| |
| |||||||
Log-Analyse und Auswertung: Windows Recovery entfernt,Ordner leerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.05.2011, 17:51
| #1 |
 |  Windows Recovery entfernt,Ordner leer Guten Tag Hab mir Windows Recovery eingefangen und laut eurer Anleitung entfernt.Dafür schon mal Danke Dann hab ich mir gedacht ich(Esel) mach was besonders schlaues und folge dieser Anleitunghttp://www.trojaner-board.de/99504-w...chsichtig.html bis Kapersky hab ich(Esel)das auch gemacht nun komme ich aber nicht weiter.Ich(Esel)hoffe das ich nicht schon irgendeinen Mist fabriziert habe.Es wäre total toll wenn Ihr mir Helfen könntet bei der Lösung meines Problems. Guten Abend Hier ist noch die erste log von mbam. mfg |
|
29.05.2011, 10:42
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows Recovery entfernt,Ordner leer Der letzte Vollscan ist ja schon etwas her. Mach bitte ein Update über den Updatebutton in Malwarebytes und danach einen neuen Vollscan, alle etwaigen Funde entfernen und Log posten.
__________________
__________________ |
|
29.05.2011, 17:01
| #3 |
| | Windows Recovery entfernt,Ordner leer Hallo Arne
__________________Hier der log von Heute nach Vollscan und Danke das Du mir Hilfst Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6715 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 29.05.2011 17:57:52 mbam-log-2011-05-29 (17-57-52).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 346094 Laufzeit: 1 Stunde(n), 9 Minute(n), 51 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Geändert von Fehmarn (29.05.2011 um 17:09 Uhr) |
|
29.05.2011, 17:28
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Recovery entfernt,Ordner leer Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3b3279ff-862e-11e0-89ff-d912f24fa8d3}\Shell - "" = AutoRun
O33 - MountPoints2\{3b3279ff-862e-11e0-89ff-d912f24fa8d3}\Shell\AutoRun\command - "" = J:\EasySuite.exe
O33 - MountPoints2\{86b1ecef-6948-11dd-8a88-001d6018d391}\Shell - "" = AutoRun
[2011.05.22 16:12:10 | 000,000,000 | ---D | C] -- C:\ProgramData\logs
[2011.05.26 17:30:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie.job
[2011.05.26 17:26:49 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2011.05.22 11:40:48 | 000,000,144 | ---- | M] () -- C:\ProgramData\~44031736r
[2011.05.22 11:40:48 | 000,000,120 | ---- | M] () -- C:\ProgramData\~44031736
[2011.05.22 11:14:30 | 000,000,344 | ---- | M] () -- C:\ProgramData\44031736
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:B81398A8
:Commands
[purity]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
29.05.2011, 18:22
| #5 |
| | Windows Recovery entfernt,Ordner leer ========== OTL ========== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3b3279ff-862e-11e0-89ff-d912f24fa8d3}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3b3279ff-862e-11e0-89ff-d912f24fa8d3}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3b3279ff-862e-11e0-89ff-d912f24fa8d3}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3b3279ff-862e-11e0-89ff-d912f24fa8d3}\ not found. File J:\EasySuite.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86b1ecef-6948-11dd-8a88-001d6018d391}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86b1ecef-6948-11dd-8a88-001d6018d391}\ not found. C:\ProgramData\logs folder moved successfully. C:\Windows\Tasks\Erweiterte Garantie.job moved successfully. C:\Windows\System32\drivers\lvuvc.hs moved successfully. C:\ProgramData\~44031736r moved successfully. C:\ProgramData\~44031736 moved successfully. C:\ProgramData\44031736 moved successfully. ADS C:\ProgramData\TEMP:B81398A8 deleted successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.23.0 log created on 05292011_192026 |
|
29.05.2011, 18:39
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Recovery entfernt,Ordner leer Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ --> Windows Recovery entfernt,Ordner leer |
|
29.05.2011, 18:51
| #7 |
| | Windows Recovery entfernt,Ordner leer 2011/05/29 19:49:58.0948 5496 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24 2011/05/29 19:50:00.0976 5496 ================================================================================ 2011/05/29 19:50:00.0976 5496 SystemInfo: 2011/05/29 19:50:00.0976 5496 2011/05/29 19:50:00.0976 5496 OS Version: 6.0.6002 ServicePack: 2.0 2011/05/29 19:50:00.0976 5496 Product type: Workstation 2011/05/29 19:50:00.0976 5496 ComputerName: FESTUS-PC 2011/05/29 19:50:00.0976 5496 UserName: festus 2011/05/29 19:50:00.0976 5496 Windows directory: C:\Windows 2011/05/29 19:50:00.0976 5496 System windows directory: C:\Windows 2011/05/29 19:50:00.0976 5496 Processor architecture: Intel x86 2011/05/29 19:50:00.0976 5496 Number of processors: 4 2011/05/29 19:50:00.0976 5496 Page size: 0x1000 2011/05/29 19:50:00.0976 5496 Boot type: Normal boot 2011/05/29 19:50:00.0976 5496 ================================================================================ 2011/05/29 19:50:01.0475 5496 Initialize success 2011/05/29 19:50:06.0077 4024 ================================================================================ 2011/05/29 19:50:06.0077 4024 Scan started 2011/05/29 19:50:06.0092 4024 Mode: Manual; 2011/05/29 19:50:06.0092 4024 ================================================================================ 2011/05/29 19:50:07.0013 4024 a016bus (b021d0ae4605ce5df67f06e741278cdf) C:\Windows\system32\DRIVERS\a016bus.sys 2011/05/29 19:50:07.0091 4024 a016mdfl (5b6bc2de851012906d4aae84c802e3f2) C:\Windows\system32\DRIVERS\a016mdfl.sys 2011/05/29 19:50:07.0122 4024 a016mdm (c80cffb5819ccfc97f2b09e2259dfde6) C:\Windows\system32\DRIVERS\a016mdm.sys 2011/05/29 19:50:07.0169 4024 a016mgmt (415243177ff67d3cfba44d931b809bf3) C:\Windows\system32\DRIVERS\a016mgmt.sys 2011/05/29 19:50:07.0247 4024 a016obex (3a853f9b8b69541cde714a83a0a6434e) C:\Windows\system32\DRIVERS\a016obex.sys 2011/05/29 19:50:07.0309 4024 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys 2011/05/29 19:50:07.0403 4024 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys 2011/05/29 19:50:07.0528 4024 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys 2011/05/29 19:50:07.0574 4024 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys 2011/05/29 19:50:07.0621 4024 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys 2011/05/29 19:50:07.0730 4024 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys 2011/05/29 19:50:07.0762 4024 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys 2011/05/29 19:50:07.0808 4024 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 2011/05/29 19:50:07.0871 4024 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys 2011/05/29 19:50:07.0918 4024 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys 2011/05/29 19:50:07.0996 4024 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys 2011/05/29 19:50:08.0042 4024 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys 2011/05/29 19:50:08.0120 4024 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys 2011/05/29 19:50:08.0214 4024 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys 2011/05/29 19:50:08.0308 4024 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys 2011/05/29 19:50:08.0386 4024 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/05/29 19:50:08.0479 4024 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys 2011/05/29 19:50:08.0573 4024 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys 2011/05/29 19:50:08.0682 4024 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys 2011/05/29 19:50:08.0776 4024 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys 2011/05/29 19:50:08.0854 4024 AVMCOWAN (5685e9f471135e6675d981d5d45c9935) C:\Windows\system32\DRIVERS\AVMCOWAN.sys 2011/05/29 19:50:08.0932 4024 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 2011/05/29 19:50:09.0056 4024 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys 2011/05/29 19:50:09.0134 4024 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 2011/05/29 19:50:09.0181 4024 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 2011/05/29 19:50:09.0228 4024 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 2011/05/29 19:50:09.0290 4024 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 2011/05/29 19:50:09.0384 4024 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 2011/05/29 19:50:09.0462 4024 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 2011/05/29 19:50:09.0509 4024 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys 2011/05/29 19:50:09.0587 4024 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 2011/05/29 19:50:09.0665 4024 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys 2011/05/29 19:50:09.0743 4024 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys 2011/05/29 19:50:09.0805 4024 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys 2011/05/29 19:50:09.0868 4024 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys 2011/05/29 19:50:09.0914 4024 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys 2011/05/29 19:50:10.0024 4024 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys 2011/05/29 19:50:10.0102 4024 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys 2011/05/29 19:50:10.0195 4024 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys 2011/05/29 19:50:10.0242 4024 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys 2011/05/29 19:50:10.0351 4024 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys 2011/05/29 19:50:10.0429 4024 