 99,92% Space Free | Partition Type: NTFS
Drive F: | 970,13 Mb Total Space | 931,73 Mb Free Space | 96,04% Space Free | Partition Type: FAT
 
Computer Name: VERIS | User Name: Veri | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Veri\Desktop\Youtube\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\lnTUynXQPRYn.exe (WinTrust)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()
PRC - C:\Windows\System32\WerFault.exe (Microsoft Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Veri\Desktop\Youtube\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (AntiVirScheduler) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (CFSvcs) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek                                            )
DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (KR10N) -- C:\Windows\system32\drivers\kr10n.sys (TOSHIBA CORPORATION)
DRV - (KR10I) -- C:\Windows\system32\drivers\kr10i.sys (TOSHIBA CORPORATION)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (tosrfec) -- C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (LPCFilter) -- C:\Windows\system32\DRIVERS\LPCFilter.sys (COMPAL ELECTRONIC INC.)
DRV - (NeroCd2k) -- C:\Windows\System32\drivers\NeroCD2k.sys (ahead software gmbh
im stoeckmaedle 6
76307 karlsbad, germany
Fax: ++49-7248-911-888
e-mail: info@nero.com)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll (GreenTree Applications, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig?ct=1056757711"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q="
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.24 12:42:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.24 12:42:03 | 000,000,000 | ---D | M]
 
