Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   gema und bka trojaner entfernt, aber ..... (https://www.trojaner-board.de/111438-gema-bka-trojaner-entfernt.html)

hoelschi 14.03.2012 01:00
gema und bka trojaner entfernt, aber .....
 
Laptop Windows XP Service Pack 3

Hallo, ich habe mir am Wochenende den BKA und den Gema Trojaner eingefangen. Den Gema Trojaner konnte man halbwegs per Hand entfernen, aber dann war auf einmal der Task Manager gesperrt und ich konnte keine Software mehr installieren. Als habe ich Malwarebytes laufen lassen und einiges entfern. Task Manager geht wieder, aber ich bin mir nicht sicher, obe der Rechner ausber ist (siehe Anhang).

Zur Sicherheit wollte ich dann Eure berühmten 3 Schritte durchführen.

Defogger hat nichts gefunden. Wann darf ich wieder Re-enable drücken?

DDS funktioniert nicht. Weder die eine, noch die andere Quelle. Es öffnet sich nur ein DOS-Fenster mit einigen Erläuterungen, so z.B., dass der Vorgang maximal drei Minuten dauert. Dann springt der Cursor eine Zeile tiefer und es erscheinen zwei Rautesymbole. Das war es dann. Kein PopUp, kein Scan, nichts.

Also habe ich Schritt 3 ausgeführt und Gmer laufen lassen.

Log:GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-14 00:42:14
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-11 Hitachi_HTS722020K9SA00 rev.DC4OC54P
Running: 1jgl2gto.exe; Driver: C:\DOKUME~1\RMHCON~1\LOKALE~1\Temp\kwlcafod.sys


---- System - GMER 1.0.15 ----

SSDT            F7AA6156                                                                                                                                          ZwCreateKey
SSDT            F7AA614C                                                                                                                                          ZwCreateThread
SSDT            F7AA615B                                                                                                                                          ZwDeleteKey
SSDT            F7AA6165                                                                                                                                          ZwDeleteValueKey
SSDT            F7AA616A                                                                                                                                          ZwLoadKey
SSDT            F7AA6138                                                                                                                                          ZwOpenProcess
SSDT            F7AA613D                                                                                                                                          ZwOpenThread
SSDT            F7AA6174                                                                                                                                          ZwReplaceKey
SSDT            F7AA616F                                                                                                                                          ZwRestoreKey
SSDT            F7AA6160                                                                                                                                          ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                                          section is writeable [0xB97DE360, 0x3074E7, 0xE8000020]
.vmp2          C:\WINDOWS\system32\drivers\acedrv11.sys                                                                                                          entry point in ".vmp2" section [0xB4B4169D]

