Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Virusbefall Worm/Downadup, Worm/Generic_c.ZS, Verbeitung mit autorun.inf auf Wechselmedien (https://www.trojaner-board.de/100071-virusbefall-worm-downadup-worm-generic_c-zs-verbeitung-autorun-inf-wechselmedien.html)

kickstarter 07.06.2011 19:59
Virusbefall Worm/Downadup, Worm/Generic_c.ZS, Verbeitung mit autorun.inf auf Wechselmedien
 
Hallo Trojaner-Board,

so wie es aussieht, habe ich mir einen hartleibigen Virus eingefangen.

Ich wollte den Laptop einer Freundin auf Viren scannen, da sie mir sagte, daß da wohl etwas sei. Das habe ich mir aber leichter vorgestellt, als es ist.:killpc:

Da sich auf dem Gerät nur ein Antivir von 2007 mit gleichalten Virusdefinitionen befand und Download bei Antivir noch sonst einem Anbieter funktionierte (Homepages wurden nicht angezeigt, Google etc. funktionerte), habe ich Antivir auf meinen eigenen Rechner heruntergeladen und per USB-Stick transferriert. Ergebnis: Antivir lässt sich auf dem Laptop der Freundin installieren, allerdings nicht starten (Meldung: Prozedureinsprungpunkt ... in DLL "MXVCP90.dll" nicht gefunden). Bei der USB-Stick-Aktion habe ich mir gleich noch meinen eigenen Rechner sowie ein paar Wechselmedien infiziert (mein aktuelles Antivir meldete zwar noch die autorun.inf, war aber wohl zu spät) :headbang:.

Ich sehe auf beiden Rechnern jetzt immer das Tray-Icon "Windows Sicherheitswarnungen" mit dem Hinweis, daß mein PC gefährdet sein könnte und automatische Updates deaktiviert sind.

Jetzt wäre es mir das Liebste, wenn wir einen Rechner nach dem anderen bereinigen könnten. Ziel wäre: Viren runter, Daten sichern, Neuinstallation. Für den ersten Punkt brauche ich Hilfe!

Laptop meiner Bekannten:
Bevor ich hierher kam, habe ich das Ding mit der AVG Rescue CD 110314a3648 gescannt. Ergebnis:
USB-Sticks haben alle:
/RECYCLER/S-5-3-42.../jwgkvsq.vmx - worm/downadup
/autorun.inf - Worm/Generic_c.ZS
Festplatte hat:
/Windows/System32/emea.js.dll - Worm/downadup
sowie haufenweise Trackingcookies

Ich habe alles Löschen lassen, werde die Plagegeister aber so einfach nicht los.

Deshalb hier meine Scans von Defogger, OTL und Gmer

1. Defogger
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:36 on 07/06/2011 (Caudia)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
2a. OTL.txt
Code:
OTL logfile created on: 07.06.2011 19:44:46 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = C:\Dokumente und Einstellungen\Caudia\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
894,10 Mb Total Physical Memory | 494,39 Mb Available Physical Memory | 55,29% Memory free
2,80 Gb Paging File | 2,32 Gb Available in Paging File | 82,91% Paging File free
Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 25,25 Gb Total Space | 5,84 Gb Free Space | 23,14% Space Free | Partition Type: FAT32
Drive D: | 25,73 Gb Total Space | 3,86 Gb Free Space | 15,01% Space Free | Partition Type: FAT32
Drive F: | 7,55 Gb Total Space | 7,48 Gb Free Space | 99,11% Space Free | Partition Type: FAT32
Drive G: | 7,50 Gb Total Space | 5,02 Gb Free Space | 66,90% Space Free | Partition Type: FAT32
 
Computer Name: CLAUDIA | User Name: Caudia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.07 19:29:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Caudia\Desktop\OTL.exe
PRC - [2011.03.28 16:15:18 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.28 16:15:06 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 16:14:58 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2007.08.31 19:49:58 | 000,498,872 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe
PRC - [2007.08.31 18:43:32 | 000,907,040 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
PRC - [2007.08.31 18:38:08 | 000,140,568 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
PRC - [2007.08.31 18:38:04 | 000,427,288 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
PRC - [2007.08.31 18:35:54 | 002,622,232 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2007.06.13 15:21:46 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.06.29 10:45:00 | 000,045,056 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
PRC - [2006.06.23 06:59:02 | 000,602,112 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe
PRC - [2006.06.01 14:40:54 | 000,413,696 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2006.05.30 12:11:56 | 000,421,888 | ---- | M] () -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2006.04.27 12:10:30 | 000,254,050 | ---- | M] () -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
PRC - [2006.04.27 12:10:30 | 000,114,784 | ---- | M] () -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
PRC - [2006.04.27 12:10:10 | 000,151,552 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Acer\Acer Arcade\PCMService.exe
PRC - [2006.04.27 12:09:50 | 001,077,376 | ---- | M] (Cyberlink) -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
PRC - [2006.04.27 12:09:50 | 000,061,440 | ---- | M] (Cyberlink) -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
PRC - [2006.03.29 20:53:34 | 000,028,672 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
PRC - [2006.02.17 15:26:32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2006.01.02 17:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2004.04.08 06:01:20 | 001,135,728 | ---- | M] (America Online, Inc.) -- C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe
PRC - [2003.07.23 08:43:10 | 000,024,651 | R--- | M] (Microsoft® Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkCalRem.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.07 19:29:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Caudia\Desktop\OTL.exe
MOD - [2006.08.25 17:46:44 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2005.10.11 13:18:54 | 000,028,672 | ---- | M] () -- C:\Acer\Empowering Technology\ePower\SysHook.dll
MOD - [2004.08.04 05:00:00 | 001,028,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mfc42.dll
MOD - [2004.08.04 05:00:00 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mfc42loc.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] --  -- (HidServ)
SRV - File not found [On_Demand | Stopped] --  -- (AppMgmt)
SRV - [2011.03.28 16:15:06 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.28 16:14:58 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2008.01.29 20:38:12 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2007.08.31 19:49:58 | 000,498,872 | ---- | M] () [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe -- (TryAndDecideService)
SRV - [2007.08.31 18:38:04 | 000,427,288 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2006.04.27 12:10:30 | 000,254,050 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2006.04.27 12:10:30 | 000,114,784 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2006.04.27 12:09:50 | 000,061,440 | ---- | M] (Cyberlink) [Auto | Running] -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2006.03.29 20:53:34 | 000,028,672 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)
SRV - [2006.02.17 15:26:32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2004.04.08 06:01:20 | 001,135,728 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe -- (AOL ACS)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.05.30 22:36:34 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2011.05.30 22:36:34 | 000,044,416 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2011.05.30 22:36:30 | 000,129,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman)
DRV - [2011.05.30 22:36:22 | 000,368,736 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\tdrpman.sys -- (tdrpman)
DRV - [2011.04.01 17:07:26 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.04.01 17:07:26 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.06.17 15:27:04 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.06.17 15:26:54 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2007.02.22 10:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (nmwcd)
DRV - [2007.02.22 10:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007.02.22 10:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (nmwcdcj)
DRV - [2007.02.22 10:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (nmwcdc)
DRV - [2006.06.28 01:25:24 | 004,304,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.06.16 04:56:38 | 000,083,968 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006.06.12 02:00:42 | 000,990,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2006.06.12 01:59:52 | 000,208,384 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2006.06.12 01:59:46 | 000,727,808 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2006.06.02 13:59:54 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\TVicPort.sys -- (tvicport)
DRV - [2006.06.02 13:59:52 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\zntport.sys -- (zntport)
DRV - [2006.06.02 13:59:50 | 000,069,632 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\int15.sys -- (int15)
DRV - [2006.05.24 19:19:48 | 000,040,064 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2006.05.24 19:19:44 | 000,074,752 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2006.05.24 19:19:40 | 000,061,056 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2006.05.24 15:46:34 | 000,008,552 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2006.05.10 11:27:00 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2006.04.27 09:46:50 | 001,540,096 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006.01.24 19:44:52 | 000,488,448 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2005.12.23 01:13:06 | 000,013,184 | ---- | M] (Dritek System Inc.) [Kernel | Auto | Running] -- C:\Programme\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2005.11.11 19:51:42 | 000,055,168 | ---- | M] (Macrovision Europe Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sdcplh.sys -- (sdcplh)
DRV - [2005.08.15 08:27:24 | 000,010,368 | R--- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2004.12.09 14:54:12 | 000,046,592 | ---- | M] (SMSC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2003.01.10 16:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001.08.17 13:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
DRV - [2001.08.17 13:49:10 | 000,026,624 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irstusb.sys -- (STIrUsb)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.tiscali.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.01.14 14:23:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.05.19 16:35:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
 
