Trojaner-Board - Windows Recovery -> Computer weiterhin langsam

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows Recovery -> Computer weiterhin langsam (https://www.trojaner-board.de/100410-windows-recovery-computer-weiterhin-langsam.html)

Windows Recovery -> Computer weiterhin langsam

Guten Abend,

bin über google auf euer Forum gestoßen. Hab mir vor kurzem den „Windows-Recovery-Trojaner“ beim surfen eingefangen (glaub ich zumindest). Die Symptome sind mit denen, die ihr hier:http://www.trojaner-board.de/96741-w...entfernen.html beschrieben habt identisch. Bin dann auch eurer Anleitung gefolgt. Habe zuerst rkill.com durchgeführt und anschließend meine Dateien wieder sichtbar gemacht. Danach habe ich einen Scan mit Malewarebytes durchgeführt und 8 infizierte Objekte gefunden (siehe Logfile). Diese habe ich in Quarantäne verschoben und entfernt. Zu meinem Bedauern ist der Laptop immernoch extrem langsam. Aus diesem Grund hab ich den OTHelper benutzt und nochmals gescant, ohne Ergebnis. Ich bin zwar froh, meine Dateien wiederzuhaben, aber da der Laptop immernoch langsam ist, ist der Trojaner wohl immernoch da. Hoffe ihr könnt mir helfen.

mfG EREZA

Die Logfiles von "defogger", "OTL" und "Malewarebytes" sind im Anhang.

Danke schonmal.

Zitat:

Art des Suchlaufs: Quick-Scan

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Hier die Logfiles von Scans, die ich durchgeführt habe:

Zitat:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6856

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

14.06.2011 19:35:30
mbam-log-2011-06-14 (19-35-30).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 162118
Laufzeit: 27 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 8

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\*****\AppData\Local\Temp\tmp118E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\tmp48E5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\tmp4A0B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\tmp5247.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\tmpE4BD.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\tmpE549.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\tmpE74C.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\*****\AppData\Local\Temp\EB16.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Zitat:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6859

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

15.06.2011 15:32:06
mbam-log-2011-06-15 (15-32-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Durchsuchte Objekte: 322303
Laufzeit: 4 Stunde(n), 8 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\*****\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Zitat:

Datenbank Version: 6859

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.

Nach ein paar Tagen Urlaub kann es ja mit dem Laptop weitergehen :headbang:

Zitat:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6955

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

26.06.2011 23:09:17
mbam-log-2011-06-26 (23-09-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|)
Durchsuchte Objekte: 320353
Laufzeit: 1 Stunde(n), 11 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Mach bitte ein neues OTL-Log. Das letzte ist schon fast 2 Wochen alt:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Wie verlangt:

OTL Logfile:

Code:

OTL logfile created on: 27.06.2011 16:48:05 - Run 2

OTL by OldTimer - Version 3.2.24.0     Folder = C:\Users\*****\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,50 Gb Total Physical Memory | 1,54 Gb Available Physical Memory | 61,56% Memory free

5,21 Gb Paging File | 4,00 Gb Available in Paging File | 76,83% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 111,44 Gb Total Space | 54,61 Gb Free Space | 49,01% Space Free | Partition Type: NTFS

Drive D: | 232,88 Gb Total Space | 232,59 Gb Free Space | 99,88% Space Free | Partition Type: NTFS

Drive E: | 111,44 Gb Total Space | 111,35 Gb Free Space | 99,92% Space Free | Partition Type: NTFS

Drive G: | 21,17 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: *****-PC | User Name: ***** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Programme\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)

PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10i_ActiveX.exe (Adobe Systems, Inc.)

PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Programme\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)

PRC - C:\Windows\PLFSetI.exe ()

PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)

PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)

PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)

PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)

PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)

PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)

PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)

PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()

PRC - C:\Programme\Mobile Partner\Mobile Partner.exe ()

PRC - c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)

PRC - C:\Programme\Internet Explorer\ieuser.exe (Microsoft Corporation)

PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)

PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()

PRC - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)

PRC - C:\ACER\Mobility Center\MobilityService.exe ()

PRC - c:\Programme\McAfee\MSC\mcuimgr.exe (McAfee, Inc.)

PRC - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

PRC - C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.)

PRC - c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)

PRC - C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

PRC - C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools)

MOD - c:\Programme\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)

MOD - C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)

MOD - C:\Windows\System32\powrprof.dll (Microsoft Corporation)

MOD - C:\Windows\System32\wtsapi32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)

SRV - (eDataSecurity Service) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)

SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()

SRV - (McNASvc) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()

SRV - (mcmscsvc) -- C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)

SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()

SRV - (McSysmon) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)

SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SRV - (MSK80Service) -- C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)

SRV - (McProxy) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)

SRV - (McShield) -- C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)

SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)

DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)

DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)

DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)

DRV - (Ltn_stk7070P) -- C:\Windows\System32\drivers\Ltn_stk7070P.sys (LiteOn)

DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)

DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)

DRV - (mfesmfk) -- C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)

DRV - (mfehidk) -- C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)

DRV - (mfeavfk) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)

DRV - (mfebopk) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)

DRV - (mferkdk) -- C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)

DRV - (MPFP) -- C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)

DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1109&m=aspire_7530g

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.facebook.com/ [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spox.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q="

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011.05.26 15:59:36 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.08 10:42:34 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.08 10:42:34 | 000,000,000 | ---D | M]

 

[2009.12.05 21:55:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions

[2011.05.07 16:10:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\2jworvw7.default\extensions

[2010.05.03 10:27:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\2jworvw7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(34)

[2011.06.15 15:52:00 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\2jworvw7.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.06.18 10:20:27 | 000,000,950 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\2jworvw7.default\searchplugins\icqplugin-1.xml

[2010.05.10 19:47:24 | 000,000,955 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\2jworvw7.default\searchplugins\icqplugin.xml

[2010.04.25 13:04:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.01.30 13:38:50 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

File not found (No name found) -- 

[2011.05.26 15:59:36 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR

[2010.04.25 13:04:25 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

[2009.11.30 16:19:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

[2011.05.08 10:42:12 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2011.05.08 10:42:17 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.05.08 10:42:17 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2011.05.08 10:42:17 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2011.05.08 10:42:17 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2011.05.08 10:42:17 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2011.05.08 10:42:17 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Programme\McAfee\MSK\mcapbho.dll ()

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)

O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)

O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)

O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)

O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)

O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)

O4 - HKLM..\Run: [eRecoveryService]  File not found

O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)

O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [WarReg_PopUp] C:\Programme\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

O4 - Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()

O8 - Extra context menu item: Free YouTube Download - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)

O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)

O20 - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe ()

O24 - Desktop WallPaper: C:\Users\*****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\*****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - G:\AutoRun.exe -- [ CDFS ]

O32 - AutoRun File - [2008.06.02 16:16:48 | 000,000,045 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{067c4248-de75-11de-bd3b-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{067c4248-de75-11de-bd3b-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{067c424a-de75-11de-bd3b-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{067c424a-de75-11de-bd3b-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{067c4252-de75-11de-bd3b-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{067c4252-de75-11de-bd3b-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{11d042f5-c171-11df-9dca-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{11d042f5-c171-11df-9dca-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{11d042f7-c171-11df-9dca-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{11d042f7-c171-11df-9dca-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{242ac820-b108-11df-b591-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{242ac820-b108-11df-b591-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{480d7d35-d92e-11de-824c-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{480d7d35-d92e-11de-824c-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{480d7d5b-d92e-11de-824c-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{480d7d5b-d92e-11de-824c-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{98eac31c-c959-11df-a4f5-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{98eac31c-c959-11df-a4f5-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{b254094b-ac43-11df-a12b-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b254094b-ac43-11df-a12b-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{d368f32d-ae13-11df-8764-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{d368f32d-ae13-11df-8764-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{e1658f55-b105-11df-81cd-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e1658f55-b105-11df-81cd-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\Shell\AutoRun\command - "" = H:\AutoRun.exe

O33 - MountPoints2\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\Shell\AutoRun\command - "" = H:\AutoRun.exe

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\H\Shell - "" = AutoRun

O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: mcmscsvc - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)

SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: mcmscsvc - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)

SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SafeBootNet: Messenger - Service

SafeBootNet: MpfService - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.06.18 13:27:47 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTH.scr

[2011.06.15 20:00:27 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe

[2011.06.15 17:22:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.06.15 17:22:19 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.06.15 17:22:06 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.06.15 17:20:01 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\*****\Desktop\mbam-setup-1.51.0.1200.exe

[2011.06.14 21:19:28 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\backups

[2011.06.14 19:04:22 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes

[2011.06.14 19:03:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.06.14 19:03:46 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2008.07.22 10:01:25 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll

[1 C:\Users\*****\Documents\*.tmp files -> C:\Users\*****\Documents\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.06.27 16:18:47 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml

[2011.06.27 16:17:36 | 000,027,934 | ---- | M] () -- C:\ProgramData\nvModes.001

[2011.06.27 16:17:17 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.06.27 16:16:46 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.06.27 16:16:45 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.06.27 16:16:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.06.27 16:16:04 | 2682,679,296 | -HS- | M] () -- C:\hiberfil.sys

[2011.06.27 11:35:10 | 000,009,416 | ---- | M] () -- C:\Windows\System32\Config.MPF

[2011.06.27 11:12:03 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.06.26 21:14:07 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.06.26 21:14:07 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.06.26 21:14:07 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.06.26 21:14:07 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.06.18 13:28:07 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTH.scr

[2011.06.18 09:52:02 | 336,739,443 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2011.06.16 19:16:15 | 000,023,378 | ---- | M] () -- C:\Users\*****\Desktop\Logfiles.zip

[2011.06.16 19:01:19 | 000,021,263 | ---- | M] () -- C:\Users\*****\Desktop\Logfiles.rar

[2011.06.16 18:01:43 | 000,000,000 | ---- | M] () -- C:\Users\*****\defogger_reenable

[2011.06.16 17:57:59 | 000,014,702 | ---- | M] () -- C:\Users\*****\Desktop\Unbenannt 1.odt

[2011.06.15 20:00:49 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe

[2011.06.15 19:58:20 | 000,050,477 | ---- | M] () -- C:\Users\*****\Desktop\Defogger.exe

[2011.06.15 17:22:20 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.15 17:20:14 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\*****\Desktop\mbam-setup-1.51.0.1200.exe

[2011.06.15 17:16:03 | 001,007,120 | ---- | M] () -- C:\Users\*****\Desktop\eXplorer.exe

[2011.06.14 17:59:38 | 000,000,128 | ---- | M] () -- C:\ProgramData\~40361720r

[2011.06.14 17:59:38 | 000,000,104 | ---- | M] () -- C:\ProgramData\~40361720

[2011.06.14 17:59:25 | 000,000,336 | ---- | M] () -- C:\ProgramData\40361720

[2011.06.10 15:12:01 | 000,027,934 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2011.06.09 02:58:38 | 000,008,268 | ---- | M] () -- C:\Users\*****\AppData\Local\d3d9caps.dat

[2011.05.30 20:16:00 | 000,002,789 | ---- | M] () -- C:\Users\*****\.recently-used.xbel

[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[1 C:\Users\*****\Documents\*.tmp files -> C:\Users\*****\Documents\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.06.16 19:16:15 | 000,023,378 | ---- | C] () -- C:\Users\*****\Desktop\Logfiles.zip

[2011.06.16 19:01:19 | 000,021,263 | ---- | C] () -- C:\Users\*****\Desktop\Logfiles.rar