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys 2011/05/29 19:50:10.0476 4024 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys 2011/05/29 19:50:10.0570 4024 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 2011/05/29 19:50:10.0632 4024 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys 2011/05/29 19:50:10.0710 4024 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys 2011/05/29 19:50:10.0788 4024 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys 2011/05/29 19:50:10.0928 4024 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys 2011/05/29 19:50:11.0022 4024 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys 2011/05/29 19:50:11.0084 4024 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys 2011/05/29 19:50:11.0162 4024 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys 2011/05/29 19:50:11.0272 4024 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 2011/05/29 19:50:11.0334 4024 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 2011/05/29 19:50:11.0443 4024 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/05/29 19:50:11.0490 4024 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys 2011/05/29 19:50:11.0599 4024 FPCIBASE (58992bb216d65a3165be62b21b0b4196) C:\Windows\system32\DRIVERS\fpcibase.sys 2011/05/29 19:50:11.0740 4024 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\Windows\system32\FsUsbExDisk.SYS 2011/05/29 19:50:11.0818 4024 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys 2011/05/29 19:50:11.0896 4024 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\DRIVERS\gagp30kx.sys 2011/05/29 19:50:12.0020 4024 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 2011/05/29 19:50:12.0098 4024 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys 2011/05/29 19:50:12.0208 4024 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 2011/05/29 19:50:12.0270 4024 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 2011/05/29 19:50:12.0301 4024 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys 2011/05/29 19:50:12.0348 4024 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys 2011/05/29 19:50:12.0395 4024 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys 2011/05/29 19:50:12.0457 4024 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys 2011/05/29 19:50:12.0504 4024 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 2011/05/29 19:50:12.0598 4024 ialm (8318e04a6455ced1020bcc5039b62cfa) C:\Windows\system32\DRIVERS\ialmnt5.sys 2011/05/29 19:50:12.0676 4024 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys 2011/05/29 19:50:12.0769 4024 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 2011/05/29 19:50:12.0878 4024 IntcAzAudAddService (04bef1c4aa990e0d5851c7532fc8642c) C:\Windows\system32\drivers\RTKVHDA.sys 2011/05/29 19:50:13.0003 4024 intelide (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys 2011/05/29 19:50:13.0050 4024 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 2011/05/29 19:50:13.0097 4024 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2011/05/29 19:50:13.0190 4024 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys 2011/05/29 19:50:13.0253 4024 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 2011/05/29 19:50:13.0284 4024 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 2011/05/29 19:50:13.0346 4024 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys 2011/05/29 19:50:13.0393 4024 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys 2011/05/29 19:50:13.0440 4024 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 2011/05/29 19:50:13.0471 4024 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 2011/05/29 19:50:13.0518 4024 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 2011/05/29 19:50:13.0612 4024 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys 2011/05/29 19:50:13.0674 4024 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys 2011/05/29 19:50:13.0768 4024 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 2011/05/29 19:50:13.0846 4024 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys 2011/05/29 19:50:13.0924 4024 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys 2011/05/29 19:50:13.0955 4024 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys 2011/05/29 19:50:14.0048 4024 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 2011/05/29 19:50:14.0111 4024 LVPr2Mon (1a7db7a00a4b0d8da24cd691a4547291) C:\Windows\system32\DRIVERS\LVPr2Mon.sys 2011/05/29 19:50:14.0189 4024 LVRS (b6e1ccd6572984adcae68439afd07011) C:\Windows\system32\DRIVERS\lvrs.sys 2011/05/29 19:50:14.0345 4024 LVUVC (6c42815dd57e397f0cd988304b5eb4b3) C:\Windows\system32\DRIVERS\lvuvc.sys 2011/05/29 19:50:14.0610 4024 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys 2011/05/29 19:50:14.0688 4024 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 2011/05/29 19:50:14.0750 4024 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 2011/05/29 19:50:14.0797 4024 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 2011/05/29 19:50:14.0844 4024 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 2011/05/29 19:50:14.0922 4024 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 2011/05/29 19:50:14.0984 4024 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys 2011/05/29 19:50:15.0031 4024 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 2011/05/29 19:50:15.0062 4024 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 2011/05/29 19:50:15.0125 4024 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys 2011/05/29 19:50:15.0187 4024 mrxsmb (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/05/29 19:50:15.0250 4024 mrxsmb10 (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/05/29 19:50:15.0296 4024 mrxsmb20 (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/05/29 19:50:15.0390 4024 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys 2011/05/29 19:50:15.0437 4024 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys 2011/05/29 19:50:15.0499 4024 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 2011/05/29 19:50:15.0546 4024 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 2011/05/29 19:50:15.0624 4024 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 2011/05/29 19:50:15.0671 4024 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/05/29 19:50:15.0718 4024 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 2011/05/29 19:50:15.0780 4024 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys 2011/05/29 19:50:15.0842 4024 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 2011/05/29 19:50:15.0952 4024 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 2011/05/29 19:50:15.0998 4024 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys 2011/05/29 19:50:16.0076 4024 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys 2011/05/29 19:50:16.0139 4024 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys 2011/05/29 19:50:16.0186 4024 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/05/29 19:50:16.0232 4024 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/05/29 19:50:16.0326 4024 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/05/29 19:50:16.0388 4024 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 2011/05/29 19:50:16.0451 4024 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 2011/05/29 19:50:16.0513 4024 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys 2011/05/29 19:50:16.0607 4024 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 2011/05/29 19:50:16.0654 4024 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys 2011/05/29 19:50:16.0700 4024 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 2011/05/29 19:50:16.0794 4024 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys 2011/05/29 19:50:16.0872 4024 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 2011/05/29 19:50:16.0919 4024 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 2011/05/29 19:50:17.0028 4024 NVENETFD (d668632606d1cebf0b6ec64c1df7ed6f) C:\Windows\system32\DRIVERS\nvmfdx32.sys 2011/05/29 19:50:17.0356 4024 nvlddmkm (73a70f1d89c942eedd99a3f10459b051) C:\Windows\system32\DRIVERS\nvlddmkm.sys 2011/05/29 19:50:17.0761 4024 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys 2011/05/29 19:50:17.0839 4024 nvrd32 (1988af02f581ee0a0a0c4d920b7e272f) C:\Windows\system32\drivers\nvrd32.sys 2011/05/29 19:50:17.0933 4024 nvsmu (9aebc32f9d6e02ebee0369ab296fe7c8) C:\Windows\system32\drivers\nvsmu.sys 2011/05/29 19:50:18.0042 4024 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys 2011/05/29 19:50:18.0229 4024 nvstor32 (8ee374b6fb3cb2bb8d70395218b464a5) C:\Windows\system32\drivers\nvstor32.sys 2011/05/29 19:50:18.0307 4024 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys 2011/05/29 19:50:18.0572 4024 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys 2011/05/29 19:50:18.0822 4024 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 2011/05/29 19:50:18.0931 4024 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys 2011/05/29 19:50:19.0056 4024 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 2011/05/29 19:50:19.0212 4024 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys 2011/05/29 19:50:19.0290 4024 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys 2011/05/29 19:50:19.0368 4024 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys 2011/05/29 19:50:19.0430 4024 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 2011/05/29 19:50:19.0602 4024 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 