[2011.05.19 16:36:16 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\Mozilla\Extensions
[2011.05.19 16:35:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) --
[2011.04.14 18:40:04 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 05:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe ()
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe ()
O4 - HKLM..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe ()
O4 - HKLM..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (Acer Inc.)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PCMService] C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PrinTray] C:\WINDOWS\system32\spool\drivers\w32x86\2\printray.exe (Lexmark)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (Acer Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Caudia\Startmenü\Programme\Autostart\wkcalrem.LNK = C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkCalRem.exe (Microsoft® Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file://E:\components\hidinputmonitorx.ocx (HidInputMonitorX Control)
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file://E:\components\A9.ocx (A9Helper.A9)
O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file://E:\components\wmvhdrating.ocx (WMVHDRatingCtrl Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.05.23 12:37:04 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\G\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.5.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 8.5.1
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {77651DFB-6EBC-BAA1-0DAE-867E2AF4DE35} - Outlook Express
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {8D1D0E9A-C799-4D28-9E29-0061D1E66E43} - Microsoft .NET Framework 1.1 Hotfix (KB928366)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\adobe
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: nqjttxgdq -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AOL 9.0 Tray-Symbol.lnk - C:\Programme\AOL 9.0\aoltray.exe - (America Online, Inc.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Kodak EasyShare Software.lnk - C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe - (Eastman Kodak Company)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation)
MsConfig - StartUpReg: AOLDialer - hkey= - key= - C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe (America Online, Inc)
MsConfig - StartUpReg: IMJPMIG8.1 - hkey= - key= - C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: LaunchApp - hkey= - key= -  File not found
MsConfig - StartUpReg: Microsoft Works Update Detection - hkey= - key= - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: ntiMUI - hkey= - key= - C:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe ()
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.07 19:29:45 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Caudia\Desktop\OTL.exe
[2011.05.31 18:07:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2011.05.31 18:07:46 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2011.05.31 18:07:45 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011.05.31 18:07:45 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011.05.31 18:07:45 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2011.05.31 18:07:45 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2011.05.31 18:07:44 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2011.05.31 18:07:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2011.05.30 22:40:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Acronis
[2011.05.30 22:36:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis
[2011.05.30 22:36:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Acronis
[2011.05.30 22:35:56 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Acronis
[2011.05.30 22:35:56 | 000,000,000 | ---D | C] -- C:\Programme\Acronis
[2011.05.19 16:45:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.05.19 16:38:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Caudia\Eigene Dateien\Downloads
[2011.05.19 16:35:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2011.05.19 16:35:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\Mozilla
[2011.05.19 16:35:20 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2006.10.04 22:27:37 | 000,016,384 | ---- | C] ( ) -- C:\WINDOWS\System32\ClearEvent.exe
[2006.02.22 11:20:14 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\Interop.Shell32.dll
[2006.01.19 18:19:06 | 000,049,152 | ---- | C] ( ) -- C:\WINDOWS\System32\SysMonitor.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.07 19:39:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.06.07 19:39:42 | 937,603,072 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.07 19:36:36 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\defogger_reenable
[2011.06.07 19:33:18 | 000,142,801 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Forum_3.JPG
[2011.06.07 19:32:54 | 000,122,623 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Forum_2.JPG
[2011.06.07 19:32:34 | 000,126,465 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Forum_1.JPG
[2011.06.07 19:30:24 | 000,293,977 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\gmer.zip
[2011.06.07 19:29:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Caudia\Desktop\OTL.exe
[2011.06.07 19:25:54 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Defogger.exe
[2011.06.06 18:05:30 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.05.31 17:55:36 | 000,000,542 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\alice.lnk
[2011.05.30 22:36:22 | 000,000,704 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Acronis*True*Image*Home 11.0.lnk
[2011.05.27 23:28:12 | 000,017,920 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.24 22:28:02 | 052,718,176 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\avira_antivir_personal648_de.exe
[2011.05.22 22:49:24 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.05.21 14:02:10 | 000,014,856 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\wklnhst.dat
[2011.05.19 22:24:46 | 000,002,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Microsoft Word.lnk
[2011.05.19 16:51:16 | 000,000,223 | RHS- | M] () -- C:\boot.ini
[2011.05.19 16:35:24 | 000,000,604 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.07 19:36:35 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\defogger_reenable
[2011.06.07 19:33:16 | 000,142,801 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Forum_3.JPG
[2011.06.07 19:32:52 | 000,122,623 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Forum_2.JPG
[2011.06.07 19:32:31 | 000,126,465 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Forum_1.JPG
[2011.06.07 19:30:27 | 000,293,977 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\gmer.zip
[2011.06.07 19:25:56 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\Defogger.exe
[2011.05.31 17:55:34 | 000,000,542 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\alice.lnk
[2011.05.30 22:36:21 | 000,000,704 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Acronis*True*Image*Home 11.0.lnk
[2011.05.24 22:24:49 | 052,718,176 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Desktop\avira_antivir_personal648_de.exe
[2011.05.19 16:35:23 | 000,000,610 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2011.05.19 16:35:23 | 000,000,604 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.05.14 11:07:41 | 000,000,022 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\kodakpcd.ini
[2010.01.14 14:11:58 | 000,176,890 | ---- | C] () -- C:\WINDOWS\hpoins38.dat
[2010.01.14 14:11:57 | 000,000,622 | ---- | C] () -- C:\WINDOWS\hpomdl38.dat
[2008.03.05 14:25:37 | 000,000,057 | ---- | C] () -- C:\WINDOWS\NWDECDU.INI
[2007.08.24 14:13:39 | 000,000,643 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2007.08.24 14:13:35 | 000,079,872 | ---- | C] () -- C:\WINDOWS\System32\lex_psu.exe
[2007.08.24 14:13:30 | 000,328,704 | ---- | C] () -- C:\WINDOWS\System32\dosfnt32.dll
[2007.04.08 18:38:51 | 000,000,034 | ---- | C] () -- C:\WINDOWS\GLASKLAR.INI
[2007.03.24 14:58:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2007.02.09 13:28:06 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2007.01.27 21:15:44 | 000,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.10.30 23:06:40 | 000,017,920 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.10.11 18:24:10 | 000,014,856 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\wklnhst.dat
[2006.10.11 18:13:39 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.10.07 15:54:51 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2006.10.04 23:51:48 | 000,000,112 | ---- | C] () -- C:\WINDOWS\UF.INI
[2006.10.04 22:55:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ImageItEncrypt.exe
[2006.10.04 22:22:30 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2006.10.04 22:11:23 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Caudia\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.08.22 13:59:50 | 000,159,821 | ---- | C] () -- C:\WINDOWS\EMEAPAGE.EXE
[2006.08.22 13:59:50 | 000,000,084 | ---- | C] () -- C:\WINDOWS\EMEAPAGE.INI
[2006.08.22 13:59:49 | 000,589,824 | ---- | C] () -- C:\WINDOWS\AntiV.EXE
[2006.08.22 13:59:49 | 000,002,790 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2006.05.24 16:06:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006.05.24 16:05:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.05.24 15:45:42 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006.05.23 13:39:10 | 000,302,824 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006.05.23 12:37:32 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2006.05.23 12:36:32 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2006.05.23 12:36:32 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2006.05.23 12:36:32 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2006.05.23 12:36:32 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2006.05.23 12:31:36 | 000,423,358 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006.05.23 12:31:36 | 000,407,564 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006.05.23 12:31:36 | 000,078,166 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006.05.23 12:31:36 | 000,064,476 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006.05.23 12:06:46 | 000,004,335 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006.05.23 12:05:12 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006.04.24 16:48:58 | 000,127,619 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2006.04.20 20:03:42 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\int15.sys
[2006.04.20 20:03:42 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\drivers\int15_64.sys
[2006.03.10 14:15:44 | 000,036,404 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006.02.22 11:20:14 | 000,331,776 | ---- | C] () -- C:\WINDOWS\System32\ScrollBarLib.dll
[2006.01.07 02:39:20 | 000,000,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\RtkHDAud.dat
[2005.12.14 20:59:52 | 000,000,038 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.07.15 16:48:00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005.03.28 15:45:26 | 000,000,081 | ---- | C] () -- C:\WINDOWS\alaunch.ini
[2004.12.17 16:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.08.04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 05:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 05:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004.08.04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 05:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 05:00:00 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.08.04 05:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004.08.04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.02.13 13:49:00 | 000,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
[2002.05.24 16:34:46 | 000,032,768 | ---- | C] () -- C:\WINDOWS\AMove.exe
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.08.26 17:04:08 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001.08.26 17:02:42 | 000,004,524 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1999.01.22 20:46:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
 