[2010.12.29 19:11:24 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Veri\AppData\Roaming\mozilla\Extensions
[2010.12.29 19:11:24 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Veri\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2011.04.25 11:53:53 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions
[2009.09.03 17:26:59 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.01.31 21:31:26 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.08.10 22:21:01 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2009.04.01 13:49:16 | 000,000,000 | -H-D | M] (Softonic Deutsch Toolbar) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}
[2010.08.10 21:35:46 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.25 11:53:53 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\staged-xpis
[2010.09.01 20:33:20 | 000,000,000 | -H-D | M] (YouTube to MP3) -- C:\Users\Veri\AppData\Roaming\mozilla\Firefox\Profiles\ogk0j4cf.default\extensions\youtube2mp3@mondayx.de
[2010.08.10 22:23:40 | 000,000,873 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\conduit.xml
[2011.04.19 14:31:39 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-1.xml
[2008.07.18 13:41:52 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-10.xml
[2008.09.29 15:58:41 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-11.xml
[2008.09.29 18:12:43 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-12.xml
[2008.11.16 21:20:54 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-13.xml
[2008.12.21 16:33:23 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-14.xml
[2009.02.15 20:50:37 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-15.xml
[2009.03.06 14:07:30 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-16.xml
[2009.03.30 18:34:08 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-17.xml
[2009.04.24 09:27:39 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-18.xml
[2009.04.30 08:50:05 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-19.xml
[2007.11.02 18:40:22 | 000,000,949 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-2.xml
[2009.06.13 10:09:14 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-20.xml
[2009.07.23 12:26:46 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-21.xml
[2009.08.07 13:57:40 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-22.xml
[2009.09.16 12:27:56 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-23.xml
[2009.10.28 19:51:35 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-24.xml
[2009.12.18 17:47:28 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-25.xml
[2010.01.25 22:08:35 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-26.xml
[2010.02.19 21:05:22 | 000,000,961 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-27.xml
[2010.03.29 18:57:28 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-28.xml
[2010.03.31 11:18:47 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-29.xml
[2007.11.28 22:48:40 | 000,000,949 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-3.xml
[2010.04.03 14:48:32 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-30.xml
[2010.06.24 20:35:21 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-31.xml
[2010.06.28 15:28:04 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-32.xml
[2010.07.22 21:09:49 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-33.xml
[2010.07.25 11:09:49 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-34.xml
[2010.08.10 22:35:48 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-35.xml
[2010.09.16 19:17:56 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-36.xml
[2010.10.21 09:23:29 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-37.xml
[2010.10.29 16:12:38 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-38.xml
[2010.12.10 22:58:09 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-39.xml
[2007.12.01 17:40:21 | 000,000,949 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-4.xml
[2011.03.02 15:24:04 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-40.xml
[2011.03.07 10:27:55 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-41.xml
[2011.03.24 12:42:30 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-42.xml
[2008.02.11 20:41:54 | 000,000,949 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-5.xml
[2008.02.27 23:56:03 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-6.xml
[2008.03.27 16:33:18 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-7.xml
[2008.04.23 06:14:52 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-8.xml
[2008.07.03 10:19:03 | 000,000,950 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin-9.xml
[2008.03.31 09:52:00 | 000,000,168 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin.gif
[2008.03.31 09:52:00 | 000,000,618 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin.src
[2009.07.13 17:12:02 | 000,000,944 | -H-- | M] () -- C:\Users\Veri\AppData\Roaming\Mozilla\Firefox\Profiles\ogk0j4cf.default\searchplugins\icqplugin.xml
[2010.01.11 18:53:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2007.10.11 14:59:56 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.07.20 19:31:17 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2007.10.11 15:27:55 | 000,000,000 | ---D | M] (AdVantage) -- C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}
[2009.04.01 13:48:45 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2009.04.01 13:48:47 | 000,000,000 | ---D | M] (Search Settings Plugin) -- C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
[2008.09.11 16:08:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org
[2010.03.29 18:57:05 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.29 18:57:05 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.29 18:57:05 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.29 18:57:05 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.29 18:57:05 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} -  File not found
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll (GreenTree Applications, Inc.)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll (GreenTree Applications, Inc.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll (GreenTree Applications, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()
O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKCU..\Run: [lnTUynXQPRYn] C:\ProgramData\lnTUynXQPRYn.exe (WinTrust)
O4 - HKCU..\Run: [TOSCDSPD]  File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Veri\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} -  File not found
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Veri\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Veri\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{38dd7299-1963-11df-97e4-0016d4f45af1}\Shell - "" = AutoRun
O33 - MountPoints2\{38dd7299-1963-11df-97e4-0016d4f45af1}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{38dd72af-1963-11df-97e4-0016d4f45af1}\Shell - "" = AutoRun
O33 - MountPoints2\{38dd72af-1963-11df-97e4-0016d4f45af1}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e43cecb-77fd-11dc-be0e-0016d4f45af1}\Shell - "" = AutoRun
O33 - MountPoints2\{6e43cecb-77fd-11dc-be0e-0016d4f45af1}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{6e43cecb-77fd-11dc-be0e-0016d4f45af1}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{6e43cecb-77fd-11dc-be0e-0016d4f45af1}\Shell\install\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.26 09:14:40 | 000,000,000 | ---D | C] -- C:\Users\Veri\AppData\Roaming\Malwarebytes
[2011.04.26 09:14:16 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.26 09:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.04.26 09:14:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.26 09:14:05 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.26 09:14:05 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.04.25 23:48:09 | 000,565,248 | -H-- | C] (WinTrust) -- C:\ProgramData\lnTUynXQPRYn.exe
[2011.04.14 15:03:24 | 000,000,000 | -H-D | C] -- C:\Users\Veri\Desktop\Youtube alte Lieder
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Veri\Desktop\*.tmp files -> C:\Users\Veri\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.26 10:03:01 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.26 10:03:01 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.26 09:39:06 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.26 09:14:19 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.26 09:03:56 | 000,487,424 | ---- | M] () -- C:\ProgramData\23519008.exe
[2011.04.26 09:03:06 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.26 09:02:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.04.26 09:02:55 | 1063,378,944 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.25 23:48:08 | 000,565,248 | -H-- | M] (WinTrust) -- C:\ProgramData\lnTUynXQPRYn.exe
[2011.04.25 23:40:29 | 000,001,936 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.04.25 20:03:06 | 003,699,579 | -H-- | M] () -- C:\Users\Veri\Desktop\pantoffelheld Unterrichtsbeispiele.pdf
[2011.04.25 11:04:27 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D19A8DDC-1619-47BF-BC80-E47F481CB542}.job
[2011.04.20 23:45:47 | 000,054,784 | -H-- | M] () -- C:\Users\Veri\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.06 15:44:26 | 000,641,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.06 15:44:26 | 000,610,142 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.06 15:44:26 | 000,116,706 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.06 15:44:26 | 000,103,924 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Veri\Desktop\*.tmp files -> C:\Users\Veri\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.26 09:14:19 | 000,000,871 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.26 09:03:56 | 000,487,424 | ---- | C] () -- C:\ProgramData\23519008.exe
[2011.04.25 20:03:06 | 003,699,579 | -H-- | C] () -- C:\Users\Veri\Desktop\pantoffelheld Unterrichtsbeispiele.pdf
[2010.12.07 19:39:40 | 000,004,096 | -H-- | C] () -- C:\Users\Veri\AppData\Local\keyfile3.drm
[2010.03.08 21:18:07 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.12.03 10:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.04.01 13:48:22 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2008.09.26 15:18:37 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.08.12 10:47:45 | 000,017,486 | -H-- | C] () -- C:\Users\Veri\AppData\Roaming\mdb.bin
[2008.08.12 10:11:05 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.02.11 20:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll
[2008.02.11 20:05:49 | 000,000,432 | -H-- | C] () -- C:\Windows\BRWMARK.INI
[2008.02.11 20:05:49 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BD2030.DAT
[2008.02.11 20:05:22 | 000,000,158 | -H-- | C] () -- C:\Windows\Brownie.ini
[2008.02.11 20:05:22 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2008.02.11 20:05:22 | 000,000,000 | -H-- | C] () -- C:\Windows\brmx2001.ini
[2008.02.11 20:05:21 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini
[2008.02.11 20:05:18 | 000,008,975 | ---- | C] () -- C:\Windows\HL-2030.INI
[2007.11.07 00:11:04 | 000,054,784 | -H-- | C] () -- C:\Users\Veri\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.10.11 15:07:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.10.11 14:59:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.08.24 20:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll
[2007.03.14 10:34:13 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.03.13 12:52:13 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2007.03.13 12:31:43 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2007.03.13 12:31:43 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2007.03.13 12:31:43 | 000,010,146 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2007.03.13 12:31:43 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2007.03.13 12:25:15 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
[2007.03.13 12:25:15 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
[2007.03.13 12:18:04 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1132.dll
[2006.11.24 08:48:44 | 000,036,864 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll
[2006.11.02 17:33:31 | 000,641,344 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,116,706 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,474,936 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,610,142 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,103,924 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.03.09 02:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005.11.23 15:55:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll
[2004.01.14 08:46:34 | 000,172,032 | ---- | C] () -- C:\Windows\System32\tifmicon.dll
[2001.06.11 16:58:12 | 000,147,456 | ---- | C] () -- C:\Windows\System32\NeroCheck.exe