2011/05/29 19:50:19.0680 4024 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys 2011/05/29 19:50:19.0742 4024 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys 2011/05/29 19:50:19.0836 4024 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\Windows\system32\Drivers\PxHelp20.sys 2011/05/29 19:50:19.0992 4024 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys 2011/05/29 19:50:20.0288 4024 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 2011/05/29 19:50:20.0398 4024 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 2011/05/29 19:50:20.0460 4024 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys 2011/05/29 19:50:20.0554 4024 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/05/29 19:50:20.0632 4024 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/05/29 19:50:20.0678 4024 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys 2011/05/29 19:50:20.0741 4024 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys 2011/05/29 19:50:20.0819 4024 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/05/29 19:50:20.0881 4024 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys 2011/05/29 19:50:20.0959 4024 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 2011/05/29 19:50:21.0022 4024 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys 2011/05/29 19:50:21.0115 4024 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 2011/05/29 19:50:21.0209 4024 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 2011/05/29 19:50:21.0318 4024 SE27bus (59a9eb4073a39895af314780d0a032fa) C:\Windows\system32\DRIVERS\SE27bus.sys 2011/05/29 19:50:21.0396 4024 SE27mdfl (d53e7e53107d1796825540129f8fe89f) C:\Windows\system32\DRIVERS\SE27mdfl.sys 2011/05/29 19:50:21.0474 4024 SE27mdm (2afa2f65a6e91da5b5070e734769827e) C:\Windows\system32\DRIVERS\SE27mdm.sys 2011/05/29 19:50:21.0536 4024 SE27mgmt (5a33a8d7b44c7bd8abe248b4dcd1ff3c) C:\Windows\system32\DRIVERS\SE27mgmt.sys 2011/05/29 19:50:21.0614 4024 se27nd5 (bb30139683bbf3ee89ec931393d9335c) C:\Windows\system32\DRIVERS\se27nd5.sys 2011/05/29 19:50:21.0724 4024 SE27obex (5da6ff71e94b9134ddd094ebb09f05e6) C:\Windows\system32\DRIVERS\SE27obex.sys 2011/05/29 19:50:21.0786 4024 se27unic (4d54a9d7c22157ab3d2442e8bcf5ecd2) C:\Windows\system32\DRIVERS\se27unic.sys 2011/05/29 19:50:21.0817 4024 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 2011/05/29 19:50:21.0880 4024 Serenum (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys 2011/05/29 19:50:21.0942 4024 Serial (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys 2011/05/29 19:50:21.0989 4024 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 2011/05/29 19:50:22.0067 4024 sffdisk (51cf56aa8bcc241f134b420b8f850406) C:\Windows\system32\drivers\sffdisk.sys 2011/05/29 19:50:22.0160 4024 sffp_mmc (96ded8b20c734ac41641ce275250e55d) C:\Windows\system32\drivers\sffp_mmc.sys 2011/05/29 19:50:22.0207 4024 sffp_sd (8b08cab1267b2c377883fc9e56981f90) C:\Windows\system32\drivers\sffp_sd.sys 2011/05/29 19:50:22.0254 4024 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 2011/05/29 19:50:22.0332 4024 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys 2011/05/29 19:50:22.0394 4024 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys 2011/05/29 19:50:22.0488 4024 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys 2011/05/29 19:50:22.0613 4024 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 2011/05/29 19:50:22.0706 4024 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys 2011/05/29 19:50:22.0738 4024 srv2 (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys 2011/05/29 19:50:22.0784 4024 srvnet (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys 2011/05/29 19:50:22.0909 4024 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys 2011/05/29 19:50:22.0972 4024 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 2011/05/29 19:50:23.0081 4024 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 2011/05/29 19:50:23.0128 4024 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 2011/05/29 19:50:23.0174 4024 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 2011/05/29 19:50:23.0268 4024 Tcpip (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\drivers\tcpip.sys 2011/05/29 19:50:23.0424 4024 Tcpip6 (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\DRIVERS\tcpip.sys 2011/05/29 19:50:23.0471 4024 tcpipreg (9bf343f4c878d6ad6922b2c5a4fefe0d) C:\Windows\system32\drivers\tcpipreg.sys 2011/05/29 19:50:23.0564 4024 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 2011/05/29 19:50:23.0627 4024 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 2011/05/29 19:50:23.0689 4024 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys 2011/05/29 19:50:23.0752 4024 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys 2011/05/29 19:50:23.0798 4024 TPM (cb258c2f726f1be73c507022be33ebb3) C:\Windows\system32\drivers\tpm.sys 2011/05/29 19:50:23.0908 4024 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/05/29 19:50:23.0954 4024 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 2011/05/29 19:50:24.0017 4024 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys 2011/05/29 19:50:24.0079 4024 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys 2011/05/29 19:50:24.0142 4024 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys 2011/05/29 19:50:24.0220 4024 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys 2011/05/29 19:50:24.0313 4024 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys 2011/05/29 19:50:24.0391 4024 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 2011/05/29 19:50:24.0485 4024 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 2011/05/29 19:50:24.0563 4024 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 2011/05/29 19:50:24.0688 4024 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys 2011/05/29 19:50:24.0766 4024 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 2011/05/29 19:50:24.0844 4024 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 2011/05/29 19:50:24.0906 4024 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys 2011/05/29 19:50:24.0984 4024 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys 2011/05/29 19:50:25.0046 4024 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys 2011/05/29 19:50:25.0109 4024 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys 2011/05/29 19:50:25.0202 4024 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys 2011/05/29 19:50:25.0280 4024 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2011/05/29 19:50:25.0343 4024 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys 2011/05/29 19:50:25.0405 4024 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys 2011/05/29 19:50:25.0499 4024 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/05/29 19:50:25.0592 4024 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 2011/05/29 19:50:25.0655 4024 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys 2011/05/29 19:50:25.0717 4024 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys 2011/05/29 19:50:25.0780 4024 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys 2011/05/29 19:50:25.0858 4024 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 2011/05/29 19:50:25.0951 4024 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys 2011/05/29 19:50:26.0029 4024 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys 2011/05/29 19:50:26.0092 4024 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys 2011/05/29 19:50:26.0170 4024 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 2011/05/29 19:50:26.0279 4024 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 2011/05/29 19:50:26.0294 4024 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 2011/05/29 19:50:26.0341 4024 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys 2011/05/29 19:50:26.0404 4024 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 2011/05/29 19:50:26.0560 4024 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys 2011/05/29 19:50:26.0622 4024 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 2011/05/29 19:50:26.0684 4024 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 2011/05/29 19:50:26.0825 4024 xnacc (69d5c58a3a03f86196db66ee95435652) C:\Windows\system32\DRIVERS\xnacc.sys 2011/05/29 19:50:26.0934 4024 xusb21 (a640c90b007762939507c28a021be3b3) C:\Windows\system32\DRIVERS\xusb21.sys 2011/05/29 19:50:26.0981 4024 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0 2011/05/29 19:50:26.0996 4024 ================================================================================ 2011/05/29 19:50:26.0996 4024 Scan finished 2011/05/29 19:50:26.0996 4024 ================================================================================ 2011/05/29 19:50:27.0012 1616 Detected object count: 0 2011/05/29 19:50:27.0012 1616 Actual detected object count: 0 |
|
29.05.2011, 20:04
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Recovery entfernt,Ordner leer Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.05.2011, 20:29
| #9 |
| | Windows Recovery entfernt,Ordner leer Combofix Logfile: Code:
ATTFilter ComboFix 11-05-28.01 - festus 29.05.2011 21:18:38.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3326.1937 [GMT 2:00]
ausgeführt von:: c:\users\festus\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\ST6UNST.000
c:\windows\system32\start.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-28 bis 2011-05-29 ))))))))))))))))))))))))))))))
.