========== LOP Check ==========
 
[2006.05.24 15:47:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2006.10.30 23:12:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NtiDvdCopy
[2009.11.03 22:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2011.05.30 22:36:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis
[2008.01.29 20:52:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\Opera
[2006.10.28 18:04:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\Steinberg
[2009.12.13 19:21:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caudia\Anwendungsdaten\Skinux
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2006.02.23 11:38:04 | 000,000,000 | ---D | M] -- C:\i386
[2004.08.04 05:00:00 | 000,000,000 | ---D | M] -- C:\VALUEADD
[2004.08.04 05:00:00 | 000,000,000 | ---D | M] -- C:\dotnetfx
[2006.02.23 11:38:08 | 000,000,000 | ---D | M] -- C:\Sysinfo
[2006.02.23 11:38:08 | 000,000,000 | ---D | M] -- C:\Book
[2006.02.23 11:38:04 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2006.05.23 11:59:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2006.05.23 12:06:02 | 000,000,000 | ---D | M] -- C:\Programme
[2006.05.23 12:10:46 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2006.05.23 12:30:16 | 000,000,000 | ---D | M] -- C:\Program Files
[2006.05.23 12:33:40 | 000,000,000 | ---D | M] -- C:\MyWorks
[2006.05.23 12:40:46 | 000,000,000 | ---D | M] -- C:\Acer
[2006.05.24 15:46:34 | 000,000,000 | ---D | M] -- C:\My Music
[2010.01.14 14:14:36 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2006.10.05 00:47:30 | 000,000,000 | ---D | M] -- C:\MAGIX
[2006.10.05 02:53:26 | 000,000,000 | -HSD | M] -- C:\Recycled
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2004.08.04 05:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 15:21:46 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\explorer.exe
[2007.06.13 15:21:46 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2004.08.04 05:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\i386\REGEDIT.EXE
[2004.08.04 05:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\regedit.exe
[2004.08.04 05:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\system32\dllcache\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2004.08.04 05:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2004.08.04 05:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 06:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2004.08.04 05:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2009-11-18 01:10:03

< End of report >
2b. Extras.log
Code:
OTL Extras logfile created on: 07.06.2011 19:44:46 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = C:\Dokumente und Einstellungen\Caudia\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
894,10 Mb Total Physical Memory | 494,39 Mb Available Physical Memory | 55,29% Memory free
2,80 Gb Paging File | 2,32 Gb Available in Paging File | 82,91% Paging File free
Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 25,25 Gb Total Space | 5,84 Gb Free Space | 23,14% Space Free | Partition Type: FAT32
Drive D: | 25,73 Gb Total Space | 3,86 Gb Free Space | 15,01% Space Free | Partition Type: FAT32
Drive F: | 7,55 Gb Total Space | 7,48 Gb Free Space | 99,11% Space Free | Partition Type: FAT32
Drive G: | 7,50 Gb Total Space | 5,02 Gb Free Space | 66,90% Space Free | Partition Type: FAT32
 
Computer Name: CLAUDIA | User Name: Caudia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"8769:TCP" = 8769:TCP:*:Enabled:xezkquyo
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online, Inc)
"C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Enabled:AOL 9.0 -- (America Online, Inc.)
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- ()
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\HP Software Update\HPWUCli.exe" = C:\Programme\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Acer\Acer Arcade\PCMService.exe" = C:\Program Files\Acer\Acer Arcade\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.)
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe:*:Disabled:AOL -- (America Online, Inc)
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe:*:Disabled:AOL -- (America Online, Inc.)
"C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Disabled:AOL 9.0 -- (America Online, Inc.)
"C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- (Eastman Kodak Company)
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- ()
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\HP Software Update\HPWUCli.exe" = C:\Programme\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn
"{04440044-9149-45C6-A806-F2BF9CFCE762}" = Microsoft Encarta Enzyklopädie 2004
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1F2C8256-2773-46C7-9ABA-3E39C24ABB51}" = Acer eSettings Management
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{31BBD146-CCC2-4E3F-B560-4D3906E2B041}" = CD Burning 4
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{385979FE-DC4F-4140-8EAD-A59625000D72}" = NTI Backup NOW! 4
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4EAD2E21-1D4A-4E2B-A082-8D08961539C9}" = Microsoft Works Suite-Add-Ins für Microsoft Word
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5B680750-760B-49E4-81E7-21B2B337F9F7}" = Microsoft Works
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{608D2A3C-6889-4C11-9B54-A42F45ACBFDB}" = fflink
"{61CF2C86-8E46-4210-A115-E4D6C65AF369}" = HP Photosmart B109a-m All-In-One Driver Software 13.0 Rel .6
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{7057702F-6D71-4F30-8000-9E72BC771887}" = Acer ePerformance Management
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{79B05AF4-8894-49A1-9FF4-53F0142D85E1}" = ATI Catalyst Control Center
"{80FE5490-E9DD-4AE9-8537-3EB5EFB606FC}" = PS_AIO_06_B109a-m_SW_Min
"{8704D51E-25B7-4F23-81E7-AA4F54790220}" = Microsoft AutoRoute v11.0
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday
"{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}" = ATI Parental Control & Encoder
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90300407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{911B0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}" = Nokia Connectivity Cable Driver
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt
"{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A70800000002}" = Adobe Reader 7.0.8 - Deutsch
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AF20390E-5ADD-4CB0-BF9D-EDF6E7891AD9}" = B109a-m
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{BFD96B89-B769-4CD6-B11E-E79FFD46F067}" = QuickTime
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare Software
"{D458BBDC-0363-42E0-8FF9-4736E3CB3CA2}" = Acer Screensaver
"{D755C7A3-C03E-4460-8C00-AC6E55505FB5}" = LightScribe  1.4.74.1
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Foto Premium 9
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby
"{E5343B27-55DF-40BD-9FCF-A643C1331E8A}" = Acronis*True*Image*Home
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1B8DB67-D30E-4FF9-A85F-3CEE51825AA2}" = SMSC IrCC V5.1.3600.7
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"America Online de" = AOL Deutschland
"AOL Connectivity Services" = AOL Optimized Dial-In
"AOL YGP Screensaver" = AOL Meine Fotos Bildschirmschoner
"AOLCoach de" = AOL Coach Version 1.0(Build:20040229.1 de)
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CFF5FD902CAD8828AC62E155C542E69D5439C37A" = Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor  (04/28/2006 1.3.1.0)
"CNXT_MODEM_PCI_VEN_14F1&DEV_2BFA&SUBSYS_1025009F" = Soft Data Fax Modem with SmartCP
"GridVista" = Acer GridVista
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{385979FE-DC4F-4140-8EAD-A59625000D72}" = NTI Backup NOW! 4
"LManager" = Launch Manager
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MSNINST" = MSN
"NeroMultiInstaller!UninstallKey" = Nero Suite
"PictureIt_v9" = Microsoft Picture It! Foto Premium 9
"RealPlayer 6.0" = RealPlayer Basic
"Shockwave" = Shockwave
"Shop for HP Supplies" = Shop for HP Supplies
"Sobotta 21. Auflage - Atlas der Anatomie" = Sobotta 21. Auflage - Atlas der Anatomie
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Works2004Setup" = Setup-Start von Microsoft Works 2004
"Yahoo! Companion" = Yahoo! Toolbar
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 25.05.2011 14:16:31 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 26.05.2011 16:18:02 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 27.05.2011 13:46:17 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 29.05.2011 04:12:58 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 30.05.2011 16:26:51 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 30.05.2011 16:39:56 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 31.05.2011 11:51:21 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 06.06.2011 15:46:28 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 06.06.2011 15:49:16 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 06.06.2011 16:16:50 | Computer Name = CLAUDIA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
[ System Events ]
Error - 06.06.2011 15:49:42 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Universal Driver" wurde mit folgendem Fehler beendet:
  %%1114
 
Error - 07.06.2011 01:29:38 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "eLock2BurnerLockDriver" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 07.06.2011 01:29:38 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "eLock2FSCTLDriver" wurde aufgrund folgenden Fehlers nicht
 gestartet:  %%2
 
Error - 07.06.2011 01:29:38 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Universal Driver" wurde mit folgendem Fehler beendet:
  %%126
 
Error - 07.06.2011 13:01:13 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "eLock2BurnerLockDriver" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 07.06.2011 13:01:13 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "eLock2FSCTLDriver" wurde aufgrund folgenden Fehlers nicht
 gestartet:  %%2
 
Error - 07.06.2011 13:01:13 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Universal Driver" wurde mit folgendem Fehler beendet:
  %%126
 
Error - 07.06.2011 13:40:18 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "eLock2BurnerLockDriver" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 07.06.2011 13:40:18 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "eLock2FSCTLDriver" wurde aufgrund folgenden Fehlers nicht
 gestartet:  %%2
 
Error - 07.06.2011 13:40:18 | Computer Name = CLAUDIA | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Universal Driver" wurde mit folgendem Fehler beendet:
  %%126
 
 
< End of report >
3. Gmer.log
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-07 20:20:00
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 HTS541060G9AT00 rev.MB3OA60A
Running: gmer.exe; Driver: C:\DOKUME~1\Caudia\LOKALE~1\Temp\pwldqpog.sys


---- System - GMER 1.0.15 ----

SSDT            F6F65136                                    ZwCreateKey
SSDT            F6F6512C                                    ZwCreateThread
SSDT            F6F6513B                                    ZwDeleteKey
SSDT            F6F65145                                    ZwDeleteValueKey
SSDT            F6F6514A                                    ZwLoadKey
SSDT            F6F65118                                    ZwOpenProcess
SSDT            F6F6511D                                    ZwOpenThread
SSDT            F6F65154                                    ZwReplaceKey
SSDT            F6F6514F                                    ZwRestoreKey
SSDT            F6F65140                                    ZwSetValueKey

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0      SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1      SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1      tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2      tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3      tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device          \Driver\atapi \Device\Ide\IdePort0          sdcplh.sys (SDCPLH/Macrovision Europe Ltd)
Device          \Driver\atapi \Device\Ide\IdePort1          sdcplh.sys (SDCPLH/Macrovision Europe Ltd)
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4  sdcplh.sys (SDCPLH/Macrovision Europe Ltd)
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c  sdcplh.sys (SDCPLH/Macrovision Europe Ltd)

AttachedDevice  \FileSystem\Fastfat \Fat                    fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
Ich hoffe, die Logs sind jetzt auch in den Code-Tags verschwunden...:killpc:

Ich komme mit dem Problem nicht alleine klar. Bitte helft mir!! :dankeschoen:

Danke und Gruß,

Kickstarter

cosinus 08.06.2011 11:19
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

kickstarter 08.06.2011 21:33
Hallo Arne,

danke für die schnelle Antwort. Wie gewünscht habe ich hier das Malware-Bytes-Log. Die gefundenen Viren heißen zwar anders, als im Titel genannt, aber das ändert ja auch nichts an meinem Problem.

