Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Nach Entfernung von HDD Repair mit MBAM findet GMER noch Root-Kit (https://www.trojaner-board.de/102974-entfernung-hdd-repair-mbam-findet-gmer-noch-root-kit.html)

ChronoJon 29.08.2011 17:19
Nach Entfernung von HDD Repair mit MBAM findet GMER noch Root-Kit
 
Hallo an alle Virenjäger!

Mein Stiefvater hat sich MALWARE namens "HDD Repair" eingefangen und jetzt darf ich mich damit herumschlagen. Erstmal waren alle Dateien auf dem Desktop, im Explorer, in der Schnellstartleiste "weg". Task-Manager konnte ich nicht öffnen, die Rechte waren entzogen. Ein Fenster eines "Programms" HDD Repair erschien und forderte zum Bezahlen auf, um den Verlust von Daten auf der Festplatte vorzubeugen. Ebenso erschienen Fake-Meldungen, die Windowsmeldungen vorgaukelten und meinten, dass verschiedene Cluster der Festplatte kaputt seien etc.

System: Win XP SP3


Mein Vorgehen:
  1. Ich habe SpyBot laufen lassen, da es eh schon installiert war und ich während des Suchlaufs mich im Internet informieren konnte. Spybot hat einige verdächtige Registryeinträge/Dateien gefunden und korrigiert/gelöscht. Danach konnte ich den Task-Manager wieder benutzen und HDD Repair schien wegzusein. Ist jedoch nach ca. 10 min wieder aufgetaucht.
  2. Ich habe einige Anleitungen zur Entfernung von HDD Repair gefunden, doch wirkten manche nicht seriös, waren in schlechtem Englisch geschrieben und rieten zum Download von extra Programmen auf. Habe mich dann an dieses Forum gehalten, doch leider war hier nichts bezüglich HDD Repair zu finden. Im Folgenden habe ich mich deswegen an die Anleitung zum Entfernen von HDD Plus gehalten.
  3. Habe rkill.com laufen lassen und die geschlossenen Prozesse anschließend per Hand gelöscht. Anschließend habe ich die restliche Malware mit MBAM entfernt. Danach habe ich nochmal Avira durchlaufen lassen, der auch nochmal einiges gelöscht hat. Im Anschluss hat GMER mir noch gemeldet das wohl noch ein Root-Kit auf der HDD ist, weshalb ich jetzt hier bin. Nachdem das Root-Kit weg ist, werde ich den Rechner formatieren und neuinstallieren.
  4. Habe dann noch defogger benutzt und OTL durchlaufen lassen. Alle Logs sind in der angehängten ZIP-Datei (inkl. Spybot, Avira).
Vielden Dank im Vorraus :)

cosinus 30.08.2011 11:14
Zitat:
Datenbank Version: 7577
Ganz aktuell war es aber nicht? Bitte Malwarebytes updaten und einen neuen Vollscan bitte machen.

ChronoJon 30.08.2011 13:04
Hier der aktuelle Scan:
Code:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7609

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

30.08.2011 13:26:55
mbam-log-2011-08-30 (13-26-55).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 248837
Laufzeit: 46 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 30.08.2011 15:27
Führe auch bitte ESET aus, danach sehen wir weiter.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

n.

ChronoJon 30.08.2011 17:50
Nichts gefunden:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6aba623a80218c438ac436ab037f0700
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-30 04:44:55
# local_time=2011-08-30 06:44:55 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775141 100 93 10492 51252295 59569 0
# compatibility_mode=8192 67108863 100 0 448 448 0 0
# scanned=94386
# found=0
# cleaned=0
# scan_time=7259

cosinus 31.08.2011 10:36
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

ChronoJon 31.08.2011 12:40
Hier das OTL-Log:
Code:
OTL logfile created on: 31.08.2011 12:56:07 - Run 4
OTL by OldTimer - Version 3.2.26.5    Folder = C:\Dokumente und Einstellungen\**USERNAME**\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1015,42 Mb Total Physical Memory | 612,76 Mb Available Physical Memory | 60,35% Memory free
2,39 Gb Paging File | 2,07 Gb Available in Paging File | 86,75% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 127,34 Gb Free Space | 85,44% Space Free | Partition Type: NTFS
Drive E: | 74,53 Gb Total Space | 34,59 Gb Free Space | 46,41% Space Free | Partition Type: NTFS
 
Computer Name: **PC-NAME** | User Name: **USERNAME** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTH.scr (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) --  File not found
SRV - (AppMgmt) --  File not found
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (LiveUpdate Notice Service) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (CLSched) CyberLink Task Scheduler (CTS) -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
SRV - (CyberLink Media Library Service) -- c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (USBDeviceService) -- C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe ()
SRV - (UleadBurningHelper) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (STI Simulator) -- C:\WINDOWS\system32\PAStiSvc.exe ()
SRV - (AOL ACS) -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe (America Online, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (eeCtrl) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\eengine\eectrl.sys (Symantec Corporation)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (TridVid) -- C:\WINDOWS\system32\drivers\TridVid.sys (Trident Multimedia Technologies Co.,Ltd)
DRV - (BVRPMPR5) -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (BVRP Software)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (PAC207) -- C:\WINDOWS\system32\drivers\pfc027.sys ()
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (glauiad) -- C:\WINDOWS\system32\drivers\glauiad.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.hamburg-magazin.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.08.21 08:55:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.08.14 12:38:41 | 000,000,000 | ---D | M]
 