---- User code sections - GMER 1.0.15 ----

.text          C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe[164] kernel32.dll!CreateProcessW                                                                      7C802336 5 Bytes  JMP 01051642
.text          C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe[164] kernel32.dll!CreateProcessA                                                                      7C80236B 5 Bytes  JMP 0105152C
.text          C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe[164] ADVAPI32.dll!CreateProcessAsUserW                                                                77DBA8A9 5 Bytes  JMP 01051871
.text          C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe[164] ADVAPI32.dll!CreateProcessAsUserA                                                                77DE0CE8 5 Bytes  JMP 01051758
.text          C:\Programme\Synaptics\SynTP\SynTPEnh.exe[180] kernel32.dll!CreateProcessW                                                                        7C802336 5 Bytes  JMP 01501642
.text          C:\Programme\Synaptics\SynTP\SynTPEnh.exe[180] kernel32.dll!CreateProcessA                                                                        7C80236B 5 Bytes  JMP 0150152C
.text          C:\Programme\Synaptics\SynTP\SynTPEnh.exe[180] ADVAPI32.dll!CreateProcessAsUserW                                                                  77DBA8A9 5 Bytes  JMP 01501871
.text          C:\Programme\Synaptics\SynTP\SynTPEnh.exe[180] ADVAPI32.dll!CreateProcessAsUserA                                                                  77DE0CE8 5 Bytes  JMP 01501758
.text          C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[464] kernel32.dll!CreateProcessW                                                      7C802336 5 Bytes  JMP 01411642
.text          C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[464] kernel32.dll!CreateProcessA                                                      7C80236B 5 Bytes  JMP 0141152C
.text          C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[464] ADVAPI32.dll!CreateProcessAsUserW                                                77DBA8A9 5 Bytes  JMP 01411871
.text          C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[464] ADVAPI32.dll!CreateProcessAsUserA                                                77DE0CE8 5 Bytes  JMP 01411758
.text          C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[572] kernel32.dll!CreateProcessW                                                      7C802336 5 Bytes  JMP 00FC1642
.text          C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[572] kernel32.dll!CreateProcessA                                                      7C80236B 5 Bytes  JMP 00FC152C
.text          C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[572] ADVAPI32.dll!CreateProcessAsUserW                                                77DBA8A9 5 Bytes  JMP 00FC1871
.text          C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[572] ADVAPI32.dll!CreateProcessAsUserA                                                77DE0CE8 5 Bytes  JMP 00FC1758
.text          C:\WINDOWS\BisonCam\InitDriverx86.exe[600] kernel32.dll!CreateProcessW                                                                            7C802336 5 Bytes  JMP 01001642
.text          C:\WINDOWS\BisonCam\InitDriverx86.exe[600] kernel32.dll!CreateProcessA                                                                            7C80236B 5 Bytes  JMP 0100152C
.text          C:\WINDOWS\BisonCam\InitDriverx86.exe[600] ADVAPI32.dll!CreateProcessAsUserW                                                                      77DBA8A9 5 Bytes  JMP 01001871
.text          C:\WINDOWS\BisonCam\InitDriverx86.exe[600] ADVAPI32.dll!CreateProcessAsUserA                                                                      77DE0CE8 5 Bytes  JMP 01001758
.text          C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe[608] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 07271642
.text          C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe[608] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 0727152C
.text          C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe[608] ADVAPI32.dll!CreateProcessAsUserW                                          77DBA8A9 5 Bytes  JMP 07271871
.text          C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe[608] ADVAPI32.dll!CreateProcessAsUserA                                          77DE0CE8 5 Bytes  JMP 07271758
.text          C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe[660] kernel32.dll!CreateProcessW                                                                          7C802336 5 Bytes  JMP 07011642
.text          C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe[660] kernel32.dll!CreateProcessA                                                                          7C80236B 5 Bytes  JMP 0701152C
.text          C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe[660] ADVAPI32.dll!CreateProcessAsUserW                                                                    77DBA8A9 5 Bytes  JMP 07011871
.text          C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe[660] ADVAPI32.dll!CreateProcessAsUserA                                                                    77DE0CE8 5 Bytes  JMP 07011758
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] kernel32.dll!CreateProcessW                                                                      7C802336 5 Bytes  JMP 011E1642
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] kernel32.dll!CreateProcessA                                                                      7C80236B 5 Bytes  JMP 011E152C
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] ADVAPI32.dll!CreateProcessAsUserW                                                                77DBA8A9 5 Bytes  JMP 011E1871
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] ADVAPI32.dll!CreateProcessAsUserA                                                                77DE0CE8 5 Bytes  JMP 011E1758
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!DialogBoxParamW                                                                      7E3747AB 5 Bytes  JMP 411954D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!SetWindowsHookExW                                                                    7E37820F 5 Bytes  JMP 41269AD1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!CallNextHookEx                                                                        7E37B3C6 5 Bytes  JMP 4125D10D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!CreateWindowExW                                                                      7E37D0A3 5 Bytes  JMP 4126DB44 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!UnhookWindowsHookEx                                                                  7E37D5F3 5 Bytes  JMP 411D464E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!DialogBoxIndirectParamW                                                              7E382072 5 Bytes  JMP 41365397 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!MessageBoxIndirectA                                                                  7E38A082 5 Bytes  JMP 413652C9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!DialogBoxParamA                                                                      7E38B144 5 Bytes  JMP 41365334 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!MessageBoxExW                                                                        7E3A0838 5 Bytes  JMP 4136519A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!MessageBoxExA                                                                        7E3A085C 5 Bytes  JMP 413651FC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!DialogBoxIndirectParamA                                                              7E3A6D7D 5 Bytes  JMP 413653FA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] USER32.dll!MessageBoxIndirectW                                                                  7E3B64D5 5 Bytes  JMP 4136525E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] ole32.dll!CoCreateInstance                                                                      774CF1AC 5 Bytes  JMP 4126DBA0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] ole32.dll!OleLoadFromStream                                                                      774F981B 5 Bytes  JMP 413656FF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] WS2_32.dll!closesocket                                                                          71A13E2B 5 Bytes  JMP 02518F70
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] WS2_32.dll!connect                                                                              71A14A07 5 Bytes  JMP 02518CE0
.text          C:\Programme\Internet Explorer\iexplore.exe[1524] WS2_32.dll!getpeername                                                                          71A20B68 5 Bytes  JMP 02518F00
.text          C:\WINDOWS\RTHDCPL.EXE[1660] kernel32.dll!CreateProcessW                                                                                          7C802336 5 Bytes  JMP 053A1642
.text          C:\WINDOWS\RTHDCPL.EXE[1660] kernel32.dll!CreateProcessA                                                                                          7C80236B 5 Bytes  JMP 053A152C
.text          C:\WINDOWS\RTHDCPL.EXE[1660] ADVAPI32.dll!CreateProcessAsUserW                                                                                    77DBA8A9 5 Bytes  JMP 053A1871
.text          C:\WINDOWS\RTHDCPL.EXE[1660] ADVAPI32.dll!CreateProcessAsUserA                                                                                    77DE0CE8 5 Bytes  JMP 053A1758
.text          C:\WINDOWS\MHotkey.exe[2576] kernel32.dll!CreateProcessW                                                                                          7C802336 5 Bytes  JMP 01301642
.text          C:\WINDOWS\MHotkey.exe[2576] kernel32.dll!CreateProcessA                                                                                          7C80236B 5 Bytes  JMP 0130152C
.text          C:\WINDOWS\MHotkey.exe[2576] ADVAPI32.dll!CreateProcessAsUserW                                                                                    77DBA8A9 5 Bytes  JMP 01301871
.text          C:\WINDOWS\MHotkey.exe[2576] ADVAPI32.dll!CreateProcessAsUserA                                                                                    77DE0CE8 5 Bytes  JMP 01301758
.text          C:\programme\real\realplayer\update\realsched.exe[2756] kernel32.dll!CreateProcessW                                                                7C802336 5 Bytes  JMP 01781642
.text          C:\programme\real\realplayer\update\realsched.exe[2756] kernel32.dll!CreateProcessA                                                                7C80236B 5 Bytes  JMP 0178152C
.text          C:\programme\real\realplayer\update\realsched.exe[2756] kernel32.dll!SetUnhandledExceptionFilter                                                  7C84495D 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text          C:\programme\real\realplayer\update\realsched.exe[2756] ADVAPI32.dll!CreateProcessAsUserW                                                          77DBA8A9 5 Bytes  JMP 01781871
.text          C:\programme\real\realplayer\update\realsched.exe[2756] ADVAPI32.dll!CreateProcessAsUserA                                                          77DE0CE8 5 Bytes  JMP 01781758
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[2768] kernel32.dll!CreateProcessW        7C802336 5 Bytes  JMP 03A61642
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[2768] kernel32.dll!CreateProcessA        7C80236B 5 Bytes  JMP 03A6152C
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[2768] ADVAPI32.dll!CreateProcessAsUserW  77DBA8A9 5 Bytes  JMP 03A61871
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[2768] ADVAPI32.dll!CreateProcessAsUserA  77DE0CE8 5 Bytes  JMP 03A61758
.text          C:\WINDOWS\BisonCam\BisonHK.exe[2844] kernel32.dll!CreateProcessW                                                                                  7C802336 5 Bytes  JMP 00F41642
.text          C:\WINDOWS\BisonCam\BisonHK.exe[2844] kernel32.dll!CreateProcessA                                                                                  7C80236B 5 Bytes  JMP 00F4152C
.text          C:\WINDOWS\BisonCam\BisonHK.exe[2844] ADVAPI32.dll!CreateProcessAsUserW                                                                            77DBA8A9 5 Bytes  JMP 00F41871
.text          C:\WINDOWS\BisonCam\BisonHK.exe[2844] ADVAPI32.dll!CreateProcessAsUserA                                                                            77DE0CE8 5 Bytes  JMP 00F41758
.text          C:\WINDOWS\system32\wbem\unsecapp.exe[3256] kernel32.dll!CreateProcessW                                                                            7C802336 5 Bytes  JMP 017A1642
.text          C:\WINDOWS\system32\wbem\unsecapp.exe[3256] kernel32.dll!CreateProcessA                                                                            7C80236B 5 Bytes  JMP 017A152C
.text          C:\WINDOWS\system32\wbem\unsecapp.exe[3256] ADVAPI32.dll!CreateProcessAsUserW                                                                      77DBA8A9 5 Bytes  JMP 017A1871
.text          C:\WINDOWS\system32\wbem\unsecapp.exe[3256] ADVAPI32.dll!CreateProcessAsUserA                                                                      77DE0CE8 5 Bytes  JMP 017A1758
.text          C:\WINDOWS\BisonCam\BsMnt.exe[3288] kernel32.dll!CreateProcessW                                                                                    7C802336 5 Bytes  JMP 01321642
.text          C:\WINDOWS\BisonCam\BsMnt.exe[3288] kernel32.dll!CreateProcessA                                                                                    7C80236B 5 Bytes  JMP 0132152C
.text          C:\WINDOWS\BisonCam\BsMnt.exe[3288] ADVAPI32.dll!CreateProcessAsUserW                                                                              77DBA8A9 5 Bytes  JMP 01321871
.text          C:\WINDOWS\BisonCam\BsMnt.exe[3288] ADVAPI32.dll!CreateProcessAsUserA                                                                              77DE0CE8 5 Bytes  JMP 01321758
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] kernel32.dll!CreateProcessW                                                                      7C802336 5 Bytes  JMP 00FC1642
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] kernel32.dll!CreateProcessA                                                                      7C80236B 5 Bytes  JMP 00FC152C
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] ADVAPI32.dll!CreateProcessAsUserW                                                                77DBA8A9 5 Bytes  JMP 00FC1871
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] ADVAPI32.dll!CreateProcessAsUserA                                                                77DE0CE8 5 Bytes  JMP 00FC1758
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!DialogBoxParamW                                                                      7E3747AB 5 Bytes  JMP 411954D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!CreateWindowExW                                                                      7E37D0A3 5 Bytes  JMP 4126DB44 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!DialogBoxIndirectParamW                                                              7E382072 5 Bytes  JMP 41365397 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!MessageBoxIndirectA                                                                  7E38A082 5 Bytes  JMP 413652C9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!DialogBoxParamA                                                                      7E38B144 5 Bytes  JMP 41365334 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!MessageBoxExW                                                                        7E3A0838 5 Bytes  JMP 4136519A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!MessageBoxExA                                                                        7E3A085C 5 Bytes  JMP 413651FC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!DialogBoxIndirectParamA                                                              7E3A6D7D 5 Bytes  JMP 413653FA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] USER32.dll!MessageBoxIndirectW                                                                  7E3B64D5 5 Bytes  JMP 4136525E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] WS2_32.dll!closesocket                                                                          71A13E2B 5 Bytes  JMP 016E8F70
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] WS2_32.dll!connect                                                                              71A14A07 5 Bytes  JMP 016E8CE0
.text          C:\Programme\Internet Explorer\iexplore.exe[3476] WS2_32.dll!getpeername                                                                          71A20B68 5 Bytes  JMP 016E8F00
.text          C:\WINDOWS\Explorer.EXE[3512] kernel32.dll!CreateProcessW                                                                                          7C802336 5 Bytes  JMP 00E81642
.text          C:\WINDOWS\Explorer.EXE[3512] kernel32.dll!CreateProcessA                                                                                          7C80236B 5 Bytes  JMP 00E8152C
.text          C:\WINDOWS\Explorer.EXE[3512] ADVAPI32.dll!CreateProcessAsUserW                                                                                    77DBA8A9 5 Bytes  JMP 00E81871
.text          C:\WINDOWS\Explorer.EXE[3512] ADVAPI32.dll!CreateProcessAsUserA                                                                                    77DE0CE8 5 Bytes  JMP 00E81758
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[3576] kernel32.dll!CreateProcessW        7C802336 5 Bytes  JMP 01991642
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[3576] kernel32.dll!CreateProcessA        7C80236B 5 Bytes  JMP 0199152C
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[3576] ADVAPI32.dll!CreateProcessAsUserW  77DBA8A9 5 Bytes  JMP 01991871
.text          C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe[3576] ADVAPI32.dll!CreateProcessAsUserA  77DE0CE8 5 Bytes  JMP 01991758
.text          C:\WINDOWS\system32\ctfmon.exe[3664] kernel32.dll!CreateProcessW                                                                                  7C802336 5 Bytes  JMP 00FE1642
.text          C:\WINDOWS\system32\ctfmon.exe[3664] kernel32.dll!CreateProcessA                                                                                  7C80236B 5 Bytes  JMP 00FE152C
.text          C:\WINDOWS\system32\ctfmon.exe[3664] ADVAPI32.dll!CreateProcessAsUserW                                                                            77DBA8A9 5 Bytes  JMP 00FE1871
.text          C:\WINDOWS\system32\ctfmon.exe[3664] ADVAPI32.dll!CreateProcessAsUserA                                                                            77DE0CE8 5 Bytes  JMP 00FE1758
.text          C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe[3808] kernel32.dll!CreateProcessW                                          7C802336 5 Bytes  JMP 017D1642
.text          C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe[3808] kernel32.dll!CreateProcessA                                          7C80236B 5 Bytes  JMP 017D152C
.text          C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe[3808] ADVAPI32.dll!CreateProcessAsUserW                                    77DBA8A9 5 Bytes  JMP 017D1871
.text          C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe[3808] ADVAPI32.dll!CreateProcessAsUserA                                    77DE0CE8 5 Bytes  JMP 017D1758
.text          C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe[4024] kernel32.dll!CreateProcessW                                                        7C802336 5 Bytes  JMP 01081642
.text          C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe[4024] kernel32.dll!CreateProcessA                                                        7C80236B 5 Bytes  JMP 0108152C
.text          C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe[4024] ADVAPI32.dll!CreateProcessAsUserW                                                  77DBA8A9 5 Bytes  JMP 01081871
.text          C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe[4024] ADVAPI32.dll!CreateProcessAsUserA                                                  77DE0CE8 5 Bytes  JMP 01081758
.text          C:\Programme\DivX\DivX Update\DivXUpdate.exe[4028] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 013A1642
.text          C:\Programme\DivX\DivX Update\DivXUpdate.exe[4028] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 013A152C
.text          C:\Programme\DivX\DivX Update\DivXUpdate.exe[4028] ADVAPI32.dll!CreateProcessAsUserW                                                              77DBA8A9 5 Bytes  JMP 013A1871
.text          C:\Programme\DivX\DivX Update\DivXUpdate.exe[4028] ADVAPI32.dll!CreateProcessAsUserA                                                              77DE0CE8 5 Bytes  JMP 013A1758
.text          C:\WINDOWS\system32\RUNDLL32.EXE[4036] kernel32.dll!CreateProcessW                                                                                7C802336 5 Bytes  JMP 00EE1642
.text          C:\WINDOWS\system32\RUNDLL32.EXE[4036] kernel32.dll!CreateProcessA                                                                                7C80236B 5 Bytes  JMP 00EE152C
.text          C:\WINDOWS\system32\RUNDLL32.EXE[4036] ADVAPI32.dll!CreateProcessAsUserW                                                                          77DBA8A9 5 Bytes  JMP 00EE1871
.text          C:\WINDOWS\system32\RUNDLL32.EXE[4036] ADVAPI32.dll!CreateProcessAsUserA                                                                          77DE0CE8 5 Bytes  JMP 00EE1758
.text          C:\WINDOWS\CleGameKey\driver\ZClevoGKY.exe[4068] kernel32.dll!CreateProcessW                                                                      7C802336 5 Bytes  JMP 00EF1642
.text          C:\WINDOWS\CleGameKey\driver\ZClevoGKY.exe[4068] kernel32.dll!CreateProcessA                                                                      7C80236B 5 Bytes  JMP 00EF152C
.text          C:\WINDOWS\CleGameKey\driver\ZClevoGKY.exe[4068] ADVAPI32.dll!CreateProcessAsUserW                                                                77DBA8A9 5 Bytes  JMP 00EF1871
.text          C:\WINDOWS\CleGameKey\driver\ZClevoGKY.exe[4068] ADVAPI32.dll!CreateProcessAsUserA                                                                77DE0CE8 5 Bytes  JMP 00EF1758
.text          C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe[4072] kernel32.dll!CreateProcessW                                                              7C802336 5 Bytes  JMP 026F1642
.text          C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe[4072] kernel32.dll!CreateProcessA                                                              7C80236B 5 Bytes  JMP 026F152C
.text          C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe[4072] ADVAPI32.dll!CreateProcessAsUserW                                                        77DBA8A9 5 Bytes  JMP 026F1871
.text          C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe[4072] ADVAPI32.dll!CreateProcessAsUserA                                                        77DE0CE8 5 Bytes  JMP 026F1758
.text          C:\Programme\iTunes\iTunesHelper.exe[4080] kernel32.dll!CreateProcessW                                                                            7C802336 5 Bytes  JMP 02D51642
.text          C:\Programme\iTunes\iTunesHelper.exe[4080] kernel32.dll!CreateProcessA                                                                            7C80236B 5 Bytes  JMP 02D5152C
.text          C:\Programme\iTunes\iTunesHelper.exe[4080] ADVAPI32.dll!CreateProcessAsUserW                                                                      77DBA8A9 5 Bytes  JMP 02D51871
.text          C:\Programme\iTunes\iTunesHelper.exe[4080] ADVAPI32.dll!CreateProcessAsUserA                                                                      77DE0CE8 5 Bytes  JMP 02D51758
.text          C:\Programme\Messenger\msmsgs.exe[4092] kernel32.dll!CreateProcessW                                                                                7C802336 5 Bytes  JMP 018E1642
.text          C:\Programme\Messenger\msmsgs.exe[4092] kernel32.dll!CreateProcessA                                                                                7C80236B 5 Bytes  JMP 018E152C
.text          C:\Programme\Messenger\msmsgs.exe[4092] ADVAPI32.dll!CreateProcessAsUserW                                                                          77DBA8A9 5 Bytes  JMP 018E1871
.text          C:\Programme\Messenger\msmsgs.exe[4092] ADVAPI32.dll!CreateProcessAsUserA                                                                          77DE0CE8 5 Bytes  JMP 018E1758
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] ntdll.dll!LdrLoadDll                                                                                7C92632D 5 Bytes  JMP 01E65B60 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] kernel32.dll!CreateProcessW                                                                        7C802336 5 Bytes  JMP 00EA1642
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] kernel32.dll!CreateProcessA                                                                        7C80236B 5 Bytes  JMP 00EA152C
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] ADVAPI32.dll!CreateProcessAsUserW                                                                  77DBA8A9 5 Bytes  JMP 00EA1871
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] ADVAPI32.dll!CreateProcessAsUserA                                                                  77DE0CE8 5 Bytes  JMP 00EA1758
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] WS2_32.dll!closesocket                                                                              71A13E2B 5 Bytes  JMP 015E8F70
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] WS2_32.dll!connect                                                                                  71A14A07 5 Bytes  JMP 015E8CE0
.text          C:\Programme\Mozilla Firefox\firefox.exe[4944] WS2_32.dll!getpeername                                                                              71A20B68 5 Bytes  JMP 015E8F00
.text          C:\WINDOWS\system32\wuauclt.exe[5224] kernel32.dll!CreateProcessW                                                                                  7C802336 5 Bytes  JMP 01351642
.text          C:\WINDOWS\system32\wuauclt.exe[5224] kernel32.dll!CreateProcessA                                                                                  7C80236B 5 Bytes  JMP 0135152C
.text          C:\WINDOWS\system32\wuauclt.exe[5224] ADVAPI32.dll!CreateProcessAsUserW                                                                            77DBA8A9 5 Bytes  JMP 01351871
.text          C:\WINDOWS\system32\wuauclt.exe[5224] ADVAPI32.dll!CreateProcessAsUserA                                                                            77DE0CE8 5 Bytes  JMP 01351758
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[6216] kernel32.dll!CreateProcessW                                                                7C802336 5 Bytes  JMP 01031642
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[6216] kernel32.dll!CreateProcessA                                                                7C80236B 5 Bytes  JMP 0103152C
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[6216] ADVAPI32.dll!CreateProcessAsUserW                                                          77DBA8A9 5 Bytes  JMP 01031871
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[6216] ADVAPI32.dll!CreateProcessAsUserA                                                          77DE0CE8 5 Bytes  JMP 01031758
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[6216] USER32.dll!GetWindowInfo                                                                  7E37C49C 5 Bytes  JMP 10450924 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[6216] USER32.dll!TrackPopupMenu                                                                  7E3B531E 5 Bytes  JMP 10450ECF C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Downloads\1jgl2gto.exe[9264] kernel32.dll!CreateProcessW                                7C802336 5 Bytes  JMP 00F31642
.text          C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Downloads\1jgl2gto.exe[9264] kernel32.dll!CreateProcessA                                7C80236B 5 Bytes  JMP 00F3152C
.text          C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Downloads\1jgl2gto.exe[9264] ADVAPI32.dll!CreateProcessAsUserW                          77DBA8A9 5 Bytes  JMP 00F31871
.text          C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Downloads\1jgl2gto.exe[9264] ADVAPI32.dll!CreateProcessAsUserA                          77DE0CE8 5 Bytes  JMP 00F31758
.text          C:\WINDOWS\system32\wscntfy.exe[9628] kernel32.dll!CreateProcessW                                                                                  7C802336 5 Bytes  JMP 00E91642
.text          C:\WINDOWS\system32\wscntfy.exe[9628] kernel32.dll!CreateProcessA                                                                                  7C80236B 5 Bytes  JMP 00E9152C
.text          C:\WINDOWS\system32\wscntfy.exe[9628] ADVAPI32.dll!CreateProcessAsUserW                                                                            77DBA8A9 5 Bytes  JMP 00E91871
.text          C:\WINDOWS\system32\wscntfy.exe[9628] ADVAPI32.dll!CreateProcessAsUserA                                                                            77DE0CE8 5 Bytes  JMP 00E91758

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                          fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b                                0xC8 0x28 0x51 0xAF ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b                                0x71 0x3B 0x04 0x66 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016                                0xFF 0x7C 0x85 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48                                0x6B 0x65 0x49 0x6A ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472                                0xCD 0x44 0xCD 0xB9 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d                                0xB0 0x18 0xED 0xA7 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b                                0x31 0x77 0xE1 0xBA ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d                                0x83 0x6C 0x56 0x8B ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3                                0xF6 0x0F 0x4E 0x58 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b                                0xB1 0xCD 0x45 0x5A ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6                                0xE3 0x0E 0x66 0xD5 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                                                  Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                                                C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2                                0x6C 0x43 0x2D 0x1E ...