Wie auch immer, Bühne frei:
Code:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6812

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

08.06.2011 22:24:01
mbam-log-2011-06-08 (22-23-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|G:\|)
Durchsuchte Objekte: 268881
Laufzeit: 1 Stunde(n), 1 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\LXAESTRN.DLL (Worm.KoobFace) -> Value: LXAESTRN.DLL -> No action taken.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (PUM.Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\WINDOWS\system32\spool\drivers\w32x86\LXAESTRN.DLL (Worm.KoobFace) -> No action taken.
c:\WINDOWS\system32\spool\drivers\w32x86\2\lxaestrn.dll (Worm.KoobFace) -> No action taken.
Ältere Logs habe ich keine. Habe durch MWB auch nichts entfernen lassen. :nixda:

Cheers,

Jan

cosinus 08.06.2011 21:57
Zitat:
-> No action taken.
Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

Zitat:
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
Wieso nur SP2/IE6?? Das ist ein uralter und unsicherer Patchstand. Wenn wir hier durch sein sollten, musst du unebdingt patchen.

kickstarter 09.06.2011 21:14
Habe jetzt die Malwarebytes-Funde beseitigt. Anbei das neuerliche Logfile.

Zum Patchstand des Laptop stimme ich zu. Ist allerdings auch der Rechner einer Freundin und ich werde sie für die Zukunft vergattern, besser auf Updates zu achten. Ihre letzten Virusdefinitionen waren ja auch von 2007 ..:daumenhoc

Code:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6812

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

09.06.2011 21:31:59
mbam-log-2011-06-09 (21-31-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|G:\|)
Durchsuchte Objekte: 268896
Laufzeit: 1 Stunde(n), 2 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\LXAESTRN.DLL (Worm.KoobFace) -> Value: LXAESTRN.DLL -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (PUM.Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\WINDOWS\system32\spool\drivers\w32x86\LXAESTRN.DLL (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\spool\drivers\w32x86\2\lxaestrn.dll (Worm.KoobFace) -> Quarantined and deleted successfully.
Gruß,

jan

cosinus 09.06.2011 21:17
Zitat:
Drive C: | 25,25 Gb Total Space | 5,84 Gb Free Space | 23,14% Space Free | Partition Type: FAT32
Drive D: | 25,73 Gb Total Space | 3,86 Gb Free Space | 15,01% Space Free | Partition Type: FAT32
C+D sollten wir später auch nach NTFS konvertieren. Ist ne weitere Schwachstelle wenn man auf FAT32 setzt :pfeiff:


Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.05.23 12:37:04 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\G\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

kickstarter 09.06.2011 21:37
Hi Arne,

ausgeführt. Allerdings erspähen meine laienhaften Augen im Log viele "not found". Verstecken sich meine Untermieter weiterhin? :confused::confused:

Code:
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{070beccc-b24e-11dc-afaa-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{070beccc-b24e-11dc-afaa-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{070beccc-b24e-11dc-afaa-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{070beccc-b24e-11dc-afaa-00038a000015}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a41e4c2-53ec-11db-ae60-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a41e4c2-53ec-11db-ae60-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a41e4c2-53ec-11db-ae60-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a41e4c2-53ec-11db-ae60-00038a000015}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edb90026-e1e3-11de-b146-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edb90026-e1e3-11de-b146-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edb90026-e1e3-11de-b146-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edb90026-e1e3-11de-b146-00038a000015}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.23.0 log created on 06092011_223052
Cheers,

Jan

cosinus 09.06.2011 21:58
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

kickstarter 09.06.2011 22:44
.. also, das Kaspersky-Tool hat nichts gefunden...