[2011.08.07 20:26:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla\Extensions
[2011.08.08 15:47:00 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla\Firefox\Profiles\f50jem8k.default\extensions
[2011.08.07 20:56:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla\Firefox\Profiles\f50jem8k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.08.22 20:58:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.08.22 20:51:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.08.22 20:58:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) --
[2011.08.22 20:51:12 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.08.21 08:55:10 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CXMon] C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [DetectorApp] C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe ()
O4 - HKLM..\Run: [DSLAGENTEXE]  File not found
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Nokia FastStart] C:\Programme\Nokia\Nokia Music\NokiaMusic.exe (Nokia)
O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
O4 - HKLM..\Run: [PCMService] c:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SVRemote] c:\Program Files\SVRemote\USB20Remote.exe ()
O4 - HKLM..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe (MacroGaming LTD.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [WinDVR SchSvr] C:\Programme\Gemeinsame Dateien\InterVideo\SchSvr\SchSvr.exe (InterVideo Inc.)
O4 - HKLM..\Run: [WinRemote] C:\Programme\InterVideo\WinDVR3\WinRemote.exe ()
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [NokiaOviSuite2] C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKCU..\Run: [SmpcSys] C:\APPS\SMP\SMPSYS.EXE (Packard Bell BV)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe (MacroGaming LTD.)
O4 - HKCU..\Run: [wlVsRfSnQB]  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\**USERNAME**\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175972806015 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {FA81E151-CFE7-4B18-8B9E-8B96E62BAC11} https://de.web.sonynetservices.com/portal/applets/DownloadManager.cab (DownloadManager)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Programme\PixiePack Codec Pack\InstallerHelper.exe
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.dvacm - C:\Programme\Gemeinsame Dateien\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp -  File not found
Drivers32: msacm.mpegacm - C:\Programme\Gemeinsame Dateien\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.ulmp3acm - C:\Programme\Gemeinsame Dateien\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.ACDV - ACDV.dll File not found
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.31 10:39:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mobile Partner
[2011.08.30 16:36:31 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2011.08.29 16:55:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\7-Zip
[2011.08.29 16:55:13 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2011.08.29 15:18:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Logs
[2011.08.26 15:15:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Malwarebytes
[2011.08.26 15:15:35 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.08.26 15:15:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.08.26 15:15:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.08.26 15:15:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.08.26 15:13:32 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Kopie von **PC-NAME**2.exe
[2011.08.26 15:12:46 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTH.scr
[2011.08.26 15:07:20 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTL.exe
[2011.08.26 15:05:06 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**2.exe
[2011.08.26 14:45:15 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Recent
[2011.08.26 10:57:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.08.22 21:03:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OpenOffice.org
[2011.08.22 20:54:51 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice.org 3.3
[2011.08.22 20:52:04 | 000,000,000 | ---D | C] -- C:\Programme\OpenOffice.org 3
[2011.08.22 20:51:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
[2011.08.21 09:43:47 | 000,000,000 | ---D | C] -- C:\Programme\Panasonic
[2011.08.21 09:43:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Panasonic
[2011.08.17 07:29:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\Downloads
[2011.08.14 21:22:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\GARMIN
[2011.08.14 13:41:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\Ovi
[2011.08.14 13:08:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2011.08.14 13:02:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
[2011.08.14 12:38:31 | 000,018,816 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2011.08.14 12:38:19 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2011.08.14 12:37:47 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys
[2011.08.14 12:37:46 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys
[2011.08.14 12:37:44 | 000,023,168 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys
[2011.08.14 12:37:42 | 000,605,696 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcocls.dll
[2011.08.14 12:37:42 | 000,123,904 | ---- | C] (Nokia) -- C:\WINDOWS\System32\ccdcmbwu.dll
[2011.08.14 12:37:42 | 000,018,176 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys
[2011.08.14 12:34:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2011.08.07 20:26:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2011.08.07 20:26:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla
[2011.08.07 20:26:06 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011.08.07 20:13:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Dream Aquarium
[2011.08.07 09:45:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy
[2011.08.07 09:27:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\Download
[2011.08.04 12:39:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2011.08.04 12:39:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\**USERNAME**\Application Data
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.31 12:40:02 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.31 12:01:02 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.08.31 09:44:28 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.31 09:43:28 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.31 09:43:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.31 09:43:13 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.29 16:56:11 | 000,030,644 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Logs.zip
[2011.08.29 15:32:57 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\defogger_reenable
[2011.08.29 15:32:23 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Defogger.exe
[2011.08.27 17:44:33 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\up17z5mu.exe
[2011.08.26 19:07:29 | 000,000,759 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.26 15:12:48 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTH.scr
[2011.08.26 15:07:23 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\OTL.exe
[2011.08.26 15:05:06 | 009,466,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Kopie von **PC-NAME**2.exe
[2011.08.26 15:05:06 | 009,466,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**2.exe
[2011.08.26 15:01:51 | 000,684,297 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\unhide.exe
[2011.08.26 14:49:23 | 001,008,092 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\rkill.com
[2011.08.26 14:49:23 | 001,008,092 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**.exe
[2011.08.24 13:12:27 | 000,092,160 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.22 21:05:49 | 000,000,839 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
[2011.08.22 21:00:05 | 000,300,440 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.22 20:54:53 | 000,000,861 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.3.lnk
[2011.08.22 20:46:53 | 168,166,968 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2011.08.21 09:43:54 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\FZ100 Bedienungsanleitung.lnk
[2011.08.14 13:03:31 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.08.14 13:03:29 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.08.11 13:12:06 | 000,467,414 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.08.11 13:12:06 | 000,449,716 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.08.11 13:12:06 | 000,088,048 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.08.11 13:12:06 | 000,074,782 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.08.08 16:38:42 | 000,000,699 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.08.08 16:35:14 | 000,000,976 | ---- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\wklnhst.dat
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.29 16:56:11 | 000,030,644 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Logs.zip
[2011.08.29 15:32:57 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\defogger_reenable
[2011.08.29 15:32:18 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\Defogger.exe
[2011.08.27 17:44:36 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\up17z5mu.exe
[2011.08.26 15:15:35 | 000,000,759 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.26 15:12:04 | 000,000,861 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.3.lnk
[2011.08.26 15:12:04 | 000,000,699 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.08.26 15:12:04 | 000,000,657 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2011.08.26 15:11:41 | 000,001,750 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk
[2011.08.26 15:11:38 | 000,001,683 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Works-Start.lnk
[2011.08.26 15:11:38 | 000,000,705 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2011.08.26 15:11:38 | 000,000,665 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Movie Maker.lnk
[2011.08.26 15:11:38 | 000,000,621 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Messenger.lnk
[2011.08.26 15:11:37 | 000,002,056 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop Album Starter Edition 3.2.lnk
[2011.08.26 15:11:37 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader 8.lnk
[2011.08.26 15:11:37 | 000,001,767 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Office PowerPoint Viewer 2003.lnk
[2011.08.26 15:11:37 | 000,001,619 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\IncrediMail.lnk
[2011.08.26 15:11:37 | 000,000,550 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Acrobat Reader 5.0.lnk
[2011.08.26 15:01:49 | 000,684,297 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\unhide.exe
[2011.08.26 14:57:52 | 001,008,092 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\rkill.com
[2011.08.26 14:49:16 | 001,008,092 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\**PC-NAME**.exe
[2011.08.22 21:05:49 | 000,000,839 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
[2011.08.22 20:45:43 | 168,166,968 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Eigene Dateien\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2011.08.21 09:43:54 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Desktop\FZ100 Bedienungsanleitung.lnk