< End of report >

--- --- ---

reni0686 · 26.04.2011, 09:37

Und der zweite Report:OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 26.04.2011 10:30:07 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Veri\Desktop\Youtube
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 265,00 Mb Available Physical Memory | 26,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 47,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 4,28 Gb Free Space | 10,97% Space Free | Partition Type: NTFS
Drive D: | 108,52 Gb Total Space | 108,43 Gb Free Space | 99,92% Space Free | Partition Type: NTFS
Drive F: | 970,13 Mb Total Space | 931,73 Mb Free Space | 96,04% Space Free | Partition Type: FAT
 
Computer Name: VERIS | User Name: Veri | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0761ABC5-228E-44FF-AA36-EC7590BF57BE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0B635F72-9E0D-4B38-84F0-EEE4759F15C8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3CAF5258-CB92-460C-B058-E93BC5BE9B45}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{62E440E7-EB60-473B-843A-D8384C4B35AD}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{6D811D26-7D9E-4079-875A-67257DB23626}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{71E14954-36FF-4266-ACD2-70BE994DF05D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8E6ADB49-9460-4589-9138-FE642D4BC7EF}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{A2A0F914-B90F-46B3-A3A7-8C7C99E3A936}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{D62AEEE7-E918-43FC-A84B-884DEDCF1E95}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{E915499C-A6EC-43E3-B01B-8D7D1D0A46B1}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{EC0FA71E-39C5-48A8-9CDB-EFCC2C4F60C7}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{F0A8E003-7188-445F-87AF-2D8F7983D122}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{FA5E83D4-88D0-4B4E-B9BF-F3AF151DA54E}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{071BF0B0-A8D7-4FCB-AF5E-7F9F0DBA80F0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{22DA5C85-B9CF-4EB7-BA1A-D528DB686465}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{4FD721C9-88E1-4E03-B13D-F3116F2A9E9A}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{60707A51-E400-4949-A32C-CB090D2B0A7F}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{66291D08-A801-4D63-B96D-39D3D23C44E0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{72E516E2-974F-41D3-8410-5A2DC90D7FB6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{A8A01F1C-7B53-4F1A-BFE4-26F95DD701B7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{D8B55485-CC8B-4A5A-9A45-AFD224A81C8D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E99E290C-DF53-4F25-B0E2-B687773AFD9B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"TCP Query User{00F1427D-36B6-4306-B2AC-662D0CBBA613}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{642C2378-3086-445C-BEB5-75B520002261}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{817881AD-B451-4EB4-AD65-B04F78914DC0}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{EF3F9413-5DF3-42E0-8166-4579708936C1}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{F604BD1C-56D8-4BF2-BAD7-4259BCC94A53}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{5FE8A121-50F3-4846-A689-089731DABE0E}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{8E73A9B5-49D5-418D-A09C-AFC66CEDCF75}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{D509AB99-8135-4FD6-95CD-0D022F3E86A6}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{EA8890EA-5077-4D2A-B055-08D333B16BDE}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{FDC737ED-85A8-404A-85AF-5579FD677A48}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0020FEE2-7CDB-4250-B04B-81D68D3CA18B}" = 
"{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}" = TIPCI
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0AED91F6-7353-4852-AA6A-BBA38A9C0B6F}" = DSL Connection Manager
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{249D2CE1-65CA-4D7E-96DD-52FB1932515B}" = Brother HL-2030
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{441C8911-CEC0-19E6-6CAC-694553E06A28}" = myphotobook.de
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}" = pdfforge Toolbar v1.0
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus(R) for Adobe
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = myphotobook.de
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ifolor-Designer" = ifolor Designer
"InstallShield_{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisorkennwort
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"NVIDIA Drivers" = NVIDIA Drivers
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TomTom HOME" = TomTom HOME 2.7.6.2056
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.9
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinRAR archiver" = WinRAR
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 29.12.2010 09:51:42 | Computer Name = Veris | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3989 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: ce0  Anfangszeit: 01cba753c6860dfc  Zeitpunkt der Beendigung:
 76
 
Error - 29.12.2010 13:11:22 | Computer Name = Veris | Source = TomTomHOMEService | ID = 10000
Description = 
 
Error - 29.12.2010 13:15:18 | Computer Name = Veris | Source = TomTomHOMEService | ID = 10000
Description = 
 
Error - 29.12.2010 18:06:48 | Computer Name = Veris | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3989 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: d84  Anfangszeit: 01cba79589c6847c  Zeitpunkt der Beendigung:
 20
 
Error - 31.12.2010 11:17:34 | Computer Name = Veris | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3989 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 8a4  Anfangszeit: 01cba8e630c86ec1  Zeitpunkt der Beendigung:
 32
 
Error - 02.01.2011 05:45:20 | Computer Name = Veris | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmplayer.exe, Version 11.0.6000.6353, Zeitstempel
 0x4aa91b5d, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00000000,  Prozess-ID 0xe0c, Anwendungsstartzeit
 01cbaa6006f43dee.
 
Error - 02.01.2011 09:27:12 | Computer Name = Veris | Source = Application Hang | ID = 1002
Description = Programm nero.exe, Version 5.5.2.8 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 818  Anfangszeit: 01cbaa80a5f9536e  Zeitpunkt der Beendigung:
 14
 
Error - 06.01.2011 08:41:34 | Computer Name = Veris | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6000.16771, Zeitstempel
 0x4907deda, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc0000005, Fehleroffset 0x000620e3,  Prozess-ID 0x758, Anwendungsstartzeit
 01cbad9abe679578.
 
Error - 14.01.2011 18:12:57 | Computer Name = Veris | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung vlc.exe, Version 0.9.9.0, Zeitstempel 0x49d25eb7,
 fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9, Ausnahmecode
 0xc0000374, Fehleroffset 0x000af1c9,  Prozess-ID 0xd4c, Anwendungsstartzeit 01cbb437e411f6d8.
 
Error - 14.01.2011 18:13:51 | Computer Name = Veris | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung vlc.exe, Version 0.9.9.0, Zeitstempel 0x49d25eb7,
 fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9, Ausnahmecode
 0xc0000374, Fehleroffset 0x000af1c9,  Prozess-ID 0xc6c, Anwendungsstartzeit 01cbb43838e0a088.
 
[ System Events ]
Error - 04.04.2011 11:52:56 | Computer Name = Veris | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 10.04.2011 17:34:56 | Computer Name = Veris | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 14.04.2011 08:44:05 | Computer Name = Veris | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 25.04.2011 18:14:17 | Computer Name = Veris | Source = DCOM | ID = 10010
Description = 
 
Error - 26.04.2011 03:08:22 | Computer Name = Veris | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "Vista" aus.
 
Error - 26.04.2011 03:08:22 | Computer Name = Veris | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "C:" aus.
 
Error - 26.04.2011 03:08:53 | Computer Name = Veris | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.04.2011 03:15:25 | Computer Name = Veris | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "Vista" aus.
 
Error - 26.04.2011 03:15:25 | Computer Name = Veris | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "Vista" aus.
 
Error - 26.04.2011 03:17:25 | Computer Name = Veris | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "Vista" aus.
 
 
< End of report >

--- --- ---

reni0686 · 26.04.2011, 09:58

Ich habe jetzt auch den nächsten Schritt durchgeführt: OTL-Fix

All processes killed
========== OTL ==========
File C:\Dokumente und Einstellungen\Admin\Desktop\Windows Recovery.lnk not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~17751860r not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~17751860 not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\17751860 not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Veri
->Temp folder emptied: 463293260 bytes
->Temporary Internet Files folder emptied: 125066381 bytes
->Java cache emptied: 8811256 bytes
->FireFox cache emptied: 75370611 bytes
->Google Chrome cache emptied: 33976292 bytes
->Flash cache emptied: 2019403 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 218302282 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1073718 bytes

Total Files Cleaned = 885,00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 04262011_103839

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

reni0686 · 26.04.2011, 09:59

Hab jetzt auch den nächsten Schritt durchgeführt: OTL-Fix

All processes killed
========== OTL ==========
File C:\Dokumente und Einstellungen\Admin\Desktop\Windows Recovery.lnk not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~17751860r not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~17751860 not found.
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\17751860 not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Veri
->Temp folder emptied: 463293260 bytes
->Temporary Internet Files folder emptied: 125066381 bytes
->Java cache emptied: 8811256 bytes
->FireFox cache emptied: 75370611 bytes
->Google Chrome cache emptied: 33976292 bytes
->Flash cache emptied: 2019403 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 218302282 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1073718 bytes

Total Files Cleaned = 885,00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 04262011_103839

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

reni0686 · 26.04.2011, 10:03

Was kann ich jetzt machen?
Der Bildschirm ist immer noch schwarz und die Dateien weg (außer der Papierkorb, Arbeitsplatz, etc.)

reni0686 · 26.04.2011, 10:10

So nachdem einigen anderen Usern als nächster Schritt folgendes geraten wurde, habe ich dies nun auch ausgeführt:

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-a...entfernen.html

Hier das Ergebnis:

2011/04/26 11:06:01.0851 1392 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/26 11:06:02.0132 1392 ================================================================================
2011/04/26 11:06:02.0132 1392 SystemInfo:
2011/04/26 11:06:02.0132 1392
2011/04/26 11:06:02.0132 1392 OS Version: 6.0.6000 ServicePack: 0.0
2011/04/26 11:06:02.0132 1392 Product type: Workstation
2011/04/26 11:06:02.0132 1392 ComputerName: VERIS
2011/04/26 11:06:02.0148 1392 UserName: Veri
2011/04/26 11:06:02.0148 1392 Windows directory: C:\Windows
2011/04/26 11:06:02.0148 1392 System windows directory: C:\Windows
2011/04/26 11:06:02.0148 1392 Processor architecture: Intel x86
2011/04/26 11:06:02.0148 1392 Number of processors: 2
2011/04/26 11:06:02.0148 1392 Page size: 0x1000
2011/04/26 11:06:02.0148 1392 Boot type: Normal boot
2011/04/26 11:06:02.0148 1392 ================================================================================
2011/04/26 11:06:02.0709 1392 Initialize success
2011/04/26 11:06:40.0649 3848 ================================================================================
2011/04/26 11:06:40.0649 3848 Scan started
2011/04/26 11:06:40.0649 3848 Mode: Manual;
2011/04/26 11:06:40.0649 3848 ================================================================================
2011/04/26 11:06:43.0160 3848 ACPI (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys
2011/04/26 11:06:43.0472 3848 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/04/26 11:06:43.0691 3848 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/04/26 11:06:43.0737 3848 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/04/26 11:06:43.0784 3848 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/04/26 11:06:44.0299 3848 AFD (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
2011/04/26 11:06:45.0063 3848 AgereSoftModem (ce91b158fa490cf4c4d487a4130f4660) C:\Windows\system32\DRIVERS\AGRSM.sys
2011/04/26 11:06:45.0235 3848 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/04/26 11:06:45.0282 3848 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/04/26 11:06:45.0344 3848 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/04/26 11:06:45.0672 3848 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/04/26 11:06:45.0968 3848 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/04/26 11:06:46.0296 3848 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/04/26 11:06:46.0389 3848 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/04/26 11:06:46.0608 3848 ApfiltrService (7c2f57bce81fa74933f0e1c84a97c9db) C:\Windows\system32\DRIVERS\Apfiltr.sys
2011/04/26 11:06:47.0138 3848 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/04/26 11:06:47.0419 3848 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/04/26 11:06:47.0481 3848 AsyncMac (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/04/26 11:06:48.0027 3848 atapi (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys
2011/04/26 11:06:48.0324 3848 athr (8be56f8300e1c37b578da23c71816b7a) C:\Windows\system32\DRIVERS\athr.sys
2011/04/26 11:06:48.0433 3848 avgio (87828ecd657f81503465ac705e845076) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
2011/04/26 11:06:48.0511 3848 avgntflt (fcb30820bed1d3feb55e3dd55a3f947f) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
2011/04/26 11:06:48.0729 3848 avipbb (0b09df022250fb7ba91fb932eac6ea9b) C:\Windows\system32\DRIVERS\avipbb.sys
2011/04/26 11:06:48.0823 3848 Beep (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
2011/04/26 11:06:49.0291 3848 bowser (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
2011/04/26 11:06:49.0478 3848 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/04/26 11:06:49.0509 3848 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/04/26 11:06:49.0572 3848 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/04/26 11:06:49.0603 3848 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/04/26 11:06:49.0681 3848 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/04/26 11:06:49.0868 3848 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/04/26 11:06:50.0118 3848 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/04/26 11:06:50.0165 3848 cdfs (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
2011/04/26 11:06:50.0211 3848 cdrom (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
2011/04/26 11:06:50.0352 3848 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/04/26 11:06:50.0445 3848 CLFS (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
2011/04/26 11:06:50.0804 3848 CmBatt (ed97ad3df1b9005989eaf149bf06c821) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/04/26 11:06:51.0069 3848 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/04/26 11:06:51.0225 3848 Compbatt (722936afb75a7f509662b69b5632f48a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/04/26 11:06:51.0381 3848 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/04/26 11:06:51.0803 3848 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/04/26 11:06:52.0068 3848 DfsC (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
2011/04/26 11:06:52.0193 3848 disk (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
2011/04/26 11:06:52.0364 3848 drmkaud (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
2011/04/26 11:06:52.0473 3848 DXGKrnl (334988883de69adb27e2cf9f9715bbdb) C:\Windows\System32\drivers\dxgkrnl.sys
2011/04/26 11:06:52.0676 3848 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/04/26 11:06:53.0144 3848 Ecache (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys
2011/04/26 11:06:53.0612 3848 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/04/26 11:06:53.0862 3848 fastfat (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
2011/04/26 11:06:53.0940 3848 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/04/26 11:06:54.0455 3848 FileInfo (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
2011/04/26 11:06:54.0813 3848 Filetrace (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
2011/04/26 11:06:55.0172 3848 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/04/26 11:06:55.0500 3848 FltMgr (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
2011/04/26 11:06:55.0765 3848 Fs_Rec (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
2011/04/26 11:06:55.0874 3848 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/04/26 11:06:56.0295 3848 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/04/26 11:06:56.0795 3848 HDAudBus (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/04/26 11:06:57.0013 3848 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/04/26 11:06:57.0278 3848 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/04/26 11:06:57.0419 3848 HidUsb (3c64042b95e583b366ba4e5d2450235e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/04/26 11:06:57.0481 3848 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/04/26 11:06:57.0653 3848 HTTP (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys
2011/04/26 11:06:58.0339 3848 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/04/26 11:06:58.0495 3848 i8042prt (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/04/26 11:06:58.0635 3848 ialm (9378d57e2b96c0a185d844770ad49948) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/04/26 11:06:58.0869 3848 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/04/26 11:06:59.0072 3848 igfx (9378d57e2b96c0a185d844770ad49948) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/04/26 11:06:59.0197 3848 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/04/26 11:06:59.0322 3848 IntcAzAudAddService (721b1a0434647418f98d034bebd4b4db) C:\Windows\system32\drivers\RTKVHDA.sys
2011/04/26 11:06:59.0478 3848 intelide (988981c840084f480ba9e3319cebde1b) C:\Windows\system32\drivers\intelide.sys
2011/04/26 11:06:59.0540 3848 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
2011/04/26 11:06:59.0587 3848 IpFilterDriver (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/04/26 11:06:59.0727 3848 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/04/26 11:06:59.0774 3848 IPNAT (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
2011/04/26 11:06:59.0821 3848 IRENUM (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
2011/04/26 11:06:59.0868 3848 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/04/26 11:06:59.0977 3848 iScsiPrt (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/04/26 11:07:00.0024 3848 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/04/26 11:07:00.0071 3848 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/04/26 11:07:00.0195 3848 kbdclass (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/04/26 11:07:00.0242 3848 kbdhid (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
2011/04/26 11:07:00.0398 3848 KR10I (a383f2cea0a8f4e76e71abc869bd5748) C:\Windows\system32\drivers\kr10i.sys
2011/04/26 11:07:00.0445 3848 KR10N (6e9922332386c2a49936b30b2b6fd298) C:\Windows\system32\drivers\kr10n.sys
2011/04/26 11:07:00.0523 3848 KSecDD (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys
2011/04/26 11:07:00.0679 3848 lltdio (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
2011/04/26 11:07:00.0741 3848 LPCFilter (515fc18cabee0158a324b08b1c2667cf) C:\Windows\system32\DRIVERS\LPCFilter.sys
2011/04/26 11:07:00.0788 3848 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/04/26 11:07:00.0819 3848 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/04/26 11:07:00.0944 3848 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/04/26 11:07:00.0975 3848 luafv (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
2011/04/26 11:07:01.0022 3848 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/04/26 11:07:01.0163 3848 Modem (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
2011/04/26 11:07:01.0225 3848 monitor (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys
2011/04/26 11:07:01.0272 3848 mouclass (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys
2011/04/26 11:07:01.0397 3848 mouhid (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys
2011/04/26 11:07:01.0459 3848 MountMgr (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
2011/04/26 11:07:01.0490 3848 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/04/26 11:07:01.0631 3848 mpsdrv (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
2011/04/26 11:07:01.0677 3848 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/04/26 11:07:01.0740 3848 MRxDAV (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys
2011/04/26 11:07:01.0865 3848 mrxsmb (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/04/26 11:07:01.0943 3848 mrxsmb10 (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/04/26 11:07:02.0021 3848 mrxsmb20 (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/04/26 11:07:02.0114 3848 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/04/26 11:07:02.0145 3848 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/04/26 11:07:02.0192 3848 Msfs (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
2011/04/26 11:07:02.0301 3848 msisadrv (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys
2011/04/26 11:07:02.0395 3848 MSKSSRV (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
2011/04/26 11:07:02.0426 3848 MSPCLOCK (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/04/26 11:07:02.0457 3848 MSPQM (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
2011/04/26 11:07:02.0551 3848 MsRPC (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
2011/04/26 11:07:02.0629 3848 mssmbios (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/04/26 11:07:02.0660 3848 MSTEE (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
2011/04/26 11:07:02.0691 3848 Mup (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
2011/04/26 11:07:02.0832 3848 NativeWifiP (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys
2011/04/26 11:07:02.0972 3848 NDIS (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys
2011/04/26 11:07:03.0097 3848 NdisTapi (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/04/26 11:07:03.0175 3848 Ndisuio (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/04/26 11:07:03.0206 3848 NdisWan (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/04/26 11:07:03.0237 3848 NDProxy (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
2011/04/26 11:07:03.0331 3848 NeroCd2k (58b29812b8d23501d15d85dd72eacb34) C:\Windows\system32\drivers\NeroCd2k.sys
2011/04/26 11:07:03.0425 3848 NetBIOS (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
2011/04/26 11:07:03.0456 3848 netbt (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys
2011/04/26 11:07:03.0643 3848 NETw3v32 (a15f219208843a5a210c8cb391384453) C:\Windows\system32\DRIVERS\NETw3v32.sys
2011/04/26 11:07:03.0783 3848 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/04/26 11:07:03.0815 3848 Npfs (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
2011/04/26 11:07:03.0846 3848 nsiproxy (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
2011/04/26 11:07:03.0986 3848 Ntfs (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys
2011/04/26 11:07:04.0142 3848 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/04/26 11:07:04.0173 3848 Null (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
2011/04/26 11:07:04.0345 3848 nvlddmkm (e70d10238e1c7463728d56920d1eb186) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/04/26 11:07:04.0657 3848 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/04/26 11:07:04.0704 3848 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/04/26 11:07:04.0735 3848 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/04/26 11:07:04.0938 3848 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/04/26 11:07:05.0031 3848 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/04/26 11:07:05.0187 3848 partmgr (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
2011/04/26 11:07:05.0250 3848 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/04/26 11:07:05.0297 3848 pci (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys
2011/04/26 11:07:05.0328 3848 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/04/26 11:07:05.0468 3848 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/04/26 11:07:05.0546 3848 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/04/26 11:07:05.0765 3848 PptpMiniport (6c359ac71d7b550a0d41f9db4563ce05) C:\Windows\system32\DRIVERS\raspptp.sys
2011/04/26 11:07:05.0811 3848 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/04/26 11:07:05.0889 3848 PSched (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
2011/04/26 11:07:06.0030 3848 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/04/26 11:07:06.0248 3848 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/04/26 11:07:06.0295 3848 QWAVEdrv (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
2011/04/26 11:07:06.0326 3848 RasAcd (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
2011/04/26 11:07:06.0373 3848 Rasl2tp (88587dd843e2059848995b407b67f6cf) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/04/26 11:07:06.0498 3848 RasPppoe (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/04/26 11:07:06.0545 3848 rdbss (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
2011/04/26 11:07:06.0591 3848 RDPCDD (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/04/26 11:07:06.0638 3848 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/04/26 11:07:06.0763 3848 RDPENCDD (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
2011/04/26 11:07:06.0810 3848 RDPWD (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
2011/04/26 11:07:07.0122 3848 rspndr (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
2011/04/26 11:07:07.0574 3848 RTL8169 (2d19a7469ea19993d0c12e627f4530bc) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/04/26 11:07:07.0746 3848 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/04/26 11:07:07.0839 3848 sdbus (7b3973cc28b8aa3e9e2e5d53e720e2c9) C:\Windows\system32\DRIVERS\sdbus.sys
2011/04/26 11:07:07.0871 3848 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/04/26 11:07:08.0011 3848 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/04/26 11:07:08.0042 3848 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/04/26 11:07:08.0105 3848 sermouse (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys
2011/04/26 11:07:08.0261 3848 sffdisk (51cf56aa8bcc241f134b420b8f850406) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/04/26 11:07:08.0292 3848 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/04/26 11:07:08.0323 3848 sffp_sd (8b08cab1267b2c377883fc9e56981f90) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/04/26 11:07:08.0370 3848 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/04/26 11:07:08.0510 3848 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/04/26 11:07:08.0588 3848 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/04/26 11:07:08.0619 3848 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/04/26 11:07:08.0760 3848 Smb (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys
2011/04/26 11:07:08.0807 3848 spldr (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
2011/04/26 11:07:08.0900 3848 sptd (d390675b8ce45e5fb359338e5e649329) C:\Windows\system32\Drivers\sptd.sys
2011/04/26 11:07:08.0900 3848 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: d390675b8ce45e5fb359338e5e649329
2011/04/26 11:07:08.0916 3848 sptd - detected Locked file (1)
2011/04/26 11:07:09.0041 3848 srv (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys
2011/04/26 11:07:09.0087 3848 srv2 (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys
2011/04/26 11:07:09.0134 3848 srvnet (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys
2011/04/26 11:07:09.0259 3848 ssmdrv (71d609c5dff067906d930bde031c4cfe) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/04/26 11:07:09.0353 3848 swenum (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys
2011/04/26 11:07:09.0384 3848 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/04/26 11:07:09.0462 3848 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/04/26 11:07:09.0540 3848 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/04/26 11:07:09.0587 3848 SynTP (a93e77225d7b32d270fbb6acc3df119b) C:\Windows\system32\DRIVERS\SynTP.sys
2011/04/26 11:07:09.0758 3848 Tcpip (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\drivers\tcpip.sys
2011/04/26 11:07:09.0930 3848 Tcpip6 (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\DRIVERS\tcpip.sys
2011/04/26 11:07:10.0070 3848 tcpipreg (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
2011/04/26 11:07:10.0133 3848 tdcmdpst (1825bceb47bf41c5a9f0e44de82fc27a) C:\Windows\system32\DRIVERS\tdcmdpst.sys
2011/04/26 11:07:10.0164 3848 TDPIPE (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
2011/04/26 11:07:10.0335 3848 TDTCP (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
2011/04/26 11:07:10.0382 3848 tdx (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys
2011/04/26 11:07:10.0460 3848 TermDD (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys
2011/04/26 11:07:10.0585 3848 tifm21 (28b7f973c36d157a7885b1ae42a4a2a9) C:\Windows\system32\drivers\tifm21.sys
2011/04/26 11:07:10.0835 3848 tosrfec (5c4103544612e5011ef46301b93d1aa6) C:\Windows\system32\DRIVERS\tosrfec.sys
2011/04/26 11:07:10.0944 3848 tssecsrv (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/04/26 11:07:11.0069 3848 tunmp (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys
2011/04/26 11:07:11.0115 3848 tunnel (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys
2011/04/26 11:07:11.0162 3848 TVALZ (792a8b80f8188aba4b2be271583f3e46) C:\Windows\system32\DRIVERS\TVALZ_O.SYS
2011/04/26 11:07:11.0209 3848 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/04/26 11:07:11.0349 3848 udfs (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys
2011/04/26 11:07:11.0412 3848 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/04/26 11:07:11.0443 3848 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/04/26 11:07:11.0599 3848 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/04/26 11:07:11.0630 3848 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/04/26 11:07:11.0677 3848 umbus (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys
2011/04/26 11:07:11.0739 3848 usbccgp (03b01e8dbd2da2b49157b7e51912aaf2) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/04/26 11:07:11.0880 3848 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/04/26 11:07:11.0942 3848 usbehci (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
2011/04/26 11:07:11.0973 3848 usbhub (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
2011/04/26 11:07:12.0114 3848 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/04/26 11:07:12.0145 3848 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
2011/04/26 11:07:12.0192 3848 USBSTOR (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/04/26 11:07:12.0363 3848 usbuhci (7747b902f6b7d0096f9c2bf55d3247f1) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/04/26 11:07:12.0488 3848 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys
2011/04/26 11:07:12.0551 3848 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/04/26 11:07:12.0597 3848 VgaSave (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
2011/04/26 11:07:12.0738 3848 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/04/26 11:07:12.0769 3848 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/04/26 11:07:12.0816 3848 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/04/26 11:07:12.0847 3848 volmgr (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys
2011/04/26 11:07:12.0972 3848 volmgrx (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
2011/04/26 11:07:13.0034 3848 volsnap (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys
2011/04/26 11:07:13.0081 3848 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/04/26 11:07:13.0143 3848 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/04/26 11:07:13.0268 3848 Wanarp (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/04/26 11:07:13.0299 3848 Wanarpv6 (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/04/26 11:07:13.0362 3848 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/04/26 11:07:13.0596 3848 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/04/26 11:07:13.0830 3848 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/04/26 11:07:13.0923 3848 WpdUsb (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/04/26 11:07:13.0970 3848 ws2ifsl (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
2011/04/26 11:07:14.0126 3848 WUDFRd (a2aafcc8a204736296d937c7c545b53f) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/04/26 11:07:14.0204 3848 ================================================================================
2011/04/26 11:07:14.0204 3848 Scan finished
2011/04/26 11:07:14.0204 3848 ================================================================================
2011/04/26 11:07:14.0220 1444 Detected object count: 1
2011/04/26 11:07:27.0995 1444 Locked file(sptd) - User select action: Skip

reni0686 · 26.04.2011, 10:23

Jetzt sind alle Dateien wieder da

Jetzt werde ich den letzten Schritt durchführen (laut cosinus):

Dann bitte jetzt CF ausführen:

ComboFix

reni0686 · 26.04.2011, 10:31

Nachdem ich den SystemCleaner durchgeführt habe, muss ich dann noch irgendetwas beachten, bzw. durchführen?

reni0686 · 26.04.2011, 12:06

Hiiiiiiiiiiiiilfe!!!! Jetzt hatte ich den PC kurz heruntergefahren und als ich ihn wieder hochgefahren habe ist dasselbe Problem wieder aufgetreten

((
Wieder alle Dateien weg...

Bitte helft mir!

reni0686 · 27.04.2011, 09:14

Problem gelöst

Ich hab jetzt auch direkt ein neues Antivirus-Programm

WTR Loader funktioniert nicht

Log-Analyse und Auswertung: WTR Loader funktioniert nicht