Code:
2011/06/09 23:37:02.0640 2444        TDSS rootkit removing tool 2.5.4.0 Jun  7 2011 17:31:48
2011/06/09 23:37:02.0703 2444        ================================================================================
2011/06/09 23:37:02.0703 2444        SystemInfo:
2011/06/09 23:37:02.0703 2444       
2011/06/09 23:37:02.0703 2444        OS Version: 5.1.2600 ServicePack: 2.0
2011/06/09 23:37:02.0703 2444        Product type: Workstation
2011/06/09 23:37:02.0703 2444        ComputerName: CLAUDIA
2011/06/09 23:37:02.0703 2444        UserName: Caudia
2011/06/09 23:37:02.0703 2444        Windows directory: C:\WINDOWS
2011/06/09 23:37:02.0703 2444        System windows directory: C:\WINDOWS
2011/06/09 23:37:02.0703 2444        Processor architecture: Intel x86
2011/06/09 23:37:02.0703 2444        Number of processors: 1
2011/06/09 23:37:02.0703 2444        Page size: 0x1000
2011/06/09 23:37:02.0703 2444        Boot type: Normal boot
2011/06/09 23:37:02.0703 2444        ================================================================================
2011/06/09 23:37:04.0000 2444        Initialize success
2011/06/09 23:37:10.0968 2268        ================================================================================
2011/06/09 23:37:10.0968 2268        Scan started
2011/06/09 23:37:10.0968 2268        Mode: Manual;
2011/06/09 23:37:10.0968 2268        ================================================================================
2011/06/09 23:37:11.0875 2268        abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/06/09 23:37:12.0078 2268        ACPI            (94b4741d2cf9ed38140b831293d1601a) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/06/09 23:37:12.0187 2268        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/06/09 23:37:12.0406 2268        adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/06/09 23:37:12.0656 2268        aec            (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2011/06/09 23:37:12.0796 2268        AFD            (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2011/06/09 23:37:12.0953 2268        agp440          (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/06/09 23:37:13.0140 2268        agpCPQ          (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/06/09 23:37:13.0312 2268        Aha154x        (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/06/09 23:37:13.0484 2268        aic78u2        (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/06/09 23:37:13.0671 2268        aic78xx        (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/06/09 23:37:13.0875 2268        AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/06/09 23:37:14.0031 2268        alim1541        (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/06/09 23:37:14.0187 2268        amdagp          (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/06/09 23:37:14.0390 2268        AmdK8          (a96cc1761e4e6e997f3ca0021226c431) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
2011/06/09 23:37:14.0578 2268        amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/06/09 23:37:14.0875 2268        AR5211          (baa6b3cc74a4377d063c5a92dd9c4098) C:\WINDOWS\system32\DRIVERS\ar5211.sys
2011/06/09 23:37:15.0000 2268        Arp1394        (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/06/09 23:37:15.0218 2268        asc            (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/06/09 23:37:15.0406 2268        asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/06/09 23:37:15.0578 2268        asc3550        (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/06/09 23:37:15.0750 2268        ASCTRM          (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
2011/06/09 23:37:15.0953 2268        AsyncMac        (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/06/09 23:37:16.0093 2268        atapi          (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/06/09 23:37:16.0578 2268        ati2mtag        (2922cd8a5d913e737d4e7a634042e154) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/06/09 23:37:16.0718 2268        Atmarpc        (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/06/09 23:37:16.0906 2268        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/06/09 23:37:17.0078 2268        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/06/09 23:37:17.0265 2268        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/06/09 23:37:17.0437 2268        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/06/09 23:37:17.0578 2268        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/06/09 23:37:17.0859 2268        cbidf          (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/06/09 23:37:18.0281 2268        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/06/09 23:37:18.0468 2268        cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/06/09 23:37:18.0515 2268        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/06/09 23:37:18.0671 2268        Cdfs            (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/06/09 23:37:18.0781 2268        Cdrom          (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/06/09 23:37:19.0218 2268        CmBatt          (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/06/09 23:37:19.0312 2268        CmdIde          (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/06/09 23:37:19.0453 2268        Compbatt        (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/06/09 23:37:19.0656 2268        Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/06/09 23:37:19.0875 2268        dac2w2k        (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/06/09 23:37:20.0046 2268        dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/06/09 23:37:20.0203 2268        Disk            (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/06/09 23:37:20.0390 2268        DKbFltr        (08d30af92c270f2e76787c81589dbad6) C:\WINDOWS\system32\DRIVERS\DKbFltr.sys
2011/06/09 23:37:20.0625 2268        dmboot          (5789b83ba87fc84c3568cf86cacef8ce) C:\WINDOWS\system32\drivers\dmboot.sys
2011/06/09 23:37:20.0750 2268        dmio            (084eb0a50a4f7b4705c8a57f234e5291) C:\WINDOWS\system32\drivers\dmio.sys
2011/06/09 23:37:20.0812 2268        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/06/09 23:37:21.0000 2268        DMusic          (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/06/09 23:37:21.0187 2268        dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/06/09 23:37:21.0343 2268        DritekPortIO    (5beb3bdaecc6c9348fc0d169ce65ecc6) C:\PROGRA~1\LAUNCH~1\DPortIO.sys
2011/06/09 23:37:21.0546 2268        drmkaud        (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/06/09 23:37:24.0156 2268        EMSCR          (5aee9eedcfbf2b0f9dec53c27ee722a3) C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
2011/06/09 23:37:24.0375 2268        ESDCR          (8e56ab21d10c368029cea57de47d79c2) C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
2011/06/09 23:37:24.0578 2268        ESMCR          (0a58fade5e12d3a611427292073362cb) C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
2011/06/09 23:37:24.0734 2268        Fastfat        (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/06/09 23:37:24.0890 2268        Fdc            (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
2011/06/09 23:37:24.0984 2268        Fips            (9e9af89f9b14aa6249065c309ce73bd8) C:\WINDOWS\system32\drivers\Fips.sys
2011/06/09 23:37:25.0140 2268        Flpydisk        (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/06/09 23:37:25.0359 2268        FltMgr          (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/06/09 23:37:25.0421 2268        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/06/09 23:37:25.0625 2268        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/06/09 23:37:25.0734 2268        Gpc            (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/06/09 23:37:25.0921 2268        HDAudBus        (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/06/09 23:37:26.0203 2268        HidUsb          (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/06/09 23:37:26.0390 2268        hpn            (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/06/09 23:37:26.0640 2268        HPZid412        (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/06/09 23:37:26.0812 2268        HPZipr12        (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/06/09 23:37:26.0984 2268        HPZius12        (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/06/09 23:37:27.0218 2268        HSFHWAZL        (358ae1d350e05f5c45f65dca0be6ba40) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
2011/06/09 23:37:27.0500 2268        HSF_DPV        (c17b97f331a08bed979961245331413d) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2011/06/09 23:37:27.0703 2268        HSXHWAZL        (83f221ddae2d2353b41f0227e6e411d7) C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys
2011/06/09 23:37:27.0968 2268        HTTP            (cb77bb47e67e84deb17ba29632501730) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/06/09 23:37:28.0203 2268        i2omgmt        (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/06/09 23:37:28.0437 2268        i2omp          (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/06/09 23:37:28.0609 2268        i8042prt        (7c575018d0413440d75432a78b88c899) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/06/09 23:37:28.0734 2268        Imapi          (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/06/09 23:37:28.0953 2268        ini910u        (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/06/09 23:37:29.0218 2268        int15          (4d8d5b1c895ea0f2a721b98a7ce198f1) C:\WINDOWS\system32\drivers\int15.sys
2011/06/09 23:37:29.0750 2268        IntcAzAudAddService (909d03b3b7fb7c830b74f74f4d0ea7ce) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/06/09 23:37:30.0046 2268        IntelIde        (d63c33f65f6ebc732116403d88883b2d) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/06/09 23:37:30.0203 2268        Ip6Fw          (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/06/09 23:37:30.0281 2268        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/06/09 23:37:30.0390 2268        IpInIp          (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/06/09 23:37:30.0656 2268        IpNat          (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/06/09 23:37:30.0765 2268        IPSec          (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/06/09 23:37:30.0953 2268        irda            (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/06/09 23:37:31.0109 2268        IRENUM          (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/06/09 23:37:31.0312 2268        irsir          (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
2011/06/09 23:37:31.0500 2268        isapnp          (ce9b7afdf0a3d7dd8d1487262316b959) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/06/09 23:37:31.0609 2268        Kbdclass        (b128fc0a5cd83f669d5de4b58f77c7d6) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/06/09 23:37:31.0828 2268        kbdhid          (7ec877aa899323b92874fe62c7ddcde7) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/06/09 23:37:32.0046 2268        kmixer          (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
2011/06/09 23:37:32.0156 2268        KSecDD          (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/06/09 23:37:32.0671 2268        mdmxsdk        (74f4372af97a587ecec527ec34955712) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/06/09 23:37:32.0765 2268        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/06/09 23:37:32.0921 2268        Modem          (91a3da4b12f6f1d760463a7f7857f748) C:\WINDOWS\system32\drivers\Modem.sys
2011/06/09 23:37:33.0109 2268        Mouclass        (71e15ca47fd947552054afb28536268f) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/06/09 23:37:33.0375 2268        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/06/09 23:37:33.0468 2268        MountMgr        (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/06/09 23:37:33.0640 2268        mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/06/09 23:37:33.0875 2268        MRxDAV          (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/06/09 23:37:34.0015 2268        MRxSmb          (6f2d483b97b395544e59749c47963c6a) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/06/09 23:37:34.0156 2268        Msfs            (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2011/06/09 23:37:34.0390 2268        MSIRCOMM        (ee55f5c64417cc369866d7eafe9b07ab) C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
2011/06/09 23:37:34.0546 2268        MSKSSRV        (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/06/09 23:37:34.0687 2268        MSPCLOCK        (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/06/09 23:37:34.0843 2268        MSPQM          (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/06/09 23:37:34.0906 2268        mssmbios        (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/06/09 23:37:35.0015 2268        Mup            (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2011/06/09 23:37:35.0171 2268        NDIS            (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2011/06/09 23:37:35.0281 2268        NdisTapi        (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/06/09 23:37:35.0390 2268        Ndisuio        (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/06/09 23:37:35.0515 2268        NdisWan        (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/06/09 23:37:35.0593 2268        NDProxy        (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/06/09 23:37:35.0734 2268        NetBIOS        (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/06/09 23:37:35.0859 2268        NetBT          (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/06/09 23:37:36.0062 2268        NIC1394        (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/06/09 23:37:36.0218 2268        nmwcd          (696b37ea78f9d9767a2f18ba0304a51a) C:\WINDOWS\system32\drivers\nmwcd.sys
2011/06/09 23:37:36.0343 2268        nmwcdc          (bbb6010fc01d9239d88fcdf133e03ff0) C:\WINDOWS\system32\drivers\nmwcdc.sys
2011/06/09 23:37:36.0453 2268        nmwcdcj        (4c3726467d67483f054c88f058e9c153) C:\WINDOWS\system32\drivers\nmwcdcj.sys
2011/06/09 23:37:36.0578 2268        nmwcdcm        (4c3726467d67483f054c88f058e9c153) C:\WINDOWS\system32\drivers\nmwcdcm.sys
2011/06/09 23:37:36.0671 2268        Npfs            (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/06/09 23:37:36.0953 2268        Ntfs            (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/06/09 23:37:37.0250 2268        NTIDrvr        (7f1c1f78d709c4a54cbb46ede7e0b48d) C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
2011/06/09 23:37:37.0375 2268        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/06/09 23:37:37.0484 2268        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/06/09 23:37:37.0562 2268        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/06/09 23:37:37.0734 2268        ohci1394        (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/06/09 23:37:37.0859 2268        Parport        (b2f17a2edb5450e61973a037f63a595b) C:\WINDOWS\system32\drivers\Parport.sys
2011/06/09 23:37:37.0953 2268        PartMgr        (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/06/09 23:37:38.0046 2268        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/06/09 23:37:38.0187 2268        PCI            (6fb463e5b243fbd6f3d3c83f914d94fb) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/06/09 23:37:38.0484 2268        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/06/09 23:37:38.0687 2268        Pcmcia          (e2363f4c1daff89abee5f593e13d8a05) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/06/09 23:37:39.0656 2268        perc2          (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/06/09 23:37:39.0812 2268        perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/06/09 23:37:40.0125 2268        pfc            (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys
2011/06/09 23:37:40.0296 2268        PptpMiniport    (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/06/09 23:37:40.0421 2268        Processor      (3d7f196e77f986c106e9320b81a5ebbf) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/06/09 23:37:40.0531 2268        PSched          (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/06/09 23:37:40.0609 2268        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/06/09 23:37:40.0781 2268        PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/06/09 23:37:40.0953 2268        ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/06/09 23:37:41.0140 2268        Ql10wnt        (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/06/09 23:37:41.0312 2268        ql12160        (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/06/09 23:37:41.0500 2268        ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/06/09 23:37:41.0687 2268        ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/06/09 23:37:41.0812 2268        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/06/09 23:37:42.0031 2268        Rasirda        (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/06/09 23:37:42.0156 2268        Rasl2tp        (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/06/09 23:37:42.0265 2268        RasPppoe        (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/06/09 23:37:42.0328 2268        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/06/09 23:37:42.0625 2268        Rdbss          (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/06/09 23:37:42.0703 2268        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/06/09 23:37:42.0843 2268        rdpdr          (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/06/09 23:37:43.0093 2268        RDPWD          (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/06/09 23:37:43.0328 2268        redbook        (aa56702e230860565cb8d43680f57f33) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/06/09 23:37:43.0609 2268        RTL8023xp      (911e07056b865760c0762f6221145999) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
2011/06/09 23:37:43.0781 2268        sdbus          (02fc71b020ec8700ee8a46c58bc6f276) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/06/09 23:37:43.0906 2268        sdcplh          (dac1594437cd44ff57fafc71256fe7f3) C:\WINDOWS\system32\drivers\sdcplh.sys
2011/06/09 23:37:44.0125 2268        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/06/09 23:37:44.0312 2268        Serial          (cd5b9995afcdb466c9efc048d167e3be) C:\WINDOWS\system32\drivers\Serial.sys
2011/06/09 23:37:44.0515 2268        Sfloppy        (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/06/09 23:37:44.0953 2268        sisagp          (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/06/09 23:37:45.0140 2268        SMCIRDA        (62556d170f22c43a544481e4ee16d2e2) C:\WINDOWS\system32\DRIVERS\smcirda.sys
2011/06/09 23:37:45.0328 2268        snapman        (bcc773872041aa59bc9a6cf770fb32e2) C:\WINDOWS\system32\DRIVERS\snapman.sys
2011/06/09 23:37:45.0468 2268        Sparrow        (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/06/09 23:37:45.0703 2268        splitter        (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
2011/06/09 23:37:45.0890 2268        sr              (e4200cb2f418d8fc4acdd7e38c419d6a) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/06/09 23:37:46.0078 2268        Srv            (ab9c79ed12d65e800aaad3d72a04792f) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/06/09 23:37:46.0296 2268        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/06/09 23:37:46.0515 2268        STIrUsb        (a1a16662c6b1a665d965d61b9eecc5a7) C:\WINDOWS\system32\DRIVERS\irstusb.sys
2011/06/09 23:37:46.0703 2268        swenum          (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/06/09 23:37:46.0890 2268        swmidi          (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/06/09 23:37:47.0156 2268        symc810        (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/06/09 23:37:47.0343 2268        symc8xx        (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/06/09 23:37:47.0500 2268        sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/06/09 23:37:47.0687 2268        sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/06/09 23:37:47.0921 2268        SynTP          (66f680409fc3bddf62741e3e920a8454) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/06/09 23:37:48.0078 2268        sysaudio        (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/06/09 23:37:48.0250 2268        Tcpip          (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/06/09 23:37:48.0437 2268        TDPIPE          (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/06/09 23:37:48.0656 2268        tdrpman        (603d59923828c6c213b84b14cbf32083) C:\WINDOWS\system32\DRIVERS\tdrpman.sys
2011/06/09 23:37:48.0859 2268        TDTCP          (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/06/09 23:37:49.0046 2268        TermDD          (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/06/09 23:37:49.0265 2268        tifsfilter      (a59f3bbe6bd3c20f8ffb0b62cff54cc6) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
2011/06/09 23:37:49.0437 2268        timounter      (e30af40ba4e54a6f4c2674b96e727605) C:\WINDOWS\system32\DRIVERS\timntr.sys
2011/06/09 23:37:49.0703 2268        TosIde          (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/06/09 23:37:49.0984 2268        tvicport        (97dd70feca64fb4f63de7bb7e66a80b1) C:\WINDOWS\system32\drivers\tvicport.sys
2011/06/09 23:37:50.0156 2268        UBHelper        (e0c67be430c6de490d6ccaecfa071f9e) C:\WINDOWS\system32\drivers\UBHelper.sys
2011/06/09 23:37:50.0312 2268        Udfs            (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2011/06/09 23:37:50.0531 2268        ultra          (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/06/09 23:37:50.0703 2268        Update          (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
2011/06/09 23:37:51.0000 2268        usbccgp        (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/06/09 23:37:51.0156 2268        usbehci        (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/06/09 23:37:51.0281 2268        usbhub          (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/06/09 23:37:51.0437 2268        usbohci        (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/06/09 23:37:51.0687 2268        usbprint        (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/06/09 23:37:51.0812 2268        usbscan        (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/06/09 23:37:52.0031 2268        USBSTOR        (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/06/09 23:37:52.0171 2268        VgaSave        (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2011/06/09 23:37:52.0421 2268        viaagp          (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/06/09 23:37:52.0484 2268        ViaIde          (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/06/09 23:37:52.0578 2268        VolSnap        (d6888520ff56d72a50437e371ca25fc9) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/06/09 23:37:52.0765 2268        Wanarp          (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/06/09 23:37:52.0968 2268        wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2011/06/09 23:37:53.0421 2268        wdmaud          (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/06/09 23:37:53.0687 2268        winachsf        (6f25b08ebbac9e02e6a0829f2c28999b) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/06/09 23:37:53.0953 2268        WmiAcpi        (ae2c8544e747c20062db27456ea2d67a) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/06/09 23:37:54.0218 2268        WpdUsb          (1385e5aa9c9821790d33a9563b8d2dd0) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/06/09 23:37:54.0515 2268        zntport        (40ac8590cc9006dbb99ffcb37879d4c6) C:\WINDOWS\system32\drivers\zntport.sys
2011/06/09 23:37:54.0609 2268        MBR (0x1B8)    (99852d5c3a78447c3d6d82b6155fe848) \Device\Harddisk0\DR0
2011/06/09 23:37:54.0859 2268        MBR (0x1B8)    (739b36f7a373fc81121d831231b6d311) \Device\Harddisk1\DR4
2011/06/09 23:37:55.0406 2268        MBR (0x1B8)    (35fb015cc001342c00298136544ed201) \Device\Harddisk2\DR8
2011/06/09 23:37:59.0093 2268        ================================================================================
2011/06/09 23:37:59.0093 2268        Scan finished
2011/06/09 23:37:59.0093 2268        ================================================================================
2011/06/09 23:37:59.0156 3660        Detected object count: 0
2011/06/09 23:37:59.0156 3660        Actual detected object count: 0
Wegen der Dokumente bin ich mir nicht sicher, ob was fehlt, da nicht mein Rechner. werde Unhide mal prophylaktisch laufen lassen.