[2011.08.14 13:03:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.08.14 13:03:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010.12.15 09:48:25 | 000,000,145 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT
[2010.08.27 16:32:00 | 000,000,072 | ---- | C] () -- C:\WINDOWS\Pex.INI
[2010.07.21 22:51:10 | 000,000,119 | ---- | C] () -- C:\WINDOWS\Podcasts.INI
[2010.07.07 10:20:57 | 000,323,360 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.06.12 11:27:33 | 000,125,440 | ---- | C] () -- C:\WINDOWS\dx7ogl32.dll
[2009.11.25 13:40:50 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009.04.24 12:25:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2009.04.24 12:25:50 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2009.04.24 12:25:50 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2009.04.24 12:25:50 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2009.04.24 12:25:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2009.04.24 12:25:50 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2007.02.21 20:46:37 | 000,000,043 | ---- | C] () -- C:\WINDOWS\TC.INI
[2007.02.21 20:41:08 | 000,246,784 | ---- | C] () -- C:\WINDOWS\UN160407.EXE
[2007.02.21 19:51:22 | 000,000,046 | ---- | C] () -- C:\WINDOWS\DFamily.ini
[2007.01.30 23:15:07 | 000,006,063 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\NMM-MetaData.db
[2007.01.30 22:48:36 | 000,000,158 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.01.15 13:47:43 | 000,025,601 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2007.01.15 13:32:28 | 000,000,509 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007.01.08 19:30:33 | 000,000,026 | ---- | C] () -- C:\WINDOWS\neosetup.INI
[2007.01.06 13:42:07 | 000,002,387 | ---- | C] () -- C:\WINDOWS\gshh04.ini
[2007.01.06 13:42:07 | 000,000,438 | ---- | C] () -- C:\WINDOWS\retrieve.ini
[2007.01.03 20:24:43 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PAStiSvc.exe
[2006.12.19 23:18:25 | 000,092,160 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.12.17 17:13:45 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\ldf252.dll
[2006.12.17 16:57:51 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS5y.DLL
[2006.12.17 16:38:27 | 000,000,976 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\wklnhst.dat
[2006.12.16 21:40:39 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\CoInst.dll
[2006.12.16 21:40:38 | 000,015,080 | ---- | C] () -- C:\WINDOWS\wwdslcfg.ini
[2006.12.16 18:56:13 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\**USERNAME**\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.09.29 11:38:09 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.09.29 11:22:59 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2006.09.29 11:18:12 | 000,000,626 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI
[2006.09.29 11:13:46 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006.09.29 11:11:40 | 000,006,929 | ---- | C] () -- C:\WINDOWS\HDReg.ini
[2006.09.29 11:10:06 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006.09.29 10:56:14 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2006.09.29 10:56:14 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2006.03.23 14:24:10 | 000,006,399 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006.01.12 12:23:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005.12.07 13:31:00 | 000,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2005.04.08 11:46:18 | 000,162,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\pfc027.sys
[2005.01.25 16:15:42 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\PA207Usd.dll
[2004.08.11 19:13:19 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.08.11 19:10:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004.08.11 19:03:37 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.11 18:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.11 18:56:16 | 000,300,440 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.08.11 18:48:09 | 000,467,414 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.11 18:48:09 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.11 18:48:09 | 000,088,048 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.11 18:48:09 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.11 18:47:49 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.11 18:47:46 | 000,449,716 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.11 18:47:46 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.11 18:47:46 | 000,074,782 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.11 18:47:46 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.11 18:47:45 | 000,004,613 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.11 18:47:43 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.11 18:47:41 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.08.11 18:47:34 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.11 18:47:34 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.11 18:47:25 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.11 18:47:16 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.01.13 19:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
 
========== LOP Check ==========
 
[2011.08.14 20:09:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2011.02.25 19:42:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2007.01.30 22:34:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations
[2009.04.24 12:27:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\InterVideo
[2011.08.14 13:08:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2011.08.14 12:34:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2009.09.08 12:02:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaMusic
[2006.09.29 11:17:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OD2
[2009.09.08 12:12:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011.07.15 11:01:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RapidSolution
[2006.09.29 11:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SmartSound Software Inc
[2007.01.15 13:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanAppDataDir
[2007.01.15 13:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanWizard
[2010.08.27 16:31:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2006.09.29 11:11:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2006.12.17 17:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ACD Systems
[2011.07.13 10:52:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\AskToolbar
[2007.01.15 14:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Canon
[2007.02.21 19:52:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\D-Info
[2007.01.30 22:42:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Datalayer
[2011.08.14 14:50:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Dream Aquarium
[2011.08.14 21:22:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\GARMIN
[2007.01.15 13:27:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\InterTrust
[2007.02.25 16:27:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Leadertech
[2009.09.08 12:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia
[2007.02.08 22:56:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia Multimedia Player
[2006.12.21 06:47:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Norman
[2009.09.08 12:11:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nseries
[2006.12.17 08:14:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OD2
[2011.08.22 21:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OpenOffice.org
[2006.12.17 17:12:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ordner HP Share-to-Web
[2011.08.14 13:08:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\PC Suite
[2009.07.04 22:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RapidSolution
[2007.09.23 06:33:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RTPlayer
[2007.01.15 13:32:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ScanSoft
[2006.12.17 16:45:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Template
[2010.08.27 16:31:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ulead Systems
[2011.08.31 12:01:02 | 000,000,228 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2006.12.17 17:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ACD Systems
[2007.08.09 14:24:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Adobe
[2007.01.16 10:17:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\AdobeUM
[2009.06.25 07:59:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Arcsoft
[2011.07.13 10:52:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\AskToolbar
[2010.10.21 18:15:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Avira
[2007.01.15 14:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Canon
[2006.12.18 14:57:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\CyberLink
[2007.02.21 19:52:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\D-Info
[2007.01.30 22:42:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Datalayer
[2011.08.14 14:50:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Dream Aquarium
[2011.08.14 21:22:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\GARMIN
[2007.06.08 05:39:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Google
[2006.12.21 16:50:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Help
[2004.08.11 19:11:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Identities
[2007.01.15 13:27:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\InterTrust
[2007.01.09 17:10:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Lavasoft
[2007.02.25 16:27:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Leadertech
[2006.12.16 20:37:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Macromedia
[2011.08.26 15:15:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Malwarebytes
[2007.01.01 22:54:57 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft
[2011.08.07 20:26:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Mozilla
[2009.09.08 12:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia
[2007.02.08 22:56:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nokia Multimedia Player
[2006.12.21 06:47:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Norman
[2009.09.08 12:11:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Nseries
[2006.12.17 08:14:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OD2
[2011.08.22 21:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\OpenOffice.org
[2006.12.17 17:12:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ordner HP Share-to-Web
[2011.08.14 13:08:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\PC Suite
[2009.07.04 22:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RapidSolution
[2007.09.23 06:33:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\RTPlayer
[2007.01.15 13:32:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\ScanSoft
[2008.02.25 13:23:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Skype
[2007.02.25 16:41:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Sonic
[2006.12.17 08:21:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Sun
[2006.12.17 16:45:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Template
[2010.08.27 16:31:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Ulead Systems
[2006.09.29 11:11:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\You've Got Pictures Screensaver
 