[2011.06.16 18:01:43 | 000,000,000 | ---- | C] () -- C:\Users\*****\defogger_reenable

[2011.06.16 17:57:55 | 000,014,702 | ---- | C] () -- C:\Users\*****\Desktop\Unbenannt 1.odt

[2011.06.15 19:58:18 | 000,050,477 | ---- | C] () -- C:\Users\*****\Desktop\Defogger.exe

[2011.06.15 17:22:20 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.15 17:15:31 | 001,007,120 | ---- | C] () -- C:\Users\*****\Desktop\eXplorer.exe

[2011.06.14 17:59:36 | 000,000,128 | ---- | C] () -- C:\ProgramData\~40361720r

[2011.06.14 17:59:36 | 000,000,104 | ---- | C] () -- C:\ProgramData\~40361720

[2011.06.14 17:59:25 | 000,000,336 | ---- | C] () -- C:\ProgramData\40361720

[2011.05.30 20:16:00 | 000,002,789 | ---- | C] () -- C:\Users\*****\.recently-used.xbel

[2010.04.25 19:37:53 | 000,203,436 | ---- | C] () -- C:\Windows\hpwins19.dat.temp

[2010.04.25 19:37:53 | 000,000,997 | ---- | C] () -- C:\Windows\hpwmdl19.dat.temp

[2010.04.25 19:30:06 | 000,010,567 | R--- | C] () -- C:\Windows\hpwscr19.dat

[2010.04.25 19:28:01 | 000,202,492 | ---- | C] () -- C:\Windows\hpwins19.dat

[2009.12.05 21:55:04 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2009.11.27 10:22:02 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.11.27 10:22:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2009.11.24 20:24:04 | 000,027,934 | ---- | C] () -- C:\ProgramData\nvModes.001

[2009.11.24 20:23:59 | 000,027,934 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2009.11.24 20:17:34 | 000,018,944 | ---- | C] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.11.24 20:07:38 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe

[2009.11.24 20:07:38 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini

[2009.11.24 20:07:37 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll

[2009.11.24 19:48:07 | 000,008,268 | ---- | C] () -- C:\Users\*****\AppData\Local\d3d9caps.dat

[2008.08.14 04:25:02 | 000,129,604 | ---- | C] () -- C:\Windows\Set_Resolution_2.0.exe

[2008.05.16 04:24:58 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2008.04.01 10:39:14 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll

[2008.04.01 10:39:14 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll

[2008.04.01 10:14:24 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll

[2008.04.01 10:09:50 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll

[2008.04.01 09:59:39 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini

[2008.04.01 09:59:38 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat

[2008.04.01 09:59:38 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat

[2008.04.01 09:59:38 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat

[2008.01.21 09:15:58 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 09:15:58 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.01.07 00:08:10 | 000,000,997 | ---- | C] () -- C:\Windows\hpwmdl19.dat

[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:37 | 000,317,424 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2002.03.13 14:15:06 | 000,057,344 | ---- | C] () -- C:\Windows\System32\mupkernps11.dll

[2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll

[2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll

[2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll

[2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

 
 ========== LOP Check ==========

 

[2008.04.01 10:35:21 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Acer GameZone Console

[2011.04.13 21:02:06 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.06.15 15:51:57 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\gtk-2.0

[2010.01.30 14:56:18 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQ

[2010.02.08 00:53:08 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\OpenOffice.org

[2008.04.01 10:16:59 | 000,000,372 | ---- | M] () -- C:\Windows\Tasks\McDefragTask.job

[2008.04.01 10:16:59 | 000,000,348 | ---- | M] () -- C:\Windows\Tasks\McQcTask.job

[2011.06.27 11:35:11 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2008.04.01 10:35:21 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Acer GameZone Console

[2009.11.25 21:14:28 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Adobe

[2009.11.29 17:22:25 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\CyberLink

[2009.12.30 01:04:22 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DivX

[2011.06.15 15:51:57 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\dvdcss

[2011.04.13 21:02:06 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers

[2009.11.24 21:45:32 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Google

[2011.06.15 15:51:57 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\gtk-2.0

[2010.04.25 19:49:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\HP

[2010.01.30 14:56:18 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQ

[2009.11.24 19:50:12 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Identities

[2009.11.24 20:07:22 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\InstallShield

[2009.11.24 19:50:38 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Macromedia

[2011.06.14 19:04:22 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Media Center Programs

[2010.07.06 12:27:20 | 000,000,000 | --SD | M] -- C:\Users\*****\AppData\Roaming\Microsoft

[2009.12.05 21:55:12 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Mozilla

[2010.02.08 00:53:08 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\OpenOffice.org

[2011.06.25 21:03:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\vlc

[2009.11.28 23:10:35 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\WinRAR

[2010.04.25 19:36:25 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Yahoo!

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 22:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Programme\Cyberlink\PowerDirector\EventLog.dll

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll

[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2008.05.26 15:13:00 | 000,140,832 | ---- | M] (NVIDIA Corporation) MD5=7DF63192BCF9C20EC2F7492E7F7544F9 -- C:\ACER\Preload\Autorun\DRV\nVidia NB Chipset NVMCP77MH\IDE\WinVista\sataraid\nvstor32.sys

[2008.05.26 15:13:00 | 000,140,832 | ---- | M] (NVIDIA Corporation) MD5=FA7B8ECA6E845B244B7E30A9DCD82C6C -- C:\ACER\Preload\Autorun\DRV\nVidia NB Chipset NVMCP77MH\IDE\WinVista\sata_ide\nvstor32.sys

[2008.05.26 15:13:00 | 000,140,832 | ---- | M] (NVIDIA Corporation) MD5=FA7B8ECA6E845B244B7E30A9DCD82C6C -- C:\Windows\System32\drivers\nvstor32.sys

[2008.05.26 15:13:00 | 000,140,832 | ---- | M] (NVIDIA Corporation) MD5=FA7B8ECA6E845B244B7E30A9DCD82C6C -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_903234fc\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll

[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX0\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX10\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX11\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX12\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX13\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX14\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX15\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX16\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX17\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX18\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX19\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX20\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX21\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX22\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX23\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX24\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX25\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX26\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX27\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX28\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX29\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX6\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX7\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX8\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX9\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX0\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****AppData\Local\Temp\RarSFX10\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX11\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX12\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX13\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX14\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX15\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX16\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX17\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX18\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX19\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX20\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX21\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX22\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX23\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX24\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX25\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX26\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX27\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX28\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX29\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX6\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX7\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX8\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\*****\AppData\Local\Temp\RarSFX9\winlogon.exe

[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe

[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >

--- --- ---

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - G:\AutoRun.exe -- [ CDFS ]

O32 - AutoRun File - [2008.06.02 16:16:48 | 000,000,045 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{067c4248-de75-11de-bd3b-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{067c4248-de75-11de-bd3b-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{067c424a-de75-11de-bd3b-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{067c424a-de75-11de-bd3b-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{067c4252-de75-11de-bd3b-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{067c4252-de75-11de-bd3b-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{11d042f5-c171-11df-9dca-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{11d042f5-c171-11df-9dca-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{11d042f7-c171-11df-9dca-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{11d042f7-c171-11df-9dca-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{242ac820-b108-11df-b591-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{242ac820-b108-11df-b591-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{480d7d35-d92e-11de-824c-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{480d7d35-d92e-11de-824c-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{480d7d5b-d92e-11de-824c-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{480d7d5b-d92e-11de-824c-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{98eac31c-c959-11df-a4f5-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{98eac31c-c959-11df-a4f5-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{b254094b-ac43-11df-a12b-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b254094b-ac43-11df-a12b-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{d368f32d-ae13-11df-8764-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{d368f32d-ae13-11df-8764-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{e1658f55-b105-11df-81cd-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e1658f55-b105-11df-81cd-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\Shell\AutoRun\command - "" = H:\AutoRun.exe

O33 - MountPoints2\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\Shell - "" = AutoRun

O33 - MountPoints2\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\Shell\AutoRun\command - "" = H:\AutoRun.exe

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)

O33 - MountPoints2\H\Shell - "" = AutoRun

O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe

[2011.06.14 17:59:36 | 000,000,128 | ---- | C] () -- C:\ProgramData\~40361720r

[2011.06.14 17:59:36 | 000,000,104 | ---- | C] () -- C:\ProgramData\~40361720

[2011.06.14 17:59:25 | 000,000,336 | ---- | C] () -- C:\ProgramData\40361720

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Bitteschön:

Zitat:

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
File move failed. G:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{067c4248-de75-11de-bd3b-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{067c4248-de75-11de-bd3b-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{067c4248-de75-11de-bd3b-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{067c4248-de75-11de-bd3b-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{067c424a-de75-11de-bd3b-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{067c424a-de75-11de-bd3b-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{067c424a-de75-11de-bd3b-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{067c424a-de75-11de-bd3b-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{067c4252-de75-11de-bd3b-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{067c4252-de75-11de-bd3b-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{067c4252-de75-11de-bd3b-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{067c4252-de75-11de-bd3b-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11d042f5-c171-11df-9dca-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11d042f5-c171-11df-9dca-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11d042f5-c171-11df-9dca-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11d042f5-c171-11df-9dca-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11d042f7-c171-11df-9dca-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11d042f7-c171-11df-9dca-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11d042f7-c171-11df-9dca-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11d042f7-c171-11df-9dca-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{242ac820-b108-11df-b591-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{242ac820-b108-11df-b591-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{242ac820-b108-11df-b591-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{242ac820-b108-11df-b591-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{480d7d35-d92e-11de-824c-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480d7d35-d92e-11de-824c-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{480d7d35-d92e-11de-824c-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480d7d35-d92e-11de-824c-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{480d7d5b-d92e-11de-824c-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480d7d5b-d92e-11de-824c-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{480d7d5b-d92e-11de-824c-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480d7d5b-d92e-11de-824c-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4aa62bc0-aa8e-11df-b040-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4aa62bd5-aa8e-11df-b040-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{98eac31c-c959-11df-a4f5-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98eac31c-c959-11df-a4f5-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{98eac31c-c959-11df-a4f5-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98eac31c-c959-11df-a4f5-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b254094b-ac43-11df-a12b-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b254094b-ac43-11df-a12b-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b254094b-ac43-11df-a12b-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b254094b-ac43-11df-a12b-806e6f6e6963}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d368f32d-ae13-11df-8764-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d368f32d-ae13-11df-8764-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d368f32d-ae13-11df-8764-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d368f32d-ae13-11df-8764-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1658f55-b105-11df-81cd-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1658f55-b105-11df-81cd-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1658f55-b105-11df-81cd-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1658f55-b105-11df-81cd-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4abbffc-b5ca-11df-8b1a-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4abbffe-b5ca-11df-8b1a-00238b05e96b}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4abc008-b5ca-11df-8b1a-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb6d5799-aaa3-11df-a8b2-00238b05e96b}\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb6d579d-aaa3-11df-a8b2-00238b05e96b}\ not found.
File H:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found.
File H:\AutoRun.exe not found.
C:\ProgramData\~40361720r moved successfully.
C:\ProgramData\~40361720 moved successfully.
C:\ProgramData\40361720 moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.24.0 log created on 06282011_120602

Files\Folders moved on Reboot...
File move failed. G:\AutoRun.exe scheduled to be moved on reboot.
File move failed. G:\AUTORUN.INF scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Mmmmhhhh er hat leider nichts gefunden. Hier der Logfile:

Zitat:

2011/06/28 15:49:48.0254 7720 TDSS rootkit removing tool 2.5.7.0 Jun 28 2011 13:21:55
2011/06/28 15:49:50.0266 7720 ================================================================================
2011/06/28 15:49:50.0266 7720 SystemInfo:
2011/06/28 15:49:50.0266 7720
2011/06/28 15:49:50.0266 7720 OS Version: 6.0.6001 ServicePack: 1.0
2011/06/28 15:49:50.0266 7720 Product type: Workstation
2011/06/28 15:49:50.0266 7720 ComputerName: *****-PC
2011/06/28 15:49:50.0266 7720 UserName: *****
2011/06/28 15:49:50.0266 7720 Windows directory: C:\Windows
2011/06/28 15:49:50.0266 7720 System windows directory: C:\Windows
2011/06/28 15:49:50.0266 7720 Processor architecture: Intel x86
2011/06/28 15:49:50.0266 7720 Number of processors: 2
2011/06/28 15:49:50.0266 7720 Page size: 0x1000
2011/06/28 15:49:50.0266 7720 Boot type: Normal boot
2011/06/28 15:49:50.0266 7720 ================================================================================
2011/06/28 15:49:53.0043 7720 Initialize success
2011/06/28 15:49:58.0222 7840 ================================================================================
2011/06/28 15:49:58.0222 7840 Scan started
2011/06/28 15:49:58.0222 7840 Mode: Manual;
2011/06/28 15:49:58.0222 7840 ================================================================================
2011/06/28 15:50:00.0000 7840 ACPI (0cee59e4613bf65e2fd37e544ad66bdb) C:\Windows\system32\drivers\acpi.sys
2011/06/28 15:50:00.0687 7840 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/06/28 15:50:01.0030 7840 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/06/28 15:50:01.0576 7840 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/06/28 15:50:02.0091 7840 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/06/28 15:50:02.0387 7840 AFD (48eb99503533c27ac6135648e5474457) C:\Windows\system32\drivers\afd.sys
2011/06/28 15:50:02.0964 7840 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/06/28 15:50:03.0698 7840 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/28 15:50:04.0446 7840 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/06/28 15:50:05.0148 7840 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/06/28 15:50:05.0351 7840 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/06/28 15:50:06.0006 7840 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/06/28 15:50:06.0599 7840 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/06/28 15:50:06.0974 7840 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/06/28 15:50:07.0598 7840 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/06/28 15:50:08.0144 7840 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/28 15:50:09.0158 7840 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/06/28 15:50:10.0172 7840 athr (8be56f8300e1c37b578da23c71816b7a) C:\Windows\system32\DRIVERS\athr.sys
2011/06/28 15:50:11.0170 7840 b57nd60x (7d0f2bfa273831124fa08526af48af18) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/06/28 15:50:12.0028 7840 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/28 15:50:13.0104 7840 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/06/28 15:50:14.0228 7840 bowser (8153396d5551276227fa146900f734e6) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/28 15:50:15.0148 7840 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/28 15:50:16.0224 7840 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/28 15:50:16.0692 7840 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/28 15:50:17.0379 7840 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/28 15:50:18.0237 7840 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/28 15:50:18.0533 7840 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/28 15:50:19.0110 7840 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/28 15:50:19.0641 7840 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/28 15:50:20.0296 7840 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/28 15:50:21.0326 7840 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
2011/06/28 15:50:22.0137 7840 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/06/28 15:50:23.0010 7840 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/28 15:50:23.0447 7840 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/06/28 15:50:23.0978 7840 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/28 15:50:24.0118 7840 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/06/28 15:50:24.0399 7840 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/06/28 15:50:25.0366 7840 DfsC (a3e9fa213f443ac77c7746119d13feec) C:\Windows\system32\Drivers\dfsc.sys
2011/06/28 15:50:26.0162 7840 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/06/28 15:50:26.0396 7840 DKbFltr (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys
2011/06/28 15:50:26.0786 7840 dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
2011/06/28 15:50:27.0363 7840 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
2011/06/28 15:50:28.0502 7840 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
2011/06/28 15:50:28.0985 7840 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/28 15:50:29.0297 7840 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/28 15:50:30.0015 7840 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/28 15:50:31.0138 7840 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/06/28 15:50:32.0136 7840 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/06/28 15:50:33.0057 7840 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/06/28 15:50:33.0712 7840 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/06/28 15:50:34.0508 7840 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/06/28 15:50:35.0116 7840 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/28 15:50:35.0615 7840 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/28 15:50:36.0224 7840 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/28 15:50:37.0050 7840 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/28 15:50:37.0674 7840 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/06/28 15:50:38.0595 7840 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/28 15:50:39.0624 7840 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/28 15:50:40.0748 7840 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/28 15:50:41.0652 7840 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/28 15:50:42.0526 7840 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/28 15:50:43.0618 7840 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
2011/06/28 15:50:44.0258 7840 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/28 15:50:44.0741 7840 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/06/28 15:50:45.0646 7840 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/06/28 15:50:47.0268 7840 HSF_DPV (fadd7095163cb3cb4073793ebb50fe75) C:\Windows\system32\DRIVERS\HSX_DPV.sys
2011/06/28 15:50:48.0017 7840 HSXHWAZL (058783bedd17615d1fece09f77960436) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
2011/06/28 15:50:48.0657 7840 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/06/28 15:50:49.0016 7840 hwdatacard (19e6885a061011d8dabe8f64498423fa) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/06/28 15:50:49.0780 7840 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/06/28 15:50:50.0732 7840 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/28 15:50:51.0886 7840 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/06/28 15:50:52.0775 7840 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/28 15:50:53.0789 7840 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
2011/06/28 15:50:54.0819 7840 IntcAzAudAddService (58628f232a00a3149d7cc7708c521499) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/28 15:50:55.0365 7840 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/28 15:50:56.0192 7840 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/28 15:50:56.0847 7840 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/06/28 15:50:57.0564 7840 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/28 15:50:57.0845 7840 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/28 15:50:58.0766 7840 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/28 15:50:58.0906 7840 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/06/28 15:50:59.0031 7840 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/28 15:50:59.0421 7840 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/28 15:50:59.0546 7840 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/28 15:50:59.0982 7840 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/28 15:51:00.0450 7840 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/28 15:51:00.0840 7840 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/28 15:51:01.0262 7840 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/28 15:51:01.0605 7840 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/28 15:51:02.0026 7840 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/28 15:51:02.0494 7840 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/28 15:51:03.0040 7840 Ltn_stk7070P (9bc81fcb5ab1253927b60c0ad815445d) C:\Windows\system32\DRIVERS\Ltn_stk7070P.sys
2011/06/28 15:51:03.0539 7840 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/28 15:51:03.0929 7840 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\Windows\system32\drivers\mbam.sys
2011/06/28 15:51:04.0600 7840 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
2011/06/28 15:51:04.0694 7840 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/06/28 15:51:05.0224 7840 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/06/28 15:51:06.0020 7840 mfeavfk (c97cbfd71c1c215150a3b3e55f77a7a3) C:\Windows\system32\drivers\mfeavfk.sys
2011/06/28 15:51:07.0049 7840 mfebopk (5447338b83a1a2354fb2fea7604387fd) C:\Windows\system32\drivers\mfebopk.sys
2011/06/28 15:51:08.0016 7840 mfehidk (6c9a6ed60b8fc3baf72fe1b1d096445b) C:\Windows\system32\drivers\mfehidk.sys
2011/06/28 15:51:09.0077 7840 mferkdk (a551154b51d6a93fccf70fc4e8eaf4bd) C:\Windows\system32\drivers\mferkdk.sys
2011/06/28 15:51:09.0436 7840 mfesmfk (299a86b780c9627aaa24e74292363ed2) C:\Windows\system32\drivers\mfesmfk.sys
2011/06/28 15:51:10.0091 7840 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/28 15:51:10.0232 7840 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/28 15:51:10.0996 7840 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/28 15:51:12.0057 7840 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/28 15:51:13.0055 7840 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/28 15:51:14.0163 7840 MPFP (96cf5286bc370b558735a7b891232d92) C:\Windows\system32\Drivers\Mpfp.sys
2011/06/28 15:51:14.0444 7840 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/06/28 15:51:15.0302 7840 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/28 15:51:15.0848 7840 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/28 15:51:17.0158 7840 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/06/28 15:51:18.0094 7840 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/28 15:51:19.0202 7840 mrxsmb10 (cf6e972f8e0d0f2970360a17572b366b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/28 15:51:20.0138 7840 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/28 15:51:21.0230 7840 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/06/28 15:51:22.0212 7840 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/06/28 15:51:23.0164 7840 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/28 15:51:23.0648 7840 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/28 15:51:24.0209 7840 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/28 15:51:24.0303 7840 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/28 15:51:24.0381 7840 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/28 15:51:24.0490 7840 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/06/28 15:51:24.0755 7840 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/28 15:51:24.0942 7840 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/28 15:51:25.0098 7840 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/06/28 15:51:25.0395 7840 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/28 15:51:26.0128 7840 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/06/28 15:51:26.0253 7840 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/28 15:51:27.0142 7840 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/28 15:51:27.0501 7840 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/28 15:51:27.0704 7840 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/28 15:51:28.0047 7840 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/28 15:51:28.0359 7840 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/28 15:51:28.0733 7840 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/28 15:51:29.0014 7840 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/06/28 15:51:29.0420 7840 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/28 15:51:29.0934 7840 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/06/28 15:51:30.0621 7840 NTIDrvr (2757d2ba59aee155209e24942ab127c9) C:\Windows\system32\DRIVERS\NTIDrvr.sys
2011/06/28 15:51:31.0167 7840 NTIPPKernel (547bfa3591c70674b0bfc99354ab78b3) C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
2011/06/28 15:51:39.0934 7840 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/28 15:51:40.0043 7840 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/28 15:51:40.0449 7840 NVHDA (2c7ac27710e8d41c1eb7d1599187d237) C:\Windows\system32\drivers\nvhda32v.sys
2011/06/28 15:51:41.0213 7840 nvlddmkm (cb0d6f8f65b8766ff2aaaa78881fd9f8) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/06/28 15:51:41.0837 7840 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/06/28 15:51:42.0461 7840 nvsmu (0fb6bf3ab170fc5bd403d25e134eafde) C:\Windows\system32\DRIVERS\nvsmu.sys
2011/06/28 15:51:42.0914 7840 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/06/28 15:51:43.0631 7840 nvstor32 (fa7b8eca6e845b244b7e30a9dcd82c6c) C:\Windows\system32\DRIVERS\nvstor32.sys
2011/06/28 15:51:44.0224 7840 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/06/28 15:51:44.0848 7840 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/06/28 15:51:45.0254 7840 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/28 15:51:45.0800 7840 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/06/28 15:51:45.0940 7840 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/28 15:51:46.0268 7840 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/06/28 15:51:46.0736 7840 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/06/28 15:51:46.0892 7840 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/06/28 15:51:47.0250 7840 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/28 15:51:48.0218 7840 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/28 15:51:48.0483 7840 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\DRIVERS\processr.sys
2011/06/28 15:51:48.0826 7840 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/28 15:51:48.0951 7840 PSDFilter (1dcbb35090cc4b2bd3d661e6089523c6) C:\Windows\system32\DRIVERS\psdfilter.sys
2011/06/28 15:51:49.0341 7840 PSDNServ (e26e46d619469964ac3609620f443867) C:\Windows\system32\DRIVERS\PSDNServ.sys
2011/06/28 15:51:49.0809 7840 psdvdisk (3e1d134af2806867d06047c4cc33cc65) C:\Windows\system32\DRIVERS\PSDVdisk.sys
2011/06/28 15:51:50.0199 7840 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/06/28 15:51:50.0807 7840 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/28 15:51:50.0979 7840 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/28 15:51:51.0494 7840 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/28 15:51:51.0759 7840 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/28 15:51:52.0102 7840 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/28 15:51:52.0352 7840 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/28 15:51:52.0648 7840 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/28 15:51:52.0866 7840 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/28 15:51:53.0178 7840 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/06/28 15:51:53.0428 7840 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/28 15:51:53.0693 7840 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/06/28 15:51:54.0426 7840 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/28 15:51:54.0723 7840 RTSTOR (830b682cb24206f457ea8a617605209f) C:\Windows\system32\drivers\RTSTOR.SYS
2011/06/28 15:51:55.0253 7840 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/28 15:51:55.0799 7840 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/28 15:51:55.0940 7840 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/28 15:51:56.0174 7840 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/28 15:51:56.0423 7840 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/28 15:51:56.0735 7840 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/06/28 15:51:56.0969 7840 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/28 15:51:57.0219 7840 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/28 15:51:57.0453 7840 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/06/28 15:51:57.0983 7840 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/06/28 15:51:58.0139 7840 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/06/28 15:51:58.0545 7840 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/06/28 15:51:58.0716 7840 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/06/28 15:51:59.0028 7840 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/28 15:51:59.0216 7840 srv (2252aef839b1093d16761189f45af885) C:\Windows\system32\DRIVERS\srv.sys
2011/06/28 15:51:59.0715 7840 srv2 (b7ff59408034119476b00a81bb53d5d1) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/28 15:52:00.0167 7840 srvnet (2accc9b12af02030f531e6cca6f8b76e) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/28 15:52:00.0557 7840 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/28 15:52:00.0838 7840 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/28 15:52:01.0400 7840 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/28 15:52:01.0852 7840 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/28 15:52:02.0336 7840 SynTP (bf7aa84d5af0faa0978c840e63b17dbf) C:\Windows\system32\DRIVERS\SynTP.sys
2011/06/28 15:52:03.0209 7840 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/06/28 15:52:03.0599 7840 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/28 15:52:03.0724 7840 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/28 15:52:03.0833 7840 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/28 15:52:03.0896 7840 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/28 15:52:03.0974 7840 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/28 15:52:04.0223 7840 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/28 15:52:04.0707 7840 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/28 15:52:04.0816 7840 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/28 15:52:04.0925 7840 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/28 15:52:05.0346 7840 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/06/28 15:52:05.0846 7840 UBHelper (f763e070843ee2803de1395002b42938) C:\Windows\system32\drivers\UBHelper.sys
2011/06/28 15:52:06.0111 7840 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/28 15:52:06.0360 7840 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/28 15:52:06.0719 7840 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/06/28 15:52:07.0218 7840 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/28 15:52:07.0328 7840 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/28 15:52:07.0780 7840 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/28 15:52:08.0076 7840 usbccgp (afb10a231254a1920c3bb4a0d02e1ca6) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/28 15:52:08.0357 7840 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/28 15:52:08.0669 7840 usbehci (44245742c4ed2eafd69020583424455b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/28 15:52:09.0168 7840 usbhub (db39b3f83af77bca019d7df6aaddbdae) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/28 15:52:09.0636 7840 usbohci (5fee2a4aaaebcd2e6576e7c90959b3fd) C:\Windows\system32\DRIVERS\usbohci.sys
2011/06/28 15:52:10.0042 7840 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/28 15:52:10.0151 7840 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/28 15:52:10.0401 7840 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/28 15:52:10.0838 7840 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/28 15:52:10.0931 7840 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/28 15:52:11.0103 7840 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/28 15:52:11.0196 7840 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/28 15:52:11.0493 7840 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/06/28 15:52:11.0602 7840 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/06/28 15:52:11.0898 7840 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/06/28 15:52:12.0070 7840 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/28 15:52:12.0210 7840 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/06/28 15:52:12.0304 7840 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/06/28 15:52:12.0476 7840 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/06/28 15:52:12.0725 7840 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/28 15:52:12.0881 7840 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/28 15:52:12.0990 7840 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/28 15:52:13.0178 7840 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/06/28 15:52:13.0630 7840 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/28 15:52:13.0911 7840 winachsf (bb9cbaf6ac20452b245c324f1f50ee81) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
2011/06/28 15:52:14.0426 7840 winbondcir (3fa87d56769838aac82fafc3e78fc732) C:\Windows\system32\DRIVERS\winbondcir.sys
2011/06/28 15:52:14.0894 7840 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/28 15:52:15.0377 7840 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/06/28 15:52:15.0549 7840 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/28 15:52:16.0095 7840 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/28 15:52:16.0298 7840 XAudio (dab33cfa9dd24251aaa389ff36b64d4b) C:\Windows\system32\DRIVERS\xaudio.sys
2011/06/28 15:52:16.0656 7840 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (4d840c6af3c020ed3a35efba9025cf4a) C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
2011/06/28 15:52:17.0702 7840 MBR (0x1B8) (7ba4c7ea1ef33a92f5f01be63edacb6a) \Device\Harddisk0\DR0
2011/06/28 15:52:18.0060 7840 MBR (0x1B8) (f05261c246ce4b3c544521ffff7aef5d) \Device\Harddisk1\DR1
2011/06/28 15:52:18.0466 7840 Boot (0x1200) (0c02a00479ec1befa02a3a9f11727327) \Device\Harddisk0\DR0\Partition0
2011/06/28 15:52:18.0544 7840 Boot (0x1200) (22a7fe9cb80953cccd5a7122b28d8514) \Device\Harddisk0\DR0\Partition1
2011/06/28 15:52:18.0591 7840 Boot (0x1200) (04b6221d7487f1b205e769e9d0a979ae) \Device\Harddisk1\DR1\Partition0
2011/06/28 15:52:18.0622 7840 ================================================================================
2011/06/28 15:52:18.0622 7840 Scan finished
2011/06/28 15:52:18.0622 7840 ================================================================================
2011/06/28 15:52:18.0684 7892 Detected object count: 0
2011/06/28 15:52:18.0684 7892 Actual detected object count: 0