.
2011-05-29 19:16 . 2011-05-29 19:17 -------- d-----w- C:\32788R22FWJFW
2011-05-27 13:04 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E2C76999-8CDF-4062-BAAE-6579F05A0023}\mpengine.dll
2011-05-26 16:54 . 2011-05-26 16:54 -------- d-----w- c:\program files\7-Zip
2011-05-25 18:49 . 2011-05-25 18:49 -------- d-----w- C:\_OTL
2011-05-24 20:38 . 2011-05-26 19:13 -------- d-----w- c:\users\Alfonso
2011-05-22 21:52 . 2011-05-22 21:52 -------- d-----w- c:\program files\Zone Labs
2011-05-22 16:26 . 2011-05-22 16:26 -------- d-----w- c:\users\festus\AppData\Roaming\Malwarebytes
2011-05-22 16:26 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-22 16:26 . 2011-05-22 16:26 -------- d-----w- c:\programdata\Malwarebytes
2011-05-22 16:26 . 2011-05-22 16:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-22 16:26 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-22 14:07 . 2011-05-22 14:07 -------- d-----w- c:\programdata\WindowsSearch
2011-05-10 21:04 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-11 06:42 . 2009-08-18 10:30 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-05-11 06:42 . 2009-08-18 10:24 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2011-04-01 03:11 . 2011-04-01 03:11 4333280 ----a-w- c:\windows\system32\drivers\lvuvc.sys
2011-04-01 03:10 . 2011-04-01 03:10 539232 ----a-w- c:\windows\system32\LVUI2RC.dll
2011-04-01 03:10 . 2011-04-01 03:10 543328 ----a-w- c:\windows\system32\LVUI2.dll
2011-04-01 03:09 . 2011-04-01 03:09 291424 ----a-w- c:\windows\system32\drivers\lvrs.sys
2011-04-01 03:08 . 2011-04-01 03:08 195168 ----a-w- c:\windows\system32\lvci13251014.dll
2011-04-01 03:08 . 2011-04-01 03:08 301664 ----a-w- c:\windows\system32\lvcodec2.dll
2011-04-01 03:07 . 2011-04-01 03:07 10877272 ----a-w- c:\windows\system32\LogiDPP.dll
2011-04-01 03:07 . 2011-04-01 03:07 102744 ----a-w- c:\windows\system32\LogiDPPApp.exe
2011-04-01 03:06 . 2011-04-01 03:06 331608 ----a-w- c:\windows\system32\DevManagerCore.dll
2011-04-01 02:56 . 2011-04-01 02:56 39318 ----a-w- c:\windows\system32\Repository.reg
2011-03-17 10:36 . 2009-05-15 20:25 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-12 21:55 . 2011-04-27 05:03 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-03-10 17:03 . 2011-04-14 16:30 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-14 16:30 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-14 16:30 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-27 05:03 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-27 05:03 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-27 05:03 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-27 05:03 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-27 05:03 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-27 05:03 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-14 16:30 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-03-02 15:44 . 2011-04-14 16:30 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2004-02-09 03:48 . 2005-07-04 15:35 899072 ----a-w- c:\program files\audiograbber.exe
2002-01-03 20:50 . 2005-07-04 15:35 155648 ----a-w- c:\program files\WMA8Connect.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
.
c:\users\festus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Internet.lnk - c:\program files\FRITZ!DSL\FritzDsl.exe [2009-7-27 987960]
FRITZ!DSL Protect.lnk - c:\program files\FRITZ!DSL\FwebProt.exe [2009-4-9 1061688]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-09-22 16:11 640440 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2011-01-30 23:36 38840 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-10-19 02:12 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2009-09-04 01:43 767312 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-03-05 15:32 1135912 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 11:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 16:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-01-09 17:50 4186112 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 02:25 144784 ----a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
"ehTray.exe"=c:\windows\ehome\ehTray.exe
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"toolbar_eula_launcher"=c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"NPSStartup"=
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c98a464d07d08f;Google Update Service (gupdate1c98a464d07d08f);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x32.sys [x]
R3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys [2006-11-02 559104]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-04-07 36608]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files\FRITZ!DSL\IGDCTRL.EXE [2009-07-28 73528]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN-CAPI-Treiber;c:\windows\system32\DRIVERS\AVMCOWAN.sys [2007-05-07 64512]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 84567296
*Deregistered* - 84567296
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 23:37]
.
2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 23:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://home.sweetim.com
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Mit FRITZ!Box Anrufen - c:\program files\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm
IE: Mit FRITZ!Box Anrufen\Contexts - 16 (0x10)
IE: Mit FRITZ!Box Anrufen\Flags
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{328ECD19-C167-40eb-A0C7-16FE7634105F} - {CC68A724-B5F7-4bd3-865C-7D97141A140F} - c:\program files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\program files\FRITZ!DSL\\sarah.dll
TCP: DhcpNameServer = 192.168.178.1
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKU-Default-Run-FRITZ!protect - FwebProt.exe
MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-Akamai - c:\program files\common files\akamai\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-05-29 21:24
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3263393759-1971768068-229383545-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:82,c5,aa,99,5e,80,c4,bf,74,76,71,ad,7a,30,ff,be,e3,f7,da,d4,44,29,03,
0b,f6,5e,80,ee,d0,ee,99,15,17,fe,bb,4f,49,b9,80,87,d2,8d,18,6a,4e,73,ae,cd,\
"??"=hex:69,39,63,c4,f5,8e,b1,30,eb,47,fd,2b,a1,69,05,03
.
[HKEY_USERS\S-1-5-21-3263393759-1971768068-229383545-1002\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:39,47,9f,5f,e6,f0,9d,6a,51,c8,c2,86,e7,21,78,cd,1d,4d,d8,53,1b,
1a,6c,f4,60,2d,1c,61,e9,23,1c,94,c4,08,78,6d,b9,30,8a,1b,14,db,a1,61,b8,08,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{17f75029-2ceb-4031-a1f4-9c147d4e2e5c}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:2a000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{1898006a-8e09-43f8-a553-6c5ae9d2349b}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:58000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{268efa2a-b4cf-449b-b19a-b95bfa3aa991}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:18000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{2e446d68-4dc8-4138-b52e-7ff7eaddb981}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0b001d60
"Dhcpv6State"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{34329462-655a-4f7d-85f8-0c071f039559}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0c001d60
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{52f23abf-269d-48c3-8c3a-4a17418c854d}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:68020054
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{58517d85-56fa-46d0-9937-03784925d92d}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:5a000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9097fef5-ac99-4ddd-a293-50e8a118e37f}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:65000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:07001422
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ad802850-6136-4b7f-a185-60a990fe4c29}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:44000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{b30ea679-46e2-4d60-9083-2a973b7bc1dc}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:61000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{c6b43f04-3881-4ce5-929b-03d5faac4100}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:31000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{c95caa35-daa9-4770-81ca-7277185eb887}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:23000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{d60428d6-f4c5-4bfe-a509-6d2a76dff616}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:32000000
"Dhcpv6State"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:06001422
"Dhcpv6State"=dword:00000000
.
Zeit der Fertigstellung: 2011-05-29 21:27:06
ComboFix-quarantined-files.txt 2011-05-29 19:27
.