< %APPDATA%\*.exe /s >
[2007.01.15 21:25:43 | 023,813,608 | ---- | M] (                            ) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe
[2006.09.29 11:22:06 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft\Installer\{5E8A1B08-0FBD-4543-9646-F2C2D0D05750}\ARPPRODUCTICON.exe
[2007.02.08 19:50:35 | 000,002,670 | R--- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft\Installer\{B123C187-8673-4B48-A3F0-24D50E1B03C6}\_18be6784.exe
[2007.02.08 19:50:35 | 000,002,670 | R--- | M] () -- C:\Dokumente und Einstellungen\**USERNAME**\Anwendungsdaten\Microsoft\Installer\{B123C187-8673-4B48-A3F0-24D50E1B03C6}\_294823.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2009.01.12 13:34:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >

cosinus 31.08.2011 15:32
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [DSLAGENTEXE]  File not found
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe (MacroGaming LTD.)
O4 - HKCU..\Run: [wlVsRfSnQB]  File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403950-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44403954-cf05-11df-9592-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

ChronoJon 31.08.2011 15:55
Hier das Log nach dem Fix:
Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DSLAGENTEXE deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM deleted successfully.
C:\Programme\Macrogaming\SweetIM\SweetIM.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wlVsRfSnQB deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c2-f032-11df-95b8-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12ea50c6-f032-11df-95b8-00038a000015}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1396c2ba-d83d-11df-956b-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e96395a-e0d7-11df-956e-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27c1a920-caec-11df-954f-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27c1a920-caec-11df-954f-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d2fc91c-94b5-11df-94df-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403950-cf05-11df-9592-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403950-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403950-cf05-11df-9592-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403954-cf05-11df-9592-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44403954-cf05-11df-9592-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44403954-cf05-11df-9592-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f573ce-eaad-11df-95a2-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc66-d7c1-11df-9566-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5720fc69-d7c1-11df-9566-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817ae-d823-11df-9568-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a4817af-d823-11df-9568-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a4817af-d823-11df-9568-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76a-c428-11df-953c-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7fcee76e-c428-11df-953c-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346a-d7bb-11df-9565-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8b346b-d7bb-11df-9565-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fa-d7ad-11df-9562-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e2f44fd-d7ad-11df-9562-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc0-f02d-11df-95b6-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b200ddc4-f02d-11df-95b6-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b546976a-ea9f-11df-95a1-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c606d7d2-8b52-11e0-95ef-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c72b453a-af77-11df-94e9-00038a000015}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd65c9d4-376f-11e0-95ca-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac304-d7b0-11df-9564-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e93ac307-d7b0-11df-9564-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9850ae2-cf1b-11df-9594-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4614cc-cf1f-11df-9595-00038a000015}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fead69e2-cf1a-11df-955b-00038a000015}\ not found.
File E:\AutoRun.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: **USERNAME**
->Temp folder emptied: 2623743 bytes
->Temporary Internet Files folder emptied: 52211806 bytes
->Java cache emptied: 521 bytes
->FireFox cache emptied: 50531587 bytes
->Google Chrome cache emptied: 11244928 bytes
->Flash cache emptied: 470 bytes
 
User: Besitzer
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 14490782 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33233 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19096 bytes
RecycleBin emptied: 167895 bytes
 
Total Files Cleaned = 125,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.26.5 log created on 08312011_164433

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 31.08.2011 16:18
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