Wieso leider?? Sei doch froh, dass kein TDSS im Spiel ist :wtf:

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Uhhhh das klingt zwar gefährlich aber ich mach es. Nur mal nebenbei, kann man irgendwie feststellen ob es (die Schnelligkeit) vllt. auch an einem überhitzen des Laptops liegt? Hatte das Problem schonmal, weil der Laptop ziemlich schnell heiß wird. Musste ihn dann komplett auf die Werkseinstellungen zurücksetzen. Bis jetzt dachte ich es liegt evtl an dem Trojaner, aber es könnte auch am zu heißen Laptop liegen, oder?

Glaubst du dir die Überhitzung ist der Schädling Windows-Recovery raufgekommen? In der Hitze vermehren sich Keime besser? :lach:

Naja rein aus biologischer Sicht ist das korrekt, Wobei mein Laptop aber die 40°C-Grenze weit überschreitet. Wäre zu schön wenn diese Art Virus auch denaturieren würde^^

Zurück zum Thema: hier der Logfile

Combofix Logfile:

Code:

ComboFix 11-06-29.03 - ***** 29.06.2011  16:14:42.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2557.1438 [GMT 2:00]

ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\*****\3a95fce6441ed39ab9150c94bb4a114bb20ba40e.jpg

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-05-28 bis 2011-06-29  ))))))))))))))))))))))))))))))

.

.

2011-06-29 14:46 . 2011-06-29 14:46        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-06-29 14:03 . 2011-06-29 14:09        --------        d-----w-        C:\32788R22FWJFW

2011-06-28 10:06 . 2011-06-28 10:06        --------        d-----w-        C:\_OTL

2011-06-28 09:24 . 2011-06-07 15:55        7074640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0ED14D07-C0AA-4922-AA72-6B7EF6712A71}\mpengine.dll

2011-06-16 14:50 . 2011-05-02 16:00        766464        ----a-w-        c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll

2011-06-16 14:50 . 2010-12-20 15:39        563200        ----a-w-        c:\windows\system32\oleaut32.dll

2011-06-16 14:50 . 2011-05-02 15:58        738816        ----a-w-        c:\windows\system32\inetcomm.dll

2011-06-16 14:50 . 2011-04-29 12:49        213504        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-06-16 14:50 . 2011-04-29 12:49        79360        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-06-16 14:50 . 2011-04-29 12:49        105984        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-06-16 14:50 . 2011-05-02 12:00        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-06-15 15:22 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 15:22 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-06-14 17:04 . 2011-06-14 17:04        --------        d-----w-        c:\users\*****\AppData\Roaming\Malwarebytes

2011-06-14 17:03 . 2011-06-14 17:03        --------        d-----w-        c:\programdata\Malwarebytes

2011-06-14 17:03 . 2011-06-26 21:22        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-24 17:14 . 2009-11-26 13:46        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-04-13 18:59 . 2011-04-13 18:59        13586992        ----a-w-        c:\users\*****\FreeYouTubeDownload21033.exe

2011-05-08 08:42 . 2011-05-08 08:42        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

2010-06-26 15:38 . 2010-02-11 18:16        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-05-14 15:05        121392        ----a-w-        c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-24 68856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-05-20 6144000]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]

"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-05-09 397312]

"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]

"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]

"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-13 1033512]

"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-26 30192]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-18 13543968]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-18 92704]

"PLFSetI"="c:\windows\PLFSetI.exe" [2008-06-30 200704]

"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-16 821768]

"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-05-12 147456]

"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936]

"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-8-24 101784]

OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-26 30192]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]

R3 Ltn_stk7070P;PCTV LITEON based TV tuner device;c:\windows\system32\DRIVERS\Ltn_stk7070P.sys [2008-03-27 542976]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-05-09 61424]

S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]

S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504]

S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2011-02-16 88176]

S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056]

S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-04-07 210432]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-06-25 44064]

S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

Inhalt des "geplante Tasks" Ordners

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 12:33]

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 12:33]

.

2008-04-01 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-11-24 12:32]

.

2008-04-01 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-11-24 12:32]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.spox.com/

mStart Page = hxxp://de.intl.acer.yahoo.com

IE: Free YouTube Download - c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\2jworvw7.default\

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - www.google.de

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-eRecoveryService - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-06-29 16:47

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2011-06-29  16:54:28

ComboFix-quarantined-files.txt  2011-06-29 14:54

.

Vor Suchlauf: 8 Verzeichnis(se), 58.718.724.096 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 59.426.258.944 Bytes frei

.

- - End Of File - - 2EAA84A5A2924D18F79CA0F377839D65

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Auch geschafft, die Dateien sind im Anhang.

Zitat:

232 GB \\.\PhysicalDrive0 MBR Code Faked!

SHA1: 715313F2BDA7CC8F27F97E412151BA170BFBF23F

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

Zitat:

232 GB \\.\PhysicalDrive0 MBR Code Faked!

SHA1: 715313F2BDA7CC8F27F97E412151BA170BFBF23F

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Kannst du mir leicht verständlich erklären was es damit auf sich hat? Wenn nicht auch nicht schlimm. Werde mir morgen die CD besorgen und dann der Anleitung folgen.

Sorry hatte die ganze Woche kein Internet -.- . Bin der Anleitung gefolgt, die neuen Logfiles sind im Anhang.