Vor Suchlauf: 19 Verzeichnis(se), 393.971.408.896 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 394.016.354.304 Bytes frei
.
- - End Of File - - DB7CE41A5B79C786D9EFA33CB22DC83F
|
|
30.05.2011, 10:45
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Recovery entfernt,Ordner leer Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter Folder::
C:\32788R22FWJFW
c:\program files\Zone Labs
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.05.2011, 15:23
| #11 |
| | Windows Recovery entfernt,Ordner leer Hallo Arne Alles wie beschrieben ausgeführt aber nach Neustart hat das Programm nicht gefragt. Hier die log nach Neustart: Combofix Logfile: Code:
ATTFilter ComboFix 11-05-29.02 - festus 30.05.2011 15:55:06.2.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3326.2296 [GMT 2:00]
ausgeführt von:: c:\users\festus\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\festus\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\32788R22FWJFW
c:\program files\Zone Labs
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\cp_ini\za_base.ini
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\cp_ini\za_fulldumps.ini
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\cp_ini\za_minidumps.ini
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\cpinfo.exe
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\cpinfo.ini
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\DiagnosticsCaptureTool.exe
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\kave.ini
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\osrbang.exe
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\vsinit.dll
c:\program files\Zone Labs\ZoneAlarm\Diagnostics\vsutil.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-28 bis 2011-05-30 ))))))))))))))))))))))))))))))
.
.
2011-05-30 14:01 . 2011-05-30 14:01 -------- d-----w- c:\users\festus\AppData\Local\temp
2011-05-30 14:01 . 2011-05-30 14:01 -------- d-----w- c:\users\Gast\AppData\Local\temp
2011-05-30 14:01 . 2011-05-30 14:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-30 13:40 . 2011-05-30 13:40 8782 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2011-05-30 13:40 . 2011-05-30 13:40 7271 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2011-05-30 13:40 . 2011-05-30 13:40 23327 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2011-05-29 19:17 . 2011-05-29 19:27 -------- d-----w- C:\cofi
2011-05-27 13:04 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E2C76999-8CDF-4062-BAAE-6579F05A0023}\mpengine.dll
2011-05-26 16:54 . 2011-05-26 16:54 -------- d-----w- c:\program files\7-Zip
2011-05-25 18:49 . 2011-05-25 18:49 -------- d-----w- C:\_OTL
2011-05-24 20:38 . 2011-05-26 19:13 -------- d-----w- c:\users\Alfonso
2011-05-22 16:26 . 2011-05-22 16:26 -------- d-----w- c:\users\festus\AppData\Roaming\Malwarebytes
2011-05-22 16:26 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-22 16:26 . 2011-05-22 16:26 -------- d-----w- c:\programdata\Malwarebytes
2011-05-22 16:26 . 2011-05-22 16:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-22 16:26 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-22 14:07 . 2011-05-22 14:07 -------- d-----w- c:\programdata\WindowsSearch
2011-05-10 21:04 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-11 06:42 . 2009-08-18 10:30 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-05-11 06:42 . 2009-08-18 10:24 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2011-04-01 03:11 . 2011-04-01 03:11 4333280 ----a-w- c:\windows\system32\drivers\lvuvc.sys
2011-04-01 03:10 . 2011-04-01 03:10 539232 ----a-w- c:\windows\system32\LVUI2RC.dll
2011-04-01 03:10 . 2011-04-01 03:10 543328 ----a-w- c:\windows\system32\LVUI2.dll
2011-04-01 03:09 . 2011-04-01 03:09 291424 ----a-w- c:\windows\system32\drivers\lvrs.sys
2011-04-01 03:08 . 2011-04-01 03:08 195168 ----a-w- c:\windows\system32\lvci13251014.dll
2011-04-01 03:08 . 2011-04-01 03:08 301664 ----a-w- c:\windows\system32\lvcodec2.dll
2011-04-01 03:07 . 2011-04-01 03:07 10877272 ----a-w- c:\windows\system32\LogiDPP.dll
2011-04-01 03:07 . 2011-04-01 03:07 102744 ----a-w- c:\windows\system32\LogiDPPApp.exe
2011-04-01 03:06 . 2011-04-01 03:06 331608 ----a-w- c:\windows\system32\DevManagerCore.dll
2011-04-01 02:56 . 2011-04-01 02:56 39318 ----a-w- c:\windows\system32\Repository.reg
2011-03-17 10:36 . 2009-05-15 20:25 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-12 21:55 . 2011-04-27 05:03 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-03-10 17:03 . 2011-04-14 16:30 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-14 16:30 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-14 16:30 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-27 05:03 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-27 05:03 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-27 05:03 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-27 05:03 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-27 05:03 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-27 05:03 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-14 16:30 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-03-02 15:44 . 2011-04-14 16:30 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2004-02-09 03:48 . 2005-07-04 15:35 899072 ----a-w- c:\program files\audiograbber.exe
2002-01-03 20:50 . 2005-07-04 15:35 155648 ----a-w- c:\program files\WMA8Connect.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
.
c:\users\festus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Internet.lnk - c:\program files\FRITZ!DSL\FritzDsl.exe [2009-7-27 987960]
FRITZ!DSL Protect.lnk - c:\program files\FRITZ!DSL\FwebProt.exe [2009-4-9 1061688]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-09-22 16:11 640440 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2011-01-30 23:36 38840 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-10-19 02:12 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2009-09-04 01:43 767312 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-03-05 15:32 1135912 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 11:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 16:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-01-09 17:50 4186112 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 02:25 144784 ----a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
"ehTray.exe"=c:\windows\ehome\ehTray.exe
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"toolbar_eula_launcher"=c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"NPSStartup"=
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c98a464d07d08f;Google Update Service (gupdate1c98a464d07d08f);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x32.sys [x]
R3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys [2006-11-02 559104]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-04-07 36608]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files\FRITZ!DSL\IGDCTRL.EXE [2009-07-28 73528]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN-CAPI-Treiber;c:\windows\system32\DRIVERS\AVMCOWAN.sys [2007-05-07 64512]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 23:37]
.
2011-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 23:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://home.sweetim.com
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Mit FRITZ!Box Anrufen - c:\program files\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm
IE: Mit FRITZ!Box Anrufen\Contexts - 16 (0x10)
IE: Mit FRITZ!Box Anrufen\Flags
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{328ECD19-C167-40eb-A0C7-16FE7634105F} - {CC68A724-B5F7-4bd3-865C-7D97141A140F} - c:\program files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\program files\FRITZ!DSL\\sarah.dll
TCP: DhcpNameServer = 192.168.178.1
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-05-30 16:01
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3263393759-1971768068-229383545-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:82,c5,aa,99,5e,80,c4,bf,74,76,71,ad,7a,30,ff,be,e3,f7,da,d4,44,29,03,
0b,f6,5e,80,ee,d0,ee,99,15,17,fe,bb,4f,49,b9,80,87,d2,8d,18,6a,4e,73,ae,cd,\
"??"=hex:69,39,63,c4,f5,8e,b1,30,eb,47,fd,2b,a1,69,05,03
.
[HKEY_USERS\S-1-5-21-3263393759-1971768068-229383545-1002\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:39,47,9f,5f,e6,f0,9d,6a,51,c8,c2,86,e7,21,78,cd,1d,4d,d8,53,1b,
1a,6c,f4,60,2d,1c,61,e9,23,1c,94,c4,08,78,6d,b9,30,8a,1b,14,db,a1,61,b8,08,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-05-30 16:04:13
ComboFix-quarantined-files.txt 2011-05-30 14:04
ComboFix2.txt 2011-05-29 19:27
.
Vor Suchlauf: 21 Verzeichnis(se), 392.027.197.440 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 391.991.562.240 Bytes frei
.