ChronoJon 31.08.2011 17:15
Es wurde ein Root-Kit gefunden und entfernt:
Code:
2011/08/31 17:35:18.0328 0532        TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/31 17:35:20.0328 0532        ================================================================================
2011/08/31 17:35:20.0328 0532        SystemInfo:
2011/08/31 17:35:20.0328 0532       
2011/08/31 17:35:20.0328 0532        OS Version: 5.1.2600 ServicePack: 3.0
2011/08/31 17:35:20.0328 0532        Product type: Workstation
2011/08/31 17:35:20.0328 0532        ComputerName: **PC-NAME**
2011/08/31 17:35:20.0328 0532        UserName: **USERNAME**
2011/08/31 17:35:20.0328 0532        Windows directory: C:\WINDOWS
2011/08/31 17:35:20.0328 0532        System windows directory: C:\WINDOWS
2011/08/31 17:35:20.0328 0532        Processor architecture: Intel x86
2011/08/31 17:35:20.0328 0532        Number of processors: 1
2011/08/31 17:35:20.0328 0532        Page size: 0x1000
2011/08/31 17:35:20.0328 0532        Boot type: Normal boot
2011/08/31 17:35:20.0328 0532        ================================================================================
2011/08/31 17:35:22.0296 0532        Initialize success
2011/08/31 17:35:31.0125 0268        ================================================================================
2011/08/31 17:35:31.0125 0268        Scan started
2011/08/31 17:35:31.0125 0268        Mode: Manual;
2011/08/31 17:35:31.0125 0268        ================================================================================
2011/08/31 17:35:32.0328 0268        abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/08/31 17:35:32.0390 0268        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/31 17:35:32.0468 0268        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/08/31 17:35:32.0500 0268        adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/08/31 17:35:32.0546 0268        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/31 17:35:32.0656 0268        AFD            (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/31 17:35:32.0718 0268        agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/31 17:35:32.0765 0268        agpCPQ          (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/08/31 17:35:32.0812 0268        Aha154x        (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/08/31 17:35:32.0859 0268        aic78u2        (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/08/31 17:35:32.0890 0268        aic78xx        (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/08/31 17:35:32.0968 0268        AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/08/31 17:35:33.0000 0268        alim1541        (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/08/31 17:35:33.0031 0268        amdagp          (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/08/31 17:35:33.0062 0268        amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/08/31 17:35:33.0156 0268        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/31 17:35:33.0234 0268        asc            (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/08/31 17:35:33.0265 0268        asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/08/31 17:35:33.0296 0268        asc3550        (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/08/31 17:35:33.0343 0268        ASCTRM          (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
2011/08/31 17:35:33.0421 0268        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/31 17:35:33.0468 0268        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/31 17:35:33.0546 0268        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/31 17:35:33.0578 0268        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/31 17:35:33.0703 0268        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/08/31 17:35:33.0781 0268        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/08/31 17:35:33.0828 0268        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/08/31 17:35:33.0921 0268        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/31 17:35:34.0015 0268        BVRPMPR5        (2120b6607cbbe426ce821643838ea1d3) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/08/31 17:35:34.0078 0268        cbidf          (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/08/31 17:35:34.0109 0268        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/31 17:35:34.0171 0268        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/31 17:35:34.0218 0268        cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/08/31 17:35:34.0265 0268        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/31 17:35:34.0328 0268        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/31 17:35:34.0390 0268        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/31 17:35:34.0515 0268        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/31 17:35:34.0562 0268        CmdIde          (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/08/31 17:35:34.0593 0268        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/31 17:35:34.0640 0268        Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/08/31 17:35:34.0671 0268        dac2w2k        (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/08/31 17:35:34.0703 0268        dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/08/31 17:35:34.0750 0268        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/31 17:35:34.0812 0268        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/31 17:35:34.0875 0268        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/31 17:35:34.0937 0268        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/31 17:35:34.0968 0268        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/31 17:35:35.0015 0268        dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/08/31 17:35:35.0046 0268        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/31 17:35:35.0171 0268        eeCtrl          (e89cc1363cb7f5320ae3b41c1333d0c3) C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
2011/08/31 17:35:35.0453 0268        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/31 17:35:35.0546 0268        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/08/31 17:35:35.0625 0268        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/31 17:35:35.0687 0268        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/31 17:35:35.0765 0268        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/08/31 17:35:35.0843 0268        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/31 17:35:35.0937 0268        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/31 17:35:36.0046 0268        glauiad        (3ebd3017f1c8aa111ba5df3243829aa0) C:\WINDOWS\system32\DRIVERS\glauiad.sys
2011/08/31 17:35:36.0156 0268        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/31 17:35:36.0281 0268        HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys
2011/08/31 17:35:36.0390 0268        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/31 17:35:36.0500 0268        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/31 17:35:36.0578 0268        hpn            (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/08/31 17:35:36.0671 0268        HSFHWAZL        (14b15d0d803ef4ab9b525b7e2da303ef) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
2011/08/31 17:35:36.0781 0268        HSF_DPV        (cbf6831420a97e8fbb91e5f52b707ef7) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2011/08/31 17:35:36.0953 0268        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/31 17:35:37.0203 0268        i2omgmt        (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/08/31 17:35:37.0281 0268        i2omp          (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/08/31 17:35:37.0359 0268        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/31 17:35:37.0500 0268        ialm            (afa7c99d211a2aff21a287bc4264cde6) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/08/31 17:35:37.0671 0268        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/31 17:35:37.0734 0268        ini910u        (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/08/31 17:35:37.0906 0268        IntcAzAudAddService (b3ed6daa38bdffa48e453d7d6007ce1b) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/08/31 17:35:38.0171 0268        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/31 17:35:38.0218 0268        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/31 17:35:38.0281 0268        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/08/31 17:35:38.0328 0268        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/31 17:35:38.0406 0268        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/31 17:35:38.0437 0268        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/31 17:35:38.0515 0268        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/31 17:35:38.0562 0268        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/31 17:35:38.0625 0268        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/31 17:35:38.0687 0268        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/31 17:35:38.0718 0268        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/31 17:35:38.0796 0268        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/31 17:35:38.0937 0268        mdmxsdk        (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/08/31 17:35:38.0984 0268        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/31 17:35:39.0046 0268        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/31 17:35:39.0078 0268        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/31 17:35:39.0140 0268        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/31 17:35:39.0203 0268        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/31 17:35:39.0234 0268        mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/08/31 17:35:39.0265 0268        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/31 17:35:39.0328 0268        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/31 17:35:39.0406 0268        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/31 17:35:39.0453 0268        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/31 17:35:39.0515 0268        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/31 17:35:39.0546 0268        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/31 17:35:39.0609 0268        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/31 17:35:39.0640 0268        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/31 17:35:39.0703 0268        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/31 17:35:39.0750 0268        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/31 17:35:39.0812 0268        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/31 17:35:39.0859 0268        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/31 17:35:39.0937 0268        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/31 17:35:39.0984 0268        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/31 17:35:40.0015 0268        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/31 17:35:40.0078 0268        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/31 17:35:40.0125 0268        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/31 17:35:40.0171 0268        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/31 17:35:40.0265 0268        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/31 17:35:40.0343 0268        nmwcd          (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/08/31 17:35:40.0406 0268        nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/08/31 17:35:40.0468 0268        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/31 17:35:40.0500 0268        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/31 17:35:40.0593 0268        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/31 17:35:40.0640 0268        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/31 17:35:40.0703 0268        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/31 17:35:40.0781 0268        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/31 17:35:40.0843 0268        PAC207          (5489b567cdd6ae216519caca7cc700e9) C:\WINDOWS\system32\DRIVERS\pfc027.sys
2011/08/31 17:35:40.0921 0268        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/31 17:35:40.0984 0268        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/31 17:35:41.0046 0268        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/31 17:35:41.0125 0268        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/08/31 17:35:41.0203 0268        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/31 17:35:41.0296 0268        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/31 17:35:41.0343 0268        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/08/31 17:35:41.0546 0268        perc2          (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/08/31 17:35:41.0593 0268        perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/08/31 17:35:41.0703 0268        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/31 17:35:41.0765 0268        Processor      (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/08/31 17:35:41.0828 0268        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/31 17:35:41.0875 0268        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/31 17:35:41.0968 0268        PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/31 17:35:42.0015 0268        ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/08/31 17:35:42.0062 0268        Ql10wnt        (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/08/31 17:35:42.0093 0268        ql12160        (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/08/31 17:35:42.0140 0268        ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/08/31 17:35:42.0187 0268        ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/08/31 17:35:42.0250 0268        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/31 17:35:42.0328 0268        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/31 17:35:42.0375 0268        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/31 17:35:42.0421 0268        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/31 17:35:42.0484 0268        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/31 17:35:42.0562 0268        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/31 17:35:42.0640 0268        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/31 17:35:42.0765 0268        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/31 17:35:42.0828 0268        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/31 17:35:42.0937 0268        RTL8023xp      (7f0413bdd7d53eb4c7a371e7f6f84df1) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
2011/08/31 17:35:43.0031 0268        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/08/31 17:35:43.0125 0268        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/31 17:35:43.0218 0268        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
2011/08/31 17:35:43.0312 0268        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/31 17:35:43.0421 0268        sisagp          (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/08/31 17:35:43.0468 0268        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/31 17:35:43.0515 0268        Sparrow        (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/08/31 17:35:43.0562 0268        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/31 17:35:43.0593 0268        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/31 17:35:43.0671 0268        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/31 17:35:43.0734 0268        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/08/31 17:35:43.0796 0268        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/31 17:35:43.0859 0268        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/31 17:35:43.0890 0268        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/31 17:35:43.0937 0268        symc810        (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/08/31 17:35:43.0968 0268        symc8xx        (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/08/31 17:35:44.0000 0268        sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/08/31 17:35:44.0031 0268        sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/08/31 17:35:44.0093 0268        SynTP          (b47954850ab7eab09961df08cc747852) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/08/31 17:35:44.0156 0268        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/31 17:35:44.0250 0268        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/31 17:35:44.0296 0268        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/31 17:35:44.0359 0268        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/31 17:35:44.0406 0268        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/31 17:35:44.0500 0268        tifm21          (046ea1353dd599dac9abdcd13504b06c) C:\WINDOWS\system32\drivers\tifm21.sys
2011/08/31 17:35:44.0578 0268        TosIde          (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/08/31 17:35:44.0671 0268        TridVid        (fa76138a8015e9c14542ad6bd2ad6d4b) C:\WINDOWS\system32\DRIVERS\TridVid.sys
2011/08/31 17:35:44.0781 0268        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/31 17:35:44.0859 0268        ultra          (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/08/31 17:35:44.0921 0268        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/31 17:35:45.0031 0268        upperdev        (ec01da44b090d2651fc032c8b9257232) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/08/31 17:35:45.0125 0268        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/31 17:35:45.0203 0268        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/31 17:35:45.0281 0268        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/31 17:35:45.0328 0268        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/31 17:35:45.0406 0268        usbohci        (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/08/31 17:35:45.0468 0268        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/31 17:35:45.0515 0268        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/31 17:35:45.0578 0268        usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/08/31 17:35:45.0656 0268        UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/08/31 17:35:45.0734 0268        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/31 17:35:45.0781 0268        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/31 17:35:45.0828 0268        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/31 17:35:45.0890 0268        viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/08/31 17:35:45.0921 0268        ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/08/31 17:35:45.0968 0268        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/31 17:35:46.0171 0268        w29n51          (c89da341fcc883a3d79dc11727484fc2) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2011/08/31 17:35:46.0453 0268        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/31 17:35:46.0578 0268        wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2011/08/31 17:35:46.0687 0268        wceusbsh        (2e8ba025d65dd49d15ea66973e2a15df) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2011/08/31 17:35:46.0796 0268        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/08/31 17:35:46.0937 0268        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/31 17:35:47.0046 0268        winachsf        (59d043485a6eda2ed2685c81489ae5bd) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/08/31 17:35:47.0281 0268        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/08/31 17:35:47.0328 0268        WS2IFSL        (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/08/31 17:35:47.0390 0268        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/31 17:35:47.0453 0268        WudfPf          (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/31 17:35:47.0515 0268        WudfRd          (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/31 17:35:47.0578 0268        MBR (0x1B8)    (6f9a1d528242bc09104b85e0becf5554) \Device\Harddisk0\DR0
2011/08/31 17:35:47.0578 0268        \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.a (0)
2011/08/31 17:35:47.0984 0268        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR2
2011/08/31 17:35:48.0031 0268        Boot (0x1200)  (abb922844b9e07469eeaec194750ccbd) \Device\Harddisk0\DR0\Partition0
2011/08/31 17:35:48.0046 0268        Boot (0x1200)  (de82ebab7c67ae63c7bfbfe90878740d) \Device\Harddisk1\DR2\Partition0
2011/08/31 17:35:48.0078 0268        ================================================================================
2011/08/31 17:35:48.0078 0268        Scan finished
2011/08/31 17:35:48.0078 0268        ================================================================================
2011/08/31 17:35:48.0093 3780        Detected object count: 1
2011/08/31 17:35:48.0093 3780        Actual detected object count: 1
2011/08/31 17:36:00.0609 3780        \Device\Harddisk0\DR0 (Rootkit.Boot.SST.a) - will be cured after reboot
2011/08/31 17:36:00.0609 3780        \Device\Harddisk0\DR0 - ok
2011/08/31 17:36:00.0609 3780        Rootkit.Boot.SST.a(\Device\Harddisk0\DR0) - User select action: Cure
2011/08/31 17:36:28.0437 0236        Deinitialize success

cosinus 31.08.2011 21:47
Da wurde was gefunden und entfernt. Bitte Windows neu starten und zur Kontrolle ein neues Log mit dem Kaspersky-TDSS-Killer machen.