Viel hilft viel, oder so. :party::party:

Jan

cosinus 10.06.2011 08:57
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

kickstarter 14.06.2011 20:02
Hi Arne,

erstmal sorry für die späte Antwort. war über's WE weg und hatte leider keinen Zugang zum Inet.

Wie auch immer. Hab dreimal versucht, Cofi scannen zu lassen. Der Rechner hängt sich dabei jedesmal auf. Man sieht noch die blaue Dos-Konsole mit dem Hinweis, daß ein Scan ca. 10 Minuten dauert, bei besonders schweren Infizierungen auch doppelt so lang. Hab die Kiste über Nacht stehen lassen. Morgens stand sie immer noch auf dieser Stufe und reagierte nicht mehr. :abklatsch:

Außerdem habe ich den Avira-Software-Rumpf deinstalliert, da sich die Prozesse avguard und noch ein anderer av.. nicht beenden ließen. Cofi hatte noch gewarnt, daß sonst keine intensiven Reinigungen durchgeführt werden können. Avira hat ja eh nicht gefunzt. Hoffe nur, daß ich Dir damit keine Steine in den Weg gelegt habe..

Und jetzt?

Cheers,

Jan

cosinus 14.06.2011 21:09
Starte Windows neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und probier es bitte nochmal.

kickstarter 15.06.2011 22:57
Moin Arne,

ComboFix will ums Verrecken nicht scannen. Systemwiederherstellngspunkt wird noch gesetzt, danach ist Schicht.

Habe mehrfach Combofix heruntergeladen und auch den Namen unterschiedlich gewählt - nichts zu machen.