Zitat:

232 GB \\.\PhysicalDrive0 MBR Code Faked!

SHA1: 715313F2BDA7CC8F27F97E412151BA170BFBF23F

232 GB \\.\PhysicalDrive1 MBR Code Faked!

SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F

Hat nicht geklappt. Wiederhol den MBR-Fix bitte.

Zitat:

Zitat von cosinus (Beitrag 681407)

Hat nicht geklappt. Wiederhol den MBR-Fix bitte.

Alles klar. Dauert aber wieder bis Freitag, hab die CD Zuhause :stirn:

Habs jetzt noch zwei mal gemacht, doch das Ergebnis ist das gleiche. Nach der Eingabe (bootrec.exe /fixboot bzw. /fixmbr) zeigt er an: Prozess erfolgreich beendet. Danach starte ich neu und führe mbrcheck aus.

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: Acer, Inc.
BIOS Manufacturer: Acer
System Manufacturer: Acer, inc.
System Product Name: Aspire 7530G
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 161):
0x82A19000 \SystemRoot\system32\ntkrnlpa.exe
0x82DD4000 \SystemRoot\system32\hal.dll
0x80405000 \SystemRoot\system32\kdcom.dll
0x8040D000 \SystemRoot\system32\PSHED.dll
0x8041E000 \SystemRoot\system32\BOOTVID.dll
0x80426000 \SystemRoot\system32\CLFS.SYS
0x80467000 \SystemRoot\system32\CI.dll
0x80547000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C3000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80606000 \SystemRoot\system32\drivers\acpi.sys
0x8064C000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80655000 \SystemRoot\system32\drivers\msisadrv.sys
0x8065D000 \SystemRoot\system32\drivers\pci.sys
0x80684000 \SystemRoot\System32\drivers\partmgr.sys
0x80693000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80696000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x806A0000 \SystemRoot\system32\drivers\volmgr.sys
0x806AF000 \SystemRoot\System32\drivers\volmgrx.sys
0x806F9000 \SystemRoot\System32\drivers\mountmgr.sys
0x80709000 \SystemRoot\System32\Drivers\UBHelper.sys
0x80711000 \SystemRoot\system32\drivers\atapi.sys
0x80719000 \SystemRoot\system32\drivers\ataport.SYS
0x80737000 \SystemRoot\system32\drivers\msahci.sys
0x80741000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8074F000 \SystemRoot\system32\DRIVERS\nvstor32.sys
0x80773000 \SystemRoot\system32\DRIVERS\storport.sys
0x807B4000 \SystemRoot\system32\drivers\fltmgr.sys
0x807E6000 \SystemRoot\system32\drivers\fileinfo.sys
0x807F6000 \SystemRoot\system32\DRIVERS\psdfilter.sys
0x89601000 \SystemRoot\System32\Drivers\ksecdd.sys
0x89672000 \SystemRoot\system32\drivers\ndis.sys
0x8977D000 \SystemRoot\system32\drivers\msrpc.sys
0x897A8000 \SystemRoot\system32\drivers\NETIO.SYS
0x89809000 \SystemRoot\System32\Drivers\Ntfs.sys
0x89918000 \SystemRoot\system32\drivers\volsnap.sys
0x89951000 \SystemRoot\System32\Drivers\spldr.sys
0x89959000 \SystemRoot\System32\Drivers\mup.sys
0x89968000 \SystemRoot\System32\drivers\ecache.sys
0x8998F000 \SystemRoot\system32\drivers\disk.sys
0x899A0000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x899C1000 \SystemRoot\system32\drivers\crcdisk.sys
0x899E1000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x899EC000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x897E2000 \SystemRoot\system32\DRIVERS\processr.sys
0x8CC0B000 \SystemRoot\system32\DRIVERS\winbondcir.sys
0x8CC20000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8CC33000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8CC62000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CC64000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8CC6F000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x8CC79000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8CC84000 \SystemRoot\system32\DRIVERS\nvsmu.sys
0x8CC8C000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8CC96000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8CCD4000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8CCE3000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8CCF5000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CD0D000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
0x8D001000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8D734000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8D7D3000 \SystemRoot\System32\drivers\watchdog.sys
0x8CD15000 \SystemRoot\system32\DRIVERS\athr.sys
0x8D802000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
0x8D839000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8D842000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8D846000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8D874000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8D87F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8D896000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8D8A1000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8D8C4000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8D8D3000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8D8E7000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8D8FC000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8D90C000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8D90E000 \SystemRoot\system32\DRIVERS\ks.sys
0x8D938000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8D946000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8D950000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8D95D000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8D991000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8DA0A000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8DC14000 \SystemRoot\system32\drivers\portcls.sys
0x8DC41000 \SystemRoot\system32\drivers\drmk.sys
0x8DC66000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8DCA3000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8DE03000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8DEB8000 \SystemRoot\system32\drivers\modem.sys
0x8DEC5000 \SystemRoot\system32\drivers\nvhda32v.sys
0x8DED3000 \SystemRoot\system32\DRIVERS\hidir.sys
0x8DEDE000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8DEEE000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8DEF5000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8DEFE000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8DF06000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8DF0F000 \SystemRoot\System32\Drivers\Null.SYS
0x8DF16000 \SystemRoot\System32\Drivers\Beep.SYS
0x8DF1D000 \SystemRoot\System32\drivers\vga.sys
0x8DF29000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8DF4A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8DF52000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8DF5A000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8DF65000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8DF73000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8E003000 \SystemRoot\System32\drivers\tcpip.sys
0x8E0EC000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8E107000 \SystemRoot\System32\Drivers\Mpfp.sys
0x8E12E000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8E144000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
0x8E156000 \SystemRoot\system32\DRIVERS\smb.sys
0x8E16A000 \SystemRoot\system32\drivers\afd.sys
0x8E1B2000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8E1E4000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8DF7C000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8DF8A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8DF9D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8DFD9000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8DDA5000 \SystemRoot\system32\drivers\mfehidk.sys
0x8DFE3000 \SystemRoot\System32\Drivers\dfsc.sys
0x8DDD5000 \SystemRoot\system32\drivers\RTSTOR.SYS
0x8DDE9000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8D9A2000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8D9C3000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8DA00000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x8D9D0000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
0x96E90000 \SystemRoot\System32\win32k.sys
0x8D9F4000 \SystemRoot\System32\drivers\Dxapi.sys
0x8D7E0000 \SystemRoot\system32\DRIVERS\monitor.sys
0x970B0000 \SystemRoot\System32\TSDDD.dll
0x805D0000 \SystemRoot\system32\drivers\luafv.sys
0x9F40B000 \SystemRoot\system32\drivers\spsys.sys
0x9F4BA000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9F4CA000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9F4F4000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9F4FE000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9F511000 \SystemRoot\system32\drivers\HTTP.sys
0x9F57E000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9F59B000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9F5B4000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9F5C9000 \SystemRoot\system32\drivers\mrxdav.sys
0xA060E000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA062D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA0666000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA067E000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA06A6000 \SystemRoot\System32\DRIVERS\srv.sys
0xA070D000 \??\C:\Windows\system32\drivers\int15.sys
0xA0714000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x970E0000 \SystemRoot\System32\cdd.dll
0xA0718000 \??\C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
0xA740A000 \SystemRoot\system32\drivers\peauth.sys
0xA74E8000 \SystemRoot\system32\DRIVERS\PSDNServ.sys
0xA74F1000 \SystemRoot\system32\DRIVERS\PSDVdisk.sys
0xA7503000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA750D000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA7519000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xA7521000 \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
0xA7542000 \SystemRoot\system32\drivers\mfebopk.sys
0xA7549000 \SystemRoot\system32\drivers\mfeavfk.sys
0xA755B000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xA757A000 \??\C:\Windows\system32\drivers\mbam.sys
0x77780000 \Windows\System32\ntdll.dll

Processes (total 95):
0 System Idle Process
4 System
416 C:\Windows\System32\smss.exe
492 csrss.exe
544 csrss.exe
552 C:\Windows\System32\wininit.exe
588 C:\Windows\System32\services.exe
600 C:\Windows\System32\lsass.exe
608 C:\Windows\System32\lsm.exe
740 C:\Windows\System32\svchost.exe
788 C:\Windows\System32\nvvsvc.exe
812 C:\Windows\System32\svchost.exe
852 C:\Windows\System32\svchost.exe
900 C:\Windows\System32\svchost.exe
932 C:\Windows\System32\svchost.exe
948 C:\Windows\System32\svchost.exe
1028 C:\Windows\System32\winlogon.exe
1076 C:\Windows\System32\audiodg.exe
1108 C:\Windows\System32\SLsvc.exe
1148 C:\Windows\System32\svchost.exe
1264 C:\Windows\System32\svchost.exe
1480 C:\Windows\System32\rundll32.exe
1572 C:\Windows\System32\spoolsv.exe
1616 C:\Windows\System32\svchost.exe
1852 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
1896 C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
1940 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
1968 C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
360 C:\Windows\System32\svchost.exe
424 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
472 C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
484 C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
688 C:\Windows\System32\rundll32.exe
944 C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
1228 C:\ACER\Mobility Center\MobilityService.exe
584 C:\Program Files\McAfee\MPF\MpfSrv.exe
2060 C:\Program Files\McAfee\MSK\msksrver.exe
2320 C:\Windows\System32\svchost.exe
2476 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
2496 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
2524 C:\Windows\System32\svchost.exe
2576 C:\Windows\System32\svchost.exe
2632 C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2684 C:\Windows\System32\svchost.exe
2756 C:\Windows\System32\svchost.exe
2896 C:\Windows\System32\SearchIndexer.exe
2928 C:\Windows\System32\drivers\XAudio.exe
3200 C:\Windows\System32\taskeng.exe
3264 C:\Windows\System32\dwm.exe
3272 C:\Windows\explorer.exe
3768 C:\Windows\RtHDVCpl.exe
3780 C:\Program Files\McAfee.com\Agent\mcagent.exe
3788 C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
3800 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
3840 C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
3896 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
3948 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
4044 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
4088 C:\Windows\System32\rundll32.exe
1736 C:\Windows\PLFSetI.exe
3644 C:\Windows\System32\wbem\unsecapp.exe
4036 WmiPrvSE.exe
1460 C:\Users\*****\AppData\Local\Temp\RtkBtMnt.exe
1644 unsecapp.exe
3308 C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
4024 C:\Program Files\Launch Manager\QtZgAcer.EXE
1672 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
4052 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
2796 C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
3032 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2052 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
768 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
3344 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2152 C:\Windows\ehome\ehtray.exe
3564 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
1844 C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
3600 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
776 C:\Program Files\OpenOffice.org 3\program\soffice.exe
4172 C:\Program Files\OpenOffice.org 3\program\soffice.bin
4184 C:\Windows\ehome\ehmsas.exe
4460 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
4536 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
4620 C:\Windows\System32\msiexec.exe
4808 C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
4996 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
5844 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
5976 C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
4192 C:\Program Files\McAfee\MSC\mcuimgr.exe
4612 WmiPrvSE.exe
4316 C:\Windows\System32\wuauclt.exe
2232 C:\Windows\servicing\TrustedInstaller.exe
980 dllhost.exe
4948 dllhost.exe
3500 C:\Users\*****\Desktop\MBRCheck.exe
3092 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001e`5c500000 (NTFS)

PhysicalDrive0 Model Number: WDC WD2500BEVT-22ZCT, Rev: 11.0
PhysicalDrive1 Model Number: WDC WD2500BEVT-22ZCT, Rev: 11.0

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 715313F2BDA7CC8F27F97E412151BA170BFBF23F
232 GB \\.\PhysicalDrive1 MBR Code Faked!
SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Was soll ich jetzt machen?