ChronoJon 01.09.2011 11:50
2. TDSSKiller Log:
Code:
2011/08/31 17:41:20.0171 1468        TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/31 17:41:20.0187 1468        ================================================================================
2011/08/31 17:41:20.0187 1468        SystemInfo:
2011/08/31 17:41:20.0187 1468       
2011/08/31 17:41:20.0187 1468        OS Version: 5.1.2600 ServicePack: 3.0
2011/08/31 17:41:20.0187 1468        Product type: Workstation
2011/08/31 17:41:20.0187 1468        ComputerName: BERND
2011/08/31 17:41:20.0187 1468        UserName: Bernie
2011/08/31 17:41:20.0187 1468        Windows directory: C:\WINDOWS
2011/08/31 17:41:20.0187 1468        System windows directory: C:\WINDOWS
2011/08/31 17:41:20.0187 1468        Processor architecture: Intel x86
2011/08/31 17:41:20.0187 1468        Number of processors: 1
2011/08/31 17:41:20.0187 1468        Page size: 0x1000
2011/08/31 17:41:20.0187 1468        Boot type: Normal boot
2011/08/31 17:41:20.0187 1468        ================================================================================
2011/08/31 17:41:22.0078 1468        Initialize success
2011/08/31 17:41:23.0765 2164        ================================================================================
2011/08/31 17:41:23.0765 2164        Scan started
2011/08/31 17:41:23.0765 2164        Mode: Manual;
2011/08/31 17:41:23.0765 2164        ================================================================================
2011/08/31 17:41:25.0046 2164        abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/08/31 17:41:25.0125 2164        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/31 17:41:25.0187 2164        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/08/31 17:41:25.0265 2164        adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/08/31 17:41:25.0359 2164        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/31 17:41:25.0437 2164        AFD            (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/31 17:41:25.0500 2164        agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/31 17:41:25.0546 2164        agpCPQ          (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/08/31 17:41:25.0578 2164        Aha154x        (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/08/31 17:41:25.0625 2164        aic78u2        (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/08/31 17:41:25.0656 2164        aic78xx        (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/08/31 17:41:25.0703 2164        AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/08/31 17:41:25.0750 2164        alim1541        (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/08/31 17:41:25.0796 2164        amdagp          (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/08/31 17:41:25.0843 2164        amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/08/31 17:41:26.0250 2164        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/31 17:41:26.0328 2164        asc            (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/08/31 17:41:26.0531 2164        asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/08/31 17:41:26.0671 2164        asc3550        (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/08/31 17:41:26.0718 2164        ASCTRM          (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
2011/08/31 17:41:26.0828 2164        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/31 17:41:26.0875 2164        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/31 17:41:26.0953 2164        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/31 17:41:27.0031 2164        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/31 17:41:27.0171 2164        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/08/31 17:41:27.0265 2164        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/08/31 17:41:27.0343 2164        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/08/31 17:41:27.0437 2164        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/31 17:41:27.0531 2164        BVRPMPR5        (2120b6607cbbe426ce821643838ea1d3) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/08/31 17:41:27.0578 2164        cbidf          (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/08/31 17:41:27.0625 2164        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/31 17:41:27.0687 2164        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/31 17:41:27.0734 2164        cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/08/31 17:41:27.0781 2164        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/31 17:41:27.0843 2164        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/31 17:41:27.0890 2164        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/31 17:41:28.0015 2164        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/31 17:41:28.0062 2164        CmdIde          (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/08/31 17:41:28.0109 2164        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/31 17:41:28.0171 2164        Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/08/31 17:41:28.0234 2164        dac2w2k        (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/08/31 17:41:28.0281 2164        dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/08/31 17:41:28.0312 2164        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/31 17:41:28.0375 2164        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/31 17:41:28.0421 2164        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/31 17:41:28.0453 2164        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/31 17:41:28.0500 2164        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/31 17:41:28.0546 2164        dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/08/31 17:41:28.0593 2164        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/31 17:41:28.0687 2164        eeCtrl          (e89cc1363cb7f5320ae3b41c1333d0c3) C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
2011/08/31 17:41:28.0906 2164        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/31 17:41:28.0953 2164        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/08/31 17:41:29.0000 2164        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/31 17:41:29.0062 2164        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/31 17:41:29.0109 2164        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/08/31 17:41:29.0171 2164        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/31 17:41:29.0234 2164        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/31 17:41:29.0281 2164        glauiad        (3ebd3017f1c8aa111ba5df3243829aa0) C:\WINDOWS\system32\DRIVERS\glauiad.sys
2011/08/31 17:41:29.0343 2164        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/31 17:41:29.0437 2164        HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys
2011/08/31 17:41:29.0500 2164        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/31 17:41:29.0562 2164        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/31 17:41:29.0609 2164        hpn            (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/08/31 17:41:29.0687 2164        HSFHWAZL        (14b15d0d803ef4ab9b525b7e2da303ef) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
2011/08/31 17:41:29.0781 2164        HSF_DPV        (cbf6831420a97e8fbb91e5f52b707ef7) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2011/08/31 17:41:29.0875 2164        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/31 17:41:30.0062 2164        i2omgmt        (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/08/31 17:41:30.0109 2164        i2omp          (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/08/31 17:41:30.0156 2164        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/31 17:41:30.0281 2164        ialm            (afa7c99d211a2aff21a287bc4264cde6) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/08/31 17:41:30.0375 2164        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/31 17:41:30.0453 2164        ini910u        (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/08/31 17:41:30.0640 2164        IntcAzAudAddService (b3ed6daa38bdffa48e453d7d6007ce1b) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/08/31 17:41:31.0046 2164        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/31 17:41:31.0109 2164        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/31 17:41:31.0187 2164        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/08/31 17:41:31.0281 2164        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/31 17:41:31.0359 2164        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/31 17:41:31.0421 2164        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/31 17:41:31.0468 2164        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/31 17:41:31.0515 2164        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/31 17:41:31.0593 2164        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/31 17:41:31.0640 2164        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/31 17:41:31.0703 2164        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/31 17:41:31.0765 2164        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/31 17:41:31.0984 2164        mdmxsdk        (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/08/31 17:41:32.0046 2164        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/31 17:41:32.0125 2164        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/31 17:41:32.0156 2164        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/31 17:41:32.0218 2164        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/31 17:41:32.0265 2164        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/31 17:41:32.0328 2164        mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/08/31 17:41:32.0406 2164        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/31 17:41:32.0468 2164        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/31 17:41:32.0546 2164        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/31 17:41:32.0609 2164        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/31 17:41:32.0656 2164        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/31 17:41:32.0703 2164        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/31 17:41:32.0765 2164        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/31 17:41:32.0812 2164        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/31 17:41:32.0890 2164        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/31 17:41:32.0937 2164        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/31 17:41:33.0000 2164        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/31 17:41:33.0062 2164        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/31 17:41:33.0109 2164        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/31 17:41:33.0156 2164        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/31 17:41:33.0203 2164        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/31 17:41:33.0265 2164        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/31 17:41:33.0296 2164        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/31 17:41:33.0375 2164        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/31 17:41:33.0437 2164        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/31 17:41:33.0484 2164        nmwcd          (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/08/31 17:41:33.0546 2164        nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/08/31 17:41:33.0609 2164        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/31 17:41:33.0656 2164        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/31 17:41:33.0703 2164        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/31 17:41:33.0734 2164        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/31 17:41:33.0781 2164        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/31 17:41:33.0843 2164        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/31 17:41:33.0906 2164        PAC207          (5489b567cdd6ae216519caca7cc700e9) C:\WINDOWS\system32\DRIVERS\pfc027.sys
2011/08/31 17:41:33.0968 2164        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/31 17:41:34.0015 2164        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/31 17:41:34.0062 2164        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/31 17:41:34.0125 2164        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/08/31 17:41:34.0171 2164        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/31 17:41:34.0234 2164        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/31 17:41:34.0281 2164        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/08/31 17:41:34.0453 2164        perc2          (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/08/31 17:41:34.0484 2164        perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/08/31 17:41:34.0562 2164        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/31 17:41:34.0593 2164        Processor      (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/08/31 17:41:34.0625 2164        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/31 17:41:34.0656 2164        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/31 17:41:34.0718 2164        PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/31 17:41:34.0734 2164        ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/08/31 17:41:34.0765 2164        Ql10wnt        (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/08/31 17:41:34.0796 2164        ql12160        (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/08/31 17:41:34.0812 2164        ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/08/31 17:41:34.0843 2164        ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/08/31 17:41:34.0875 2164        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/31 17:41:34.0937 2164        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/31 17:41:34.0953 2164        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/31 17:41:34.0984 2164        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/31 17:41:35.0015 2164        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/31 17:41:35.0046 2164        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/31 17:41:35.0125 2164        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/31 17:41:35.0218 2164        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/31 17:41:35.0296 2164        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/31 17:41:35.0390 2164        RTL8023xp      (7f0413bdd7d53eb4c7a371e7f6f84df1) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
2011/08/31 17:41:35.0468 2164        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/08/31 17:41:35.0515 2164        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/31 17:41:35.0578 2164        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
2011/08/31 17:41:35.0640 2164        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/31 17:41:35.0718 2164        sisagp          (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/08/31 17:41:35.0765 2164        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/31 17:41:35.0812 2164        Sparrow        (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/08/31 17:41:35.0875 2164        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/31 17:41:35.0921 2164        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/31 17:41:36.0000 2164        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/31 17:41:36.0062 2164        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/08/31 17:41:36.0156 2164        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/31 17:41:36.0218 2164        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/31 17:41:36.0265 2164        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/31 17:41:36.0359 2164        symc810        (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/08/31 17:41:36.0406 2164        symc8xx        (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/08/31 17:41:36.0453 2164        sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/08/31 17:41:36.0484 2164        sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/08/31 17:41:36.0562 2164        SynTP          (b47954850ab7eab09961df08cc747852) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/08/31 17:41:36.0625 2164        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/31 17:41:36.0734 2164        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/31 17:41:36.0765 2164        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/31 17:41:36.0828 2164        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/31 17:41:36.0906 2164        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/31 17:41:37.0015 2164        tifm21          (046ea1353dd599dac9abdcd13504b06c) C:\WINDOWS\system32\drivers\tifm21.sys
2011/08/31 17:41:37.0062 2164        TosIde          (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/08/31 17:41:37.0156 2164        TridVid        (fa76138a8015e9c14542ad6bd2ad6d4b) C:\WINDOWS\system32\DRIVERS\TridVid.sys
2011/08/31 17:41:37.0234 2164        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/31 17:41:37.0281 2164        ultra          (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/08/31 17:41:37.0359 2164        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/31 17:41:37.0468 2164        upperdev        (ec01da44b090d2651fc032c8b9257232) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/08/31 17:41:37.0562 2164        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/31 17:41:37.0609 2164        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/31 17:41:37.0687 2164        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/31 17:41:37.0750 2164        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/31 17:41:37.0796 2164        usbohci        (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/08/31 17:41:37.0859 2164        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/31 17:41:37.0906 2164        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/31 17:41:37.0984 2164        usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/08/31 17:41:38.0062 2164        UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/08/31 17:41:38.0125 2164        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/31 17:41:38.0171 2164        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/31 17:41:38.0234 2164        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/31 17:41:38.0265 2164        viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/08/31 17:41:38.0312 2164        ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/08/31 17:41:38.0343 2164        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/31 17:41:38.0500 2164        w29n51          (c89da341fcc883a3d79dc11727484fc2) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2011/08/31 17:41:38.0718 2164        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/31 17:41:38.0781 2164        wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2011/08/31 17:41:38.0828 2164        wceusbsh        (2e8ba025d65dd49d15ea66973e2a15df) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2011/08/31 17:41:38.0890 2164        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/08/31 17:41:39.0015 2164        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/31 17:41:39.0125 2164        winachsf        (59d043485a6eda2ed2685c81489ae5bd) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/08/31 17:41:39.0296 2164        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/08/31 17:41:39.0359 2164        WS2IFSL        (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/08/31 17:41:39.0421 2164        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/31 17:41:39.0500 2164        WudfPf          (50eb9e21963b4f06fd010d007d54351b) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/31 17:41:39.0578 2164        WudfRd          (6e209664bdea8a15b5e8e480d6c607c2) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/31 17:41:39.0671 2164        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/08/31 17:41:39.0859 2164        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR2
2011/08/31 17:41:39.0890 2164        Boot (0x1200)  (abb922844b9e07469eeaec194750ccbd) \Device\Harddisk0\DR0\Partition0
2011/08/31 17:41:39.0921 2164        Boot (0x1200)  (de82ebab7c67ae63c7bfbfe90878740d) \Device\Harddisk1\DR2\Partition0
2011/08/31 17:41:39.0937 2164        ================================================================================
2011/08/31 17:41:39.0937 2164        Scan finished
2011/08/31 17:41:39.0937 2164        ================================================================================
2011/08/31 17:41:39.0953 3888        Detected object count: 0
2011/08/31 17:41:39.0953 3888        Actual detected object count: 0
2011/08/31 17:41:49.0859 0400        Deinitialize success
Habe auch noch ein Scan mit GMER gemacht:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-09-01 12:31:09
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST9160821A rev.3.ALA
Running: up17z5mu.exe; Driver: C:\DOKUME~1\**USERNAME**\LOKALE~1\Temp\pxldqpog.sys