:killpc:

jan

cosinus 16.06.2011 09:10
Dann erstmal Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

kickstarter 16.06.2011 21:09
.. da wären die Logs:

1. GMER

Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-16 21:18:52
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 HTS541060G9AT00 rev.MB3OA60A
Running: t9i6ulrl.exe; Driver: C:\DOKUME~1\Caudia\LOKALE~1\Temp\pwldqpog.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                              tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                              tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                              tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device          \Driver\atapi \Device\Ide\IdePort0                                                  sdcplh.sys (SDCPLH/Macrovision Europe Ltd)
Device          \Driver\atapi \Device\Ide\IdePort1                                                  sdcplh.sys (SDCPLH/Macrovision Europe Ltd)
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4                                        sdcplh.sys (SDCPLH/Macrovision Europe Ltd)
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c                                        sdcplh.sys (SDCPLH/Macrovision Europe Ltd)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout  15
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota    10000
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                  yes
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                 
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout  90
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota    10000

---- EOF - GMER 1.0.15 ----
2. OSAM

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:00:17 on 16.06.2011

OS: Windows XP Home Edition Service Pack 2 (Build 2600)
Default Browser: Mozilla Corporation Firefox 4.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"PREFSCPL.CPL" - "RealNetworks, Inc." - C:\WINDOWS\system32\PREFSCPL.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Acronis Snapshots Manager" (snapman) - "Acronis" - C:\WINDOWS\System32\DRIVERS\snapman.sys
"Acronis True Image Backup Archive Explorer" (timounter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\timntr.sys
"Acronis True Image FS Filter" (tifsfilter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tifsfilt.sys
"Acronis Try&Decide and Restore Points filter" (tdrpman) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tdrpman.sys
"ASCTRM" (ASCTRM) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\system32\drivers\ASCTRM.sys
"c2993f78-9da9-45d9-a79d-744e5b8562e3" (c2993f78-9da9-45d9-a79d-744e5b8562e3) - ? - E:\Player\cds300.dll  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Dritek General Port I/O" (DritekPortIO) - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\DPortIO.sys
"eLock2BurnerLockDriver" (eLock2BurnerLockDriver) - ? - C:\WINDOWS\system32\eLock2BurnerLockDriver.sys  (File not found)
"eLock2FSCTLDriver" (eLock2FSCTLDriver) - ? - C:\WINDOWS\system32\eLock2FSCTLDriver.sys  (File not found)
"int15" (int15) - ? - C:\WINDOWS\system32\drivers\int15.sys  (File found, but it contains no detailed information)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"Padus ASPI Shell" (pfc) - "Padus, Inc." - C:\WINDOWS\System32\drivers\pfc.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"sdcplh" (sdcplh) - "Macrovision Europe Ltd" - C:\WINDOWS\System32\drivers\sdcplh.sys
"tvicport" (tvicport) - "EnTech Taiwan" - C:\WINDOWS\system32\drivers\tvicport.sys
"UBHelper" (UBHelper) - ? - C:\WINDOWS\system32\drivers\UBHelper.sys  (File found, but it contains no detailed information)
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\WINDOWS\System32\DRIVERS\NTIDrvr.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"zntport" (zntport) - "Zeal SoftStudio" - C:\WINDOWS\system32\drivers\zntport.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{C539A15A-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Context Menu Extension" - "Acronis" - C:\Programme\Acronis\TrueImageHome\tishell.dll
{C539A15B-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Extension" - "Acronis" - C:\Programme\Acronis\TrueImageHome\tishell.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - "Acer Labs USA" - C:\WINDOWS\system32\epm-po.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\msohev.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -  (File not found | COM-object registry key not found)
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Yahoo! Toolbar" - "Yahoo! Inc." - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
<binary data> "{C4069E3A-68F1-403E-B40E-20066696354B}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{EF99BD32-C1FB-11D2-892F-0090271D4F88} "Yahoo! Toolbar" - "Yahoo! Inc." - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} "A9Helper.A9" - ? - C:\WINDOWS\Downloaded Program Files\A9.ocx / file://E:\components\A9.ocx
{22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} "HidInputMonitorX Control" - "TODO: <Company name>" - C:\WINDOWS\DOWNLO~1\HIDINP~1.OCX / file://E:\components\hidinputmonitorx.ocx
{7030CC6C-1A88-4591-BB5A-651B9F7F0C30} "WMVHDRatingCtrl Class" - ? - C:\WINDOWS\Downloaded Program Files\wmvhdrating.ocx / file://E:\components\wmvhdrating.ocx
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -  (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Yahoo! Toolbar" - "Yahoo! Inc." - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{02478D38-C3F9-4efb-9B51-7695ECA05670} "&Yahoo! Toolbar Helper" - "Yahoo! Inc." - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} "SingleInstance Class" - "Yahoo! Inc" - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Authentication packages" - "Acronis" - C:\WINDOWS\system32\relog_ap.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"Acer Empowering Technology.lnk" - "Acer Inc." - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe  (Shortcut exists | File exists)
"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\DESKTOP.INI
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\Caudia\Startmenü\Programme\Autostart\DESKTOP.INI
"WKCALREM.LNK" - "Microsoft® Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkCalRem.exe  (Shortcut exists | File exists)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acer ePresentation HPD" - ? - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
"Acronis Scheduler2 Service" - "Acronis" - "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
"AcronisTimounterMonitor" - "Acronis" - C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
"ATICCC" - "ATI Technologies Inc." - "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
"AzMixerSel" - "Realtek Semiconductor Corp." - C:\Programme\Realtek\InstallShield\AzMixerSel.exe
"Boot" - ? - C:\Acer\Empowering Technology\ePower\Boot.exe  (File found, but it contains no detailed information)
"ePower_DMC" - ? - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
"eRecoveryService" - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
"HP Software Update" - "Hewlett-Packard" - C:\Programme\HP\HP Software Update\HPWuSchd2.exe
"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\LManager.exe
"MSPY2002" - ? - C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC  (File signed by Microsoft | File found, but it contains no detailed information)
"PCMService" - "CyberLink Corp." - "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
"PrinTray" - "Lexmark" - C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
"TrueImageMonitor.exe" - "Acronis" - C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Lexmark Network Port" - "Lexmark International, Inc." - C:\WINDOWS\system32\LEXLMPM.DLL

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Acronis Scheduler2 Service" (AcrSch2Svc) - "Acronis" - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
"Acronis Try And Decide Service" (TryAndDecideService) - ? - C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe  (File found, but it contains no detailed information)
"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"AOL Connectivity Service" (AOL ACS) - "America Online, Inc." - C:\PROGRA~1\GEMEIN~1\aol\ACS\AOLACSD.EXE
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
"CyberLink Media Library Service" (CyberLink Media Library Service) - "Cyberlink" - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Programme\CyberLink\Shared Files\RichVideo.exe
"CyberLink Task Scheduler (CTS)" (CLSched) - ? - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll
"LexBce Server" (LexBceS) - "Lexmark International, Inc." - C:\WINDOWS\system32\LEXBCES.EXE
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
"Memory Check Service" (AcerMemUsageCheckService) - "Acer Inc." - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZinw12.dll
"PEVSystemStart" (PEVSystemStart) - ? - C:\test\pev.cfxxe  (File found, but it contains no detailed information)
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZipm12.dll
"Universal Driver" (nqjttxgdq) - ? - C:\WINDOWS\system32\emeajs.dll  (File not found)

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
3. MBRcheck

Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows XP Home Edition
Windows Information:                Service Pack 2 (build 2600)
Logical Drives Mask:                0x0000007c

Kernel Drivers (total 185):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806E3000 \WINDOWS\system32\hal.dll
  0xF7987000 \WINDOWS\system32\KDCOM.DLL
  0xF7897000 \WINDOWS\system32\BOOTVID.dll
  0xF7357000 ACPI.sys
  0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xF7346000 pci.sys
  0xF7487000 isapnp.sys
  0xF7497000 ohci1394.sys
  0xF74A7000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xF789B000 compbatt.sys
  0xF789F000 \WINDOWS\system32\DRIVERS\BATTC.SYS
  0xF7A4F000 pciide.sys
  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF798B000 aliide.sys
  0xF798D000 intelide.sys
  0xF798F000 toside.sys
  0xF7991000 viaide.sys
  0xF7993000 cmdide.sys
  0xF7328000 pcmcia.sys
  0xF74B7000 MountMgr.sys
  0xF7309000 ftdisk.sys
  0xF78A3000 ACPIEC.sys
  0xF7A50000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
  0xF770F000 PartMgr.sys
  0xF78A7000 UBHelper.sys
  0xF74C7000 VolSnap.sys
  0xF78AB000 cpqarray.sys
  0xF72F1000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
  0xF72D9000 atapi.sys
  0xF78AF000 aha154x.sys
  0xF7717000 sparrow.sys
  0xF78B3000 symc810.sys
  0xF74D7000 aic78xx.sys
  0xF78B7000 dac960nt.sys
  0xF74E7000 ql10wnt.sys
  0xF78BB000 amsint.sys
  0xF771F000 asc.sys
  0xF78BF000 asc3550.sys
  0xF7727000 mraid35x.sys
  0xF772F000 i2omp.sys
  0xF78C3000 ini910u.sys
  0xF74F7000 ql1240.sys
  0xF7507000 aic78u2.sys
  0xF7737000 symc8xx.sys
  0xF773F000 sym_hi.sys
  0xF7747000 sym_u3.sys
  0xF774F000 ABP480N5.SYS
  0xF7757000 asc3350p.sys
  0xF7995000 cd20xrnt.sys
  0xF7517000 ultra.sys
  0xF72C0000 adpu160m.sys
  0xF775F000 dpti2o.sys
  0xF7527000 ql1080.sys
  0xF7537000 ql1280.sys
  0xF7547000 ql12160.sys
  0xF7767000 perc2.sys
  0xF7997000 perc2hib.sys
  0xF776F000 hpn.sys
  0xF78C7000 cbidf2k.sys
  0xF7294000 dac2w2k.sys
  0xF7557000 disk.sys
  0xF7567000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7274000 fltMgr.sys
  0xF7262000 sr.sys
  0xF7577000 PxHelp20.sys
  0xF723F000 Fastfat.sys
  0xF7228000 KSecDD.sys
  0xF71FB000 NDIS.sys
  0xF7190000 timntr.sys
  0xF7587000 viaagp.sys
  0xF7137000 tdrpman.sys
  0xF7119000 snapman.sys
  0xF7597000 sisagp.sys
  0xF70FE000 Mup.sys
  0xF75A7000 alim1541.sys
  0xF75B7000 amdagp.sys
  0xF75C7000 agp440.sys
  0xF75D7000 agpCPQ.sys
  0xF75E7000 \SystemRoot\system32\DRIVERS\AmdK8.sys
  0xF7002000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0xF6DEF000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
  0xF6DDB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF77CF000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xF6DB8000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF77D7000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF75F7000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xF6FFE000 \SystemRoot\system32\drivers\pfc.sys
  0xF7607000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xF7617000 \SystemRoot\system32\DRIVERS\redbook.sys
  0xF6D95000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF79AB000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0xF6D70000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xF7627000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF77DF000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
  0xF77E7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF6D40000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0xF79AD000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF77EF000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF6FF6000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0xF6D2B000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
  0xF6CB3000 \SystemRoot\system32\DRIVERS\ar5211.sys
  0xF7637000 \SystemRoot\system32\DRIVERS\EMS7SK.sys
  0xF6CA2000 \SystemRoot\system32\DRIVERS\sdbus.sys
  0xF6C8F000 \SystemRoot\system32\DRIVERS\ESM7SK.sys
  0xF7647000 \SystemRoot\system32\DRIVERS\ESD7SK.sys
  0xF7B27000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xF77F7000 \SystemRoot\system32\DRIVERS\rasirda.sys
  0xF77FF000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xF7657000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xF6FEE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xF6C78000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xF7667000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xF7677000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xF6BC7000 \SystemRoot\system32\DRIVERS\psched.sys
  0xF7687000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF7807000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF780F000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xF7817000 \SystemRoot\system32\DRIVERS\wanatw4.sys
  0xF7697000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xF79AF000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xF6B6B000 \SystemRoot\system32\DRIVERS\update.sys
  0xF6FE2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xF76A7000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF76D7000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xEE6A0000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xEE67C000 \SystemRoot\system32\drivers\portcls.sys
  0xF76E7000 \SystemRoot\system32\drivers\drmk.sys
  0xEE649000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
  0xEE557000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
  0xEE4A5000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
  0xF781F000 \SystemRoot\System32\Drivers\Modem.SYS
  0xF79BB000 \SystemRoot\System32\Drivers\i2omgmt.SYS
  0xF79BD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xF7B5B000 \SystemRoot\System32\Drivers\Null.SYS
  0xF79BF000 \SystemRoot\System32\Drivers\Beep.SYS
  0xF7847000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xF784F000 \SystemRoot\System32\drivers\vga.sys
  0xF79C1000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF79C3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xF7857000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xF785F000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF6FB2000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xEE329000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xEE2D1000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xEE2A9000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xEE287000 \SystemRoot\System32\drivers\afd.sys
  0xF70DE000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xF70BE000 \SystemRoot\System32\drivers\sdcplh.sys
  0xEE25C000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xEE1ED000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xF70AE000 \SystemRoot\System32\Drivers\Fips.SYS
  0xEE1CC000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xF709E000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xF7867000 \SystemRoot\system32\DRIVERS\irstusb.sys
  0xF6F86000 \SystemRoot\system32\DRIVERS\irenum.sys
  0xF786F000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xF6C58000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xEE13C000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xF79CD000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xEE1B8000 \SystemRoot\System32\drivers\Dxapi.sys
  0xF7877000 \SystemRoot\System32\watchdog.sys
  0xBF9C3000 \SystemRoot\System32\drivers\dxg.sys
  0xF7A62000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF9D5000 \SystemRoot\System32\ati2dvag.dll
  0xBFA18000 \SystemRoot\System32\ati2cqag.dll
  0xBFA5D000 \SystemRoot\System32\atikvmag.dll
  0xBFA93000 \SystemRoot\System32\ati3duag.dll
  0xBFD25000 \SystemRoot\System32\ativvaxx.dll
  0xEE455000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
  0xEBDF6000 \SystemRoot\system32\DRIVERS\irda.sys
  0xEBF1C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xEBAFA000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xF7A03000 \SystemRoot\System32\Drivers\ASCTRM.SYS
  0xEBAEA000 \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys
  0xEB9A9000 \??\C:\WINDOWS\system32\drivers\int15.sys
  0xEB92F000 \SystemRoot\system32\DRIVERS\srv.sys
  0xEBABE000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
  0xEB762000 \SystemRoot\system32\drivers\wdmaud.sys
  0xEB8DF000 \SystemRoot\system32\drivers\sysaudio.sys
  0xEB87F000 \??\C:\WINDOWS\system32\drivers\tvicport.sys
  0xF7BC9000 \??\C:\WINDOWS\system32\drivers\zntport.sys
  0xEB0BB000 \SystemRoot\System32\Drivers\HTTP.sys
  0x7C910000 \WINDOWS\System32\ntdll.dll

Processes (total 62):
      0 System Idle Process
      4 System
    648 C:\WINDOWS\System32\SMSS.EXE
    788 csrss.exe
    820 C:\WINDOWS\System32\winlogon.exe
    864 C:\WINDOWS\System32\services.exe
    876 C:\WINDOWS\System32\lsass.exe
    1024 C:\WINDOWS\System32\Ati2evxx.exe
    1040 C:\WINDOWS\System32\svchost.exe
    1112 svchost.exe
    1168 C:\WINDOWS\System32\svchost.exe
    1264 svchost.exe
    1360 svchost.exe
    1604 C:\WINDOWS\System32\LexBceS.exe
    1640 C:\WINDOWS\System32\spoolsv.exe
    1648 C:\WINDOWS\System32\Lexpps.exe
    1764 svchost.exe
    1792 C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    1884 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
    1920 C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe
    1964 C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
    2020 C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
    2044 C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
    248 C:\WINDOWS\System32\svchost.exe
    296 C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
    392 C:\WINDOWS\System32\svchost.exe
    512 C:\WINDOWS\System32\svchost.exe
    572 C:\Programme\CyberLink\Shared Files\RichVideo.exe
    604 C:\WINDOWS\System32\svchost.exe
    676 C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe
    1548 wdfmgr.exe
    1836 C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
    2628 C:\WINDOWS\System32\Ati2evxx.exe
    2736 C:\WINDOWS\Explorer.EXE
    2776 C:\WINDOWS\System32\wscntfy.exe
    2872 wmiprvse.exe
    3128 alg.exe
    3248 C:\WINDOWS\System32\wbem\wmiapsrv.exe
    3340 wmiprvse.exe
    3384 C:\Program Files\Acer\Acer Arcade\PCMService.exe
    3448 C:\Programme\ATI Technologies\ATI.ACE\cli.exe
    3496 C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    3544 C:\WINDOWS\RTHDCPL.EXE
    3580 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
    3612 C:\Programme\Launch Manager\LManager.exe
    3624 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    3664 C:\Programme\hp\HP Software Update\hpwuSchd2.exe
    3848 C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
    3880 C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
    3932 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
    3960 C:\WINDOWS\System32\ctfmon.exe
    4092 C:\Programme\hp\Digital Imaging\bin\hpqtra08.exe
    288 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkCalRem.exe
    2168 C:\WINDOWS\System32\wbem\unsecapp.exe
    3004 C:\Programme\ATI Technologies\ATI.ACE\cli.exe
    2996 C:\Programme\ATI Technologies\ATI.ACE\cli.exe
    3404 C:\Programme\hp\Digital Imaging\bin\hpqSTE08.exe
    3576 C:\Programme\hp\Digital Imaging\bin\HPQBAM08.EXE
    3532 C:\Programme\hp\Digital Imaging\bin\hpqgpc01.exe
    3156 C:\WINDOWS\System32\wuauclt.exe
    2952 C:\Dokumente und Einstellungen\Caudia\Desktop\MBRCheck.exe
    4048 <unknown>

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`384c7a00  (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000007`89313e00  (FAT32)

PhysicalDrive0 Model Number: HTS541060G9AT00, Rev: MB3OA60A

      Size  Device Name          MBR Status
  --------------------------------------------
    55 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: 6A37CCD118436B688B51F6BD4C2B47A895EBDF7F


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice:

Done!
Cheers :party:,

jan


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:22 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131