Hmpf, geh mal bitte so vor: => Beheben und Reparieren von Startproblemen in Windows Vista mit dem Hilfsprogramm "Bootrec.exe" in der Windows-Wiederherstellungsumgebung

Also folgende Befehle nacheinander abtippen und jew. mit Enter ausführen:

bcdedit /export C:\BCD_Backup
c:
cd boot
attrib bcd -s -h -r
ren c:\boot\bcd bcd.old
bootrec /RebuildBcd

Zitat:

Zitat von cosinus (Beitrag 682537)

Also folgende Befehle nacheinander abtippen und jew. mit Enter ausführen:

bcdedit /export C:\BCD_Backup
c:
cd boot
attrib bcd -s -h -r
ren c:\boot\bcd bcd.old
bootrec /RebuildBcd

Hab ich gemacht.

Zitat:

Die Suche nach Windows-Installationen war erfolgreich. [1]

habe den Computer neugestartet. Ist nicht mehr hochgefahren. Also hab ich alles nochmal gemacht.

Zitat:

Die Suche nach Windows-Installationen war erfolgreich [0] Der Prozess war erfolgreich

Danach Neustart, ist diesmal hochgefahren. Jetzt nochmal fixboot/fixmbr?

Nein erstmal ein neues Log mit mbrcheck bitte machen

Zitat:

Zitat von cosinus (Beitrag 682622)

Nein erstmal ein neues Log mit mbrcheck bitte machen

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: Acer, Inc.
BIOS Manufacturer: Acer
System Manufacturer: Acer, inc.
System Product Name: Aspire 7530G
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 167):
0x82A39000 \SystemRoot\system32\ntkrnlpa.exe
0x82A06000 \SystemRoot\system32\hal.dll
0x8040A000 \SystemRoot\system32\kdcom.dll
0x80412000 \SystemRoot\system32\PSHED.dll
0x80423000 \SystemRoot\system32\BOOTVID.dll
0x8042B000 \SystemRoot\system32\CLFS.SYS
0x8046C000 \SystemRoot\system32\CI.dll
0x8054C000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C8000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80604000 \SystemRoot\system32\drivers\acpi.sys
0x8064A000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80653000 \SystemRoot\system32\drivers\msisadrv.sys
0x8065B000 \SystemRoot\system32\drivers\pci.sys
0x80682000 \SystemRoot\System32\drivers\partmgr.sys
0x80691000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80694000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8069E000 \SystemRoot\system32\drivers\volmgr.sys
0x806AD000 \SystemRoot\System32\drivers\volmgrx.sys
0x806F7000 \SystemRoot\System32\drivers\mountmgr.sys
0x80707000 \SystemRoot\System32\Drivers\UBHelper.sys
0x8070F000 \SystemRoot\system32\drivers\atapi.sys
0x80717000 \SystemRoot\system32\drivers\ataport.SYS
0x80735000 \SystemRoot\system32\drivers\msahci.sys
0x8073F000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8074D000 \SystemRoot\system32\DRIVERS\nvstor32.sys
0x80771000 \SystemRoot\system32\DRIVERS\storport.sys
0x807B2000 \SystemRoot\system32\drivers\fltmgr.sys
0x807E4000 \SystemRoot\system32\drivers\fileinfo.sys
0x807F4000 \SystemRoot\system32\DRIVERS\psdfilter.sys
0x89603000 \SystemRoot\System32\Drivers\ksecdd.sys
0x89674000 \SystemRoot\system32\drivers\ndis.sys
0x8977F000 \SystemRoot\system32\drivers\msrpc.sys
0x897AA000 \SystemRoot\system32\drivers\NETIO.SYS
0x89803000 \SystemRoot\System32\Drivers\Ntfs.sys
0x89912000 \SystemRoot\system32\drivers\volsnap.sys
0x8994B000 \SystemRoot\System32\Drivers\spldr.sys
0x89953000 \SystemRoot\System32\Drivers\mup.sys
0x89962000 \SystemRoot\System32\drivers\ecache.sys
0x89989000 \SystemRoot\system32\drivers\disk.sys
0x8999A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x899BB000 \SystemRoot\system32\drivers\crcdisk.sys
0x897E4000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x897EF000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x805D5000 \SystemRoot\system32\DRIVERS\processr.sys
0x805E4000 \SystemRoot\system32\DRIVERS\winbondcir.sys
0x8D006000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8D019000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8D048000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8D04A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8D055000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x8D05F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8D06A000 \SystemRoot\system32\DRIVERS\nvsmu.sys
0x8D072000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8D07C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8D0BA000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8D0C9000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8D0DB000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8D0F3000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
0x8D400000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8DB33000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8DBD2000 \SystemRoot\System32\drivers\watchdog.sys
0x8D0FB000 \SystemRoot\system32\DRIVERS\athr.sys
0x8DC00000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
0x8DC37000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8DC40000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8DC44000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8DC72000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8DC7D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8DC94000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8DC9F000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8DCC2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8DCD1000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8DCE5000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8DCFA000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8DD0A000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8DD0C000 \SystemRoot\system32\DRIVERS\ks.sys
0x8DD36000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8DD44000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8DD4E000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8DD5B000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8DD8F000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8E00C000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8E216000 \SystemRoot\system32\drivers\portcls.sys
0x8E243000 \SystemRoot\system32\drivers\drmk.sys
0x8E268000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8E2A5000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8E40E000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8E4C3000 \SystemRoot\system32\drivers\modem.sys
0x8E4D0000 \SystemRoot\system32\drivers\nvhda32v.sys
0x8E4DE000 \SystemRoot\system32\DRIVERS\hidir.sys
0x8E4E9000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8E4F9000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8E500000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8E509000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8E511000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8E51A000 \SystemRoot\System32\Drivers\Null.SYS
0x8E521000 \SystemRoot\System32\Drivers\Beep.SYS
0x8E528000 \SystemRoot\System32\drivers\vga.sys
0x8E534000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8E555000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8E55D000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8E565000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8E570000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8E57E000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8E604000 \SystemRoot\System32\drivers\tcpip.sys
0x8E6ED000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8E708000 \SystemRoot\System32\Drivers\Mpfp.sys
0x8E72F000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8E745000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
0x8E757000 \SystemRoot\system32\DRIVERS\smb.sys
0x8E76B000 \SystemRoot\system32\drivers\afd.sys
0x8E7B3000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8E7E5000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8E587000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8E595000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8E5A8000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8E5E4000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8E3A7000 \SystemRoot\system32\drivers\mfehidk.sys
0x8E3D7000 \SystemRoot\System32\Drivers\dfsc.sys
0x8DDA0000 \SystemRoot\system32\drivers\RTSTOR.SYS
0x8DDB4000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8DDCB000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8E5EE000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8E400000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x899C4000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
0x8DBDF000 \SystemRoot\system32\DRIVERS\ewusbmdm.sys
0x8E3EE000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x97030000 \SystemRoot\System32\win32k.sys
0x8E000000 \SystemRoot\System32\drivers\Dxapi.sys
0x8DDEC000 \SystemRoot\system32\DRIVERS\monitor.sys
0x97250000 \SystemRoot\System32\TSDDD.dll
0x8D1E2000 \SystemRoot\system32\drivers\luafv.sys
0xA0C0F000 \SystemRoot\system32\drivers\spsys.sys
0xA0CBE000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA0CCE000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xA0CF8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA0D02000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA0D15000 \SystemRoot\system32\drivers\HTTP.sys
0xA0D82000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA0D9F000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA0DB8000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA0DCD000 \SystemRoot\system32\drivers\mrxdav.sys
0xA0A01000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA0A20000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA0A59000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA0A71000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA0A99000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xA0AAF000 \SystemRoot\System32\DRIVERS\srv.sys
0xA0B16000 \??\C:\Windows\system32\drivers\int15.sys
0xA0B1D000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA0B21000 \??\C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
0xA6009000 \SystemRoot\system32\drivers\peauth.sys
0x97280000 \SystemRoot\System32\cdd.dll
0xA60E7000 \SystemRoot\system32\DRIVERS\PSDNServ.sys
0xA60F0000 \SystemRoot\system32\DRIVERS\PSDVdisk.sys
0xA6102000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA610C000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA6118000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xA612D000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0xA613F000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xA6147000 \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
0xA6168000 \SystemRoot\system32\drivers\mfebopk.sys
0xA616F000 \SystemRoot\system32\drivers\mfeavfk.sys
0xA6181000 \SystemRoot\system32\drivers\mfesmfk.sys
0xA618A000 \??\C:\Windows\system32\drivers\mbam.sys
0xA618E000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x774C0000 \Windows\System32\ntdll.dll

Processes (total 106):
0 System Idle Process
4 System
416 C:\Windows\System32\smss.exe
516 csrss.exe
568 C:\Windows\System32\wininit.exe
576 csrss.exe
612 C:\Windows\System32\services.exe
624 C:\Windows\System32\lsass.exe
632 C:\Windows\System32\lsm.exe
768 C:\Windows\System32\svchost.exe
816 C:\Windows\System32\nvvsvc.exe
844 C:\Windows\System32\svchost.exe
876 C:\Windows\System32\svchost.exe
928 C:\Windows\System32\svchost.exe
960 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\svchost.exe
1060 C:\Windows\System32\audiodg.exe
1084 C:\Windows\System32\winlogon.exe
1132 C:\Windows\System32\SLsvc.exe
1164 C:\Windows\System32\svchost.exe
1328 C:\Windows\System32\svchost.exe
1468 C:\Windows\System32\rundll32.exe
1636 C:\Windows\System32\spoolsv.exe
1692 C:\Windows\System32\svchost.exe
1956 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
1996 C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
2016 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
360 C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
464 C:\Windows\System32\svchost.exe
492 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
692 C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
716 C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
752 C:\Windows\System32\rundll32.exe
1048 C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
1256 C:\ACER\Mobility Center\MobilityService.exe
1856 C:\Program Files\McAfee\MPF\MpfSrv.exe
2064 C:\Program Files\McAfee\MSK\msksrver.exe
2080 C:\Windows\System32\svchost.exe
2104 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
2256 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
2348 C:\Windows\System32\svchost.exe
2424 C:\Windows\System32\svchost.exe
2504 C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2552 C:\Windows\System32\svchost.exe
2676 C:\Windows\System32\svchost.exe
2728 C:\Windows\System32\SearchIndexer.exe
2812 C:\Windows\System32\drivers\XAudio.exe
2976 WUDFHost.exe
3736 C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
3840 unsecapp.exe
3892 WmiPrvSE.exe
4028 C:\Program Files\McAfee\VirusScan\mcsysmon.exe
1540 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
3500 C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
2588 C:\Program Files\McAfee.com\Agent\mcagent.exe
2512 C:\Windows\System32\dwm.exe
2780 C:\Windows\explorer.exe
3460 C:\Windows\System32\taskeng.exe
3568 C:\Windows\servicing\TrustedInstaller.exe
3256 C:\Windows\System32\taskeng.exe
2388 C:\Windows\RtHDVCpl.exe
3856 C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
2932 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
2656 C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
2808 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
3640 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1300 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
4060 C:\Windows\System32\wbem\unsecapp.exe
2888 C:\Windows\System32\rundll32.exe
2828 C:\Windows\PLFSetI.exe
4176 C:\Program Files\Launch Manager\QtZgAcer.EXE
4200 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
4236 C:\Users\*****\AppData\Local\Temp\RtkBtMnt.exe
4252 C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
4300 C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
4316 C:\Program Files\Common Files\Java\Java Update\jusched.exe
4356 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
4388 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
4412 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
4448 C:\Windows\ehome\ehtray.exe
4456 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
4464 C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
4492 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
5020 C:\Program Files\OpenOffice.org 3\program\soffice.exe
5568 C:\Program Files\OpenOffice.org 3\program\soffice.bin
3236 C:\Windows\System32\svchost.exe
4224 mcupdmgr.exe
4596 C:\Program Files\McAfee\MSC\mcuimgr.exe
5908 C:\Windows\ehome\ehmsas.exe
4272 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
5160 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
5528 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
4116 C:\Windows\System32\msiexec.exe
2604 C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
2248 C:\Program Files\Mobile Partner\Mobile Partner.exe
4884 C:\Program Files\Internet Explorer\ieuser.exe
2868 C:\Program Files\Internet Explorer\iexplore.exe
6028 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
5008 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
5800 C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
4592 C:\Windows\System32\Macromed\Flash\FlashUtil10i_ActiveX.exe
2944 C:\Windows\System32\wuauclt.exe
5016 dllhost.exe
2964 dllhost.exe
2560 C:\Users\*****\Desktop\MBRCheck.exe
5308 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001e`5c500000 (NTFS)