---- System - GMER 1.0.15 ----

SSDT  F7BFDD8C                                ZwClose
SSDT  F7BFDD46                                ZwCreateKey
SSDT  F7BFDD96                                ZwCreateSection
SSDT  F7BFDD3C                                ZwCreateThread
SSDT  F7BFDD4B                                ZwDeleteKey
SSDT  F7BFDD55                                ZwDeleteValueKey
SSDT  F7BFDD87                                ZwDuplicateObject
SSDT  F7BFDD5A                                ZwLoadKey
SSDT  F7BFDD28                                ZwOpenProcess
SSDT  F7BFDD2D                                ZwOpenThread
SSDT  F7BFDD64                                ZwReplaceKey
SSDT  F7BFDD5F                                ZwRestoreKey
SSDT  F7BFDD9B                                ZwSetContextThread
SSDT  F7BFDD50                                ZwSetValueKey
SSDT  F7BFDD37                                ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

init  C:\WINDOWS\system32\drivers\tifm21.sys  entry point in "init" section [0xF6A2DDBF]

---- EOF - GMER 1.0.15 ----

cosinus 01.09.2011 14:58
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

ChronoJon 01.09.2011 15:41
Combo-Fix Log:
Code:
ComboFix 11-09-01.02 - Bernie 01.09.2011  16:21:37.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1015.604 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Bernie\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Bernie\Anwendungsdaten\ACD Systems\ACDSee\ImageDB.ddf
c:\dokumente und einstellungen\Bernie\WINDOWS
c:\windows\IsUn0407.exe
c:\windows\system32\CddbCdda.dll
c:\windows\system32\comct332.ocx
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-01 bis 2011-09-01  ))))))))))))))))))))))))))))))
.
.
2011-08-31 14:44 . 2011-08-31 14:44        --------        d-----w-        C:\_OTL
2011-08-30 14:36 . 2011-08-30 14:36        --------        d-----w-        c:\programme\ESET
2011-08-29 14:55 . 2011-08-29 14:55        --------        d-----w-        c:\programme\7-Zip
2011-08-26 13:15 . 2011-08-26 13:15        --------        d-----w-        c:\dokumente und einstellungen\Bernie\Anwendungsdaten\Malwarebytes
2011-08-26 13:15 . 2011-07-06 17:52        41272        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-26 13:15 . 2011-08-26 13:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-08-26 13:15 . 2011-08-26 17:07        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2011-08-22 19:03 . 2011-08-22 19:03        --------        d-----w-        c:\dokumente und einstellungen\Bernie\Anwendungsdaten\OpenOffice.org
2011-08-22 18:52 . 2011-08-22 18:52        --------        d-----w-        c:\programme\OpenOffice.org 3
2011-08-22 18:51 . 2011-05-04 02:52        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-08-21 07:43 . 2011-08-21 07:43        --------        d-----w-        c:\programme\Panasonic
2011-08-16 15:16 . 2011-08-16 15:16        --------        d-----w-        c:\dokumente und einstellungen\Besitzer
2011-08-14 19:22 . 2011-08-14 19:22        --------        d-----w-        c:\dokumente und einstellungen\Bernie\Anwendungsdaten\GARMIN
2011-08-14 11:08 . 2011-08-14 11:08        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nokia
2011-08-14 11:02 . 2011-08-14 11:08        --------        d-----w-        c:\dokumente und einstellungen\Bernie\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
2011-08-14 10:38 . 2008-08-26 08:26        18816        ----a-w-        c:\windows\system32\drivers\pccsmcfd.sys
2011-08-14 10:38 . 2011-08-14 10:38        --------        d-----w-        c:\programme\PC Connectivity Solution
2011-08-14 10:37 . 2011-05-18 08:12        8192        ----a-w-        c:\windows\system32\drivers\usbser_lowerfltj.sys
2011-08-14 10:37 . 2011-05-18 08:12        8192        ----a-w-        c:\windows\system32\drivers\usbser_lowerflt.sys
2011-08-14 10:37 . 2011-05-18 08:12        23168        ----a-w-        c:\windows\system32\drivers\ccdcmbo.sys
2011-08-14 10:37 . 2011-05-18 08:13        123904        ----a-w-        c:\windows\system32\ccdcmbwu.dll
2011-08-14 10:37 . 2011-05-18 08:13        605696        ----a-w-        c:\windows\system32\nmwcdcocls.dll
2011-08-14 10:37 . 2011-05-18 08:12        18176        ----a-w-        c:\windows\system32\drivers\ccdcmb.sys
2011-08-14 10:37 . 2011-05-18 08:09        1461992        ----a-w-        c:\windows\system32\wdfcoinstaller01009.dll
2011-08-10 18:01 . 2011-06-24 14:10        139656        ------w-        c:\windows\system32\dllcache\rdpwd.sys
2011-08-10 18:00 . 2011-07-08 14:02        10496        ------w-        c:\windows\system32\dllcache\ndistapi.sys
2011-08-08 07:22 . 2008-04-14 00:52        32000        ----a-w-        c:\windows\system32\drivers\wceusbsh.sys
2011-08-08 07:22 . 2008-04-14 00:52        32000        ----a-w-        c:\windows\system32\dllcache\wceusbsh.sys
2011-08-07 18:26 . 2011-08-07 18:26        --------        d-----w-        c:\dokumente und einstellungen\Bernie\Lokale Einstellungen\Anwendungsdaten\Mozilla
2011-08-07 18:13 . 2011-08-14 12:50        --------        d-----w-        c:\dokumente und einstellungen\Bernie\Anwendungsdaten\Dream Aquarium
2011-08-04 10:39 . 2011-08-14 18:09        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\boost_interprocess
2011-08-02 17:27 . 2008-04-13 16:44        2560        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\USMT\iconlib.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-20 06:26 . 2011-05-24 15:44        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2004-08-11 16:47        456320        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2011-07-13 08:23 . 2010-04-26 18:49        66616        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2011-07-13 08:23 . 2010-04-26 18:49        138192        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2011-07-08 14:02 . 2004-08-11 16:47        10496        ----a-w-        c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2004-08-11 17:02        139656        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2004-08-11 16:48        916480        ----a-w-        c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2004-08-11 16:47        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2004-08-11 16:47        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-11 16:47        385024        ----a-w-        c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-11 16:48        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2004-08-11 16:47        1859072        ----a-w-        c:\windows\system32\win32k.sys
2011-08-31 11:35 . 2011-08-08 14:38        134104        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
2004-08-04 12:00        94800        --sh--w-        c:\windows\twain.dll
2008-04-14 02:22        50688        --sh--w-        c:\windows\twain_32.dll
2011-02-08 13:33        978944        --sha-w-        c:\windows\system32\mfc42.dll
2008-04-14 02:22        57344        --sh--w-        c:\windows\system32\msvcirt.dll
2008-04-14 02:22        413696        --sha-w-        c:\windows\system32\msvcp60.dll
2008-04-14 02:22        343040        --sha-w-        c:\windows\system32\msvcrt.dll
2010-12-20 17:32        551936        --sh--w-        c:\windows\system32\oleaut32.dll
2008-04-14 02:22        84992        --sh--w-        c:\windows\system32\olepro32.dll
2008-04-14 02:22        12288        --sh--w-        c:\windows\system32\regsvr32.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-11-17 975360]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2011-08-04 966712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-05-04 14396416]
"AzMixerSel"="c:\programme\Realtek\InstallShield\AzMixerSel.exe" [2005-04-26 45056]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-08-24 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-08-24 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-08-24 114688]
"DetectorApp"="c:\programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
"ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"CXMon"="c:\programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-08-09 49152]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2006-09-29 98304]
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"Symantec PIF AlertEng"="c:\programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SVRemote"="c:\program files\SVRemote\USB20Remote.exe" [2007-01-26 24576]
"WinDVR SchSvr"="c:\programme\Gemeinsame Dateien\InterVideo\SchSvr\SchSvr.exe" [2005-08-15 106496]
"WinRemote"="c:\programme\InterVideo\WinDVR3\WinRemote.exe" [2005-08-15 208896]
"Nokia FastStart"="c:\programme\Nokia\Nokia Music\NokiaMusic.exe" [2009-02-26 2376992]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]
"ApnUpdater"="c:\programme\Ask.com\Updater\Updater.exe" [2011-07-09 397992]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Bernie\Startmen\Programme\Autostart\
OpenOffice.org 3.3.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
InterVideo WinCinema Manager.lnk - c:\programme\InterVideo\Common\Bin\WinCinemaMgr.exe [2009-4-24 208896]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Programme\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Programme\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
.
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [26.04.2010 20:49 136360]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [13.07.2011 10:24 428200]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\programme\Symantec\LiveUpdate\AluSchedulerSvc.exe [17.12.2006 00:13 100032]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [11.02.2010 20:18 135664]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [26.08.2011 15:15 366640]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys --> c:\windows\system32\DRIVERS\ewusbnet.sys [?]
S3 glauiad;Lucent USB IAD LAN Modem;c:\windows\system32\drivers\glauiad.sys [16.12.2006 21:40 30373]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [11.02.2010 20:18 135664]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\pfc027.sys [08.04.2005 11:46 162176]
S3 TridVid;SinoVideo Analog Video;c:\windows\system32\drivers\TridVid.sys [24.04.2009 12:20 75264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 17:02        114688        ----a-w-        c:\programme\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-11 18:18]
.
2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-11 18:18]
.
2011-09-01 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programme\Ask.com\UpdateTask.exe [2011-07-09 05:13]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.arcor.de/
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
DPF: {FA81E151-CFE7-4B18-8B9E-8B96E62BAC11} - hxxps://de.web.sonynetservices.com/portal/applets/DownloadManager.cab
FF - ProfilePath - c:\dokumente und einstellungen\Bernie\Anwendungsdaten\Mozilla\Firefox\Profiles\f50jem8k.default\
FF - prefs.js: browser.startup.homepage - www.hamburg-magazin.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SweetIM - c:\programme\Macrogaming\SweetIM\SweetIM.exe
AddRemove-Ad-Aware SE Personal - e:\progra~1\Lavasoft\AD-AWA~1\UNWISE.EXE
AddRemove-Adobe Acrobat 5.0 - c:\windows\ISUN0407.EXE
AddRemove-Easy-WebPrint - c:\windows\IsUn0407.exe
AddRemove-HP Fotobearbeitungs-Programm - c:\windows\IsUn0407.exe
AddRemove-HP Fotodruck-Programm - c:\windows\IsUn0407.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-01 16:28
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
"ImagePath"="\"c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\02\00\00\00@
[%\00«Ô’|\00\00\00\00(n3\03\00\00\00\00\00T3\03\00\00,\03pè\13\00pè\13\00À\01"
.
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(696)
c:\programme\Avira\AntiVir Desktop\avsda.dll
.
Zeit der Fertigstellung: 2011-09-01  16:30:15
ComboFix-quarantined-files.txt  2011-09-01 14:30
.
Vor Suchlauf: 16 Verzeichnis(se), 136.702.918.656 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 136.790.564.864 Bytes frei
.
- - End Of File - - CE69D8BFEB1FDCD458DFE1AA8AB61913

cosinus 01.09.2011 15:53
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!


Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

ChronoJon 02.09.2011 17:33
GMER:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-09-02 16:09:02
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST9160821A rev.3.ALA
Running: up17z5mu.exe; Driver: C:\DOKUME~1\Bernie\LOKALE~1\Temp\pxldqpog.sys


---- System - GMER 1.0.15 ----

SSDT  F7BEE81C                                  ZwClose
SSDT  F7BEE7D6                                  ZwCreateKey
SSDT  F7BEE826                                  ZwCreateSection
SSDT  F7BEE7CC                                  ZwCreateThread
SSDT  F7BEE7DB                                  ZwDeleteKey
SSDT  F7BEE7E5                                  ZwDeleteValueKey
SSDT  F7BEE817                                  ZwDuplicateObject
SSDT  F7BEE7EA                                  ZwLoadKey
SSDT  F7BEE7B8                                  ZwOpenProcess
SSDT  F7BEE7BD                                  ZwOpenThread
SSDT  F7BEE7F4                                  ZwReplaceKey
SSDT  F7BEE7EF                                  ZwRestoreKey
SSDT  F7BEE82B                                  ZwSetContextThread
SSDT  F7BEE7E0                                  ZwSetValueKey
SSDT  F7BEE7C7                                  ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text  ntoskrnl.exe!_abnormal_termination + B0  804E271C 4 Bytes  [1C, E8, BE, F7]
.text  ntoskrnl.exe!_abnormal_termination + 114  804E2780 4 Bytes  [26, E8, BE, F7]
.text  ntoskrnl.exe!_abnormal_termination + 15C  804E27C8 4 Bytes  [17, E8, BE, F7]
.text  ntoskrnl.exe!_abnormal_termination + 1D4  804E2840 4 Bytes  [EA, E7, BE, F7]
.text  ntoskrnl.exe!_abnormal_termination + 3A0  804E2A0C 4 Bytes  [2B, E8, BE, F7]
init  C:\WINDOWS\system32\drivers\tifm21.sys    entry point in "init" section [0xF6AB3DBF]
?      System32\Drivers\hiber_WMILIB.SYS        Das System kann den angegebenen Pfad nicht finden. !

---- EOF - GMER 1.0.15 ----
OSAM:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:58:22 on 02.09.2011

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 6.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Scheduled Update for Ask Toolbar.job" - ? - C:\Programme\Ask.com\UpdateTask.exe  (File found, but it contains no detailed information)

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\WINDOWS\system32\ISUSPM.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"prefscpl.cpl" - "RealNetworks, Inc." - C:\WINDOWS\system32\prefscpl.cpl
"QuickTime.cpl" - "Apple Computer, Inc." - C:\WINDOWS\system32\QuickTime.cpl
"SETUPPC.CPL" - "NEC Computers International" - C:\WINDOWS\system32\SETUPPC.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"NokiaConnectionManager" - ? - E:\NOKIAN~1\NOKIAP~1\CONNEC~1.CPL  (File not found)
"SYMLIVE" - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\S32LUCP1.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASCTRM" (ASCTRM) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\system32\drivers\ASCTRM.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"BVRPMPR5 NDIS Protocol Driver" (BVRPMPR5) - "BVRP Software" - C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
"catchme" (catchme) - ? - C:\DOKUME~1\Bernie\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys  (File not found)
"Huawei DataCard USB PNP Device" (hwusbdev) - ? - C:\WINDOWS\System32\DRIVERS\ewusbdev.sys  (File not found)
"HUAWEI USB-NDIS miniport" (ewusbnet) - ? - C:\WINDOWS\System32\DRIVERS\ewusbnet.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"Lucent USB IAD LAN Modem" (glauiad) - "GlobespanVirata Inc." - C:\WINDOWS\System32\DRIVERS\glauiad.sys
"MBAMProtector" (MBAMProtector) - ? - C:\WINDOWS\system32\drivers\mbam.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"SinoVideo Analog Video" (TridVid) - "Trident Multimedia Technologies Co.,Ltd" - C:\WINDOWS\System32\DRIVERS\TridVid.sys
"SoC PC-Camera" (PAC207) - ? - C:\WINDOWS\System32\DRIVERS\pfc027.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} "PixiePack Codec Pack 1.1.1200.0" - ? - C:\Programme\PixiePack Codec Pack\InstallerHelper.exe
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Yahoo! Toolbar" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{FA81E151-CFE7-4B18-8B9E-8B96E62BAC11} "DownloadManager" - "Vodafone" - C:\Programme\Vodafone\DownloadManager\DownloadManager.ocx / https://de.web.sonynetservices.com/portal/applets/DownloadManager.cab
Garmin Communicator Plug-In "Garmin Communicator Plug-In" - ? -  (File not found | COM-object registry key not found) / https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Programme\Spybot - Search & Destroy\SDHelper.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"InterVideo WinCinema Manager.lnk" - ? - C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Bernie\Startmenü\Programme\Autostart\desktop.ini
"OpenOffice.org 3.3.lnk" - ? - C:\Programme\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"NokiaOviSuite2" - "Nokia" - C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
"SmpcSys" - "Packard Bell BV" - C:\APPS\SMP\SmpSys.exe
"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Photo Downloader" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"ApnUpdater" - "{StringFileInfo_CompanyName}" - "C:\Programme\Ask.com\Updater\Updater.exe"
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"AzMixerSel" - "Realtek Semiconductor Corp." - C:\Programme\Realtek\InstallShield\AzMixerSel.exe
"CXMon" - "Hewlett-Packard Company" - "C:\Programme\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
"DetectorApp" - ? - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
"Easy-PrintToolBox" - "CANON INC." - C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
"ISUSPM Startup" - "InstallShield Software Corporation" - C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler" - "InstallShield Software Corporation" - "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
"Nokia FastStart" - "Nokia" - "C:\Programme\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
"NokiaMServer" - "Nokia" - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup
"Omnipage" - "ScanSoft, Inc" - C:\Programme\ScanSoft\OmniPageSE\opware32.exe
"PCMService" - "CyberLink Corp." - "c:\APPS\Powercinema\PCMService.exe"
"QuickTime Task" - "Apple Computer, Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"SVRemote" - ? - c:\Program Files\SVRemote\USB20Remote.exe
"Symantec PIF AlertEng" - "Symantec Corporation" - "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
"WinDVR SchSvr" - "InterVideo Inc." - "C:\Programme\Gemeinsame Dateien\InterVideo\SchSvr\SchSvr.exe"
"WinRemote" - ? - C:\Programme\InterVideo\WinDVR3\WinRemote.exe

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"AOL Connectivity Service" (AOL ACS) - "America Online, Inc." - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Automatisches LiveUpdate - Scheduler" (Automatisches LiveUpdate - Scheduler) - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
"CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
"CyberLink Media Library Service" (CyberLink Media Library Service) - "Cyberlink" - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
"CyberLink Task Scheduler (CTS)" (CLSched) - ? - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
"LiveUpdate Notice Service" (LiveUpdate Notice Service) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"STI Simulator" (STI Simulator) - ? - C:\WINDOWS\System32\PAStiSvc.exe  (File found, but it contains no detailed information)
"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
"USBDeviceService" (USBDeviceService) - ? - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"AVSDA" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avsda.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
aswMBR:
Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-02 18:00:28
-----------------------------
18:00:28.593    OS Version: Windows 5.1.2600 Service Pack 3
18:00:28.593    Number of processors: 1 586 0xD08
18:00:28.593    ComputerName: BERND  UserName:
18:00:29.078    Initialize success
18:16:13.046    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
18:16:13.046    Disk 0 Vendor: ST9160821A 3.ALA Size: 152627MB BusType: 3
18:16:15.093    Disk 0 MBR read successfully
18:16:15.093    Disk 0 MBR scan
18:16:15.093    Disk 0 Windows XP default MBR code
18:16:15.093    Disk 0 scanning sectors +312560640
18:16:15.171    Disk 0 scanning C:\WINDOWS\system32\drivers
18:16:26.843    Service scanning
18:16:28.296    Modules scanning
18:16:50.437    Disk 0 trace - called modules:
18:16:50.484    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
18:16:50.484    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f78ab8]
18:16:50.484    3 CLASSPNP.SYS[f7696fd7] -> nt!IofCallDriver -> \Device\000000a1[0x86fa78a8]
18:16:50.500    5 ACPI.sys[f758c620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86f33d98]
18:16:50.500    Scan finished successfully
18:20:50.140    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Bernie\Desktop\Logs\2\MBR.dat"
18:20:50.156    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Bernie\Desktop\Logs\2\aswMBR.txt"

cosinus 04.09.2011 12:45
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


ChronoJon 05.09.2011 18:44
MBAM hat nichts gefunden:
Code:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7656

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

05.09.2011 19:04:21
mbam-log-2011-09-05 (19-04-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 276301
Laufzeit: 45 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Dafür aber SuperAntispyware ...
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/04/2011 at 05:56 PM

Application Version : 5.0.1118

Core Rules Database Version : 7645
Trace Rules Database Version: 5457

Scan type      : Complete Scan
Total Scan Time : 01:45:31

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 678
Memory threats detected  : 0
Registry items scanned    : 37829
Registry threats detected : 0
File items scanned        : 137928
File threats detected    : 56

Adware.Tracking Cookie
        C:\Dokumente und Einstellungen\Bernie\Cookies\7YC6D57L.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\D6V97T81.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\QURCRWFT.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\8E52T23M.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\VAJZ3ZAH.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\KQ8W7S5P.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\PTPN3Q7F.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\NAFDX57P.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\3A3Q2EKG.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\KAHRNQX4.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\E1URWIEV.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\QDBGKTLP.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\OJUIXMMP.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\9DOGC8VR.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\HUBVT0MH.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\8BPON2HR.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\WZWSF1OA.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\TOSICWU0.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\06P5201F.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\1ZNSMU8C.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\Y761BSHI.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\Y5OE8N0X.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\Q5W3Z6MM.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\2GG17ZUY.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\GSUFGUSQ.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\NOS71HR2.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\302SHJR5.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\SGRA38KV.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\WAZSOPP5.txt
        C:\Dokumente und Einstellungen\Bernie\Cookies\MNDLXZJ5.txt
        .paypal.112.2o7.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\LOKALE EINSTELLUNGEN\ANWENDUNGSDATEN\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\DOKUMENTE UND EINSTELLUNGEN\BERNIE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\F50JEM8K.DEFAULT\COOKIES.SQLITE ]

Rootkit.Agent/Gen
        E:\PRIVAT\UTE\ALLGEMEIN\KLINIKEN.DOC
und ESET:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6aba623a80218c438ac436ab037f0700
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-30 04:44:55
# local_time=2011-08-30 06:44:55 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775141 100 93 10492 51252295 59569 0
# compatibility_mode=8192 67108863 100 0 448 448 0 0
# scanned=94386
# found=0
# cleaned=0
# scan_time=7259
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6aba623a80218c438ac436ab037f0700
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-05 01:46:59
# local_time=2011-09-05 03:46:59 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775141 100 93 77856 51759161 77199 0
# compatibility_mode=8192 67108863 100 0 507314 507314 0 0
# scanned=97401
# found=3
# cleaned=0
# scan_time=8116
C:\System Volume Information\_restore{66234F2B-C93E-4D94-8BDB-1899CBBA9319}\RP590\A0062127.exe        a variant of Win32/Kryptik.SCP trojan (unable to clean)        00000000000000000000000000000000        I
C:\System Volume Information\_restore{66234F2B-C93E-4D94-8BDB-1899CBBA9319}\RP590\A0062146.exe        a variant of Win32/Kryptik.SCP trojan (unable to clean)        00000000000000000000000000000000        I
C:\System Volume Information\_restore{66234F2B-C93E-4D94-8BDB-1899CBBA9319}\RP590\A0062147.exe        a variant of Win32/Kryptik.SCP trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 05.09.2011 22:02
Nur Cookies und ein paar Überreste. SuperantiSpyware hat sich wohl einen Fehlalarm geleistet.
Rechner soweit wieder im Lot?

ChronoJon 07.09.2011 10:11
Läuft alles wieder rund. Ich bin wirklich sehr, sehr dankbar für die Hilfe. :dankeschoen:
Gilt natürlich auch für meinen Stiefvater!
Auf mich allein gestellt, hätte ich wahrscheinlich nur TDSS-Killer laufen lassen, Daten gesichert und Windows neu drauf gemacht, wäre mir aber unsicher gewesen, ob dabei etwas über geblieben wäre.
Also nochmal vielen Dank.

cosinus 07.09.2011 10:40
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:34 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131