---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0                                                                                                                              malicious Win32:MBRoot code @ sector 390700803
Disk            \Device\Harddisk0\DR0                                                                                                                              PE file @ sector 390700825

---- EOF - GMER 1.0.15 ----
--- --- ---

Ich habe eben noch einmal im Task Manager geschaut, welche Prozesse laufen und festgestellt, dass iexplore.exe (Internet Explorer?) läuft. Ich nutze aber firefox und weiß daher nicht, was das ist.

Psychotic 14.03.2012 07:34
:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
  • Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren) - wenn du die anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
  • Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  • Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.


Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.



Starte den PC im abgesicherten Modus mit Netzwerktreibern! (Dazu beim Systemstart vordem Windows XP-Bildschirm die F8-Taste drücken)


Schritt 1: defogger


Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
    Vista und Win7 User mit Rechtsklick "als Administrator starten".
  • Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
  • Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
  • Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.



Schritt 2: OTL


Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
  • Doppelklick auf die OTL.exe
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.



Schritt 3: Scan mit TDSS-Killer


Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.

hoelschi 14.03.2012 08:43
defogger hat keine Fehlermeldung ausgegeben.

die logfiles von OTL:OTL Logfile:
Code:
OTL logfile created on: 14.03.2012 08:22:16 - Run 2
OTL by OldTimer - Version 3.2.36.3    Folder = C:\Dokumente und Einstellungen\rmhconcepts\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,90 Gb Available Physical Memory | 89,14% Memory free
5,09 Gb Paging File | 4,97 Gb Available in Paging File | 97,54% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 186,30 Gb Total Space | 38,05 Gb Free Space | 20,43% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 122,20 Gb Free Space | 26,24% Space Free | Partition Type: NTFS
Drive E: | 111,79 Gb Total Space | 99,09 Gb Free Space | 88,64% Space Free | Partition Type: NTFS
Drive G: | 959,63 Mb Total Space | 950,56 Mb Free Space | 99,06% Space Free | Partition Type: FAT
 
Computer Name: MYSTERYMACHINE | User Name: rmhconcepts | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\rmhconcepts\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\rmhconcepts\Desktop\Defogger.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Dokumente und Einstellungen\rmhconcepts\Desktop\Defogger.exe ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Programme\IZArc\IZArcCM.dll ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (FLEXnet Licensing Service) --  File not found
SRV - (Akamai) -- c:\programme\gemeinsame dateien\akamai/netsession_win_7de0ed9.dll ()
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (PSI_SVC_2) -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (SwitchBoard) -- C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel(R) Corporation)
SRV - (RegSrvc) Intel(R) -- C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (LightScribeService) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (regi) -- C:\WINDOWS\system32\drivers\regi.sys (InterVideo)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (smserial) -- C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (Revoflt) -- C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (NETw5x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (Aspi32) -- C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (NETw4x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (MarvinBus) -- C:\WINDOWS\system32\drivers\MarvinBus.sys (Pinnacle Systems GmbH)
DRV - (Cam5603D) -- C:\WINDOWS\system32\drivers\BisonCam.sys (Bison Electronics. Inc. )
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=110004&babsrc=SP_ss&mntrId=0c4614b70000000000000013e8bfcf83
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "google"
FF - prefs.js..browser.search.order.1: "google"
FF - prefs.js..browser.search.selectedEngine: "google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://office.microsoft.com/de-de/web-apps/"
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.1
FF - prefs.js..extensions.enabledItems: web2pdfextension@web2pdf.adobedotcom:1.0
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?q="
FF - prefs.js..network.proxy.ftp: "localhost"
FF - prefs.js..network.proxy.ftp_port: 8118
FF - prefs.js..network.proxy.gopher: "localhost"
FF - prefs.js..network.proxy.gopher_port: 8118
FF - prefs.js..network.proxy.http: "localhost"
FF - prefs.js..network.proxy.http_port: 8118
FF - prefs.js..network.proxy.no_proxies_on: "localhost"
FF - prefs.js..network.proxy.socks: "localhost"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.ssl: "localhost"
FF - prefs.js..network.proxy.ssl_port: 8118
FF - prefs.js..network.proxy.type: 0
 
FF - user.js..browser.search.selectedEngine: "google"
FF - user.js..browser.search.order.1: "google"
FF - user.js..browser.search.defaultenginename: "google"
FF - user.js..keyword.URL: "hxxp://www.google.de/search?q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\programme\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5016 [2011.06.09 13:48:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.01.25 12:55:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.03.09 10:36:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.03.10 11:54:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5016 [2011.06.09 13:48:26 | 000,000,000 | ---D | M]
 
[2010.06.03 14:28:58 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Mozilla\Extensions
[2012.03.13 07:29:44 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Mozilla\Firefox\Profiles\eikna12w.default\extensions
[2012.01.28 14:57:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.09 10:36:22 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.03.19 03:58:26 | 000,067,216 | ---- | M] (Adobe Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\npContribute.dll
[2011.03.12 18:55:57 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.03.09 10:36:18 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.11 20:56:11 | 000,002,310 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.03.09 10:36:18 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.03.09 10:36:18 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.09 10:36:18 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.09 10:36:18 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.09 10:36:18 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2007.07.27 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Programme\Gemeinsame Dateien\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Programme\Gemeinsame Dateien\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Programme\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [BisonHK] C:\WINDOWS\BisonCam\BisonHK.exe ()
O4 - HKLM..\Run: [BisonInst0402] C:\WINDOWS\BisonCam\InitDriverx86.exe (Bison Inc.)
O4 - HKLM..\Run: [BsMnt] C:\WINDOWS\BisonCam\BsMnt.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [ESDRWSTT] C:\Programme\wGXe SOFTWARE\wGXe Photo Recovery\esdrwstt.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [LchGKey] C:\WINDOWS\LchGKey.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NBAgent] C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [USBToolTip] C:\Programme\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKCU..\Run: [Upgrade] C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\ICQ\{3783BB90-B123-4517-88AD-B71213A65C19}\Upgrade.exe (Conexant Systems , Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html File not found
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.06.03 13:06:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.14 08:10:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\alze logs
[2012.03.14 07:39:14 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\tdsskiller.exe
[2012.03.14 07:38:40 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\OTL.exe
[2012.03.13 21:37:31 | 000,607,260 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\dds.scr
[2012.03.13 21:28:33 | 000,607,260 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\dds.com
[2012.03.13 15:48:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Malwarebytes
[2012.03.13 15:48:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.03.13 15:48:20 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.03.13 15:48:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.03.13 15:48:19 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.03.13 00:10:22 | 000,000,000 | ---D | C] -- C:\Programme\Elaborate Bytes
[2012.03.13 00:10:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Elaborate Bytes
[2012.03.12 21:03:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\ICQ
[2012.03.12 16:56:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Freemake
[2012.03.12 16:55:47 | 000,000,000 | ---D | C] -- C:\Programme\Freemake
[2012.03.12 14:26:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Deshaker
[2012.03.11 20:56:11 | 000,000,000 | ---D | C] -- C:\Programme\FoxTabVideoConverter
[2012.03.11 20:56:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Babylon
[2012.03.11 10:12:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Avid
[2012.03.11 09:07:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\VS Revo Group
[2012.03.11 09:07:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Revo Uninstaller Pro
[2012.03.11 09:07:20 | 000,027,064 | ---- | C] (VS Revo Group) -- C:\WINDOWS\System32\drivers\revoflt.sys
[2012.03.11 09:07:17 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group
[2012.03.11 08:51:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1
[2012.03.11 08:50:58 | 000,000,000 | ---D | C] -- C:\Programme\Adobe Support Advisor
[2012.03.10 12:47:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\CS5.5 Production Premium
[2012.03.08 00:05:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\videos-mauer
[2012.03.08 00:05:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\videos-ddr
[2012.03.07 22:36:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\DVD Projekte
[2012.03.07 20:36:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony
[2012.03.07 20:34:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Sony
[2012.03.07 10:45:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\videos-kommunismus
[2012.03.06 21:22:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\DVD Architect Pro 5.2 Projekte
[2012.03.06 20:01:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Sony Creative Software Inc
[2012.03.06 19:53:59 | 000,000,000 | ---D | C] -- C:\Programme\Sony
[2012.03.06 19:53:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Sony
[2012.03.06 19:52:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Sony
[2012.03.06 18:04:29 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Startmenü\Programme\Verwaltung
[2012.03.06 18:04:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\temp
[2012.03.06 18:00:56 | 000,171,520 | ---- | C] (Pinnacle Systems GmbH) -- C:\WINDOWS\System32\drivers\MarvinBus.sys
[2012.03.06 18:00:46 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Pinnacle
[2012.03.06 18:00:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
[2012.03.06 18:00:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\InstantCDDVD
[2012.03.06 18:00:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Avid
[2012.03.06 17:59:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avid Studio
[2012.03.06 17:55:09 | 000,000,000 | ---D | C] -- C:\Programme\Pinnacle
[2012.03.06 17:55:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\Pinnacle
[2012.03.06 17:55:09 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Pegasus Imaging
[2012.03.06 17:55:09 | 000,000,000 | ---D | C] -- C:\Programme\Avid
[2012.03.06 17:52:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2012.03.06 17:49:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avid
[2012.03.06 15:23:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\PMB Files
[2012.03.06 15:23:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files
[2012.03.06 15:03:41 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012.03.06 14:58:44 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2012.03.06 14:06:50 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2012.03.06 11:34:44 | 000,000,000 | ---D | C] -- C:\Programme\Pando Networks
[2012.03.06 11:00:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\My Videos
[2012.03.06 10:58:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WinX DVD Author
[2012.03.06 10:58:54 | 000,000,000 | ---D | C] -- C:\Programme\Digiarty
[2012.03.04 18:13:38 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Eigene Dateien\Meine Datenquellen
[2012.03.02 22:23:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\No Company Name
[2012.03.02 10:41:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\TeamViewer
[2012.03.01 10:36:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\Neuer Ordner (2)
[2012.03.01 10:31:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\Neuer Ordner
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.14 08:17:47 | 000,481,432 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.03.14 08:17:47 | 000,459,004 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.03.14 08:17:47 | 000,079,766 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.03.14 08:17:46 | 000,094,754 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.03.14 08:13:34 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.03.14 08:01:16 | 000,000,238 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.03.14 07:59:19 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2012.03.14 07:59:12 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-73586283-839522115-1003.job
[2012.03.14 07:59:11 | 000,001,096 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.14 07:59:11 | 000,000,266 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-73586283-839522115-1004.job
[2012.03.14 07:42:29 | 000,000,246 | ---- | M] () -- C:\WINDOWS\Brownie.ini
[2012.03.14 07:42:00 | 000,001,100 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.14 07:40:52 | 000,000,432 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
[2012.03.14 07:39:48 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\tdsskiller.exe
[2012.03.14 07:38:48 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\OTL.exe
[2012.03.13 22:30:54 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\rmhconcepts\defogger_reenable
[2012.03.13 21:37:33 | 000,607,260 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\dds.scr
[2012.03.13 21:28:36 | 000,607,260 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\dds.com
[2012.03.13 21:25:52 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\Defogger.exe
[2012.03.13 15:53:12 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-73586283-839522115-1003.job
[2012.03.13 15:48:21 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.13 07:37:40 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.03.13 00:10:50 | 000,000,875 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Virtual CloneDrive.lnk
[2012.03.12 23:57:35 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.03.12 21:15:52 | 000,117,760 | ---- | M] () -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.12 19:22:43 | 000,000,349 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI
[2012.03.12 18:00:01 | 000,000,462 | ---- | M] () -- C:\WINDOWS\tasks\ParetoLogic Registration.job
[2012.03.12 09:06:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012.03.11 23:21:39 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.03.11 20:56:13 | 000,000,770 | ---- | M] () -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\FoxTab Video Converter.lnk
[2012.03.11 09:07:21 | 000,000,897 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012.03.10 16:33:25 | 003,686,512 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.03.07 22:10:00 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-73586283-839522115-1004.job
[2012.03.07 20:34:05 | 000,000,831 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DVD Architect Pro 5.2.lnk
[2012.03.07 18:21:21 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.03.06 17:59:07 | 000,001,846 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avid Studio.lnk
[2012.03.01 12:49:41 | 000,000,040 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2012.03.01 10:45:53 | 000,000,224 | ---- | M] () -- C:\WINDOWS\System32\9B13A86D.plf
[2012.02.16 16:08:11 | 000,000,113 | ---- | M] () -- C:\WINDOWS\Epscan2.INI
[2012.02.16 16:01:58 | 000,004,144 | ---- | M] () -- C:\WINDOWS\estwn323.ini
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.13 22:30:54 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\defogger_reenable
[2012.03.13 21:25:52 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\Defogger.exe
[2012.03.13 15:48:21 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.13 00:10:50 | 000,000,875 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Virtual CloneDrive.lnk
[2012.03.12 11:01:40 | 000,073,728 | ---- | C] ( ) -- C:\WINDOWS\System\vdremote.dll
[2012.03.12 11:01:40 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System\vdsvrlnk.dll
[2012.03.11 20:56:13 | 000,000,770 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\Desktop\FoxTab Video Converter.lnk
[2012.03.11 09:07:21 | 000,000,897 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012.03.07 20:34:05 | 000,000,831 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DVD Architect Pro 5.2.lnk
[2012.03.06 17:59:07 | 000,001,846 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avid Studio.lnk
[2012.03.06 17:54:00 | 000,000,349 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI
[2011.10.26 16:56:40 | 000,001,456 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Adobe Für Web speichern 12.0 Prefs
[2011.10.25 23:29:03 | 000,000,132 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Adobe BMP Format CS5 Prefs
[2011.10.24 09:12:49 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2011.09.07 10:41:37 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2011.05.31 13:18:12 | 000,000,027 | ---- | C] () -- C:\WINDOWS\System32\urhtps.dat
[2011.02.27 11:30:28 | 000,003,452 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2011.02.27 11:30:28 | 000,000,088 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\C4D4A0384A.sys
[2011.02.26 09:39:40 | 002,165,568 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2011.02.26 00:26:47 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011.02.03 08:58:56 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011.02.03 08:58:55 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2011.02.03 08:58:54 | 000,810,496 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011.02.03 08:58:54 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011.02.03 08:58:53 | 000,080,896 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.12.19 13:43:14 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2010.11.07 10:43:56 | 000,001,763 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2010.10.26 18:07:05 | 000,015,190 | R--- | C] () -- C:\WINDOWS\M2000Twn.ini
[2010.09.13 16:30:40 | 000,350,208 | ---- | C] () -- C:\WINDOWS\System32\Rivet200.dll
[2010.08.24 14:16:39 | 000,004,144 | ---- | C] () -- C:\WINDOWS\estwn323.ini
[2010.08.24 14:15:15 | 000,057,424 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010.08.24 14:05:49 | 000,000,113 | ---- | C] () -- C:\WINDOWS\Epscan2.INI
[2010.08.21 14:09:34 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL
[2010.08.21 14:09:34 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL
[2010.08.21 14:09:34 | 000,000,141 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2010.08.21 14:09:34 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\brlmw03a.ini
[2010.08.21 14:09:34 | 000,000,040 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI
[2010.08.21 14:09:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
[2010.08.21 14:09:33 | 000,009,030 | ---- | C] () -- C:\WINDOWS\HL-2030.INI
[2010.08.21 14:08:36 | 000,000,246 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2010.08.14 21:11:38 | 000,000,132 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\Adobe PNG Format CS5 Prefs
[2010.06.22 09:51:45 | 000,117,760 | ---- | C] () -- C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.16 09:49:24 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.06.11 20:49:44 | 000,000,432 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010.06.11 20:49:44 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\BD2030.DAT
[2010.06.03 14:28:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.06.03 13:55:27 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.06.03 13:54:21 | 003,686,512 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.03 13:35:28 | 000,319,488 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe
[2010.06.03 13:31:31 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2010.06.03 13:31:31 | 000,036,864 | ---- | C] () -- C:\WINDOWS\ShowWnd.exe
[2010.06.03 13:31:31 | 000,036,864 | ---- | C] () -- C:\WINDOWS\LchGKey.exe
[2010.06.03 13:31:31 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2010.06.03 13:31:31 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2010.06.03 13:19:07 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010.06.03 13:07:59 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.06.03 13:03:30 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.05.21 10:53:16 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2010.05.21 10:53:16 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2010.05.21 10:53:16 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2010.05.21 10:53:16 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2010.05.21 10:53:15 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2010.05.21 10:53:15 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2010.05.21 10:53:14 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2010.05.21 10:53:14 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe

< End of report >
--- --- ---
OTL Logfile:
Code:
OTL Extras logfile created on: 14.03.2012 08:22:16 - Run 2
OTL by OldTimer - Version 3.2.36.3    Folder = C:\Dokumente und Einstellungen\rmhconcepts\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,90 Gb Available Physical Memory | 89,14% Memory free
5,09 Gb Paging File | 4,97 Gb Available in Paging File | 97,54% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 186,30 Gb Total Space | 38,05 Gb Free Space | 20,43% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 122,20 Gb Free Space | 26,24% Space Free | Partition Type: NTFS
Drive E: | 111,79 Gb Total Space | 99,09 Gb Free Space | 88,64% Space Free | Partition Type: NTFS
Drive G: | 959,63 Mb Total Space | 950,56 Mb Free Space | 99,06% Space Free | Partition Type: FAT
 
Computer Name: MYSTERYMACHINE | User Name: rmhconcepts | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.js [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"57793:TCP" = 57793:TCP:*:Enabled:Pando Media Booster
"57793:UDP" = 57793:UDP:*:Enabled:Pando Media Booster
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"57793:TCP" = 57793:TCP:*:Enabled:Pando Media Booster
"57793:UDP" = 57793:UDP:*:Enabled:Pando Media Booster
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Electronic Arts\EADM\Core.exe" = C:\Programme\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\SecondLifeViewer2\SLVoice.exe" = C:\Programme\SecondLifeViewer2\SLVoice.exe:*:Enabled:SLVoice
"C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe" = C:\Dokumente und Einstellungen\rmhconcepts\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe:*:Enabled:Akamai NetSession Interface -- (Akamai Technologies, Inc)
"C:\Programme\Microsoft Office\Office14\GROOVE.EXE" = C:\Programme\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Programme\Avid\Studio\programs\RM.exe" = C:\Programme\Avid\Studio\programs\RM.exe:*:Enabled:Render Manager -- (Avid)
"C:\Programme\Avid\Studio\programs\NGStudio.exe" = C:\Programme\Avid\Studio\programs\NGStudio.exe:*:Enabled:NGStudio -- (Avid)
"C:\Programme\Avid\Studio\programs\UMI.exe" = C:\Programme\Avid\Studio\programs\UMI.exe:*:Enabled:umi -- (Avid)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B48B3C5-B596-4822-A148-837B11885CB5}" = Lost Horizon
"{2C8B45B1-4BDC-4321-A574-B10D25C9CE54}" = Brother HL-2030
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{42C8B7DF-FEB0-4D51-B169-506B6BEC5797}" = Nero 10 Menu TemplatePack 1
"{43507E5B-94A0-4E56-9C7B-FAAAFBDB5904}" = Intel(R) PROSet/Wireless WiFi-Software
"{43FBAB46-5969-4200-9958-1FF81FEE506F}" = Nero 10 Movie ThemePack 1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = BisonCam
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = BisonCam
"{4F93ABBE-5A1D-4D56-94CB-022F109FDE4D}" = Adobe Presenter 7
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5C1F18D2-F6B7-4242-B803-B5A78648185D}" = Corel WinDVD 2010
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6DE721A5-5E89-4D74-994C-652BB3C0672E}" = Pinnacle Video Treiber
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{70F19404-B96C-4EBB-AD2B-3574F8736197}" = Nero 10 Movie ThemePack 2
"{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71B6C9B6-CDF1-516E-EDBD-F3F8EBF7A0C7}" = Adobe Support Advisor
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7AA92D13-8B7A-48B9-B18D-645564FAD258}" = Nero Vision Xtra
"{82EF29B1-9B60-4142-A155-0599216DD053}" = LightScribe System Software
"{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}" = Nero BurnLite 10
"{84FCDDA1-DFD4-11E0-B673-F04DA23A5C58}" = DVD Architect Pro 5.2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{874790EE-DFD4-11E0-973A-F04DA23A5C58}" = MSVCRT Redists
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-001A-0000-0000-0000000FF1CE}" = Microsoft Office Outlook 2010
"{92146419-AE44-4C8B-A48B-0ABB1B5EC026}" = Nero 10 Menu TemplatePack 3
"{92A10E9D-EA00-4A46-8F22-EEA660992D61}" = Nero 10 Sample Videos
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant
"{96ED4B78-300E-4033-AE6C-C115CEB4DF07}" = Nero 10 ClipartPack
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.2
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}" = Nero BurnLite 10
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{ACD15FDF-FC42-4175-B477-576F92FF2256}" = Nero 10 Sample ImagePack
"{AD67D19C-71FB-410B-8562-5F028DB07831}" = wGXe Photo Recovery
"{B001064C-D061-4BAE-9031-416A838D5536}" = Adobe Flash Player 10 ActiveX
"{B1C2398C-6FAB-46D1-806C-5942F0829994}" = ParetoLogic Data Recovery
"{B35DC076-CEF2-4631-9EF7-45380E27C841}" = Avid Studio
"{BD8C5D59-B689-4245-8BCF-89378CA909B0}_is1" = Deutschlands Kartenspiele Deluxe
"{BDE646E8-86E0-50E1-37BC-0AEBB2185D76}" = Adobe Widget Browser
"{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = TIPCI
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D8EEDC94-EE82-46A0-A7DB-812E3C6A0A6E}_is1" = PSD Viewer
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E712C273-7564-4C8E-AA59-0FA19BC35117}" = Nero 10 Menu TemplatePack 2
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F385F486-C1BC-4350-8837-6F17761134B5}" = Multimedia Keyboard Driver
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FBD7A67D-D700-4043-B54F-DD106D00F308}" = LameXP
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3ACM" = AC-3 ACM Codec
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Presenter 7" = Adobe Presenter 7
"AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Support Advisor
"Advanced MP3 Converter_is1" = Advanced MP3 Converter 5.00
"Akamai" = Akamai NetSession Interface Service
"ALUpdate_is1" = ALTools Update
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Black Mirror 2_is1" = Black Mirror 2
"Black Mirror III_is1" = Black Mirror III
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Widget Browser
"DesktopIconAmazon" = Desktop Icon für Amazon
"DFX for Windows Media Player" = DFX for Windows Media Player
"DivX Setup.divx.com" = DivX-Setup
"DVD-lab PRO 2.51_is1" = DVD-lab PRO 2.51
"EA Installer.828943773" = EA Installer
"EADM" = EA Download Manager
"EPSON Scan! II" = EPSON Scan! II
"FLV Player" = FLV Player 2.0 (build 25)
"FUSSBALL MANAGER 11" = FUSSBALL MANAGER 11
"Glary Undelete_is1" = Glary Undelete 1.8.0.468
"ie8" = Windows Internet Explorer 8
"ImTOO DVD to PSP Converter 5" = ImTOO DVD to PSP Converter 5
"ImTOO iPod Converter 6" = ImTOO iPod Converter 6
"ImTOO iPod Movie Converter" = ImTOO iPod Movie Converter
"InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"InstallShield_{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.9.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.OUTLOOKR" = Microsoft Outlook 2010
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Open Codecs" = Xiph.Org Open Codecs 0.84.17359
"ProInst" = Intel PROSet Wireless
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"QUE PASA 3" = QUE PASA 3
"RealPlayer 12.0" = RealPlayer
"Recuva" = Recuva
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Zero Assumption Recovery_is1" = Zero Assumption Recovery Version 9
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"FoxTab Video Converter" = FoxTab Video Converter
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 14.03.2012 03:01:58 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn  der Prozess Performance auf dem Erweitungerungsindikator-Anbieter
 ausgeführt wird. Der Wert BaseIndex aus der  Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert LastCounter ist das zweite  DWORD im Datenbereich
 und der Werte LastHelp ist das dritte DWORD im Datenbereich.
 
Error - 14.03.2012 03:01:58 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für  Dienst WmiApRpl (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
Error - 14.03.2012 03:03:46 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn  der Prozess Performance auf dem Erweitungerungsindikator-Anbieter
 ausgeführt wird. Der Wert BaseIndex aus der  Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert LastCounter ist das zweite  DWORD im Datenbereich
 und der Werte LastHelp ist das dritte DWORD im Datenbereich.
 
Error - 14.03.2012 03:03:46 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn  der Prozess Performance auf dem Erweitungerungsindikator-Anbieter
 ausgeführt wird. Der Wert BaseIndex aus der  Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert LastCounter ist das zweite  DWORD im Datenbereich
 und der Werte LastHelp ist das dritte DWORD im Datenbereich.
 
Error - 14.03.2012 03:03:46 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für  Dienst WmiApRpl (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
Error - 14.03.2012 03:11:57 | Computer Name = MYSTERYMACHINE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 14.03.2012 03:11:57 | Computer Name = MYSTERYMACHINE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Der angegebene Server kann den angeforderten
 Vorgang nicht ausführen.  .
 
Error - 14.03.2012 03:17:43 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn  der Prozess Performance auf dem Erweitungerungsindikator-Anbieter
 ausgeführt wird. Der Wert BaseIndex aus der  Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert LastCounter ist das zweite  DWORD im Datenbereich
 und der Werte LastHelp ist das dritte DWORD im Datenbereich.
 
Error - 14.03.2012 03:17:43 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn  der Prozess Performance auf dem Erweitungerungsindikator-Anbieter
 ausgeführt wird. Der Wert BaseIndex aus der  Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert LastCounter ist das zweite  DWORD im Datenbereich
 und der Werte LastHelp ist das dritte DWORD im Datenbereich.
 
Error - 14.03.2012 03:17:43 | Computer Name = MYSTERYMACHINE | Source = LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für  Dienst WmiApRpl (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
[ System Events ]
Error - 16.02.2012 12:15:51 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 12:16:21 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:25:41 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:26:11 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:26:41 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:27:11 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:27:41 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:28:11 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:28:42 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.02.2012 18:29:12 | Computer Name = MYSTERYMACHINE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
 
< End of report >
--- --- ---




und zum guten Schluss das logfile von TDSS:

08:27:23.0875 2016 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:43
08:27:23.0875 2016 ============================================================
08:27:23.0875 2016 Current date / time: 2012/03/14 08:27:23.0875
08:27:23.0875 2016 SystemInfo:
08:27:23.0875 2016
08:27:23.0875 2016 OS Version: 5.1.2600 ServicePack: 3.0
08:27:23.0875 2016 Product type: Workstation
08:27:23.0875 2016 ComputerName: MYSTERYMACHINE
08:27:23.0875 2016 UserName: rmhconcepts
08:27:23.0875 2016 Windows directory: C:\WINDOWS
08:27:23.0875 2016 System windows directory: C:\WINDOWS
08:27:23.0875 2016 Processor architecture: Intel x86
08:27:23.0875 2016 Number of processors: 4
08:27:23.0875 2016 Page size: 0x1000
08:27:23.0875 2016 Boot type: Safe boot with network
08:27:23.0875 2016 ============================================================
08:27:25.0484 2016 Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:27:25.0625 2016 Drive \Device\Harddisk1\DR1 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:27:25.0625 2016 Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:27:25.0625 2016 Drive \Device\Harddisk3\DR6 - Size: 0x3C000000 (0.94 Gb), SectorSize: 0x200, Cylinders: 0x7A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
08:27:25.0625 2016 \Device\Harddisk0\DR0:
08:27:25.0625 2016 MBR used
08:27:25.0625 2016 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x17499EC1
08:27:25.0625 2016 \Device\Harddisk1\DR1:
08:27:25.0625 2016 MBR used
08:27:25.0625 2016 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xDF93782
08:27:25.0625 2016 \Device\Harddisk2\DR2:
08:27:25.0625 2016 MBR used
08:27:25.0625 2016 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
08:27:25.0625 2016 \Device\Harddisk3\DR6:
08:27:25.0625 2016 MBR used
08:27:25.0625 2016 \Device\Harddisk3\DR6\Partition0: MBR, Type 0x6, StartLBA 0xFF, BlocksNum 0x1DFF01
08:27:26.0062 2016 Initialize success
08:27:26.0062 2016 ============================================================
08:27:41.0406 2036 ============================================================
08:27:41.0406 2036 Scan started
08:27:41.0406 2036 Mode: Manual;
08:27:41.0406 2036 ============================================================
08:27:42.0890 2036 Abiosdsk - ok
08:27:42.0921 2036 abp480n5 - ok
08:27:42.0968 2036 acedrv11 (e6f53d6c0dea3d375362265e175ca638) C:\WINDOWS\system32\drivers\acedrv11.sys
08:27:42.0968 2036 acedrv11 - ok
08:27:43.0015 2036 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:27:43.0015 2036 ACPI - ok
08:27:43.0031 2036 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
08:27:43.0031 2036 ACPIEC - ok
08:27:43.0062 2036 adpu160m - ok
08:27:43.0125 2036 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:27:43.0125 2036 aec - ok
08:27:43.0171 2036 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:27:43.0171 2036 AFD - ok
08:27:43.0187 2036 Aha154x - ok
08:27:43.0218 2036 aic78u2 - ok
08:27:43.0250 2036 aic78xx - ok
08:27:43.0359 2036 AliIde - ok
08:27:43.0390 2036 amsint - ok
08:27:43.0484 2036 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
08:27:43.0484 2036 Arp1394 - ok
08:27:43.0515 2036 asc - ok
08:27:43.0546 2036 asc3350p - ok
08:27:43.0578 2036 asc3550 - ok
08:27:43.0671 2036 Aspi32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\aspi32.sys
08:27:43.0671 2036 Aspi32 - ok
08:27:43.0734 2036 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:27:43.0734 2036 AsyncMac - ok
08:27:43.0781 2036 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:27:43.0781 2036 atapi - ok
08:27:43.0796 2036 Atdisk - ok
08:27:43.0859 2036 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:27:43.0859 2036 Atmarpc - ok
08:27:43.0906 2036 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:27:43.0906 2036 audstub - ok
08:27:43.0984 2036 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
08:27:43.0984 2036 avgio - ok
08:27:44.0046 2036 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
08:27:44.0046 2036 avgntflt - ok
08:27:44.0093 2036 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
08:27:44.0093 2036 avipbb - ok
08:27:44.0156 2036 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:27:44.0156 2036 Beep - ok
08:27:44.0312 2036 Cam5603D (2230b842f43a204abd3ec6bdd39d793f) C:\WINDOWS\system32\Drivers\BisonCam.sys
08:27:44.0312 2036 Cam5603D - ok
08:27:44.0390 2036 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:27:44.0390 2036 cbidf2k - ok
08:27:44.0421 2036 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:27:44.0421 2036 CCDECODE - ok
08:27:44.0453 2036 cd20xrnt - ok
08:27:44.0484 2036 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:27:44.0484 2036 Cdaudio - ok
08:27:44.0515 2036 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:27:44.0515 2036 Cdfs - ok
08:27:44.0562 2036 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:27:44.0562 2036 Cdrom - ok
08:27:44.0578 2036 Changer - ok
08:27:44.0687 2036 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
08:27:44.0687 2036 CmBatt - ok
08:27:44.0718 2036 CmdIde - ok
08:27:44.0750 2036 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
08:27:44.0750 2036 Compbatt - ok
08:27:44.0828 2036 Cpqarray - ok
08:27:44.0875 2036 dac2w2k - ok
08:27:44.0906 2036 dac960nt - ok
08:27:44.0984 2036 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
08:27:44.0984 2036 Disk - ok
08:27:45.0062 2036 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
08:27:45.0062 2036 dmboot - ok
08:27:45.0093 2036 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
08:27:45.0093 2036 dmio - ok
08:27:45.0125 2036 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:27:45.0125 2036 dmload - ok
08:27:45.0203 2036 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
08:27:45.0203 2036 DMusic - ok
08:27:45.0250 2036 dpti2o - ok
08:27:45.0281 2036 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
08:27:45.0281 2036 drmkaud - ok
08:27:45.0390 2036 ElbyCDIO (d71233d7ccc2e64f8715a20428d5a33b) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
08:27:45.0406 2036 ElbyCDIO - ok
08:27:45.0515 2036 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
08:27:45.0515 2036 Fastfat - ok
08:27:45.0562 2036 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
08:27:45.0562 2036 Fdc - ok
08:27:45.0593 2036 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
08:27:45.0593 2036 Fips - ok
08:27:45.0640 2036 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
08:27:45.0640 2036 Flpydisk - ok
08:27:45.0671 2036 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
08:27:45.0671 2036 FltMgr - ok
08:27:45.0718 2036 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:27:45.0718 2036 Fs_Rec - ok
08:27:45.0765 2036 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:27:45.0765 2036 Ftdisk - ok
08:27:45.0812 2036 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
08:27:45.0812 2036 GEARAspiWDM - ok
08:27:45.0828 2036 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:27:45.0828 2036 Gpc - ok
08:27:45.0921 2036 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
08:27:45.0921 2036 HDAudBus - ok
08:27:46.0031 2036 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:27:46.0031 2036 HidUsb - ok
08:27:46.0062 2036 hpn - ok
08:27:46.0125 2036 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
08:27:46.0125 2036 HTTP - ok
08:27:46.0156 2036 i2omgmt - ok
08:27:46.0187 2036 i2omp - ok
08:27:46.0234 2036 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:27:46.0234 2036 i8042prt - ok
08:27:46.0296 2036 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:27:46.0296 2036 Imapi - ok
08:27:46.0359 2036 ini910u - ok
08:27:46.0500 2036 IntcAzAudAddService (41ef008d7b089ce6f5f2e4a61d5638e6) C:\WINDOWS\system32\drivers\RtkHDAud.sys
08:27:46.0531 2036 IntcAzAudAddService - ok
08:27:46.0562 2036 IntelIde - ok
08:27:46.0609 2036 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
08:27:46.0609 2036 intelppm - ok
08:27:46.0656 2036 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
08:27:46.0656 2036 Ip6Fw - ok
08:27:46.0687 2036 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:27:46.0687 2036 IpFilterDriver - ok
08:27:46.0734 2036 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:27:46.0734 2036 IpInIp - ok
08:27:46.0765 2036 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:27:46.0765 2036 IpNat - ok
08:27:46.0812 2036 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:27:46.0812 2036 IPSec - ok
08:27:46.0859 2036 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:27:46.0859 2036 IRENUM - ok
08:27:46.0906 2036 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:27:46.0906 2036 isapnp - ok
08:27:46.0953 2036 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:27:46.0953 2036 Kbdclass - ok
08:27:47.0015 2036 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
08:27:47.0031 2036 kmixer - ok
08:27:47.0046 2036 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
08:27:47.0046 2036 KSecDD - ok
08:27:47.0125 2036 lbrtfdc - ok
08:27:47.0234 2036 MarvinBus (a3e700d78eec390f1208098cdca5c6b6) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
08:27:47.0234 2036 MarvinBus - ok
08:27:47.0281 2036 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
08:27:47.0281 2036 MBAMProtector - ok
08:27:47.0359 2036 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:27:47.0359 2036 mnmdd - ok
08:27:47.0406 2036 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
08:27:47.0406 2036 Modem - ok
08:27:47.0437 2036 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:27:47.0437 2036 Mouclass - ok
08:27:47.0500 2036 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:27:47.0500 2036 mouhid - ok
08:27:47.0546 2036 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
08:27:47.0546 2036 MountMgr - ok
08:27:47.0562 2036 mraid35x - ok
08:27:47.0593 2036 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:27:47.0593 2036 MRxDAV - ok
08:27:47.0640 2036 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:27:47.0640 2036 MRxSmb - ok
08:27:47.0718 2036 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
08:27:47.0718 2036 Msfs - ok
08:27:47.0781 2036 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:27:47.0781 2036 MSKSSRV - ok
08:27:47.0828 2036 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:27:47.0828 2036 MSPCLOCK - ok
08:27:47.0843 2036 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
08:27:47.0843 2036 MSPQM - ok
08:27:47.0890 2036 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:27:47.0890 2036 mssmbios - ok
08:27:47.0921 2036 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
08:27:47.0921 2036 MSTEE - ok
08:27:47.0953 2036 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
08:27:47.0953 2036 Mup - ok
08:27:48.0015 2036 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
08:27:48.0015 2036 NABTSFEC - ok
08:27:48.0078 2036 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
08:27:48.0078 2036 NDIS - ok
08:27:48.0109 2036 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
08:27:48.0109 2036 NdisIP - ok
08:27:48.0156 2036 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:27:48.0156 2036 NdisTapi - ok
08:27:48.0218 2036 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:27:48.0218 2036 Ndisuio - ok
08:27:48.0234 2036 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:27:48.0234 2036 NdisWan - ok
08:27:48.0296 2036 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
08:27:48.0296 2036 NDProxy - ok
08:27:48.0312 2036 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:27:48.0312 2036 NetBIOS - ok
08:27:48.0359 2036 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:27:48.0359 2036 NetBT - ok
08:27:48.0562 2036 NETw4x32 (12b0d99865434387f784268b70e23360) C:\WINDOWS\system32\DRIVERS\NETw4x32.sys
08:27:48.0562 2036 NETw4x32 - ok
08:27:48.0750 2036 NETw5x32 (580207a7c9bde8ba65401f51f9ba9741) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
08:27:48.0781 2036 NETw5x32 - ok
08:27:48.0828 2036 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
08:27:48.0828 2036 NIC1394 - ok
08:27:48.0906 2036 NPF (b9730495e0cf674680121e34bd95a73b) C:\WINDOWS\system32\drivers\npf.sys
08:27:48.0906 2036 NPF - ok
08:27:48.0921 2036 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
08:27:48.0921 2036 Npfs - ok
08:27:48.0968 2036 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
08:27:48.0984 2036 Ntfs - ok
08:27:49.0046 2036 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:27:49.0046 2036 Null - ok
08:27:49.0218 2036 nv (a50a030be64fa2fdb548a2ee888f8adb) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:27:49.0250 2036 nv - ok
08:27:49.0312 2036 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:27:49.0312 2036 NwlnkFlt - ok
08:27:49.0359 2036 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:27:49.0359 2036 NwlnkFwd - ok
08:27:49.0390 2036 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
08:27:49.0390 2036 ohci1394 - ok
08:27:49.0484 2036 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
08:27:49.0484 2036 Parport - ok
08:27:49.0500 2036 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
08:27:49.0500 2036 PartMgr - ok
08:27:49.0546 2036 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
08:27:49.0546 2036 ParVdm - ok
08:27:49.0562 2036 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
08:27:49.0562 2036 PCI - ok
08:27:49.0593 2036 PCIDump - ok
08:27:49.0640 2036 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:27:49.0640 2036 PCIIde - ok
08:27:49.0671 2036 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
08:27:49.0671 2036 Pcmcia - ok
08:27:49.0703 2036 PDCOMP - ok
08:27:49.0734 2036 PDFRAME - ok
08:27:49.0765 2036 PDRELI - ok
08:27:49.0796 2036 PDRFRAME - ok
08:27:49.0843 2036 perc2 - ok
08:27:49.0875 2036 perc2hib - ok
08:27:50.0015 2036 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:27:50.0015 2036 PptpMiniport - ok
08:27:50.0046 2036 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
08:27:50.0046 2036 PSched - ok
08:27:50.0109 2036 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:27:50.0109 2036 Ptilink - ok
08:27:50.0140 2036 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
08:27:50.0140 2036 PxHelp20 - ok
08:27:50.0171 2036 ql1080 - ok
08:27:50.0203 2036 Ql10wnt - ok
08:27:50.0234 2036 ql12160 - ok
08:27:50.0265 2036 ql1240 - ok
08:27:50.0312 2036 ql1280 - ok
08:27:50.0343 2036 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:27:50.0343 2036 RasAcd - ok
08:27:50.0390 2036 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:27:50.0390 2036 Rasl2tp - ok
08:27:50.0453 2036 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:27:50.0453 2036 RasPppoe - ok
08:27:50.0484 2036 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:27:50.0484 2036 Raspti - ok
08:27:50.0531 2036 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:27:50.0531 2036 Rdbss - ok
08:27:50.0562 2036 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:27:50.0562 2036 RDPCDD - ok
08:27:50.0609 2036 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:27:50.0609 2036 rdpdr - ok
08:27:50.0671 2036 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
08:27:50.0671 2036 RDPWD - ok
08:27:50.0734 2036 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:27:50.0734 2036 redbook - ok
08:27:50.0765 2036 regi (c1e596e42e77f94d5c1c18fd9b2b3274) C:\WINDOWS\system32\drivers\regi.sys
08:27:50.0765 2036 regi - ok
08:27:50.0875 2036 Revoflt (8b5b8a11306190c6963d3473f052d3c8) C:\WINDOWS\system32\DRIVERS\revoflt.sys
08:27:50.0875 2036 Revoflt - ok
08:27:51.0000 2036 RTLE8023xp (25be98c05808c57e4d8d26477dc12d39) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
08:27:51.0000 2036 RTLE8023xp - ok
08:27:51.0062 2036 s24trans (e7958e8acda7ca20127ef5f2235f25cc) C:\WINDOWS\system32\DRIVERS\s24trans.sys
08:27:51.0062 2036 s24trans - ok
08:27:51.0187 2036 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
08:27:51.0187 2036 sdbus - ok
08:27:51.0218 2036 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:27:51.0218 2036 Secdrv - ok
08:27:51.0281 2036 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
08:27:51.0281 2036 Serial - ok
08:27:51.0375 2036 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:27:51.0375 2036 Sfloppy - ok
08:27:51.0421 2036 Simbad - ok
08:27:51.0468 2036 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
08:27:51.0468 2036 SLIP - ok
08:27:51.0531 2036 smserial (d9bfd2298f5cf116d8eaae3b02dcee2e) C:\WINDOWS\system32\DRIVERS\smserial.sys
08:27:51.0531 2036 smserial - ok
08:27:51.0578 2036 Sparrow - ok
08:27:51.0609 2036 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
08:27:51.0609 2036 splitter - ok
08:27:51.0671 2036 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
08:27:51.0671 2036 sr - ok
08:27:51.0718 2036 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
08:27:51.0734 2036 Srv - ok
08:27:51.0781 2036 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
08:27:51.0796 2036 ssmdrv - ok
08:27:51.0843 2036 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
08:27:51.0843 2036 streamip - ok
08:27:51.0875 2036 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:27:51.0875 2036 swenum - ok
08:27:51.0937 2036 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
08:27:51.0937 2036 swmidi - ok
08:27:52.0000 2036 symc810 - ok
08:27:52.0031 2036 symc8xx - ok
08:27:52.0062 2036 sym_hi - ok
08:27:52.0093 2036 sym_u3 - ok
08:27:52.0140 2036 SynTP (60b421663910fbb3c9b350b7efa75a68) C:\WINDOWS\system32\DRIVERS\SynTP.sys
08:27:52.0140 2036 SynTP - ok
08:27:52.0203 2036 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
08:27:52.0203 2036 sysaudio - ok
08:27:52.0281 2036 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:27:52.0281 2036 Tcpip - ok
08:27:52.0312 2036 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:27:52.0312 2036 TDPIPE - ok
08:27:52.0359 2036 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
08:27:52.0359 2036 TDTCP - ok
08:27:52.0406 2036 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:27:52.0406 2036 TermDD - ok
08:27:52.0468 2036 tifm21 (78213f01ce781f93180bef5eb5b3ad81) C:\WINDOWS\system32\drivers\tifm21.sys
08:27:52.0468 2036 tifm21 - ok
08:27:52.0515 2036 TosIde - ok
08:27:52.0593 2036 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
08:27:52.0593 2036 Udfs - ok
08:27:52.0609 2036 ultra - ok
08:27:52.0656 2036 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
08:27:52.0656 2036 Update - ok
08:27:52.0734 2036 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
08:27:52.0734 2036 USBAAPL - ok
08:27:52.0812 2036 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:27:52.0812 2036 usbccgp - ok
08:27:52.0843 2036 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:27:52.0843 2036 usbehci - ok
08:27:52.0875 2036 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:27:52.0890 2036 usbhub - ok
08:27:52.0937 2036 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
08:27:52.0937 2036 usbscan - ok
08:27:52.0968 2036 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:27:52.0968 2036 USBSTOR - ok
08:27:53.0000 2036 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
08:27:53.0000 2036 usbuhci - ok
08:27:53.0031 2036 VClone (fce98c43b5c5db8e0da8ea0e2b45e044) C:\WINDOWS\system32\DRIVERS\VClone.sys
08:27:53.0031 2036 VClone - ok
08:27:53.0078 2036 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
08:27:53.0078 2036 VgaSave - ok
08:27:53.0093 2036 ViaIde - ok
08:27:53.0140 2036 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
08:27:53.0140 2036 VolSnap - ok
08:27:53.0234 2036 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:27:53.0234 2036 Wanarp - ok
08:27:53.0265 2036 WDICA - ok
08:27:53.0312 2036 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
08:27:53.0312 2036 wdmaud - ok
08:27:53.0468 2036 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
08:27:53.0468 2036 WmiAcpi - ok
08:27:53.0578 2036 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
08:27:53.0578 2036 WSTCODEC - ok
08:27:53.0656 2036 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
08:27:53.0656 2036 WudfPf - ok
08:27:53.0687 2036 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
08:27:53.0687 2036 WudfRd - ok
08:27:53.0843 2036 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
08:27:53.0859 2036 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - infected
08:27:53.0859 2036 \Device\Harddisk0\DR0 - detected Backdoor.Win32.Sinowal.knf (0)
08:27:54.0015 2036 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk1\DR1
08:27:54.0015 2036 \Device\Harddisk1\DR1 - ok
08:27:54.0031 2036 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk2\DR2
08:27:54.0031 2036 \Device\Harddisk2\DR2 - ok
08:27:54.0078 2036 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk3\DR6
08:27:54.0078 2036 \Device\Harddisk3\DR6 - ok
08:27:54.0109 2036 Boot (0x1200) (545e8a008aa3e0257118e34bc623c33c) \Device\Harddisk0\DR0\Partition0
08:27:54.0109 2036 \Device\Harddisk0\DR0\Partition0 - ok
08:27:54.0140 2036 Boot (0x1200) (bf3d7442bb0e84650dc9d7abec7e93a4) \Device\Harddisk1\DR1\Partition0
08:27:54.0140 2036 \Device\Harddisk1\DR1\Partition0 - ok
08:27:54.0156 2036 Boot (0x1200) (e3d75ca6740c758f0402d3ecacab74bf) \Device\Harddisk2\DR2\Partition0
08:27:54.0156 2036 \Device\Harddisk2\DR2\Partition0 - ok
08:27:54.0187 2036 Boot (0x1200) (ea5ed5501c79594c297e9cfa1e7ac37b) \Device\Harddisk3\DR6\Partition0
08:27:54.0187 2036 \Device\Harddisk3\DR6\Partition0 - ok
08:27:54.0203 2036 ============================================================
08:27:54.0203 2036 Scan finished
08:27:54.0203 2036 ============================================================
08:27:54.0250 2024 Detected object count: 1
08:27:54.0250 2024 Actual detected object count: 1
08:28:37.0625 2024 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - skipped by user
08:28:37.0625 2024 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - User select action: Skip
08:30:43.0796 2012 Deinitialize success




----------------------

Mir ist aufgefallen, dass ich mittlerweile 6 Administrator-Ordner unter Dokumente und Einstellungen habe, angefangen von Administrator ohne Zusatz bis zu Administrator*Computername*003

Als ich am WE versucht habe, Windows im abges. Modus mit Eingabeaufforderung zu starten, wunderte ich mich schon über die Anzeige im DOS Fenster: Administrator 000, dann Administrator 001, usw.

Merkwürdig??

Psychotic 14.03.2012 08:48
Schritt 1: TDSS-Killer


Dowloade Dir bitte TDSSKiller.exe und speichere die Datei am Desktop.
  • Schließe alle laufenden Programme.
  • Trenne dich von Internet.
  • Deaktiviere deine AntiViren Software.
  • Starte TDSSkiller.exe mit Doppelklick. Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Drücke auf Start scan. Mache während dem Scan nichts am Rechner
    1. Sollte das Tool keine Funde aufweisen, klicke Close um es zu schließen.
    2. Wurde etwas gefunden werden die Funde in Scan results - Select action for found objects angezeigt und geben 3 Auswahlmöglichkeiten. Gehe sicher das Cure ( default ) angehackt ist ! Drücke Continue --> Reboot.
  • Die Logfile ist nach dem Neustart auf deinem Systemlaufwerk ( meist C: ) unter TDSSKiller_version_date_time_log.txt zu finden.
  • Bitte poste mir den Inhalt hier in deinen Thread.
Bebilderte Anleitung zur Benutzung von TDSSKiller.




Schritt 2: Combofix


Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
    Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die End Nutzer Lizenz.
    Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls was schief geht.
    Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.


Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

hoelschi 14.03.2012 09:58
TDSS-Killer ist gelaufen, hat eine Sache gefunden und bin weiter nach Anweisung vorgegangen.

Hier das log-file:
08:55:25.0171 7356 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:43
08:55:25.0187 7356 ============================================================
08:55:25.0187 7356 Current date / time: 2012/03/14 08:55:25.0187
08:55:25.0187 7356 SystemInfo:
08:55:25.0187 7356
08:55:25.0187 7356 OS Version: 5.1.2600 ServicePack: 3.0
08:55:25.0187 7356 Product type: Workstation
08:55:25.0187 7356 ComputerName: MYSTERYMACHINE
08:55:25.0187 7356 UserName: rmhconcepts
08:55:25.0187 7356 Windows directory: C:\WINDOWS
08:55:25.0187 7356 System windows directory: C:\WINDOWS
08:55:25.0187 7356 Processor architecture: Intel x86
08:55:25.0187 7356 Number of processors: 4
08:55:25.0187 7356 Page size: 0x1000
08:55:25.0187 7356 Boot type: Normal boot
08:55:25.0187 7356 ============================================================
08:55:26.0562 7356 Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:55:26.0703 7356 Drive \Device\Harddisk1\DR1 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:55:26.0703 7356 Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:55:26.0703 7356 Drive \Device\Harddisk3\DR6 - Size: 0x3C000000 (0.94 Gb), SectorSize: 0x200, Cylinders: 0x7A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
08:55:26.0703 7356 \Device\Harddisk0\DR0:
08:55:26.0703 7356 MBR used
08:55:26.0703 7356 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x17499EC1
08:55:26.0703 7356 \Device\Harddisk1\DR1:
08:55:26.0703 7356 MBR used
08:55:26.0703 7356 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xDF93782
08:55:26.0703 7356 \Device\Harddisk2\DR2:
08:55:26.0703 7356 MBR used
08:55:26.0703 7356 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
08:55:26.0703 7356 \Device\Harddisk3\DR6:
08:55:26.0703 7356 MBR used
08:55:26.0703 7356 \Device\Harddisk3\DR6\Partition0: MBR, Type 0x6, StartLBA 0xFF, BlocksNum 0x1DFF01
08:55:27.0125 7356 Initialize success
08:55:27.0125 7356 ============================================================
08:55:48.0671 7456 ============================================================
08:55:48.0671 7456 Scan started
08:55:48.0671 7456 Mode: Manual;
08:55:48.0671 7456 ============================================================
08:55:49.0203 7456 Abiosdsk - ok
08:55:49.0218 7456 abp480n5 - ok
08:55:49.0265 7456 acedrv11 (e6f53d6c0dea3d375362265e175ca638) C:\WINDOWS\system32\drivers\acedrv11.sys
08:55:49.0265 7456 acedrv11 - ok
08:55:49.0296 7456 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:55:49.0296 7456 ACPI - ok
08:55:49.0328 7456 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
08:55:49.0328 7456 ACPIEC - ok
08:55:49.0328 7456 adpu160m - ok
08:55:49.0359 7456 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:55:49.0359 7456 aec - ok
08:55:49.0390 7456 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:55:49.0406 7456 AFD - ok
08:55:49.0406 7456 Aha154x - ok
08:55:49.0421 7456 aic78u2 - ok
08:55:49.0421 7456 aic78xx - ok
08:55:49.0437 7456 AliIde - ok
08:55:49.0453 7456 amsint - ok
08:55:49.0468 7456 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
08:55:49.0468 7456 Arp1394 - ok
08:55:49.0484 7456 asc - ok
08:55:49.0484 7456 asc3350p - ok
08:55:49.0500 7456 asc3550 - ok
08:55:49.0531 7456 Aspi32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\aspi32.sys
08:55:49.0531 7456 Aspi32 - ok
08:55:49.0562 7456 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:55:49.0562 7456 AsyncMac - ok
08:55:49.0593 7456 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:55:49.0593 7456 atapi - ok
08:55:49.0593 7456 Atdisk - ok
08:55:49.0640 7456 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:55:49.0640 7456 Atmarpc - ok
08:55:49.0703 7456 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:55:49.0703 7456 audstub - ok
08:55:49.0750 7456 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
08:55:49.0750 7456 avgio - ok
08:55:49.0765 7456 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
08:55:49.0765 7456 avgntflt - ok
08:55:49.0781 7456 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
08:55:49.0781 7456 avipbb - ok
08:55:49.0796 7456 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:55:49.0796 7456 Beep - ok
08:55:49.0859 7456 Cam5603D (2230b842f43a204abd3ec6bdd39d793f) C:\WINDOWS\system32\Drivers\BisonCam.sys
08:55:49.0875 7456 Cam5603D - ok
08:55:49.0921 7456 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:55:49.0921 7456 cbidf2k - ok
08:55:49.0953 7456 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:55:49.0953 7456 CCDECODE - ok
08:55:49.0968 7456 cd20xrnt - ok
08:55:49.0984 7456 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:55:49.0984 7456 Cdaudio - ok
08:55:49.0984 7456 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:55:49.0984 7456 Cdfs - ok
08:55:50.0000 7456 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:55:50.0015 7456 Cdrom - ok
08:55:50.0031 7456 Changer - ok
08:55:50.0078 7456 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
08:55:50.0078 7456 CmBatt - ok
08:55:50.0078 7456 CmdIde - ok
08:55:50.0093 7456 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
08:55:50.0093 7456 Compbatt - ok
08:55:50.0109 7456 Cpqarray - ok
08:55:50.0125 7456 dac2w2k - ok
08:55:50.0125 7456 dac960nt - ok
08:55:50.0140 7456 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
08:55:50.0140 7456 Disk - ok
08:55:50.0187 7456 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
08:55:50.0203 7456 dmboot - ok
08:55:50.0234 7456 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
08:55:50.0234 7456 dmio - ok
08:55:50.0250 7456 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:55:50.0250 7456 dmload - ok
08:55:50.0265 7456 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
08:55:50.0265 7456 DMusic - ok
08:55:50.0281 7456 dpti2o - ok
08:55:50.0296 7456 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
08:55:50.0296 7456 drmkaud - ok
08:55:50.0343 7456 ElbyCDIO (d71233d7ccc2e64f8715a20428d5a33b) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
08:55:50.0343 7456 ElbyCDIO - ok
08:55:50.0359 7456 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
08:55:50.0375 7456 Fastfat - ok
08:55:50.0375 7456 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
08:55:50.0375 7456 Fdc - ok
08:55:50.0406 7456 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
08:55:50.0406 7456 Fips - ok
08:55:50.0421 7456 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
08:55:50.0421 7456 Flpydisk - ok
08:55:50.0453 7456 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
08:55:50.0453 7456 FltMgr - ok
08:55:50.0453 7456 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:55:50.0453 7456 Fs_Rec - ok
08:55:50.0468 7456 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:55:50.0468 7456 Ftdisk - ok
08:55:50.0515 7456 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
08:55:50.0515 7456 GEARAspiWDM - ok
08:55:50.0546 7456 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:55:50.0546 7456 Gpc - ok
08:55:50.0562 7456 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
08:55:50.0562 7456 HDAudBus - ok
08:55:50.0593 7456 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:55:50.0593 7456 HidUsb - ok
08:55:50.0593 7456 hpn - ok
08:55:50.0640 7456 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
08:55:50.0640 7456 HTTP - ok
08:55:50.0656 7456 i2omgmt - ok
08:55:50.0656 7456 i2omp - ok
08:55:50.0687 7456 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:55:50.0687 7456 i8042prt - ok
08:55:50.0718 7456 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:55:50.0718 7456 Imapi - ok
08:55:50.0718 7456 ini910u - ok
08:55:50.0843 7456 IntcAzAudAddService (41ef008d7b089ce6f5f2e4a61d5638e6) C:\WINDOWS\system32\drivers\RtkHDAud.sys
08:55:50.0859 7456 IntcAzAudAddService - ok
08:55:50.0890 7456 IntelIde - ok
08:55:50.0921 7456 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
08:55:50.0921 7456 intelppm - ok
08:55:50.0953 7456 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
08:55:50.0953 7456 Ip6Fw - ok
08:55:50.0984 7456 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:55:50.0984 7456 IpFilterDriver - ok
08:55:51.0031 7456 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:55:51.0031 7456 IpInIp - ok
08:55:51.0031 7456 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:55:51.0046 7456 IpNat - ok
08:55:51.0046 7456 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:55:51.0046 7456 IPSec - ok
08:55:51.0078 7456 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:55:51.0078 7456 IRENUM - ok
08:55:51.0093 7456 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:55:51.0093 7456 isapnp - ok
08:55:51.0125 7456 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:55:51.0125 7456 Kbdclass - ok
08:55:51.0140 7456 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
08:55:51.0140 7456 kmixer - ok
08:55:51.0156 7456 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
08:55:51.0171 7456 KSecDD - ok
08:55:51.0171 7456 lbrtfdc - ok
08:55:51.0218 7456 MarvinBus (a3e700d78eec390f1208098cdca5c6b6) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
08:55:51.0218 7456 MarvinBus - ok
08:55:51.0265 7456 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
08:55:51.0265 7456 MBAMProtector - ok
08:55:51.0328 7456 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:55:51.0328 7456 mnmdd - ok
08:55:51.0359 7456 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
08:55:51.0359 7456 Modem - ok
08:55:51.0375 7456 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:55:51.0375 7456 Mouclass - ok
08:55:51.0421 7456 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:55:51.0421 7456 mouhid - ok
08:55:51.0421 7456 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
08:55:51.0421 7456 MountMgr - ok
08:55:51.0437 7456 mraid35x - ok
08:55:51.0453 7456 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:55:51.0453 7456 MRxDAV - ok
08:55:51.0500 7456 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:55:51.0515 7456 MRxSmb - ok
08:55:51.0562 7456 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
08:55:51.0562 7456 Msfs - ok
08:55:51.0593 7456 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:55:51.0593 7456 MSKSSRV - ok
08:55:51.0609 7456 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:55:51.0609 7456 MSPCLOCK - ok
08:55:51.0625 7456 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
08:55:51.0625 7456 MSPQM - ok
08:55:51.0656 7456 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:55:51.0656 7456 mssmbios - ok
08:55:51.0671 7456 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
08:55:51.0671 7456 MSTEE - ok
08:55:51.0703 7456 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
08:55:51.0703 7456 Mup - ok
08:55:51.0750 7456 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
08:55:51.0750 7456 NABTSFEC - ok
08:55:51.0796 7456 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
08:55:51.0796 7456 NDIS - ok
08:55:51.0812 7456 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
08:55:51.0812 7456 NdisIP - ok
08:55:51.0843 7456 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:55:51.0843 7456 NdisTapi - ok
08:55:51.0859 7456 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:55:51.0859 7456 Ndisuio - ok
08:55:51.0875 7456 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:55:51.0875 7456 NdisWan - ok
08:55:51.0890 7456 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
08:55:51.0890 7456 NDProxy - ok
08:55:51.0921 7456 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:55:51.0921 7456 NetBIOS - ok
08:55:51.0953 7456 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:55:51.0968 7456 NetBT - ok
08:55:52.0078 7456 NETw4x32 (12b0d99865434387f784268b70e23360) C:\WINDOWS\system32\DRIVERS\NETw4x32.sys
08:55:52.0156 7456 NETw4x32 - ok
08:55:52.0328 7456 NETw5x32 (580207a7c9bde8ba65401f51f9ba9741) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
08:55:52.0421 7456 NETw5x32 - ok
08:55:52.0468 7456 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
08:55:52.0468 7456 NIC1394 - ok
08:55:52.0515 7456 NPF (b9730495e0cf674680121e34bd95a73b) C:\WINDOWS\system32\drivers\npf.sys
08:55:52.0515 7456 NPF - ok
08:55:52.0531 7456 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
08:55:52.0531 7456 Npfs - ok
08:55:52.0562 7456 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
08:55:52.0578 7456 Ntfs - ok
08:55:52.0625 7456 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:55:52.0625 7456 Null - ok
08:55:52.0796 7456 nv (a50a030be64fa2fdb548a2ee888f8adb) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:55:52.0906 7456 nv - ok
08:55:52.0968 7456 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:55:52.0968 7456 NwlnkFlt - ok
08:55:53.0000 7456 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:55:53.0000 7456 NwlnkFwd - ok
08:55:53.0046 7456 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
08:55:53.0046 7456 ohci1394 - ok
08:55:53.0062 7456 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
08:55:53.0062 7456 Parport - ok
08:55:53.0078 7456 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
08:55:53.0078 7456 PartMgr - ok
08:55:53.0093 7456 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
08:55:53.0093 7456 ParVdm - ok
08:55:53.0109 7456 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
08:55:53.0109 7456 PCI - ok
08:55:53.0125 7456 PCIDump - ok
08:55:53.0140 7456 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:55:53.0140 7456 PCIIde - ok
08:55:53.0171 7456 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
08:55:53.0171 7456 Pcmcia - ok
08:55:53.0171 7456 PDCOMP - ok
08:55:53.0187 7456 PDFRAME - ok
08:55:53.0203 7456 PDRELI - ok
08:55:53.0203 7456 PDRFRAME - ok
08:55:53.0218 7456 perc2 - ok
08:55:53.0218 7456 perc2hib - ok
08:55:53.0250 7456 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:55:53.0250 7456 PptpMiniport - ok
08:55:53.0265 7456 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
08:55:53.0265 7456 PSched - ok
08:55:53.0281 7456 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:55:53.0281 7456 Ptilink - ok
08:55:53.0296 7456 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
08:55:53.0328 7456 PxHelp20 - ok
08:55:53.0328 7456 ql1080 - ok
08:55:53.0343 7456 Ql10wnt - ok
08:55:53.0359 7456 ql12160 - ok
08:55:53.0359 7456 ql1240 - ok
08:55:53.0375 7456 ql1280 - ok
08:55:53.0390 7456 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:55:53.0390 7456 RasAcd - ok
08:55:53.0406 7456 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:55:53.0421 7456 Rasl2tp - ok
08:55:53.0421 7456 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:55:53.0421 7456 RasPppoe - ok
08:55:53.0437 7456 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:55:53.0437 7456 Raspti - ok
08:55:53.0484 7456 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:55:53.0500 7456 Rdbss - ok
08:55:53.0500 7456 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:55:53.0500 7456 RDPCDD - ok
08:55:53.0515 7456 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:55:53.0515 7456 rdpdr - ok
08:55:53.0578 7456 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
08:55:53.0578 7456 RDPWD - ok
08:55:53.0593 7456 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:55:53.0593 7456 redbook - ok
08:55:53.0625 7456 regi (c1e596e42e77f94d5c1c18fd9b2b3274) C:\WINDOWS\system32\drivers\regi.sys
08:55:53.0640 7456 regi - ok
08:55:53.0671 7456 Revoflt (8b5b8a11306190c6963d3473f052d3c8) C:\WINDOWS\system32\DRIVERS\revoflt.sys
08:55:53.0671 7456 Revoflt - ok
08:55:53.0703 7456 RTLE8023xp (25be98c05808c57e4d8d26477dc12d39) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
08:55:53.0703 7456 RTLE8023xp - ok
08:55:53.0734 7456 s24trans (e7958e8acda7ca20127ef5f2235f25cc) C:\WINDOWS\system32\DRIVERS\s24trans.sys
08:55:53.0734 7456 s24trans - ok
08:55:53.0781 7456 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
08:55:53.0781 7456 sdbus - ok
08:55:53.0812 7456 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:55:53.0812 7456 Secdrv - ok
08:55:53.0843 7456 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
08:55:53.0843 7456 Serial - ok
08:55:53.0890 7456 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:55:53.0890 7456 Sfloppy - ok
08:55:53.0906 7456 Simbad - ok
08:55:53.0921 7456 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
08:55:53.0921 7456 SLIP - ok
08:55:53.0968 7456 smserial (d9bfd2298f5cf116d8eaae3b02dcee2e) C:\WINDOWS\system32\DRIVERS\smserial.sys
08:55:53.0984 7456 smserial - ok
08:55:54.0000 7456 Sparrow - ok
08:55:54.0015 7456 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
08:55:54.0015 7456 splitter - ok
08:55:54.0031 7456 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
08:55:54.0031 7456 sr - ok
08:55:54.0062 7456 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
08:55:54.0062 7456 Srv - ok
08:55:54.0078 7456 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
08:55:54.0078 7456 ssmdrv - ok
08:55:54.0109 7456 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
08:55:54.0125 7456 streamip - ok
08:55:54.0171 7456 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:55:54.0171 7456 swenum - ok
08:55:54.0171 7456 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
08:55:54.0171 7456 swmidi - ok
08:55:54.0187 7456 symc810 - ok
08:55:54.0203 7456 symc8xx - ok
08:55:54.0203 7456 sym_hi - ok
08:55:54.0218 7456 sym_u3 - ok
08:55:54.0250 7456 SynTP (60b421663910fbb3c9b350b7efa75a68) C:\WINDOWS\system32\DRIVERS\SynTP.sys
08:55:54.0250 7456 SynTP - ok
08:55:54.0265 7456 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
08:55:54.0265 7456 sysaudio - ok
08:55:54.0312 7456 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:55:54.0312 7456 Tcpip - ok
08:55:54.0343 7456 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:55:54.0343 7456 TDPIPE - ok
08:55:54.0375 7456 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
08:55:54.0375 7456 TDTCP - ok
08:55:54.0406 7456 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:55:54.0421 7456 TermDD - ok
08:55:54.0437 7456 tifm21 (78213f01ce781f93180bef5eb5b3ad81) C:\WINDOWS\system32\drivers\tifm21.sys
08:55:54.0437 7456 tifm21 - ok
08:55:54.0453 7456 TosIde - ok
08:55:54.0484 7456 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
08:55:54.0500 7456 Udfs - ok
08:55:54.0531 7456 ultra - ok
08:55:54.0562 7456 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
08:55:54.0562 7456 Update - ok
08:55:54.0593 7456 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
08:55:54.0593 7456 USBAAPL - ok
08:55:54.0640 7456 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:55:54.0640 7456 usbccgp - ok
08:55:54.0671 7456 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:55:54.0671 7456 usbehci - ok
08:55:54.0703 7456 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:55:54.0703 7456 usbhub - ok
08:55:54.0750 7456 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
08:55:54.0750 7456 usbscan - ok
08:55:54.0765 7456 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:55:54.0765 7456 USBSTOR - ok
08:55:54.0781 7456 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
08:55:54.0781 7456 usbuhci - ok
08:55:54.0812 7456 VClone (fce98c43b5c5db8e0da8ea0e2b45e044) C:\WINDOWS\system32\DRIVERS\VClone.sys
08:55:54.0812 7456 VClone - ok
08:55:54.0828 7456 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
08:55:54.0828 7456 VgaSave - ok
08:55:54.0843 7456 ViaIde - ok
08:55:54.0859 7456 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
08:55:54.0859 7456 VolSnap - ok
08:55:54.0890 7456 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:55:54.0890 7456 Wanarp - ok
08:55:54.0937 7456 WDICA - ok
08:55:54.0953 7456 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
08:55:54.0953 7456 wdmaud - ok
08:55:54.0984 7456 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
08:55:54.0984 7456 WmiAcpi - ok
08:55:55.0015 7456 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
08:55:55.0015 7456 WSTCODEC - ok
08:55:55.0062 7456 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
08:55:55.0062 7456 WudfPf - ok
08:55:55.0078 7456 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
08:55:55.0078 7456 WudfRd - ok
08:55:55.0109 7456 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
08:55:55.0125 7456 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - infected
08:55:55.0125 7456 \Device\Harddisk0\DR0 - detected Backdoor.Win32.Sinowal.knf (0)
08:55:55.0171 7456 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk1\DR1
08:55:55.0171 7456 \Device\Harddisk1\DR1 - ok
08:55:55.0218 7456 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk2\DR2
08:55:55.0218 7456 \Device\Harddisk2\DR2 - ok
08:55:55.0218 7456 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk3\DR6
08:55:55.0234 7456 \Device\Harddisk3\DR6 - ok
08:55:55.0234 7456 Boot (0x1200) (545e8a008aa3e0257118e34bc623c33c) \Device\Harddisk0\DR0\Partition0
08:55:55.0234 7456 \Device\Harddisk0\DR0\Partition0 - ok
08:55:55.0234 7456 Boot (0x1200) (bf3d7442bb0e84650dc9d7abec7e93a4) \Device\Harddisk1\DR1\Partition0
08:55:55.0234 7456 \Device\Harddisk1\DR1\Partition0 - ok
08:55:55.0234 7456 Boot (0x1200) (e3d75ca6740c758f0402d3ecacab74bf) \Device\Harddisk2\DR2\Partition0
08:55:55.0234 7456 \Device\Harddisk2\DR2\Partition0 - ok
08:55:55.0250 7456 Boot (0x1200) (ea5ed5501c79594c297e9cfa1e7ac37b) \Device\Harddisk3\DR6\Partition0
08:55:55.0250 7456 \Device\Harddisk3\DR6\Partition0 - ok
08:55:55.0250 7456 ============================================================
08:55:55.0250 7456 Scan finished
08:55:55.0250 7456 ============================================================
08:55:55.0250 7448 Detected object count: 1
08:55:55.0250 7448 Actual detected object count: 1
08:56:16.0718 7448 \Device\Harddisk0\DR0\# - copied to quarantine
08:56:16.0718 7448 \Device\Harddisk0\DR0 - copied to quarantine
08:56:16.0750 7448 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - will be cured on reboot
08:56:16.0750 7448 \Device\Harddisk0\DR0 - ok
08:56:16.0750 7448 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - User select action: Cure
08:56:27.0968 5268 Deinitialize success



Nun zum Problem:

Bin nach Anweisung vorgegangen, aber Combofix startet nicht richtig.
Die blaue Box erscheint.

Combofix wird vorbereitet, um ausgeführt zu werden.
Versuche, einen neuen Systemwiederherstellungspunkt zu erstellen.

Außer einem blinkenden Cursor passiert seit ca. einer halben Stunde nichts mehr.

-----

Was ist mit meinen diversen Administrator-Ordnern?
Defogger ist zwar schon lange geschlossen, aber meine letzte Aktion war der disable-Button. Muss man vielleicht wieder auf Re-enable drücken, um Combofix ordentlich laufen zu lassen?

Psychotic 14.03.2012 10:04
Zitat:
Außer einem blinkenden Cursor passiert seit ca. einer halben Stunde nichts mehr.
Wenn das nicht funktioniert, starte den Rechner im abgesicherten Modus mit Netzwerktreibern neu und versuche erneut, CF auszuführen.


Zitat:
Was ist mit meinen diversen Administrator-Ordnern?
Abwarten, was davon am Ende noch übrig ist! ;)

Zitat:
Defogger ist zwar schon lange geschlossen, aber meine letzte Aktion war der disable-Button. Muss man vielleicht wieder auf Re-enable drücken, um Combofix ordentlich laufen zu lassen?
NEIN! :nono:
Defogger deaktiviert Programme auf deinem Rechner, die uns bei der Arbeit massiv behindern - lass ihn also deaktiviert!

hoelschi 14.03.2012 10:36
auch im abgesicherten Modus passiert nicht mehr, als vorher beschrieben.
Bei dem Versuch, einen Systemwiederherstellungspunkt zu setzen, kommt außer dem blinkenden Cursor nichts mehr.

Ich habe gerade versucht, eine alte Software mittels Revo Uninstaller vom Rechner zu schmeißen. Auch hier konnte kein Wiederherstellungspunkt gesetzt werden.

Ich kann auch über die Systemwiederherstellung keinen älteren Punkt als vom gestrigen Nachmittag aufrufen, als ich die massive Verseuchung des Rechners festgestellt habe. Normalerweise habe ich jeden zweiten Tag einen Punkt gehabt.

Psychotic 14.03.2012 11:05
Schritt 1: OTL-Fix

Code:
:OTL
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=110004&babsrc=SP_ss&mntrId=0c4614b70000000000000013e8bfcf83
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;
FF - prefs.js..network.proxy.ftp: "localhost"
FF - prefs.js..network.proxy.ftp_port: 8118
FF - prefs.js..network.proxy.gopher: "localhost"
FF - prefs.js..network.proxy.gopher_port: 8118
FF - prefs.js..network.proxy.http: "localhost"
FF - prefs.js..network.proxy.http_port: 8118
FF - prefs.js..network.proxy.no_proxies_on: "localhost"
FF - prefs.js..network.proxy.socks: "localhost"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.ssl: "localhost"
FF - prefs.js..network.proxy.ssl_port: 8118
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5016 [2011.06.09 13:48:26 | 000,000,000 | ---D | M]
[2012.03.11 20:56:11 | 000,002,310 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKCU..\Run: [Upgrade] C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\ICQ\{3783BB90-B123-4517-88AD-B71213A65C19}\Upgrade.exe (Conexant Systems , Inc.)
[2012.03.14 08:01:16 | 000,000,238 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
:COMMANDS
[CLEARALLRESTOREPOINTS]
[EMPTYTEMP]
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Schritt 2: MBAM


Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.


Schritt 3: aswMBR


Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

hoelschi 14.03.2012 13:15
OTL.exe habe ich ja noch auf dem Deskop. Habe es gestartet, den Text hineinkopiert, alle Programme geschlossen und Fix-Button gedrückt.

Da ich seit dem Wochenende Malwarebytes laufen habe, kam jetzt eine Fehlermeldung "Malwarebytes unexpected terminated", o.ä. und alles war wie eingefroren. Nur der Cursor ließ sich noch über den Bildschirm bewegen.

Also Rechner ausgeschaltet, neu gestartet, Malwarebytes deaktiviert, OTL.exe gestartet, Text hineinkopiert, alle Programme geschlossen und wieder Fix-Button gedrückt. Wieder war alles eingefroren. Im Fenster von OTL steht zwar unten: Killing processes. Do not interrupt..., aber das steht dann da auch länger als eine halbe Stunde und nichts weiter passiert. Alles eingefroren.

Mache ich was falsch??

Psychotic 14.03.2012 13:27
Starte den Rechner im abgesicherten Modus und führe dort Schritt 1 durch.

Berichte. ;)

hoelschi 14.03.2012 14:01
Hat prächtig funktioniert, aber um die Dateien endgültig zu löschen, muss ich das System neu starten. Soll ich normal starten lassen, oder wieder im abgesicherten Modus?

Soll ich danach mit den Schritten 2 und 3 weitermachen?

Psychotic 14.03.2012 15:32
Ja, mach direkt weiter und poste dann gemeinsam die Logfiles! :)

hoelschi 14.03.2012 16:00
Hat alles prima funktioniert. Das DOS-Fenster von aswMBR habe ich offen gelassen, falls ich noch einen FIX-Button drücken soll.

Logfile von OTL:

All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "localhost" removed from network.proxy.ftp
Prefs.js: 8118 removed from network.proxy.ftp_port
Prefs.js: "localhost" removed from network.proxy.gopher
Prefs.js: 8118 removed from network.proxy.gopher_port
Prefs.js: "localhost" removed from network.proxy.http
Prefs.js: 8118 removed from network.proxy.http_port
Prefs.js: "localhost" removed from network.proxy.no_proxies_on
Prefs.js: "localhost" removed from network.proxy.socks
Prefs.js: 9050 removed from network.proxy.socks_port
Prefs.js: "localhost" removed from network.proxy.ssl
Prefs.js: 8118 removed from network.proxy.ssl_port
File HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5016 not found.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Upgrade deleted successfully.
C:\Dokumente und Einstellungen\rmhconcepts\Anwendungsdaten\ICQ\{3783BB90-B123-4517-88AD-B71213A65C19}\Upgrade.exe moved successfully.
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job moved successfully.
========== COMMANDS ==========
Restore points cleared and new OTL Restore Point set!

[EMPTYTEMP]

User: Administrator
->Temporary Internet Files folder emptied: 32768 bytes
->FireFox cache emptied: 5850072 bytes
->Flash cache emptied: 2836 bytes

User: Administrator.MYSTERYMACHINE
->Temporary Internet Files folder emptied: 205592 bytes
->Flash cache emptied: 2836 bytes

User: Administrator.MYSTERYMACHINE.000
->Temporary Internet Files folder emptied: 205592 bytes
->Flash cache emptied: 2836 bytes

User: Administrator.MYSTERYMACHINE.001
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: Administrator.MYSTERYMACHINE.002
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 205994 bytes
->Flash cache emptied: 56475 bytes

User: Administrator.MYSTERYMACHINE.003
->Temp folder emptied: 180224 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: LocalService
->Temp folder emptied: 82513 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1654690 bytes

User: rmhconcepts
->Temp folder emptied: 21335102362 bytes
->Temporary Internet Files folder emptied: 1263467646 bytes
->Java cache emptied: 9537529 bytes
->FireFox cache emptied: 680391803 bytes
->Flash cache emptied: 68416 bytes

User: tom
->Temp folder emptied: 224050156 bytes
->Temporary Internet Files folder emptied: 61504410 bytes
->Java cache emptied: 3873126 bytes
->FireFox cache emptied: 51316220 bytes
->Flash cache emptied: 116003 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2154807 bytes
%systemroot%\System32 .tmp files removed: 6678919 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23346000 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 22.574,00 mb


OTL by OldTimer - Version 3.2.36.3 log created on 03142012_133702

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Logfile von mbam:

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.14.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
rmhconcepts :: MYSTERYMACHINE [Administrator]

Schutz: Aktiviert

14.03.2012 15:00:45
mbam-log-2012-03-14 (15-00-45).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 296472
Laufzeit: 4 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


Logfile von aswMBR:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-14 15:20:05
-----------------------------
15:20:05.062 OS Version: Windows 5.1.2600 Service Pack 3
15:20:05.062 Number of processors: 4 586 0xF0B
15:20:05.062 ComputerName: MYSTERYMACHINE UserName: rmhconcepts
15:20:05.828 Initialize success
15:30:02.531 AVAST engine defs: 12031400
15:32:46.953 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-11
15:32:46.953 Disk 0 Vendor: Hitachi_HTS722020K9SA00 DC4OC54P Size: 190782MB BusType: 3
15:32:46.968 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-19
15:32:46.968 Disk 1 Vendor: ST9120823AS 3.AAB Size: 114473MB BusType: 3
15:32:46.968 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T0L0-24
15:32:46.968 Disk 2 Vendor: ST9500420AS 0002SDM1 Size: 476940MB BusType: 3
15:32:46.984 Disk 0 MBR read successfully
15:32:46.984 Disk 0 MBR scan
15:32:47.015 Disk 0 Windows XP default MBR code
15:32:47.015 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 190771 MB offset 63
15:32:47.015 Disk 0 scanning sectors +390700800
15:32:47.046 Disk 0 malicious Win32:MBRoot code @ sector 390700803 !
15:32:47.078 Disk 0 scanning C:\WINDOWS\system32\drivers
15:32:55.000 Service scanning
15:33:10.390 Modules scanning
15:33:12.890 Disk 0 trace - called modules:
15:33:12.890 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
15:33:12.890 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ace3ab8]
15:33:12.890 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000008c[0x8ad54a50]
15:33:12.890 5 ACPI.sys[f75ad620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-11[0x8ad17b00]
15:33:13.484 AVAST engine scan C:\WINDOWS
15:33:25.093 AVAST engine scan C:\WINDOWS\system32
15:35:38.484 AVAST engine scan C:\WINDOWS\system32\drivers
15:35:49.015 AVAST engine scan C:\Dokumente und Einstellungen\rmhconcepts
15:49:35.234 AVAST engine scan C:\Dokumente und Einstellungen\All Users
15:53:32.671 Scan finished successfully
15:54:33.843 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\rmhconcepts\Desktop\MBR.dat"
15:54:33.843 The log file has been saved successfully to "C:\Dokumente und Einstellungen\rmhconcepts\Desktop\aswMBR.txt"

Psychotic 14.03.2012 16:07
Starte neu!


Schritt 1: MBAM (Full scan)





Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Vollständigen Scan durchführen und drücke auf Scannen.(Hinweis: Alle Festplatten anhaken!
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.



Schritt 2: ESET




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


hoelschi 14.03.2012 16:10
Kann ich das DOS-Fenster von aswMBR vor dem Neustart schließen, ohne irgendetwas zu drücken?


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:09 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131