- - End Of File - - E279297B02DFC92258001BB29795EC17
|
|
30.05.2011, 16:13
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Recovery entfernt,Ordner leer Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.05.2011, 17:21
| #13 |
| | Windows Recovery entfernt,Ordner leer GMER Logfile: Code:
ATTFilter GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-05-30 18:19:45
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\000000a9 ST350083 rev.3.AA
Running: f2hlo0cs.exe; Driver: C:\Users\festus\AppData\Local\Temp\pwriipow.sys
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!EnableWindow 76B3CD8B 5 Bytes JMP 6DB69884 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!DialogBoxParamW 76B610B0 5 Bytes JMP 6DAC15BB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!DialogBoxIndirectParamW 76B62EF5 5 Bytes JMP 6DCB590F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!DialogBoxParamA 76B78152 5 Bytes JMP 6DCB58AA C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!DialogBoxIndirectParamA 76B7847D 5 Bytes JMP 6DCB5974 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!MessageBoxIndirectA 76B8D4D9 5 Bytes JMP 6DCB5831 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!MessageBoxIndirectW 76B8D5D3 5 Bytes JMP 6DCB57B8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!MessageBoxExA 76B8D639 5 Bytes JMP 6DCB5754 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3736] USER32.dll!MessageBoxExW 76B8D65D 5 Bytes JMP 6DCB56F0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] kernel32.dll!CreateThread 7744C90E 5 Bytes JMP 6DB27133 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateDialogParamW 76B372A2 5 Bytes JMP 6DCB5C79 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!GetAsyncKeyState 76B3863C 2 Bytes JMP 6DB0DC09 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!GetAsyncKeyState + 3 76B3863F 2 Bytes [FD, F6]
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!SetWindowsHookExW 76B387AD 5 Bytes JMP 6DB61FE4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CallNextHookEx 76B38E3B 5 Bytes JMP 6DB87AEF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!UnhookWindowsHookEx 76B398DB 5 Bytes JMP 6DBAEB70 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!EnableWindow 76B3CD8B 5 Bytes JMP 6DB69884 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!DefWindowProcA 76B3DB88 7 Bytes JMP 6DB29345 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateWindowExA 76B3DC2A 2 Bytes JMP 6DB33173 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateWindowExA + 3 76B3DC2D 2 Bytes [FF, F6] {PUSH ESI}
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateWindowExW 76B41305 5 Bytes JMP 6DB8FF57 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!GetKeyState 76B48CB1 5 Bytes JMP 6DB0DAE3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!DefWindowProcW 76B503B4 7 Bytes JMP 6DB87B52 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!IsDialogMessageW 76B50745 5 Bytes JMP 6DCB6406 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateDialogParamA 76B517AA 5 Bytes JMP 6DCB5C41 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!IsDialogMessage 76B51847 5 Bytes JMP 6DCB63DE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateDialogIndirectParamA 76B526F1 5 Bytes JMP 6DCB5CB1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!CreateDialogIndirectParamW 76B59A62 5 Bytes JMP 6DCB5CE9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!SetKeyboardState 76B60987 5 Bytes JMP 6DCB6CCD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!DialogBoxParamW 76B610B0 5 Bytes JMP 6DAC15BB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!DialogBoxIndirectParamW 76B62EF5 5 Bytes JMP 6DCB590F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!SendInput 76B62F75 5 Bytes JMP 6DCB6C75 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!EndDialog 76B6326E 5 Bytes JMP 6DCB66B2 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!SetCursorPos 76B76FB2 5 Bytes JMP 6DCB6D4E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!DialogBoxParamA 76B78152 5 Bytes JMP 6DCB58AA C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!DialogBoxIndirectParamA 76B7847D 5 Bytes JMP 6DCB5974 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!MessageBoxIndirectA 76B8D4D9 5 Bytes JMP 6DCB5831 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!MessageBoxIndirectW 76B8D5D3 5 Bytes JMP 6DCB57B8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!MessageBoxExA 76B8D639 5 Bytes JMP 6DCB5754 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!MessageBoxExW 76B8D65D 5 Bytes JMP 6DCB56F0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] USER32.dll!keybd_event 76B8D972 5 Bytes JMP 6DCB6C32 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] SHELL32.dll!SHRestricted + D95 75EB89A8 4 Bytes [37, 01, 6D, 6F] {AAA ; ADD [EBP+0x6f], EBP}
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] SHELL32.dll!SHRestricted + D9D 75EB89B0 8 Bytes [60, 61, 6C, 6F, E1, F6, 6C, ...] {PUSHA ; POPA ; INSB ; OUTSD ; LOOPZ 0xfffffffffffffffc; INSB ; OUTSD }
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] ole32.dll!OleLoadFromStream 76E01E80 5 Bytes JMP 6DCB6110 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[6100] ole32.dll!CoCreateInstance 76E39F3E 5 Bytes JMP 6DB8B6D4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
|
|
30.05.2011, 17:32
| #14 |
| | Windows Recovery entfernt,Ordner leer OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 18:31:02 on 30.05.2011 OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Opera Software Opera Internet Browser 11.11 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl "ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl "nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL "Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "AVM ISDN CoNDIS WAN-CAPI-Treiber" (AVMCOWAN) - "AVM GmbH" - C:\Windows\System32\DRIVERS\AVMCOWAN.sys "catchme" (catchme) - ? - C:\Users\festus\AppData\Local\Temp\catchme.sys (File not found) "cpuz135" (cpuz135) - ? - C:\Windows\TEMP\cpuz135\cpuz135_x32.sys (File not found) "FsUsbExDisk" (FsUsbExDisk) - ? - C:\Windows\system32\FsUsbExDisk.SYS (File found, but it contains no detailed information) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "PCCS Mode Change Filter Driver" (pccsmcfd) - ? - C:\Windows\System32\DRIVERS\pccsmcfd.sys (File not found) "pwriipow" (pwriipow) - ? - C:\Users\festus\AppData\Local\Temp\pwriipow.sys (Hidden registry entry, rootkit activity | File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys "SANDRA" (SANDRA) - ? - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\Sandra.sys (File not found) "Sony Ericsson Device 039 Driver driver (WDM)" (SE27bus) - "MCCI" - C:\Windows\System32\DRIVERS\SE27bus.sys "Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)" (se27nd5) - "MCCI" - C:\Windows\System32\DRIVERS\se27nd5.sys "Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)" (se27unic) - "MCCI" - C:\Windows\System32\DRIVERS\se27unic.sys "Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)" (SE27mgmt) - "MCCI" - C:\Windows\System32\DRIVERS\SE27mgmt.sys "Sony Ericsson Device 039 USB WMC Modem Driver" (SE27mdm) - "MCCI" - C:\Windows\System32\DRIVERS\SE27mdm.sys "Sony Ericsson Device 039 USB WMC Modem Filter" (SE27mdfl) - "MCCI" - C:\Windows\System32\DRIVERS\SE27mdfl.sys "Sony Ericsson Device 039 USB WMC OBEX Interface" (SE27obex) - "MCCI" - C:\Windows\System32\DRIVERS\SE27obex.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.dll {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\Display\nvui.dll {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL {00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll {B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll {7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {52B87208-9CCF-42C9-B88E-069281105805} "Trojan Remover Shell Extension" - ? - (File not found | COM-object registry key not found) {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll (File found, but it contains no detailed information) [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {21347690-EC41-4F9A-8887-1F4AEE672439} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "Klicke hier um das Projekt xp-AntiSpy zu unterstützen" - ? - C:\Program Files\xp-AntiSpy\sponsoring\sponsor.html -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll <binary data> "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found) <binary data> "Winamp Toolbar" - "AOL LLC" - C:\Program Files\Winamp Toolbar\winamptb.dll <binary data> "{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {EF99BD32-C1FB-11D2-892F-0090271D4F88} "Yahoo! Toolbar" - "Yahoo! Inc." - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? - (File not found | COM-object registry key not found) / file:///C:/Windows/Java/classes/xmldso.cab {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} "{D1E7CBDA-E60E-4970-A01C-37301EF7BF98}" - ? - (File not found | COM-object registry key not found) / hxxp://clients.futuremark.com/openapi/receivers/FMSI.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {CC68A724-B5F7-4bd3-865C-7D97141A140F} "FRITZ!Box AddOn" - "AVM Berlin" - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL {77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} "Winamp Toolbar" - "AOL LLC" - C:\Program Files\Winamp Toolbar\winamptb.dll <binary data> "Yahoo! Toolbar" - "Yahoo! Inc." - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {02478D38-C3F9-4efb-9B51-7695ECA05670} "&Yahoo! Toolbar Helper" - "Yahoo! Inc." - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} "Canon Easy-WebPrint EX BHO" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {22BF413B-C6D2-4d91-82A9-A0F997BA588C} "Skype add-on (mastermind)" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll {F4971EE7-DAA0-4053-9964-665D8EE6A077} "SmartSelect Class" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll {C0C86BBE-9509-4296-8459-FDBFDAF4B673} "SplitButtonBHO Class" - "AVM Berlin" - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} "Winamp Toolbar BHO" - "AOL LLC" - C:\Program Files\Winamp Toolbar\winamptb.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\festus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "FRITZ!DSL Internet.lnk" - "AVM Berlin" - C:\Program Files\FRITZ!DSL\FritzDsl.exe (Shortcut exists | File exists) "FRITZ!DSL Protect.lnk" - "AVM Berlin" - C:\Program Files\FRITZ!DSL\FwebProt.exe (Shortcut exists | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "HP Digital Imaging Monitor.lnk" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk (Shortcut exists | File not found) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "ISUSPM" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler "SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Adobe PDF Port Monitor" - "Adobe Systems Inc" - C:\Windows\system32\AdobePDF.dll "Canon BJ Language Monitor MP250 series" - "CANON INC." - C:\Windows\system32\CNMLM9W.DLL "PCL hpz3l4v2" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l4v2.dll "PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll (File found, but it contains no detailed information) "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "AVM IGD CTRL Service" (IGDCTRL) - "AVM Berlin" - C:\Program Files\FRITZ!DSL\IGDCTRL.EXE "Canon Inkjet Printer/Scanner/Fax Extended Survey Program" (IJPLMSVC) - ? - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE "FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe "Google Update Service (gupdate1c98a464d07d08f)" (gupdate1c98a464d07d08f) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll "hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe "LiveShare P2P Server 9" (RoxLiveShare9) - ? - "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" (File not found) "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe "Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll "NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe "NVIDIA Driver Helper Service" (NVSvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll "PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe (File found, but it contains no detailed information) "Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe "Roxio UPnP Renderer 9" (Roxio UPnP Renderer 9) - ? - "C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe" (File not found) "Roxio Upnp Server 9" (Roxio Upnp Server 9) - ? - "C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe" (File not found) "SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe "stllssvr" (stllssvr) - ? - "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe" (File not found) "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "Sarah NSP" - "AVM Berlin" - C:\Program Files\FRITZ!DSL\sarah.dll -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )----- "SARAH LSP" - "AVM Berlin" - C:\Program Files\FRITZ!DSL\sarah.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
30.05.2011, 17:36
| #15 |
| | Windows Recovery entfernt,Ordner leer MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: Packard Bell BV BIOS Manufacturer: Phoenix Technologies, LTD System Manufacturer: Packard Bell BV System Product Name: iPower X9093 Logical Drives Mask: 0x000001fc Kernel Drivers (total 148): 0x82C3A000 \SystemRoot\system32\ntkrnlpa.exe 0x82C07000 \SystemRoot\system32\hal.dll 0x8060F000 \SystemRoot\system32\kdcom.dll 0x80616000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x80686000 \SystemRoot\system32\PSHED.dll 0x80697000 \SystemRoot\system32\BOOTVID.dll 0x8069F000 \SystemRoot\system32\CLFS.SYS 0x806E0000 \SystemRoot\system32\CI.dll 0x83209000 \SystemRoot\system32\drivers\Wdf01000.sys 0x83285000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x83292000 \SystemRoot\system32\drivers\acpi.sys 0x832D8000 \SystemRoot\system32\drivers\WMILIB.SYS 0x832E1000 \SystemRoot\system32\drivers\msisadrv.sys 0x832E9000 \SystemRoot\system32\drivers\pci.sys 0x83310000 \SystemRoot\System32\drivers\partmgr.sys 0x8331F000 \SystemRoot\system32\drivers\volmgr.sys 0x8332E000 \SystemRoot\System32\drivers\volmgrx.sys 0x83378000 \SystemRoot\system32\drivers\pciide.sys 0x8337F000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x8338D000 \SystemRoot\System32\drivers\mountmgr.sys 0x8339D000 \SystemRoot\system32\drivers\nvraid.sys 0x833B6000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x833D7000 \SystemRoot\system32\drivers\atapi.sys 0x833DF000 \SystemRoot\system32\drivers\ataport.SYS 0x807C0000 \SystemRoot\system32\drivers\nvstor32.sys 0x8B800000 \SystemRoot\system32\drivers\storport.sys 0x8B841000 \SystemRoot\system32\drivers\fltmgr.sys 0x8B873000 \SystemRoot\system32\drivers\fileinfo.sys 0x8B883000 \SystemRoot\System32\Drivers\PxHelp20.sys 0x8B88C000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8BA0F000 \SystemRoot\system32\drivers\ndis.sys 0x8BB1A000 \SystemRoot\system32\drivers\msrpc.sys 0x8BB45000 \SystemRoot\system32\drivers\NETIO.SYS 0x8B8FD000 \SystemRoot\System32\drivers\tcpip.sys 0x8BB80000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8BC03000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8BD13000 \SystemRoot\system32\drivers\volsnap.sys 0x8BD4C000 \SystemRoot\System32\Drivers\spldr.sys 0x8BD54000 \SystemRoot\System32\Drivers\mup.sys 0x8BD63000 \SystemRoot\System32\drivers\ecache.sys 0x8BD8A000 \SystemRoot\system32\DRIVERS\gagp30kx.sys 0x8BD9B000 \SystemRoot\system32\drivers\disk.sys 0x8BDAC000 \SystemRoot\system32\drivers\crcdisk.sys 0x8BDF1000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8BB9B000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x8BBA4000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x90E00000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x917FA000 \SystemRoot\System32\Drivers\nvBridge.kmd 0x91807000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x918A7000 \SystemRoot\System32\drivers\watchdog.sys 0x918B3000 \SystemRoot\system32\DRIVERS\serial.sys 0x918CD000 \SystemRoot\system32\DRIVERS\serenum.sys 0x918D7000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x918E1000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x9191F000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x9192E000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x91946000 \SystemRoot\system32\DRIVERS\ohci1394.sys 0x91956000 \SystemRoot\system32\DRIVERS\1394BUS.SYS 0x91964000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x91A02000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys 0x91AFF000 \SystemRoot\system32\DRIVERS\AVMCOWAN.sys 0x91C0C000 \SystemRoot\system32\DRIVERS\ialmnt5.sys 0x91D4A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0x91D6B000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x91D9A000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x91DA5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x91DBC000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x91DC7000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x91DEA000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x91B12000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x91B26000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x91B3B000 \SystemRoot\system32\DRIVERS\termdd.sys 0x91C00000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x91B4B000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x91DF9000 \SystemRoot\system32\DRIVERS\swenum.sys 0x91B64000 \SystemRoot\system32\DRIVERS\ks.sys 0x91B8E000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x91B98000 \SystemRoot\system32\DRIVERS\umbus.sys 0x91BA5000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x91BDA000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x9200A000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x9219D000 \SystemRoot\system32\drivers\portcls.sys 0x921CA000 \SystemRoot\system32\drivers\drmk.sys 0x921EF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x921F8000 \SystemRoot\System32\Drivers\Null.SYS 0x92000000 \SystemRoot\System32\Drivers\Beep.SYS 0x91BEB000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x91BF2000 \SystemRoot\System32\drivers\vga.sys 0x91B56000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x919F1000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8BBB3000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8BBBE000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8BBCC000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x8BBD5000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8BBEB000 \SystemRoot\system32\DRIVERS\smb.sys 0x9240D000 \SystemRoot\system32\drivers\afd.sys 0x92455000 \SystemRoot\System32\DRIVERS\netbt.sys 0x92487000 \SystemRoot\system32\drivers\ws2ifsl.sys 0x92490000 \SystemRoot\system32\DRIVERS\pacer.sys 0x924A6000 \SystemRoot\system32\DRIVERS\netbios.sys 0x924B4000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x924C7000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0x924CD000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x92509000 \SystemRoot\system32\drivers\nsiproxy.sys 0x92513000 \SystemRoot\System32\Drivers\dfsc.sys 0x9252A000 \SystemRoot\system32\DRIVERS\avipbb.sys 0x92550000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x92567000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x92569000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys 0x9260F000 \SystemRoot\system32\DRIVERS\lvuvc.sys 0x92A30000 \SystemRoot\system32\drivers\usbaudio.sys 0x92A42000 \SystemRoot\system32\DRIVERS\lvrs.sys 0x92A88000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0x92A9D000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x92AA6000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x92AB6000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x92ABF000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x92AC7000 \SystemRoot\System32\Drivers\crashdmp.sys 0x92AD4000 \SystemRoot\System32\Drivers\dump_diskdump.sys 0x92ADE000 \SystemRoot\System32\Drivers\dump_nvstor32.sys 0x9C260000 \SystemRoot\System32\win32k.sys 0x92B03000 \SystemRoot\System32\drivers\Dxapi.sys 0x92B0D000 \SystemRoot\system32\DRIVERS\monitor.sys 0x9C480000 \SystemRoot\System32\TSDDD.dll 0x9C4A0000 \SystemRoot\System32\cdd.dll 0x92B1C000 \SystemRoot\system32\drivers\luafv.sys 0x92B37000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0xA4A02000 \SystemRoot\system32\drivers\spsys.sys 0xA4AB2000 \SystemRoot\system32\DRIVERS\lltdio.sys 0xA4AC2000 \SystemRoot\system32\DRIVERS\rspndr.sys 0xA4AFC000 \SystemRoot\system32\drivers\HTTP.sys 0xA4B69000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xA4B86000 \SystemRoot\system32\DRIVERS\bowser.sys 0xA4B9F000 \SystemRoot\System32\drivers\mpsdrv.sys 0xA4BB4000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x92B54000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xA4BD3000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x92B8D000 \SystemRoot\System32\DRIVERS\srv2.sys 0x9256B000 \SystemRoot\System32\DRIVERS\srv.sys 0xA7806000 \SystemRoot\system32\drivers\peauth.sys 0xA78E4000 \SystemRoot\System32\Drivers\secdrv.SYS 0xA78EE000 \SystemRoot\System32\drivers\tcpipreg.sys 0xA78FA000 \SystemRoot\system32\DRIVERS\WUDFRd.sys 0xA790F000 \SystemRoot\system32\DRIVERS\WUDFPf.sys 0xA7921000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys 0xA7926000 \SystemRoot\system32\DRIVERS\cdfs.sys 0xA793C000 \??\C:\Users\festus\AppData\Local\Temp\pwriipow.sys 0x774E0000 \Windows\System32\ntdll.dll Processes (total 73): 0 System Idle Process 4 System 476 C:\Windows\System32\smss.exe 544 csrss.exe 612 C:\Windows\System32\wininit.exe 624 csrss.exe 656 C:\Windows\System32\services.exe 672 C:\Windows\System32\lsass.exe 688 C:\Windows\System32\lsm.exe 844 C:\Windows\System32\svchost.exe 928 C:\Windows\System32\nvvsvc.exe 952 C:\Windows\System32\winlogon.exe 996 C:\Windows\System32\svchost.exe 1056 C:\Windows\System32\svchost.exe 1084 C:\Windows\System32\svchost.exe 1112 C:\Windows\System32\svchost.exe 1124 C:\Windows\System32\svchost.exe 1164 C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe 1244 C:\Windows\System32\audiodg.exe 1296 C:\Windows\System32\svchost.exe 1312 C:\Windows\System32\SLsvc.exe 1360 C:\Windows\System32\svchost.exe 1460 C:\Windows\System32\svchost.exe 1664 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe 1676 C:\Windows\System32\nvvsvc.exe 1992 C:\Windows\System32\spoolsv.exe 2020 C:\Program Files\Avira\AntiVir Desktop\sched.exe 2032 C:\Windows\System32\svchost.exe 1120 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1428 C:\Windows\System32\svchost.exe 1448 C:\Program Files\FRITZ!DSL\IGDCTRL.EXE 296 C:\Program Files\Canon\IJPLM\ijplmsvc.exe 2128 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe 2156 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe 2176 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe 2192 C:\Windows\System32\svchost.exe 2232 C:\Windows\System32\IoctlSvc.exe 2244 C:\Windows\System32\svchost.exe 2256 C:\Windows\System32\PnkBstrA.exe 2296 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe 2320 C:\Windows\System32\svchost.exe 2360 C:\Windows\System32\svchost.exe 2408 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE 2460 C:\Windows\System32\SearchIndexer.exe 2540 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe 3088 WUDFHost.exe 3160 C:\Windows\System32\taskeng.exe 3248 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE 3764 C:\Windows\System32\dwm.exe 3844 C:\Windows\System32\taskeng.exe 3908 C:\Windows\explorer.exe 2392 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1628 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe 2880 C:\Windows\System32\wpcumi.exe 3200 C:\Program Files\Windows Media Player\wmpnscfg.exe 3268 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe 3420 C:\Windows\ehome\ehtray.exe 3472 C:\Program Files\Windows Media Player\wmpnetwk.exe 3484 C:\Windows\ehome\ehmsas.exe 312 C:\Program Files\FRITZ!DSL\FwebProt.exe 3824 C:\Program Files\FRITZ!DSL\StCenter.exe 2512 C:\Windows\System32\svchost.exe 5548 C:\Program Files\Internet Explorer\iexplore.exe 4048 C:\Program Files\Internet Explorer\iexplore.exe 5240 C:\Windows\System32\Macromed\Flash\FlashUtil10c.exe 5564 C:\Program Files\Internet Explorer\iexplore.exe 4088 C:\Windows\System32\wermgr.exe 2172 C:\Windows\System32\SearchProtocolHost.exe 6072 C:\Windows\System32\SearchFilterHost.exe 1568 dllhost.exe 6120 dllhost.exe 6060 C:\Users\festus\Desktop\MBRCheck.exe 1392 C:\Windows\System32\conime.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`0053aa00 (NTFS) PhysicalDrive0 Model Number: ST3500830AS, Rev: 3.AA Size Device Name MBR Status -------------------------------------------- 465 GB \\.\PhysicalDrive0 RE: Windows 2008 MBR code detected SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979 Done! |
|
| Themen zu Windows Recovery entfernt,Ordner leer |
| adobe, antivir, avira, bho, defender, dsl, error, explorer, firefox, format, helper, home, hängen, kaspersky, logfile, mozilla, musik, ordner leer, registry, senden, server, software, temp, vista, windows, windows recovery entfernt, wma |
Linear-Darstellung