PhysicalDrive0 Model Number: WDC WD2500BEVT-22ZCT, Rev: 11.0
PhysicalDrive1 Model Number: WDC WD2500BEVT-22ZCT, Rev: 11.0

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 715313F2BDA7CC8F27F97E412151BA170BFBF23F
232 GB \\.\PhysicalDrive1 MBR Code Faked!
SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Irgendwie bekomme ich den gefakeden MBR Code nicht weg.

Zitat:

232 GB \\.\PhysicalDrive0 MBR Code Faked!

Hm, immer noch!
Machnoch mal fixboot und fixmbr!

Ich werde es einfach nicht los -.-

Zitat:

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 715313F2BDA7CC8F27F97E412151BA170BFBF23F
232 GB \\.\PhysicalDrive1 MBR Code Faked!
SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F

Found non-standard or infected MBR.

Kann auch sein, dass mbrcheck da einen Bug hat.

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Bitteschön:

Zitat:

aswMBR version 0.9.7.707 Copyright(c) 2011 AVAST Software
Run date: 2011-07-14 15:09:27
-----------------------------
15:09:27.211 OS Version: Windows 6.0.6001 Service Pack 1
15:09:27.211 Number of processors: 2 586 0x301
15:09:27.211 ComputerName: *****-PC UserName: *****
15:09:29.863 Initialize success
15:09:40.885 AVAST engine download error: 0
15:10:00.151 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000093
15:10:00.151 Disk 0 Vendor: WDC_WD25 11.0 Size: 238475MB BusType: 6
15:10:00.183 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000094
15:10:00.183 Disk 1 Vendor: WDC_WD25 11.0 Size: 238475MB BusType: 6
15:10:02.226 Disk 0 MBR read successfully
15:10:02.226 Disk 0 MBR scan
15:10:02.242 Disk 0 unknown MBR code
15:10:04.270 Disk 0 scanning sectors +488394752
15:10:04.317 Disk 0 scanning C:\Windows\system32\drivers
15:10:14.550 Service scanning
15:10:17.483 Disk 0 trace - called modules:
15:10:17.545 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys dxgkrnl.sys nvlddmkm.sys
15:10:17.561 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85ce1968]
15:10:17.577 3 CLASSPNP.SYS[899aa745] -> nt!IofCallDriver -> [0x85bc65f8]
15:10:17.608 5 acpi.sys[806156a0] -> nt!IofCallDriver -> \Device\00000093[0x84e07c90]
15:10:17.623 Scan finished successfully
15:10:58.324 Disk 0 MBR has been saved successfully to "C:\Users\*****\Desktop\MBR.dat"
15:10:58.371 The log file has been saved successfully to "C:\Users\*****\Desktop\aswMBR.txt"

Zitat:

"C:\Users\*****\Desktop\MBR.dat"

Bitte die Datei bei uns hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Edit: Lad bitte auch noch den TDSS-Killer neu runter und führe ihn aus! (thx to Larusso! :))

Hab die Datei hochgeladen. Hier das Ergebnis vom TDSS-Killer:

Zitat:

2011/07/14 18:47:56.0516 3532 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/14 18:47:58.0539 3532 ================================================================================
2011/07/14 18:47:58.0539 3532 SystemInfo:
2011/07/14 18:47:58.0540 3532
2011/07/14 18:47:58.0540 3532 OS Version: 6.0.6001 ServicePack: 1.0
2011/07/14 18:47:58.0540 3532 Product type: Workstation
2011/07/14 18:47:58.0541 3532 ComputerName: *****-PC
2011/07/14 18:47:58.0542 3532 UserName: *****
2011/07/14 18:47:58.0542 3532 Windows directory: C:\Windows
2011/07/14 18:47:58.0542 3532 System windows directory: C:\Windows
2011/07/14 18:47:58.0542 3532 Processor architecture: Intel x86
2011/07/14 18:47:58.0542 3532 Number of processors: 2
2011/07/14 18:47:58.0543 3532 Page size: 0x1000
2011/07/14 18:47:58.0543 3532 Boot type: Normal boot
2011/07/14 18:47:58.0543 3532 ================================================================================
2011/07/14 18:48:00.0539 3532 Initialize success
2011/07/14 18:48:05.0030 5408 ================================================================================
2011/07/14 18:48:05.0030 5408 Scan started
2011/07/14 18:48:05.0030 5408 Mode: Manual;
2011/07/14 18:48:05.0030 5408 ================================================================================
2011/07/14 18:48:06.0097 5408 ACPI (0cee59e4613bf65e2fd37e544ad66bdb) C:\Windows\system32\drivers\acpi.sys
2011/07/14 18:48:06.0225 5408 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/07/14 18:48:06.0355 5408 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/07/14 18:48:06.0473 5408 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/07/14 18:48:06.0569 5408 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/07/14 18:48:06.0794 5408 AFD (48eb99503533c27ac6135648e5474457) C:\Windows\system32\drivers\afd.sys
2011/07/14 18:48:06.0961 5408 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/07/14 18:48:07.0066 5408 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/07/14 18:48:07.0157 5408 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/07/14 18:48:07.0269 5408 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/07/14 18:48:07.0348 5408 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/07/14 18:48:07.0439 5408 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/07/14 18:48:07.0607 5408 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/07/14 18:48:07.0937 5408 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/07/14 18:48:08.0054 5408 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/07/14 18:48:08.0161 5408 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/07/14 18:48:08.0251 5408 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/07/14 18:48:08.0409 5408 athr (8be56f8300e1c37b578da23c71816b7a) C:\Windows\system32\DRIVERS\athr.sys
2011/07/14 18:48:08.0601 5408 b57nd60x (7d0f2bfa273831124fa08526af48af18) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/07/14 18:48:08.0732 5408 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/07/14 18:48:08.0865 5408 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/07/14 18:48:08.0983 5408 bowser (8153396d5551276227fa146900f734e6) C:\Windows\system32\DRIVERS\bowser.sys
2011/07/14 18:48:09.0085 5408 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/07/14 18:48:09.0267 5408 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/07/14 18:48:09.0367 5408 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/07/14 18:48:09.0739 5408 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/07/14 18:48:09.0819 5408 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/07/14 18:48:09.0919 5408 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/07/14 18:48:09.0995 5408 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/07/14 18:48:10.0277 5408 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/07/14 18:48:10.0381 5408 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/07/14 18:48:10.0548 5408 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
2011/07/14 18:48:10.0633 5408 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/07/14 18:48:10.0846 5408 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/07/14 18:48:10.0928 5408 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/07/14 18:48:11.0042 5408 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/07/14 18:48:11.0157 5408 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/07/14 18:48:11.0256 5408 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/07/14 18:48:11.0497 5408 DfsC (a3e9fa213f443ac77c7746119d13feec) C:\Windows\system32\Drivers\dfsc.sys
2011/07/14 18:48:11.0661 5408 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/07/14 18:48:11.0785 5408 DKbFltr (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys
2011/07/14 18:48:12.0131 5408 dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
2011/07/14 18:48:12.0332 5408 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
2011/07/14 18:48:12.0486 5408 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
2011/07/14 18:48:12.0603 5408 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/07/14 18:48:12.0723 5408 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/07/14 18:48:12.0851 5408 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/07/14 18:48:13.0004 5408 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/07/14 18:48:13.0215 5408 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/07/14 18:48:13.0733 5408 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/07/14 18:48:13.0982 5408 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/07/14 18:48:14.0058 5408 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/07/14 18:48:14.0147 5408 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/07/14 18:48:14.0322 5408 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/07/14 18:48:14.0376 5408 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/07/14 18:48:14.0475 5408 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/07/14 18:48:14.0565 5408 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/07/14 18:48:14.0657 5408 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/07/14 18:48:14.0810 5408 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/07/14 18:48:15.0130 5408 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/07/14 18:48:15.0212 5408 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/07/14 18:48:15.0364 5408 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/07/14 18:48:15.0435 5408 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
2011/07/14 18:48:15.0614 5408 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/07/14 18:48:15.0707 5408 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/07/14 18:48:15.0859 5408 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/07/14 18:48:16.0033 5408 HSF_DPV (fadd7095163cb3cb4073793ebb50fe75) C:\Windows\system32\DRIVERS\HSX_DPV.sys
2011/07/14 18:48:16.0132 5408 HSXHWAZL (058783bedd17615d1fece09f77960436) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
2011/07/14 18:48:16.0225 5408 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/07/14 18:48:16.0362 5408 hwdatacard (19e6885a061011d8dabe8f64498423fa) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/07/14 18:48:16.0478 5408 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/07/14 18:48:16.0575 5408 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/07/14 18:48:16.0663 5408 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/07/14 18:48:16.0757 5408 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/07/14 18:48:16.0889 5408 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
2011/07/14 18:48:17.0100 5408 IntcAzAudAddService (58628f232a00a3149d7cc7708c521499) C:\Windows\system32\drivers\RTKVHDA.sys
2011/07/14 18:48:17.0736 5408 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/07/14 18:48:17.0913 5408 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/07/14 18:48:18.0055 5408 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/07/14 18:48:18.0313 5408 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/07/14 18:48:18.0405 5408 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/07/14 18:48:18.0486 5408 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/07/14 18:48:18.0565 5408 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/07/14 18:48:18.0763 5408 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/07/14 18:48:18.0863 5408 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/07/14 18:48:18.0989 5408 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/07/14 18:48:19.0075 5408 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/07/14 18:48:19.0188 5408 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/07/14 18:48:19.0344 5408 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/07/14 18:48:19.0671 5408 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/07/14 18:48:19.0894 5408 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/07/14 18:48:19.0994 5408 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/07/14 18:48:20.0102 5408 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/07/14 18:48:20.0226 5408 Ltn_stk7070P (9bc81fcb5ab1253927b60c0ad815445d) C:\Windows\system32\DRIVERS\Ltn_stk7070P.sys
2011/07/14 18:48:20.0321 5408 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/07/14 18:48:20.0431 5408 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\Windows\system32\drivers\mbam.sys
2011/07/14 18:48:20.0748 5408 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
2011/07/14 18:48:20.0855 5408 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/07/14 18:48:21.0011 5408 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/07/14 18:48:21.0101 5408 mfeavfk (c97cbfd71c1c215150a3b3e55f77a7a3) C:\Windows\system32\drivers\mfeavfk.sys
2011/07/14 18:48:21.0180 5408 mfebopk (5447338b83a1a2354fb2fea7604387fd) C:\Windows\system32\drivers\mfebopk.sys
2011/07/14 18:48:21.0263 5408 mfehidk (6c9a6ed60b8fc3baf72fe1b1d096445b) C:\Windows\system32\drivers\mfehidk.sys
2011/07/14 18:48:21.0336 5408 mferkdk (a551154b51d6a93fccf70fc4e8eaf4bd) C:\Windows\system32\drivers\mferkdk.sys
2011/07/14 18:48:21.0415 5408 mfesmfk (299a86b780c9627aaa24e74292363ed2) C:\Windows\system32\drivers\mfesmfk.sys
2011/07/14 18:48:21.0690 5408 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/07/14 18:48:21.0800 5408 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/07/14 18:48:21.0914 5408 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/07/14 18:48:21.0979 5408 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/07/14 18:48:22.0085 5408 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/07/14 18:48:22.0166 5408 MPFP (96cf5286bc370b558735a7b891232d92) C:\Windows\system32\Drivers\Mpfp.sys
2011/07/14 18:48:22.0344 5408 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/07/14 18:48:22.0417 5408 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/07/14 18:48:22.0523 5408 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/07/14 18:48:22.0604 5408 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/07/14 18:48:22.0722 5408 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/07/14 18:48:22.0804 5408 mrxsmb10 (cf6e972f8e0d0f2970360a17572b366b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/07/14 18:48:22.0925 5408 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/07/14 18:48:23.0035 5408 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/07/14 18:48:23.0144 5408 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/07/14 18:48:23.0312 5408 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/07/14 18:48:23.0414 5408 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/07/14 18:48:23.0654 5408 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/07/14 18:48:23.0750 5408 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/07/14 18:48:23.0868 5408 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/07/14 18:48:23.0955 5408 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/07/14 18:48:24.0057 5408 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/07/14 18:48:24.0168 5408 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/07/14 18:48:24.0246 5408 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/07/14 18:48:24.0406 5408 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/07/14 18:48:24.0527 5408 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/07/14 18:48:24.0613 5408 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/07/14 18:48:24.0691 5408 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/07/14 18:48:24.0792 5408 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/07/14 18:48:24.0915 5408 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/07/14 18:48:25.0040 5408 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/07/14 18:48:25.0109 5408 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/07/14 18:48:25.0300 5408 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/07/14 18:48:25.0387 5408 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/07/14 18:48:25.0533 5408 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/07/14 18:48:25.0714 5408 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/07/14 18:48:25.0854 5408 NTIDrvr (2757d2ba59aee155209e24942ab127c9) C:\Windows\system32\DRIVERS\NTIDrvr.sys
2011/07/14 18:48:26.0089 5408 NTIPPKernel (547bfa3591c70674b0bfc99354ab78b3) C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
2011/07/14 18:48:35.0796 5408 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/07/14 18:48:35.0925 5408 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/07/14 18:48:36.0098 5408 NVHDA (2c7ac27710e8d41c1eb7d1599187d237) C:\Windows\system32\drivers\nvhda32v.sys
2011/07/14 18:48:36.0783 5408 nvlddmkm (cb0d6f8f65b8766ff2aaaa78881fd9f8) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/07/14 18:48:37.0223 5408 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/07/14 18:48:37.0297 5408 nvsmu (0fb6bf3ab170fc5bd403d25e134eafde) C:\Windows\system32\DRIVERS\nvsmu.sys
2011/07/14 18:48:37.0399 5408 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/07/14 18:48:37.0570 5408 nvstor32 (fa7b8eca6e845b244b7e30a9dcd82c6c) C:\Windows\system32\DRIVERS\nvstor32.sys
2011/07/14 18:48:38.0111 5408 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/07/14 18:48:38.0458 5408 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/07/14 18:48:38.0673 5408 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/07/14 18:48:38.0772 5408 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/07/14 18:48:38.0936 5408 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/07/14 18:48:39.0051 5408 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/07/14 18:48:39.0211 5408 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/07/14 18:48:39.0297 5408 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/07/14 18:48:39.0427 5408 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/07/14 18:48:39.0879 5408 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/07/14 18:48:39.0973 5408 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\DRIVERS\processr.sys
2011/07/14 18:48:40.0154 5408 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/07/14 18:48:40.0243 5408 PSDFilter (1dcbb35090cc4b2bd3d661e6089523c6) C:\Windows\system32\DRIVERS\psdfilter.sys
2011/07/14 18:48:40.0331 5408 PSDNServ (e26e46d619469964ac3609620f443867) C:\Windows\system32\DRIVERS\PSDNServ.sys
2011/07/14 18:48:40.0425 5408 psdvdisk (3e1d134af2806867d06047c4cc33cc65) C:\Windows\system32\DRIVERS\PSDVdisk.sys
2011/07/14 18:48:40.0614 5408 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/07/14 18:48:40.0708 5408 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/07/14 18:48:40.0818 5408 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/07/14 18:48:40.0886 5408 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/07/14 18:48:41.0004 5408 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/07/14 18:48:41.0106 5408 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/07/14 18:48:41.0192 5408 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/07/14 18:48:41.0295 5408 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/07/14 18:48:41.0360 5408 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/07/14 18:48:41.0511 5408 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/07/14 18:48:41.0650 5408 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/07/14 18:48:41.0790 5408 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/07/14 18:48:42.0152 5408 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/07/14 18:48:42.0238 5408 RTSTOR (830b682cb24206f457ea8a617605209f) C:\Windows\system32\drivers\RTSTOR.SYS
2011/07/14 18:48:42.0392 5408 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/07/14 18:48:42.0642 5408 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/07/14 18:48:42.0776 5408 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/07/14 18:48:42.0917 5408 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/07/14 18:48:43.0037 5408 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/07/14 18:48:43.0268 5408 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/07/14 18:48:43.0361 5408 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/07/14 18:48:43.0448 5408 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/07/14 18:48:43.0596 5408 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/07/14 18:48:43.0754 5408 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/07/14 18:48:43.0838 5408 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/07/14 18:48:43.0949 5408 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/07/14 18:48:44.0109 5408 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/07/14 18:48:44.0276 5408 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/07/14 18:48:44.0418 5408 srv (2252aef839b1093d16761189f45af885) C:\Windows\system32\DRIVERS\srv.sys
2011/07/14 18:48:44.0516 5408 srv2 (b7ff59408034119476b00a81bb53d5d1) C:\Windows\system32\DRIVERS\srv2.sys
2011/07/14 18:48:44.0616 5408 srvnet (2accc9b12af02030f531e6cca6f8b76e) C:\Windows\system32\DRIVERS\srvnet.sys
2011/07/14 18:48:44.0787 5408 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/07/14 18:48:44.0898 5408 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/07/14 18:48:44.0979 5408 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/07/14 18:48:45.0068 5408 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/07/14 18:48:45.0170 5408 SynTP (bf7aa84d5af0faa0978c840e63b17dbf) C:\Windows\system32\DRIVERS\SynTP.sys
2011/07/14 18:48:45.0430 5408 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/07/14 18:48:45.0620 5408 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/07/14 18:48:45.0710 5408 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/07/14 18:48:45.0809 5408 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/07/14 18:48:45.0925 5408 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/07/14 18:48:46.0006 5408 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/07/14 18:48:46.0125 5408 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/07/14 18:48:46.0389 5408 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/07/14 18:48:46.0507 5408 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/07/14 18:48:46.0625 5408 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2011/07/14 18:48:46.0701 5408 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/07/14 18:48:47.0047 5408 UBHelper (f763e070843ee2803de1395002b42938) C:\Windows\system32\drivers\UBHelper.sys
2011/07/14 18:48:47.0234 5408 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/07/14 18:48:47.0481 5408 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/07/14 18:48:47.0654 5408 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/07/14 18:48:47.0754 5408 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/07/14 18:48:47.0865 5408 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/07/14 18:48:47.0965 5408 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/07/14 18:48:48.0120 5408 usbccgp (afb10a231254a1920c3bb4a0d02e1ca6) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/07/14 18:48:48.0216 5408 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/07/14 18:48:48.0301 5408 usbehci (44245742c4ed2eafd69020583424455b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/07/14 18:48:48.0464 5408 usbhub (db39b3f83af77bca019d7df6aaddbdae) C:\Windows\system32\DRIVERS\usbhub.sys
2011/07/14 18:48:48.0555 5408 usbohci (5fee2a4aaaebcd2e6576e7c90959b3fd) C:\Windows\system32\DRIVERS\usbohci.sys
2011/07/14 18:48:48.0669 5408 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/07/14 18:48:48.0745 5408 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/07/14 18:48:48.0852 5408 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/07/14 18:48:48.0956 5408 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/07/14 18:48:49.0057 5408 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/07/14 18:48:49.0204 5408 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/07/14 18:48:49.0269 5408 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/07/14 18:48:49.0366 5408 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/07/14 18:48:49.0497 5408 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/07/14 18:48:49.0577 5408 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/07/14 18:48:49.0667 5408 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/07/14 18:48:49.0793 5408 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/07/14 18:48:49.0897 5408 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/07/14 18:48:50.0058 5408 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/07/14 18:48:50.0276 5408 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/07/14 18:48:50.0366 5408 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/14 18:48:50.0467 5408 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/14 18:48:50.0707 5408 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/07/14 18:48:50.0853 5408 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/07/14 18:48:51.0185 5408 winachsf (bb9cbaf6ac20452b245c324f1f50ee81) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
2011/07/14 18:48:51.0294 5408 winbondcir (3fa87d56769838aac82fafc3e78fc732) C:\Windows\system32\DRIVERS\winbondcir.sys
2011/07/14 18:48:51.0666 5408 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/07/14 18:48:51.0944 5408 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/07/14 18:48:52.0062 5408 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/07/14 18:48:52.0296 5408 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/07/14 18:48:52.0480 5408 XAudio (dab33cfa9dd24251aaa389ff36b64d4b) C:\Windows\system32\DRIVERS\xaudio.sys
2011/07/14 18:48:52.0681 5408 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (4d840c6af3c020ed3a35efba9025cf4a) C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
2011/07/14 18:48:52.0855 5408 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/07/14 18:48:52.0962 5408 MBR (0x1B8) (f05261c246ce4b3c544521ffff7aef5d) \Device\Harddisk1\DR1
2011/07/14 18:48:53.0320 5408 Boot (0x1200) (0c02a00479ec1befa02a3a9f11727327) \Device\Harddisk0\DR0\Partition0
2011/07/14 18:48:53.0407 5408 Boot (0x1200) (22a7fe9cb80953cccd5a7122b28d8514) \Device\Harddisk0\DR0\Partition1
2011/07/14 18:48:53.0484 5408 Boot (0x1200) (04b6221d7487f1b205e769e9d0a979ae) \Device\Harddisk1\DR1\Partition0
2011/07/14 18:48:53.0535 5408 ================================================================================
2011/07/14 18:48:53.0535 5408 Scan finished
2011/07/14 18:48:53.0535 5408 ================================================================================
2011/07/14 18:48:53.0606 5692 Detected object count: 0
2011/07/14 18:48:53.0607 5692 Actual detected object count: 0

Das Tool sagt alles sauber :wtf:

Mach erstmal zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset