Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   SMART HDD Virus Befall / wie entfernen? (https://www.trojaner-board.de/113184-smart-hdd-virus-befall-entfernen.html)

mikaa 05.04.2012 10:03
SMART HDD Virus Befall / wie entfernen?
 
Hallo. Seit gestern gibt es die typischen "smart hdd"-Probleme auf dem Rechner; alles auf dem Desktop ist verschwunden; es öffneten sich viele Fenster mit "angeblichen Virus-Meldungen" von SMART HDD.
Ich habe das Programm zum Glück nicht gekauft. Ich konnte irgendwie ins Internet gelangen, habe mir Malwarebytes heruntergeladen und einen Scan durchgeführt.
Nachd em Scan und Neustart ist der Papierkorb wieder da und eigene Dateien; alles weitere fehlt noch.
Was kann ich tun um ihn loszuwerden?

Lieben Dank,

Monika

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.04.05.03

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2096
slimak :: JAMAKSJA [Administrator]

05.04.2012 10:16:22
mbam-log-2012-04-05 (10-16-22).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 172135
Laufzeit: 9 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 2
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\lxREnplrbMhlohn.exe (Backdoor.Agent.RCGen) -> 1608 -> Löschen bei Neustart.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\gJkNgQrByltLj6.exe (Backdoor.Agent.RCGen) -> 3528 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|lxREnplrbMhlohn.exe (Backdoor.Agent.RCGen) -> Daten: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\lxREnplrbMhlohn.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 7
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\lxREnplrbMhlohn.exe (Backdoor.Agent.RCGen) -> Löschen bei Neustart.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\gJkNgQrByltLj6.exe (Backdoor.Agent.RCGen) -> Löschen bei Neustart.
C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Temp\kes86897.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 05.04.2012 20:00
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

mikaa 06.04.2012 15:11
Hallo, vielen Dank!
Habe heute beide empfohlenen Scans durchgeführt. Die logs werde ich gleich einfügen.
Es ist im Moment immer noch der Papierkorb und der Ordner "eigene Dateien" zu sehen, allerdings sind beide leer. So wie der Rest des Computers (keine Programme....)

Hier der malware-log:

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.04.06.02

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2096
slimak :: JAMAKSJA [Administrator]

06.04.2012 15:27:19
mbam-log-2012-04-06 (15-27-19).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 218958
Laufzeit: 34 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Hier der ESET-Log:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ecab6e201509da4285353818afd4543a
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-06 01:21:59
# local_time=2012-04-06 03:21:59 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2, v.2096
# compatibility_mode=1032 16777173 100 95 0 76891318 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=41580
# found=5
# cleaned=0
# scan_time=2147
C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\Setup.exe    Win32/Toolbar.Babylon application (unable to clean)    00000000000000000000000000000000    I
C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Temp\19099116-BAB0-7891-A9D1-A36D63B57BB5\MyBabylonTB.exe    Win32/Toolbar.Babylon application (unable to clean)    00000000000000000000000000000000    I
C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Temp\19099116-BAB0-7891-A9D1-A36D63B57BB5\Setup.exe    Win32/Toolbar.Babylon application (unable to clean)    00000000000000000000000000000000    I
C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe    Win32/Toolbar.Babylon application (unable to clean)    00000000000000000000000000000000    I
C:\WINDOWS\FixCamera.exe    a variant of Win32/KillProc.A application (unable to clean)    00000000000000000000000000000000    I
Lieben Dank für die Unterstützung!

Monika

cosinus 06.04.2012 15:37
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

mikaa 06.04.2012 15:49
Super, alles wieder da! MERCI!

Jetzt ist nur noch das Programm SMART HDD in der Startleiste zu sehen incl. der Datei "Uninstall SMART HDD" - soll ich da drauf drücken?? Oder wwas soll ich machen damit es verschwindet?

LG,

Monika

cosinus 06.04.2012 15:50
Nicht da drauf drücken!! LÖSCHEN!!

Mach danach ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

mikaa 06.04.2012 16:10
Okay...habe die Verknüpfung gelöscht und OTL durchlaufen lassen. Hier die OTL.txt

Code:
OTL logfile created on: 06.04.2012 16:58:38 - Run 1
OTL by OldTimer - Version 3.2.39.2    Folder = C:\Dokumente und Einstellungen\slimak\Desktop
Windows XP Professional Edition Service Pack 2, v.2096 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2096)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 72,55% Memory free
3,60 Gb Paging File | 3,27 Gb Available in Paging File | 90,85% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 36,15 Gb Free Space | 74,04% Space Free | Partition Type: NTFS
Drive D: | 27,85 Gb Total Space | 27,77 Gb Free Space | 99,71% Space Free | Partition Type: NTFS
 
Computer Name: JAMAKSJA | User Name: slimak | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.04.06 16:54:33 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\slimak\Desktop\OTL.exe
PRC - [2012.01.31 16:02:52 | 007,391,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2012.01.17 21:03:24 | 002,339,168 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgtray.exe
PRC - [2011.09.09 03:10:56 | 001,082,208 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgnsx.exe
PRC - [2011.08.18 01:33:26 | 000,659,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgrsx.exe
PRC - [2011.05.23 14:13:04 | 000,657,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgchsvx.exe
PRC - [2011.03.28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgcsrvx.exe
PRC - [2011.03.16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgemcx.exe
PRC - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgwdsvc.exe
PRC - [2006.10.10 14:11:08 | 000,827,392 | ---- | M] () -- C:\WINDOWS\vsnp325.exe
PRC - [2004.03.12 01:10:20 | 001,031,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.05 19:04:58 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
MOD - [2006.10.10 14:11:08 | 000,827,392 | ---- | M] () -- C:\WINDOWS\vsnp325.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.01.31 16:02:52 | 007,391,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG10\avgwdsvc.exe -- (avgwd)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2011.05.27 19:05:44 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011.03.16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011.03.01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011.02.22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV - [2011.02.10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011.02.10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011.01.07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2007.01.27 09:56:18 | 010,242,176 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp325.sys -- (SNP325) USB PC Camera (SNPSTD325)
DRV - [2005.10.15 05:07:12 | 001,351,680 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2004.03.12 01:53:40 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004.03.12 00:14:40 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x)
DRV - [2004.03.11 23:46:44 | 000,084,480 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97via.sys -- (VIAudio) VIA AC'97 Audiocontroller (WDM)
DRV - [2004.03.11 23:43:50 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2003.07.02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2001.08.18 04:27:44 | 000,009,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NtApm.sys -- (NtApm)
DRV - [2001.08.17 15:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001.08.17 14:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = ${SEARCH_URL_IE7}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.softonic.com/MON00005/tb_v1?SearchSource=10&cc=
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\..\SearchScopes,DefaultScope = {DCDBBF03-BC10-457D-911F-EFB0321D22BE}
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\..\SearchScopes\{DCDBBF03-BC10-457D-911F-EFB0321D22BE}: "URL" = ${SRCH_SCP_URL}
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?babsrc=HP_Prot"
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1410
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Programme\AVG\AVG10\Firefox4\ [2012.02.05 12:05:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.12.06 16:17:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
 
[2011.10.06 12:40:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Extensions
[2012.04.05 11:29:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions
[2012.03.21 15:17:37 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.12.14 20:06:08 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com
[2011.12.14 20:06:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com
[2012.04.05 11:29:45 | 000,000,000 | ---D | M] (softonic.com) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbra@softonic.com
[2012.04.05 11:29:27 | 000,002,060 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\searchplugins\softonic.xml
[2011.12.06 17:17:59 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.12.06 17:17:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011.10.06 18:22:03 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2011.10.06 18:22:03 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012.02.05 12:05:45 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAMME\AVG\AVG10\FIREFOX4
[2011.12.06 17:17:42 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.06.16 06:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.14 20:06:08 | 000,002,288 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - Extension: AVG Safe Search = C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\10.0.0.1409_0\
 
O1 HOSTS File: ([2001.08.18 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [snp325] C:\WINDOWS\vsnp325.exe ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-602162358-1645522239-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Tools\Office\XP\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DD8B0A29-AB69-4ABF-B441-53A6F41E3AA4}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.04.18 19:28:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "AVGIDSAgent"
MsConfig - Services: "ATI Smart"
MsConfig - Services: "Ati HotKey Poller"
MsConfig - Services: "JavaQuickStarterService"
MsConfig - Services: "WZCSVC"
MsConfig - Services: "WmdmPmSN"
MsConfig - Services: "seclogon"
MsConfig - Services: "SCardSvr"
MsConfig - Services: "SCardDrv"
MsConfig - Services: "Irmon"
MsConfig - Services: "ERSvc"
MsConfig - Services: "CryptSvc"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk - C:\Tools\Office\XP\Office10\OSA.EXE - (Microsoft Corporation)
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: APSDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: ATICustomerCare - hkey= - key= - C:\Programme\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
MsConfig - StartUpReg: Browser companion helper - hkey= - key= - C:\Programme\BrowserCompanion\BCHelper.exe (Blabbers Communications LTD)
MsConfig - StartUpReg: Cmaudio - hkey= - key= -  File not found
MsConfig - StartUpReg: EEventManager - hkey= - key= - C:\Programme\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
MsConfig - StartUpReg: EPSON BX525WD Series - hkey= - key= -  File not found
MsConfig - StartUpReg: EPSON Stylus DX4800 Series - hkey= - key= -  File not found
MsConfig - StartUpReg: FixCamera - hkey= - key= - C:\WINDOWS\FixCamera.exe ()
MsConfig - StartUpReg: QuickTime Task - hkey= - key= -  File not found
MsConfig - StartUpReg: RaidTool - hkey= - key= - C:\Programme\VIA\RAID\raid_tool.exe (VIA Technologies)
MsConfig - StartUpReg: snp325 - hkey= - key= - C:\WINDOWS\vsnp325.exe ()
MsConfig - StartUpReg: tsnp325 - hkey= - key= - C:\WINDOWS\tsnp325.exe ()
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.0
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 8.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.0
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.06 16:54:25 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\slimak\Desktop\OTL.exe
[2012.04.06 16:31:37 | 000,397,728 | ---- | C] (Bleeping Computer, LLC) -- C:\Dokumente und Einstellungen\slimak\Desktop\unhide.exe
[2012.04.06 14:41:27 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.04.05 10:30:12 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\slimak\Recent
[2012.04.05 10:14:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Malwarebytes
[2012.04.05 10:14:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.04.05 10:14:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.04.05 10:14:32 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.04.05 10:14:32 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.03.30 13:12:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Desktop\kwiecien
[2012.03.28 19:41:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Audacity
[2012.03.28 19:29:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\Mamas Geburtstag
[2012.03.19 16:20:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\Anton
[2012.03.12 12:51:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\moje
[2012.03.12 11:24:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\Renia Antrag
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.06 16:54:33 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\slimak\Desktop\OTL.exe
[2012.04.06 16:40:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.04.06 16:31:39 | 000,397,728 | ---- | M] (Bleeping Computer, LLC) -- C:\Dokumente und Einstellungen\slimak\Desktop\unhide.exe
[2012.04.06 14:40:36 | 093,978,413 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012.04.05 17:17:22 | 000,000,208 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Desktop\Verknüpfung mit EPSON BX525WD Series.lnk
[2012.04.05 11:29:50 | 000,000,295 | ---- | M] () -- C:\user.js
[2012.04.05 10:14:34 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.02 20:26:14 | 001,399,714 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\Attachments_2012_04_2.zip
[2012.04.02 09:01:59 | 000,002,485 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Desktop\Microsoft Word.lnk
[2012.03.31 19:03:23 | 000,018,022 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\irka.jpeg
[2012.03.28 19:27:36 | 000,014,848 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.25 07:51:35 | 000,316,924 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.03.25 07:51:35 | 000,311,740 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.03.25 07:51:35 | 000,048,354 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.03.25 07:51:35 | 000,040,128 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.03.20 18:54:28 | 000,065,108 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012.03.14 22:28:49 | 000,057,916 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\podusia.jpg
[2012.03.13 20:20:53 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.03.10 11:24:00 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.05 17:17:22 | 000,000,208 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Desktop\Verknüpfung mit EPSON BX525WD Series.lnk
[2012.04.05 10:14:34 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.02 20:26:12 | 001,399,714 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\Attachments_2012_04_2.zip
[2012.03.31 19:03:23 | 000,018,022 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\irka.jpeg
[2012.03.14 22:28:49 | 000,057,916 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Eigene Dateien\podusia.jpg
[2011.10.18 20:25:54 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Anwendungsdaten\{EB1EB85A-B44E-4DFC-9245-4EBF2FCEA396}
[2011.10.18 20:25:54 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Anwendungsdaten\{946B8A0D-5BAD-491C-8AEB-D28F03D48327}
[2011.05.26 12:11:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011.05.20 20:36:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\EEventManager.INI
[2011.04.24 17:28:39 | 000,014,848 | ---- | C] () -- C:\Dokumente und Einstellungen\slimak\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.21 07:30:23 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.04.19 17:15:19 | 000,020,480 | ---- | C] () -- C:\WINDOWS\FixCamera.exe
[2011.04.19 17:15:13 | 000,827,392 | ---- | C] () -- C:\WINDOWS\vsnp325.exe
[2011.04.19 17:15:10 | 000,270,336 | ---- | C] () -- C:\WINDOWS\tsnp325.exe
[2011.04.19 17:15:10 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snp325.ini
[2011.04.19 17:15:05 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp325.dll
[2011.04.19 17:15:04 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnp325.dll
[2011.04.19 17:15:03 | 000,147,456 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp325.dll
[2011.04.19 15:23:15 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.04.19 14:49:15 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2011.04.19 14:49:15 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2011.04.19 14:49:15 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2011.04.19 14:49:15 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2011.04.19 14:49:15 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2011.04.19 14:49:15 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2011.04.19 14:49:15 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2011.04.19 14:49:15 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2011.04.19 14:49:15 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2011.04.19 14:49:15 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2011.04.19 14:49:15 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2011.04.19 14:49:15 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2011.04.19 14:49:15 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2011.04.19 14:49:15 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2011.04.19 14:49:15 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2011.04.19 14:49:15 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2011.04.19 14:49:15 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2011.04.19 14:49:15 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2011.04.19 14:49:15 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2011.04.19 13:56:39 | 000,516,096 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2011.04.19 13:56:31 | 000,109,589 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011.04.19 13:16:34 | 000,233,472 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.exe
[2011.04.19 13:16:34 | 000,028,672 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll
[2011.04.19 13:16:22 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2011.04.19 13:16:21 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2011.04.19 13:16:19 | 000,000,010 | ---- | C] () -- C:\WINDOWS\Wininit.ini
[2011.04.19 13:16:10 | 000,266,240 | ---- | C] () -- C:\WINDOWS\CMIUninstall.exe
[2011.04.19 13:16:10 | 000,225,280 | ---- | C] () -- C:\WINDOWS\CmiRmRedundDir.exe
[2011.04.19 13:16:10 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll
[2011.04.19 13:14:17 | 000,003,255 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2011.04.19 13:04:00 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2011.04.18 20:12:30 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.04.18 20:11:00 | 000,184,224 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.18 19:30:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.04.18 19:25:39 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
 
========== LOP Check ==========
 
[2011.07.13 08:20:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG10
[2011.12.14 20:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2011.04.19 11:24:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2011.05.20 18:19:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2012.02.04 17:51:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData
[2011.05.20 18:24:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2012.03.28 19:48:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Audacity
[2011.04.19 11:25:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\AVG10
[2011.12.14 20:06:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Babylon
[2011.05.20 18:28:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\EPSON
[2011.10.05 09:47:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Opera
[2011.04.18 20:38:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\SumatraPDF
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.26 12:23:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Adobe
[2011.12.06 16:48:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Apple Computer
[2012.03.28 19:48:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Audacity
[2011.04.19 11:25:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\AVG10
[2011.12.14 20:06:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Babylon
[2011.05.20 18:28:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\EPSON
[2011.04.19 13:58:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Help
[2011.04.18 19:36:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Identities
[2011.04.19 14:49:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\InstallShield
[2011.04.19 11:38:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Macromedia
[2012.04.05 10:14:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Malwarebytes
[2011.05.26 12:23:13 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Microsoft
[2011.10.06 12:40:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla
[2011.10.05 09:47:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Opera
[2011.12.06 16:23:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Real
[2012.03.10 12:24:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Skype
[2011.09.13 00:55:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\skypePM
[2011.04.18 20:38:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\SumatraPDF
[2011.12.06 16:27:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Sun
[2011.12.06 17:20:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\teamspeak2
[2011.10.14 12:40:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\vlc
[2011.04.19 17:59:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Winamp
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2004.03.12 01:21:16 | 018,274,539 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.03.12 01:21:16 | 018,274,539 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004.03.11 23:46:20 | 000,095,488 | ---- | M] (Microsoft Corporation) MD5=030CB0BC20BF0CBBBEA8CEC1803D6E6D -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2004.03.12 01:09:52 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=9E399DAB26E34AEC7DE800B8245809DF -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004.03.12 01:09:52 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=9E399DAB26E34AEC7DE800B8245809DF -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2004.03.12 01:10:00 | 000,417,280 | ---- | M] (Microsoft Corporation) MD5=73878C661BC77B5306ED4AB0BB9784D0 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004.03.12 01:10:00 | 000,417,280 | ---- | M] (Microsoft Corporation) MD5=73878C661BC77B5306ED4AB0BB9784D0 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2004.03.12 01:10:06 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=78F824000457D32BE44DABA04327147B -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004.03.12 01:10:06 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=78F824000457D32BE44DABA04327147B -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004.03.12 01:10:08 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=7CD078803333AF1936972CC663E7A722 -- C:\WINDOWS\system32\dllcache\user32.dll
[2004.03.12 01:10:08 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=7CD078803333AF1936972CC663E7A722 -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2004.03.12 01:10:38 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D75069D14E6A7771EA541E6DD17C5DFC -- C:\WINDOWS\system32\dllcache\userinit.exe
[2004.03.12 01:10:38 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D75069D14E6A7771EA541E6DD17C5DFC -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2005.02.25 08:26:14 | 000,060,800 | R--- | M] (VIA Technologies inc,.ltd) MD5=6AAA39DD79A8341CE0EF9249F21D6B89 -- C:\WINDOWS\system32\drivers\viamraid.sys
 
< MD5 for: WINLOGON.EXE  >
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2004.03.12 01:10:40 | 000,509,440 | ---- | M] (Microsoft Corporation) MD5=C46377D6C48332CD1B81D98D669EEA5F -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2004.03.12 01:10:40 | 000,509,440 | ---- | M] (Microsoft Corporation) MD5=C46377D6C48332CD1B81D98D669EEA5F -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2001.08.18 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001.08.18 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2011.04.18 21:10:18 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2011.04.18 21:10:18 | 000,655,360 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2011.04.18 21:10:18 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >

cosinus 06.04.2012 16:19
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.softonic.com/MON00005/tb_v1?SearchSource=10&cc=
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\..\SearchScopes,DefaultScope = {DCDBBF03-BC10-457D-911F-EFB0321D22BE}
IE - HKU\S-1-5-21-602162358-1645522239-725345543-1003\..\SearchScopes\{DCDBBF03-BC10-457D-911F-EFB0321D22BE}: "URL" = ${SRCH_SCP_URL}
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_Prot"
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1410
[2012.03.21 15:17:37 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.12.14 20:06:08 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com
[2011.12.14 20:06:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com
[2012.04.05 11:29:45 | 000,000,000 | ---D | M] (softonic.com) -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbra@softonic.com
[2012.04.05 11:29:27 | 000,002,060 | ---- | M] () -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\searchplugins\softonic.xml
[2011.10.06 18:22:03 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.12.14 20:06:08 | 000,002,288 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-602162358-1645522239-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.04.18 19:28:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
MsConfig - StartUpReg: FixCamera - hkey= - key= - C:\WINDOWS\FixCamera.exe ()
[2012.04.05 11:29:50 | 000,000,295 | ---- | M] () -- C:\user.js
[2011.12.14 20:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2011.12.14 20:06:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Babylon
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

mikaa 06.04.2012 16:29
Jetzt ist alles wieder gut?

Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-602162358-1645522239-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_USERS\S-1-5-21-602162358-1645522239-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-602162358-1645522239-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{DCDBBF03-BC10-457D-911F-EFB0321D22BE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCDBBF03-BC10-457D-911F-EFB0321D22BE}\ not found.
Prefs.js: "" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.babylon.com/?babsrc=HP_Prot" removed from browser.startup.homepage
Prefs.js: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1410 removed from extensions.enabledItems
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com\components folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com\chrome\content\cache folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com\chrome\content folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com\chrome folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\bbrs_002@blabbers.com folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com\defaults folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbr@babylon.com folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbra@softonic.com\content\imgs\flgs folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbra@softonic.com\content\imgs folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbra@softonic.com\content folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\extensions\ffxtlbra@softonic.com folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\searchplugins\softonic.xml moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-602162358-1645522239-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\FixCamera\ deleted successfully.
C:\user.js moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\slimak\Anwendungsdaten\Babylon folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
 
User: slimak
->Temp folder emptied: 1508128078 bytes
->Temporary Internet Files folder emptied: 75422058 bytes
->Java cache emptied: 1485765 bytes
->FireFox cache emptied: 55516685 bytes
->Google Chrome cache emptied: 394343975 bytes
->Opera cache emptied: 13421807 bytes
->Flash cache emptied: 64056 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1100101 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2872311 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.957,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default User
 
User: LocalService
 
User: NetworkService
 
User: slimak
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 04062012_172345

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 06.04.2012 16:31
Nein wir sind noch lange nicht fertig. Du hast auch hier einiges vernachlässigt:

Zitat:
Windows XP Professional Edition Service Pack 2, v.2096 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2096)
XP SP2 und IE6, auweia, das ist ein Updatestand von 2004! :eek:
Das müssen wir nachher dringend ändern!

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

mikaa 06.04.2012 16:41
Auweia....okay, der Killer ist durchgelaufen:

Code:
17:34:22.0578 3004        TDSS rootkit removing tool 2.7.26.0 Apr  4 2012 19:52:02
17:34:22.0781 3004        ============================================================
17:34:22.0781 3004        Current date / time: 2012/04/06 17:34:22.0781
17:34:22.0781 3004        SystemInfo:
17:34:22.0781 3004       
17:34:22.0781 3004        OS Version: 5.1.2600 ServicePack: 2.0
17:34:22.0781 3004        Product type: Workstation
17:34:22.0781 3004        ComputerName: JAMAKSJA
17:34:22.0781 3004        UserName: slimak
17:34:22.0781 3004        Windows directory: C:\WINDOWS
17:34:22.0781 3004        System windows directory: C:\WINDOWS
17:34:22.0781 3004        Processor architecture: Intel x86
17:34:22.0781 3004        Number of processors: 1
17:34:22.0781 3004        Page size: 0x1000
17:34:22.0781 3004        Boot type: Normal boot
17:34:22.0781 3004        ============================================================
17:34:24.0468 3004        Drive \Device\Harddisk0\DR0 - Size: 0x132C570000 (76.69 Gb), SectorSize: 0x200, Cylinders: 0x271B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:34:24.0468 3004        \Device\Harddisk0\DR0:
17:34:24.0468 3004        MBR used
17:34:24.0468 3004        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x61A7927
17:34:24.0500 3004        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x61A79A5, BlocksNum 0x37B4CF5
17:34:24.0765 3004        Initialize success
17:34:24.0765 3004        ============================================================
17:36:47.0828 4044        ============================================================
17:36:47.0828 4044        Scan started
17:36:47.0828 4044        Mode: Manual; SigCheck; TDLFS;
17:36:47.0828 4044        ============================================================
17:36:49.0140 4044        Abiosdsk - ok
17:36:49.0343 4044        abp480n5 - ok
17:36:49.0593 4044        ACPI            (8805390b120c34e69c1b35b3d28ecde1) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:36:50.0171 4044        ACPI - ok
17:36:50.0421 4044        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
17:36:50.0625 4044        ACPIEC - ok
17:36:50.0843 4044        adpu160m - ok
17:36:51.0031 4044        aec            (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
17:36:51.0250 4044        aec - ok
17:36:51.0343 4044        AFD            (c54d2a3a407be0b02eb996454286b18e) C:\WINDOWS\System32\drivers\afd.sys
17:36:51.0546 4044        AFD - ok
17:36:51.0625 4044        Aha154x - ok
17:36:51.0640 4044        aic78u2 - ok
17:36:51.0671 4044        aic78xx - ok
17:36:51.0703 4044        Alerter        (dac783423c83b41e93812b874161b6f4) C:\WINDOWS\system32\alrsvc.dll
17:36:51.0875 4044        Alerter - ok
17:36:51.0968 4044        ALG            (900ebf87952eb84547c1daef14929f21) C:\WINDOWS\System32\alg.exe
17:36:52.0156 4044        ALG - ok
17:36:52.0218 4044        AliIde - ok
17:36:52.0234 4044        amsint - ok
17:36:52.0281 4044        AppMgmt        (6d68d715561a9da52a3805a402e2b894) C:\WINDOWS\System32\appmgmts.dll
17:36:52.0359 4044        AppMgmt - ok
17:36:52.0437 4044        asc - ok
17:36:52.0453 4044        asc3350p - ok
17:36:52.0468 4044        asc3550 - ok
17:36:52.0515 4044        AsyncMac        (6be963ded6d4fb0903f4d43b30f55201) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:36:52.0687 4044        AsyncMac - ok
17:36:52.0875 4044        atapi          (030cb0bc20bf0cbbbea8cec1803d6e6d) C:\WINDOWS\system32\DRIVERS\atapi.sys
17:36:53.0109 4044        atapi - ok
17:36:53.0171 4044        Atdisk - ok
17:36:53.0234 4044        Ati HotKey Poller (79ac386b310189ce66455e45ba68ab97) C:\WINDOWS\system32\Ati2evxx.exe
17:36:53.0296 4044        Ati HotKey Poller - ok
17:36:53.0406 4044        ATI Smart      (5b1bb9c05b832510c130ccfbf3d203b5) C:\WINDOWS\system32\ati2sgag.exe
17:36:53.0437 4044        ATI Smart ( UnsignedFile.Multi.Generic ) - warning
17:36:53.0437 4044        ATI Smart - detected UnsignedFile.Multi.Generic (1)
17:36:53.0593 4044        ati2mtag        (185773dfbb89b62d856f077c6c58fbe3) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
17:36:53.0671 4044        ati2mtag - ok
17:36:53.0843 4044        Atmarpc        (411ee1364d9d9e200c1c17c44b6aaec6) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:36:54.0015 4044        Atmarpc - ok
17:36:54.0109 4044        AudioSrv        (645ed056f5555df8bddf8c65d31cfdf4) C:\WINDOWS\System32\audiosrv.dll
17:36:54.0296 4044        AudioSrv - ok
17:36:54.0406 4044        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:36:54.0578 4044        audstub - ok
17:36:55.0015 4044        AVGIDSAgent    (7a0f6a3e0e41425b9ba54616b482668a) C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
17:36:55.0890 4044        AVGIDSAgent - ok
17:36:56.0000 4044        AVGIDSDriver    (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
17:36:56.0031 4044        AVGIDSDriver - ok
17:36:56.0156 4044        AVGIDSEH        (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
17:36:56.0156 4044        AVGIDSEH - ok
17:36:56.0265 4044        AVGIDSFilter    (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
17:36:56.0281 4044        AVGIDSFilter - ok
17:36:56.0328 4044        AVGIDSShim      (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
17:36:56.0328 4044        AVGIDSShim - ok
17:36:56.0406 4044        Avgldx86        (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
17:36:56.0421 4044        Avgldx86 - ok
17:36:56.0531 4044        Avgmfx86        (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
17:36:56.0546 4044        Avgmfx86 - ok
17:36:56.0640 4044        Avgrkx86        (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
17:36:56.0640 4044        Avgrkx86 - ok
17:36:56.0718 4044        Avgtdix        (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
17:36:56.0734 4044        Avgtdix - ok
17:36:56.0828 4044        avgwd          (fc2bc51120a945f7c70376495e4e7737) C:\Programme\AVG\AVG10\avgwdsvc.exe
17:36:56.0843 4044        avgwd - ok
17:36:56.0953 4044        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:36:57.0093 4044        Beep - ok
17:36:57.0203 4044        BITS            (86688b627f8a153c229da4a51e66bdfc) C:\WINDOWS\system32\qmgr.dll
17:36:57.0437 4044        BITS - ok
17:36:57.0546 4044        Browser        (b927521aad7ac6c3fc4c139e7eef36fc) C:\WINDOWS\System32\browser.dll
17:36:57.0734 4044        Browser - ok
17:36:57.0843 4044        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:36:58.0015 4044        cbidf2k - ok
17:36:58.0109 4044        CCDECODE        (c343eca0bcb999a2c237b08da1c4ed6b) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:36:58.0296 4044        CCDECODE - ok
17:36:58.0328 4044        cd20xrnt - ok
17:36:58.0359 4044        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:36:58.0531 4044        Cdaudio - ok
17:36:58.0640 4044        Cdfs            (41e9cf315bb37895396a1c24eeb6f651) C:\WINDOWS\system32\drivers\Cdfs.sys
17:36:58.0843 4044        Cdfs - ok
17:36:58.0953 4044        Cdrom          (f00752cbcfc70d33f046ebba00ef2d4b) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:36:59.0140 4044        Cdrom - ok
17:36:59.0218 4044        Changer - ok
17:36:59.0265 4044        CiSvc          (ff45d4bea3d9780f52a8e95abe888cc6) C:\WINDOWS\system32\cisvc.exe
17:36:59.0453 4044        CiSvc - ok
17:36:59.0546 4044        ClipSrv        (49908a1fca93b26a3cbe3a89ab8d0a30) C:\WINDOWS\system32\clipsrv.exe
17:36:59.0734 4044        ClipSrv - ok
17:36:59.0828 4044        CmdIde - ok
17:36:59.0906 4044        cmuda          (924ab66e831e9cf3e20dbc6b63103516) C:\WINDOWS\system32\drivers\cmuda.sys
17:37:00.0031 4044        cmuda - ok
17:37:00.0093 4044        COMSysApp - ok
17:37:00.0125 4044        Cpqarray - ok
17:37:00.0156 4044        CryptSvc        (6b79b003c0359dc7a8b0164e13e2a1aa) C:\WINDOWS\System32\cryptsvc.dll
17:37:00.0343 4044        CryptSvc - ok
17:37:00.0406 4044        dac2w2k - ok
17:37:00.0437 4044        dac960nt - ok
17:37:00.0484 4044        DcomLaunch      (694c86b174e4b7f611e362e8ada0c4e8) C:\WINDOWS\system32\rpcss.dll
17:37:00.0671 4044        DcomLaunch - ok
17:37:00.0890 4044        Dhcp            (0c8b549fc627c10e95b16ef6545f191a) C:\WINDOWS\System32\dhcpcsvc.dll
17:37:01.0093 4044        Dhcp - ok
17:37:01.0281 4044        Disk            (330f4c2fbef822f40a200408045731d4) C:\WINDOWS\system32\DRIVERS\disk.sys
17:37:01.0468 4044        Disk - ok
17:37:01.0531 4044        dmadmin - ok
17:37:01.0609 4044        dmboot          (a3e12fa13299f5a1dc242f73eaa66854) C:\WINDOWS\system32\drivers\dmboot.sys
17:37:01.0812 4044        dmboot - ok
17:37:01.0921 4044        dmio            (d15558da8c900b61c0a7f20ec226f60c) C:\WINDOWS\system32\drivers\dmio.sys
17:37:02.0093 4044        dmio - ok
17:37:02.0203 4044        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:37:02.0375 4044        dmload - ok
17:37:02.0421 4044        dmserver        (cf5c7f7e2c922a97cd8e618016634f27) C:\WINDOWS\System32\dmserver.dll
17:37:02.0625 4044        dmserver - ok
17:37:02.0828 4044        DMusic          (70d91b349a90d02b83ff4b36dc97efae) C:\WINDOWS\system32\drivers\DMusic.sys
17:37:03.0031 4044        DMusic - ok
17:37:03.0125 4044        Dnscache        (3f2ceb288e1850b9e7a9bd006c0ac2da) C:\WINDOWS\System32\dnsrslvr.dll
17:37:03.0296 4044        Dnscache - ok
17:37:03.0375 4044        dpti2o - ok
17:37:03.0421 4044        drmkaud        (8b3e949a9cf63a4089542a9065532240) C:\WINDOWS\system32\drivers\drmkaud.sys
17:37:03.0625 4044        drmkaud - ok
17:37:03.0750 4044        ERSvc          (54400dbc585a26ca955eb138d4c3defd) C:\WINDOWS\System32\ersvc.dll
17:37:03.0921 4044        ERSvc - ok
17:37:04.0031 4044        Eventlog        (12d2666955e46c86eb8dcff3c8576aa8) C:\WINDOWS\system32\services.exe
17:37:04.0203 4044        Eventlog - ok
17:37:04.0312 4044        EventSystem    (9835a199543aa632fff13e6948642c40) C:\WINDOWS\system32\es.dll
17:37:04.0515 4044        EventSystem - ok
17:37:04.0640 4044        Fastfat        (4391f4902d8181f5e8e863f07867a4d9) C:\WINDOWS\system32\drivers\Fastfat.sys
17:37:04.0843 4044        Fastfat - ok
17:37:04.0968 4044        FastUserSwitchingCompatibility (a13e32ad1106505731f7289d0870c155) C:\WINDOWS\System32\shsvcs.dll
17:37:05.0156 4044        FastUserSwitchingCompatibility - ok
17:37:05.0250 4044        Fdc            (b061a735a4c6231a72990629a8ed7538) C:\WINDOWS\system32\DRIVERS\fdc.sys
17:37:05.0437 4044        Fdc - ok
17:37:05.0546 4044        FETNDIS        (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
17:37:05.0734 4044        FETNDIS - ok
17:37:05.0843 4044        Fips            (9e9af89f9b14aa6249065c309ce73bd8) C:\WINDOWS\system32\drivers\Fips.sys
17:37:06.0015 4044        Fips - ok
17:37:06.0125 4044        Flpydisk        (74e2d1eb0225c93b375a05578df8ff3b) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:37:06.0312 4044        Flpydisk - ok
17:37:06.0406 4044        FltMgr          (c1c4a97b27ebacd9c6b3ca9026b6593b) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:37:06.0578 4044        FltMgr - ok
17:37:06.0703 4044        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:37:06.0875 4044        Fs_Rec - ok
17:37:06.0984 4044        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:37:07.0187 4044        Ftdisk - ok
17:37:07.0281 4044        gameenum        (8469234cef5c74418cdd8848ac9db1b6) C:\WINDOWS\system32\DRIVERS\gameenum.sys
17:37:07.0453 4044        gameenum - ok
17:37:07.0562 4044        Gpc            (3ffa140800b67f821c69b274537cd7fc) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:37:07.0750 4044        Gpc - ok
17:37:07.0859 4044        helpsvc        (3813f99b3c623dc457bc150b920138c0) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:37:08.0031 4044        helpsvc - ok
17:37:08.0078 4044        HidServ - ok
17:37:08.0171 4044        hidusb          (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:37:08.0343 4044        hidusb - ok
17:37:08.0406 4044        hpn - ok
17:37:08.0468 4044        HTTP            (257bbac658ea5aae6ae6f4b7a75888d2) C:\WINDOWS\system32\Drivers\HTTP.sys
17:37:08.0671 4044        HTTP - ok
17:37:08.0781 4044        HTTPFilter      (9824d14a82473feba3807decdf33a5b0) C:\WINDOWS\System32\w3ssl.dll
17:37:08.0984 4044        HTTPFilter - ok
17:37:09.0046 4044        i2omgmt - ok
17:37:09.0062 4044        i2omp - ok
17:37:09.0125 4044        i8042prt        (b1143ebfe4d5943a56e78ee03dfe8bf4) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:37:09.0296 4044        i8042prt - ok
17:37:09.0390 4044        i81x            (df9a1be4bc252bd6f9551a4201537dda) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
17:37:09.0562 4044        i81x - ok
17:37:09.0656 4044        Imapi          (89f660c75a4e50716262a83cec08e290) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:37:09.0828 4044        Imapi - ok
17:37:09.0937 4044        ImapiService    (2b38c9547dfa30f860d3422aea19d6d7) C:\WINDOWS\system32\imapi.exe
17:37:10.0109 4044        ImapiService - ok
17:37:10.0187 4044        ini910u - ok
17:37:10.0218 4044        IntelIde - ok
17:37:10.0265 4044        intelppm        (871536db1722efbf9a79f85a9a9e6a15) C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:37:10.0468 4044        intelppm - ok
17:37:10.0562 4044        Ip6Fw          (b390ca36ea188d82c73a76970523482b) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:37:10.0750 4044        Ip6Fw - ok
17:37:10.0859 4044        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:37:11.0031 4044        IpFilterDriver - ok
17:37:11.0140 4044        IpInIp          (f56dd863ba732a4e8ee58d486c31250f) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:37:11.0328 4044        IpInIp - ok
17:37:11.0437 4044        IpNat          (e8c398fdf78bed12b525e46216a02351) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:37:11.0625 4044        IpNat - ok
17:37:11.0750 4044        IPSec          (9fb02788a4cd0c9f934f53204878782b) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:37:11.0937 4044        IPSec - ok
17:37:12.0031 4044        irda            (701c42a97b0a032738fa44072ca3e022) C:\WINDOWS\system32\DRIVERS\irda.sys
17:37:12.0203 4044        irda - ok
17:37:12.0296 4044        IRENUM          (775cbd5fa1c66f717c8754d8c658f835) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:37:12.0468 4044        IRENUM - ok
17:37:12.0578 4044        Irmon          (2ce7667b9f7851e106f6cf450cbe6e10) C:\WINDOWS\System32\irmon.dll
17:37:12.0750 4044        Irmon - ok
17:37:12.0859 4044        irsir          (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
17:37:12.0921 4044        irsir - ok
17:37:13.0031 4044        isapnp          (ce9b7afdf0a3d7dd8d1487262316b959) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:37:13.0203 4044        isapnp - ok
17:37:13.0312 4044        JavaQuickStarterService (381b25dc8e958d905b33130d500bbf29) C:\Programme\Java\jre6\bin\jqs.exe
17:37:13.0343 4044        JavaQuickStarterService - ok
17:37:13.0453 4044        Kbdclass        (a8a57cf5cf1effccfde194e139b7c063) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:37:13.0640 4044        Kbdclass - ok
17:37:13.0765 4044        kmixer          (c37f1175844ce4b865bde5cc20681123) C:\WINDOWS\system32\drivers\kmixer.sys
17:37:13.0921 4044        kmixer - ok
17:37:14.0031 4044        KSecDD          (d54f25d53a5921a78e1bee6947b7dd36) C:\WINDOWS\system32\drivers\KSecDD.sys
17:37:14.0218 4044        KSecDD - ok
17:37:14.0312 4044        lanmanserver    (f3ba9a3e2d88377b6262a1951e5af114) C:\WINDOWS\System32\srvsvc.dll
17:37:14.0500 4044        lanmanserver - ok
17:37:14.0531 4044        lanmanworkstation (d56bff930e6d6d80be2ba9387bbe03f1) C:\WINDOWS\System32\wkssvc.dll
17:37:14.0703 4044        lanmanworkstation - ok
17:37:14.0781 4044        lbrtfdc - ok
17:37:14.0828 4044        LmHosts        (161b97c670b8c70cf16ff4d2fa913e24) C:\WINDOWS\System32\lmhsvc.dll
17:37:15.0015 4044        LmHosts - ok
17:37:15.0109 4044        Messenger      (e4d091a7b0c69f83edb2a290c12a0c2e) C:\WINDOWS\System32\msgsvc.dll
17:37:15.0281 4044        Messenger - ok
17:37:15.0390 4044        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:37:15.0546 4044        mnmdd - ok
17:37:15.0640 4044        mnmsrvc        (ba97c4e0b97f95440337072f5c101f3c) C:\WINDOWS\system32\mnmsrvc.exe
17:37:15.0796 4044        mnmsrvc - ok
17:37:15.0890 4044        Modem          (e79e84f06a313db6a79a08ea9db1f706) C:\WINDOWS\system32\drivers\Modem.sys
17:37:16.0062 4044        Modem - ok
17:37:16.0140 4044        Mouclass        (031dd9cafd98aa2345aa7fc8b602dd67) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:37:16.0312 4044        Mouclass - ok
17:37:16.0421 4044        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:37:16.0593 4044        mouhid - ok
17:37:16.0703 4044        MountMgr        (3381fe107e3855d9877c37b95f40ce0d) C:\WINDOWS\system32\drivers\MountMgr.sys
17:37:16.0859 4044        MountMgr - ok
17:37:16.0937 4044        mraid35x - ok
17:37:16.0968 4044        MRxDAV          (ec56f61732d90c362f1e787925b68a7a) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:37:17.0140 4044        MRxDAV - ok
17:37:17.0187 4044        MRxSmb          (17f33fd6d76e2184df7b396a078a3e43) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:37:17.0359 4044        MRxSmb - ok
17:37:17.0453 4044        MSDTC          (e092119953ab000e0f50901d2c7372e2) C:\WINDOWS\system32\msdtc.exe
17:37:17.0625 4044        MSDTC - ok
17:37:17.0765 4044        Msfs            (bc2862d0afbbbc0a31c71ac2a6d556e7) C:\WINDOWS\system32\drivers\Msfs.sys
17:37:17.0937 4044        Msfs - ok
17:37:18.0000 4044        MSIServer - ok
17:37:18.0046 4044        MSKSSRV        (92d55003d3e701e67b309df2c7e6028a) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:37:18.0218 4044        MSKSSRV - ok
17:37:18.0312 4044        MSPCLOCK        (671fbb5e78a1a02b9d56d3f2484bfe26) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:37:18.0484 4044        MSPCLOCK - ok
17:37:18.0578 4044        MSPQM          (498cd4c3efc6783c0545221cb66e7c3e) C:\WINDOWS\system32\drivers\MSPQM.sys
17:37:18.0734 4044        MSPQM - ok
17:37:18.0828 4044        mssmbios        (f0f5c06ce05eedca80d3e8c98f1e2935) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:37:19.0000 4044        mssmbios - ok
17:37:19.0031 4044        MSTEE          (144fde677766101da3bbda57c14f5f83) C:\WINDOWS\system32\drivers\MSTEE.sys
17:37:19.0187 4044        MSTEE - ok
17:37:19.0281 4044        ms_mpu401      (ca3e22598f411199adc2dfee76cd0ae0) C:\WINDOWS\system32\drivers\msmpu401.sys
17:37:19.0453 4044        ms_mpu401 - ok
17:37:19.0562 4044        Mup            (199c73daf5b26380271db4752847b10a) C:\WINDOWS\system32\drivers\Mup.sys
17:37:19.0718 4044        Mup - ok
17:37:19.0812 4044        NABTSFEC        (a08ef9b9d365450d530c3df5d541f959) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:37:19.0984 4044        NABTSFEC - ok
17:37:20.0078 4044        NDIS            (db8ea964c507dfc0445e63c9a6ce6b42) C:\WINDOWS\system32\drivers\NDIS.sys
17:37:20.0234 4044        NDIS - ok
17:37:20.0343 4044        NdisIP          (dcb617b784d7cc80d8355a22aabc7019) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:37:20.0500 4044        NdisIP - ok
17:37:20.0593 4044        NdisTapi        (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:37:20.0765 4044        NdisTapi - ok
17:37:20.0859 4044        Ndisuio        (7f1781c46663f7f8eb78915e188a8f60) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:37:21.0031 4044        Ndisuio - ok
17:37:21.0125 4044        NdisWan        (024029f33a57933b194ed156ba969cd5) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:37:21.0296 4044        NdisWan - ok
17:37:21.0390 4044        NDProxy        (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
17:37:21.0562 4044        NDProxy - ok
17:37:21.0687 4044        NetBIOS        (9df94c862bd1be22d4d2cbe23bc942a0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:37:21.0859 4044        NetBIOS - ok
17:37:21.0968 4044        NetBT          (c017ec90a95997c1c9a0bab5773c7cd8) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:37:22.0109 4044        NetBT - ok
17:37:22.0218 4044        NetDDE          (4363152d258f338414388e2a93674211) C:\WINDOWS\system32\netdde.exe
17:37:22.0375 4044        NetDDE - ok
17:37:22.0390 4044        NetDDEdsdm      (4363152d258f338414388e2a93674211) C:\WINDOWS\system32\netdde.exe
17:37:22.0531 4044        NetDDEdsdm - ok
17:37:22.0656 4044        Netlogon        (ac0cac3fbd6b1692463748a1b3aee55e) C:\WINDOWS\system32\lsass.exe
17:37:22.0796 4044        Netlogon - ok
17:37:22.0921 4044        Netman          (5491c31eb5d891e1af3cd23057f5c728) C:\WINDOWS\System32\netman.dll
17:37:23.0093 4044        Netman - ok
17:37:23.0218 4044        Nla            (2109235aaf20a016916e64ebe5fb0511) C:\WINDOWS\System32\mswsock.dll
17:37:23.0375 4044        Nla - ok
17:37:23.0484 4044        Npfs            (a7efbd4a2e62e7cb6c130f2de13e80ab) C:\WINDOWS\system32\drivers\Npfs.sys
17:37:23.0671 4044        Npfs - ok
17:37:23.0812 4044        NtApm          (5061d3d7e8d7bdef0cb1c764af9f68f9) C:\WINDOWS\system32\DRIVERS\NtApm.sys
17:37:23.0890 4044        NtApm - ok
17:37:24.0015 4044        Ntfs            (7e6185d867456ddd817bb34bb0bc429b) C:\WINDOWS\system32\drivers\Ntfs.sys
17:37:24.0203 4044        Ntfs - ok
17:37:24.0296 4044        NtLmSsp        (ac0cac3fbd6b1692463748a1b3aee55e) C:\WINDOWS\system32\lsass.exe
17:37:24.0468 4044        NtLmSsp - ok
17:37:24.0531 4044        NtmsSvc        (984246523d8936a9b604dbbb04c66c70) C:\WINDOWS\system32\ntmssvc.dll
17:37:24.0703 4044        NtmsSvc - ok
17:37:24.0812 4044        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:37:24.0984 4044        Null - ok
17:37:25.0093 4044        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:37:25.0250 4044        NwlnkFlt - ok
17:37:25.0343 4044        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:37:25.0515 4044        NwlnkFwd - ok
17:37:25.0625 4044        Parport        (a862a9e4ee4d6c7a4ef230c20ecb8dec) C:\WINDOWS\system32\DRIVERS\parport.sys
17:37:25.0781 4044        Parport - ok
17:37:25.0875 4044        PartMgr        (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
17:37:26.0031 4044        PartMgr - ok
17:37:26.0125 4044        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
17:37:26.0312 4044        ParVdm - ok
17:37:26.0421 4044        PCI            (2089f2f12daede50d47d6e7dbb9aa87c) C:\WINDOWS\system32\DRIVERS\pci.sys
17:37:26.0593 4044        PCI - ok
17:37:26.0656 4044        PCIDump - ok
17:37:26.0703 4044        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
17:37:26.0859 4044        PCIIde - ok
17:37:26.0953 4044        Pcmcia          (907278caa6c2f5328468c58682270914) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:37:27.0109 4044        Pcmcia - ok
17:37:27.0187 4044        PDCOMP - ok
17:37:27.0203 4044        PDFRAME - ok
17:37:27.0218 4044        PDRELI - ok
17:37:27.0250 4044        PDRFRAME - ok
17:37:27.0265 4044        perc2 - ok
17:37:27.0281 4044        perc2hib - ok
17:37:27.0375 4044        PlugPlay        (12d2666955e46c86eb8dcff3c8576aa8) C:\WINDOWS\system32\services.exe
17:37:27.0531 4044        PlugPlay - ok
17:37:27.0640 4044        PolicyAgent    (ac0cac3fbd6b1692463748a1b3aee55e) C:\WINDOWS\system32\lsass.exe
17:37:27.0781 4044        PolicyAgent - ok
17:37:27.0906 4044        PptpMiniport    (34d3c4eafa2857a1b8748f963c1715c6) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:37:28.0078 4044        PptpMiniport - ok
17:37:28.0171 4044        ProtectedStorage (ac0cac3fbd6b1692463748a1b3aee55e) C:\WINDOWS\system32\lsass.exe
17:37:28.0328 4044        ProtectedStorage - ok
17:37:28.0375 4044        PSched          (c37be259f8524b6de485b9c8f5c30228) C:\WINDOWS\system32\DRIVERS\psched.sys
17:37:28.0531 4044        PSched - ok
17:37:28.0640 4044        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:37:28.0812 4044        Ptilink - ok
17:37:28.0906 4044        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
17:37:28.0906 4044        PxHelp20 - ok
17:37:28.0984 4044        ql1080 - ok
17:37:29.0015 4044        Ql10wnt - ok
17:37:29.0031 4044        ql12160 - ok
17:37:29.0046 4044        ql1240 - ok
17:37:29.0078 4044        ql1280 - ok
17:37:29.0109 4044        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:37:29.0265 4044        RasAcd - ok
17:37:29.0375 4044        RasAuto        (72e69164e182c6c2b4df2b263d249e4b) C:\WINDOWS\System32\rasauto.dll
17:37:29.0546 4044        RasAuto - ok
17:37:29.0656 4044        Rasirda        (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
17:37:29.0734 4044        Rasirda - ok
17:37:29.0843 4044        Rasl2tp        (87e1a55d92a4f3c9c554253757e6b172) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:37:30.0015 4044        Rasl2tp - ok
17:37:30.0109 4044        RasMan          (83dfea6d8b125d2008e77f69ae68ee08) C:\WINDOWS\System32\rasmans.dll
17:37:30.0265 4044        RasMan - ok
17:37:30.0375 4044        RasPppoe        (888335b3be346119cf7b4eff3a3fca7c) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:37:30.0562 4044        RasPppoe - ok
17:37:30.0656 4044        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:37:30.0828 4044        Raspti - ok
17:37:30.0937 4044        Rdbss          (bd3cae2438b36a2c1a22374ee5225de0) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:37:31.0093 4044        Rdbss - ok
17:37:31.0187 4044        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:37:31.0359 4044        RDPCDD - ok
17:37:31.0453 4044        rdpdr          (5768fb41bf8f15a46465cb7884a32c89) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:37:31.0625 4044        rdpdr - ok
17:37:31.0843 4044        RDPWD          (5f1ca52a7834958cba53f61dd0acfe8c) C:\WINDOWS\system32\drivers\RDPWD.sys
17:37:32.0000 4044        RDPWD - ok
17:37:32.0093 4044        RDSessMgr      (d21e35dbd35c9294cdf19c7c5ca43313) C:\WINDOWS\system32\sessmgr.exe
17:37:32.0250 4044        RDSessMgr - ok
17:37:32.0343 4044        redbook        (6d6a4514721a6f7259703cf473ec41c0) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:37:32.0515 4044        redbook - ok
17:37:32.0625 4044        RemoteAccess    (eba80cdf25e02084857957e820004934) C:\WINDOWS\System32\mprdim.dll
17:37:32.0765 4044        RemoteAccess - ok
17:37:32.0875 4044        RemoteRegistry  (909e89473dc956b3347571d41e716178) C:\WINDOWS\system32\regsvc.dll
17:37:33.0031 4044        RemoteRegistry - ok
17:37:33.0093 4044        RpcLocator      (177f2b1d88d3a7299fd05bc0dac1856e) C:\WINDOWS\system32\locator.exe
17:37:33.0250 4044        RpcLocator - ok
17:37:33.0343 4044        RpcSs          (694c86b174e4b7f611e362e8ada0c4e8) C:\WINDOWS\system32\rpcss.dll
17:37:33.0500 4044        RpcSs - ok
17:37:33.0609 4044        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
17:37:33.0796 4044        RSVP - ok
17:37:33.0890 4044        rtl8139        (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
17:37:34.0078 4044        rtl8139 - ok
17:37:34.0125 4044        SamSs          (ac0cac3fbd6b1692463748a1b3aee55e) C:\WINDOWS\system32\lsass.exe
17:37:34.0265 4044        SamSs - ok
17:37:34.0375 4044        SCardDrv        (70ef93d3ec0bd262bb1eddd986edf44c) C:\WINDOWS\System32\SCardSvr.exe
17:37:34.0531 4044        SCardDrv - ok
17:37:34.0546 4044        SCardSvr        (70ef93d3ec0bd262bb1eddd986edf44c) C:\WINDOWS\System32\SCardSvr.exe
17:37:34.0718 4044        SCardSvr - ok
17:37:34.0828 4044        Schedule        (195edfc5e2f2bf77e5c8bbb4f57a4946) C:\WINDOWS\system32\schedsvc.dll
17:37:35.0000 4044        Schedule - ok
17:37:35.0093 4044        Secdrv          (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:37:35.0265 4044        Secdrv - ok
17:37:35.0359 4044        seclogon        (91f87fb12f41d03b6e1bd7697e0c55d8) C:\WINDOWS\System32\seclogon.dll
17:37:35.0515 4044        seclogon - ok
17:37:35.0609 4044        SENS            (4429ec4c3817b81e49a298ad8e4d05e9) C:\WINDOWS\system32\sens.dll
17:37:35.0765 4044        SENS - ok
17:37:35.0812 4044        serenum        (4b455594589a4fc1b791126a7b3044cd) C:\WINDOWS\system32\DRIVERS\serenum.sys
17:37:35.0984 4044        serenum - ok
17:37:36.0093 4044        Serial          (44a5892ca596bfa93efd7a20f04ae3e7) C:\WINDOWS\system32\DRIVERS\serial.sys
17:37:36.0250 4044        Serial - ok
17:37:36.0343 4044        Sfloppy        (4f0e5df584405f296e1ab69e61870cad) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:37:36.0515 4044        Sfloppy - ok
17:37:36.0640 4044        SharedAccess    (23a423b6ab27debaf0de0a97f65f47b1) C:\WINDOWS\System32\ipnathlp.dll
17:37:36.0812 4044        SharedAccess - ok
17:37:36.0921 4044        ShellHWDetection (a13e32ad1106505731f7289d0870c155) C:\WINDOWS\System32\shsvcs.dll
17:37:37.0093 4044        ShellHWDetection - ok
17:37:37.0156 4044        Simbad - ok
17:37:37.0218 4044        SLIP            (d68195a39a4b00e32bc1f28967856e69) C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:37:37.0375 4044        SLIP - ok
17:37:37.0859 4044        SNP325          (a9b89dfa529f5e333d8276a5f2993840) C:\WINDOWS\system32\DRIVERS\snp325.sys
17:37:38.0453 4044        SNP325 ( UnsignedFile.Multi.Generic ) - warning
17:37:38.0453 4044        SNP325 - detected UnsignedFile.Multi.Generic (1)
17:37:38.0515 4044        Sparrow - ok
17:37:38.0562 4044        splitter        (0571ee7476963e244d0302c7fe438e1f) C:\WINDOWS\system32\drivers\splitter.sys
17:37:38.0718 4044        splitter - ok
17:37:38.0812 4044        Spooler        (651f6950a54e8b5eacd5e63f4767278b) C:\WINDOWS\system32\spoolsv.exe
17:37:38.0968 4044        Spooler - ok
17:37:39.0015 4044        sr              (e59be1ec2f58e6cb771fa3e7474398f7) C:\WINDOWS\system32\DRIVERS\sr.sys
17:37:39.0187 4044        sr - ok
17:37:39.0296 4044        srservice      (09f5d31c9d2813fff6e9751b5afa3736) C:\WINDOWS\system32\srsvc.dll
17:37:39.0453 4044        srservice - ok
17:37:39.0562 4044        Srv            (fd974de6b9f6f23a8ccbc1776aa00c1d) C:\WINDOWS\system32\DRIVERS\srv.sys
17:37:39.0734 4044        Srv - ok
17:37:39.0828 4044        SSDPSRV        (7d17d3650a114bd6b40e3c196f5d5a06) C:\WINDOWS\System32\ssdpsrv.dll
17:37:40.0000 4044        SSDPSRV - ok
17:37:40.0109 4044        stisvc          (84a781fb260c014489f35ebaed363f79) C:\WINDOWS\system32\wiaservc.dll
17:37:40.0281 4044        stisvc - ok
17:37:40.0390 4044        streamip        (c1501d3969f73561d5e55fdfa7dec750) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:37:40.0562 4044        streamip - ok
17:37:40.0671 4044        swenum          (ab4ea57db7f2762603a3574e25f2dd56) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:37:40.0796 4044        swenum - ok
17:37:40.0906 4044        swmidi          (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
17:37:41.0062 4044        swmidi - ok
17:37:41.0125 4044        SwPrv - ok
17:37:41.0140 4044        symc810 - ok
17:37:41.0171 4044        symc8xx - ok
17:37:41.0187 4044        sym_hi - ok
17:37:41.0203 4044        sym_u3 - ok
17:37:41.0265 4044        sysaudio        (1b428657c58b8e97c55fe6054853230c) C:\WINDOWS\system32\drivers\sysaudio.sys
17:37:41.0406 4044        sysaudio - ok
17:37:41.0515 4044        SysmonLog      (cf84d983a20a1db158a7e290e1a0e17e) C:\WINDOWS\system32\smlogsvc.exe
17:37:41.0671 4044        SysmonLog - ok
17:37:41.0781 4044        TapiSrv        (020b1958b42745f0fcb75d4437c27df1) C:\WINDOWS\System32\tapisrv.dll
17:37:41.0937 4044        TapiSrv - ok
17:37:42.0062 4044        Tcpip          (7347c92a9e8a92c67d57695f9bf4e824) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:37:42.0250 4044        Tcpip - ok
17:37:42.0343 4044        TDPIPE          (1a96630babbd59e8b885eae0dfbe6a3e) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:37:42.0484 4044        TDPIPE - ok
17:37:42.0546 4044        TDTCP          (d1c578c6b37713694c5edd7c2d7f7451) C:\WINDOWS\system32\drivers\TDTCP.sys
17:37:42.0718 4044        TDTCP - ok
17:37:42.0781 4044        TermDD          (931ba49a7fb38158be89740e69213f08) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:37:42.0937 4044        TermDD - ok
17:37:43.0031 4044        TermService    (7d203365122268c6ee1c622655e1e770) C:\WINDOWS\System32\termsrv.dll
17:37:43.0187 4044        TermService - ok
17:37:43.0296 4044        Themes          (a13e32ad1106505731f7289d0870c155) C:\WINDOWS\System32\shsvcs.dll
17:37:43.0437 4044        Themes - ok
17:37:43.0546 4044        TlntSvr        (2fd45d6f9db6bc494e127a6d25020be1) C:\WINDOWS\system32\tlntsvr.exe
17:37:43.0625 4044        TlntSvr - ok
17:37:43.0718 4044        TosIde - ok
17:37:43.0765 4044        TrkWks          (418223b416f33c916de09f6c11a1ae51) C:\WINDOWS\system32\trkwks.dll
17:37:43.0906 4044        TrkWks - ok
17:37:44.0015 4044        uagp35          (d81d2739d1b3a55f8b15776b2fbb5ded) C:\WINDOWS\system32\DRIVERS\uagp35.sys
17:37:44.0171 4044        uagp35 - ok
17:37:44.0203 4044        Udfs            (657e040de0da0bfe2dd48923c7e744cc) C:\WINDOWS\system32\drivers\Udfs.sys
17:37:44.0359 4044        Udfs - ok
17:37:44.0421 4044        ultra - ok
17:37:44.0484 4044        UMWdf          (ab0a7ca90d9e3d6a193905dc1715ded0) C:\WINDOWS\system32\wdfmgr.exe
17:37:44.0515 4044        UMWdf - ok
17:37:44.0625 4044        Update          (c2e69ecbd09975594ab9437cdaf3962a) C:\WINDOWS\system32\DRIVERS\update.sys
17:37:44.0781 4044        Update - ok
17:37:44.0875 4044        upnphost        (cffe64b381baa1059a7d9d643ec21ec8) C:\WINDOWS\System32\upnphost.dll
17:37:45.0046 4044        upnphost - ok
17:37:45.0140 4044        UPS            (fb0284ac616c03c9bd7c993000ec5567) C:\WINDOWS\System32\ups.exe
17:37:45.0312 4044        UPS - ok
17:37:45.0406 4044        usbccgp        (0dcef2abbccb48e4c2b296f0adeeb334) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:37:45.0562 4044        usbccgp - ok
17:37:45.0687 4044        usbehci        (5df553eb2c3de25b3277dbbe4c029731) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:37:45.0828 4044        usbehci - ok
17:37:45.0859 4044        usbhub          (966d908ab5b9e4b8f3efc5eef66ab272) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:37:46.0015 4044        usbhub - ok
17:37:46.0109 4044        usbprint        (281e44b560c83b55389d229bc99c5c54) C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:37:46.0250 4044        usbprint - ok
17:37:46.0359 4044        usbscan        (e7ca35510364a041daf2f4e0d3025251) C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:37:46.0500 4044        usbscan - ok
17:37:46.0609 4044        usbstor        (439c51b07325e672aac277fc18f81854) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:37:46.0765 4044        usbstor - ok
17:37:46.0859 4044        usbuhci        (48f261c00954d8a2a489e56321c21583) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:37:47.0015 4044        usbuhci - ok
17:37:47.0109 4044        VgaSave        (5bdf4e55a2cdff60fd30998d6b988af1) C:\WINDOWS\System32\drivers\vga.sys
17:37:47.0281 4044        VgaSave - ok
17:37:47.0390 4044        viaagp1        (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
17:37:47.0437 4044        viaagp1 - ok
17:37:47.0531 4044        ViaIde          (7fefd555f9639c94ae545793e8d1f133) C:\WINDOWS\system32\DRIVERS\viaide.sys
17:37:47.0687 4044        ViaIde - ok
17:37:47.0796 4044        viamraid        (6aaa39dd79a8341ce0ef9249f21d6b89) C:\WINDOWS\system32\DRIVERS\viamraid.sys
17:37:47.0828 4044        viamraid - ok
17:37:47.0921 4044        VIAudio        (819bf44085104be6527b86a88acf856b) C:\WINDOWS\system32\drivers\ac97via.sys
17:37:48.0078 4044        VIAudio - ok
17:37:48.0171 4044        VolSnap        (c61abff23a557346de30965ad9e45073) C:\WINDOWS\system32\drivers\VolSnap.sys
17:37:48.0312 4044        VolSnap - ok
17:37:48.0437 4044        VSS            (4696b3d9d96a99eb288e990219ad5ad2) C:\WINDOWS\System32\vssvc.exe
17:37:48.0609 4044        VSS - ok
17:37:48.0750 4044        W32Time        (0a0deafa0fa09150d9f73517b016f5c4) C:\WINDOWS\system32\w32time.dll
17:37:48.0906 4044        W32Time - ok
17:37:49.0015 4044        Wanarp          (5dc459c80fe66a44b2ddbeafd5afab70) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:37:49.0171 4044        Wanarp - ok
17:37:49.0250 4044        WDICA - ok
17:37:49.0312 4044        wdmaud          (08874bec364ea93be283fc0932d06742) C:\WINDOWS\system32\drivers\wdmaud.sys
17:37:49.0453 4044        wdmaud - ok
17:37:49.0562 4044        WebClient      (5eb06684a5dea22d38d00d03772adf75) C:\WINDOWS\System32\webclnt.dll
17:37:49.0718 4044        WebClient - ok
17:37:49.0859 4044        winmgmt        (5a3c70e0a2674efa42a41ef4d027bf77) C:\WINDOWS\system32\wbem\WMIsvc.dll
17:37:50.0000 4044        winmgmt - ok
17:37:50.0109 4044        WmdmPmSN        (140ef97b64f560fd78643cae2cdad838) C:\WINDOWS\system32\MsPMSNSv.dll
17:37:50.0140 4044        WmdmPmSN - ok
17:37:50.0250 4044        Wmi            (4c248b8eec34c80f4601bf52269eff19) C:\WINDOWS\System32\advapi32.dll
17:37:50.0437 4044        Wmi - ok
17:37:50.0578 4044        WmiApSrv        (823e73fce543e3484f69ab4f985f1497) C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:37:50.0734 4044        WmiApSrv - ok
17:37:50.0828 4044        wscsvc          (57ffcafe98667c960cbcf4323c7a06ef) C:\WINDOWS\system32\wscsvc.dll
17:37:50.0984 4044        wscsvc - ok
17:37:51.0093 4044        WSTCODEC        (ce1c31b8347e08bbcccde0556bd96e8a) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:37:51.0234 4044        WSTCODEC - ok
17:37:51.0281 4044        wuauserv        (aa6c6632f607113e9dd320f3db08d7d7) C:\WINDOWS\system32\wuauserv.dll
17:37:51.0421 4044        wuauserv - ok
17:37:51.0531 4044        WZCSVC          (3d72ffd328820eba77a3f0918d456142) C:\WINDOWS\System32\wzcsvc.dll
17:37:51.0718 4044        WZCSVC - ok
17:37:51.0812 4044        xmlprov        (4107eaddaeec50a76415f89ecaac9224) C:\WINDOWS\System32\xmlprov.dll
17:37:51.0968 4044        xmlprov - ok
17:37:52.0000 4044        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
17:37:52.0203 4044        \Device\Harddisk0\DR0 - ok
17:37:52.0234 4044        Boot (0x1200)  (7478d63aed38e14d2244f39eeecdf120) \Device\Harddisk0\DR0\Partition0
17:37:52.0250 4044        \Device\Harddisk0\DR0\Partition0 - ok
17:37:52.0265 4044        Boot (0x1200)  (c544752855e49017cd242fdbb4a57623) \Device\Harddisk0\DR0\Partition1
17:37:52.0281 4044        \Device\Harddisk0\DR0\Partition1 - ok
17:37:52.0281 4044        ============================================================
17:37:52.0281 4044        Scan finished
17:37:52.0281 4044        ============================================================
17:37:52.0406 4032        Detected object count: 2
17:37:52.0406 4032        Actual detected object count: 2
17:38:12.0031 4032        ATI Smart ( UnsignedFile.Multi.Generic ) - skipped by user
17:38:12.0031 4032        ATI Smart ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:38:12.0031 4032        SNP325 ( UnsignedFile.Multi.Generic ) - skipped by user
17:38:12.0031 4032        SNP325 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 06.04.2012 16:54
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

mikaa 06.04.2012 17:12
Combofix Logfile:
Code:
ComboFix 12-04-06.03 - slimak 06.04.2012  18:04:28.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.1791.1343 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\slimak\Eigene Dateien\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\slimak\WINDOWS
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-06 bis 2012-04-06  ))))))))))))))))))))))))))))))
.
.
2012-04-06 15:23 . 2012-04-06 15:23        --------        d-----w-        C:\_OTL
2012-04-06 12:41 . 2012-04-06 12:41        --------        d-----w-        c:\programme\ESET
2012-04-05 08:14 . 2012-04-05 08:14        --------        d-----w-        c:\dokumente und einstellungen\slimak\Anwendungsdaten\Malwarebytes
2012-04-05 08:14 . 2012-04-05 08:14        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-04-05 08:14 . 2012-04-05 08:14        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-04-05 08:14 . 2011-12-10 13:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-28 17:41 . 2012-03-28 17:48        --------        d-----w-        c:\dokumente und einstellungen\slimak\Anwendungsdaten\Audacity
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-08 17:26 . 2011-05-26 11:15        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-16 04:32 . 2011-10-06 16:22        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"="c:\programme\AVG\AVG10\avgtray.exe" [2012-01-17 2339168]
"snp325"="c:\windows\vsnp325.exe" [2006-10-10 827392]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-03-11 14336]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-05-04 14:05        311296        ----a-r-        c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Browser companion helper]
2011-11-29 15:50        182576        ----a-w-        c:\programme\BrowserCompanion\BCHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
2009-12-03 08:12        976320        ----a-w-        c:\programme\Epson Software\Event Manager\EEventManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON BX525WD Series]
2010-01-12 07:01        201216        ----a-w-        c:\windows\system32\spool\drivers\w32x86\3\E_FATIGAU.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4800 Series]
2005-02-02 02:00        98304        ----a-w-        c:\windows\system32\spool\drivers\w32x86\3\E_FATIADE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
2005-02-25 06:26        589824        ----a-r-        c:\programme\VIA\RAID\raid_tool.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
2006-10-10 12:11        827392        ----a-w-        c:\windows\vsnp325.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
2006-10-10 13:49        270336        ----a-w-        c:\windows\tsnp325.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVGIDSAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"WZCSVC"=2 (0x2)
"WmdmPmSN"=3 (0x3)
"seclogon"=2 (0x2)
"SCardSvr"=3 (0x3)
"SCardDrv"=3 (0x3)
"Irmon"=2 (0x2)
"ERSvc"=2 (0x2)
"CryptSvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Programme\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Programme\\Opera\\Opera.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Programme\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Programme\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Programme\\AVG\\AVG10\\avgemcx.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [22.02.2011 08:13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16.03.2011 16:03 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07.01.2011 06:41 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [05.04.2011 00:59 297168]
R2 avgwd;AVG WatchDog;c:\programme\AVG\AVG10\avgwdsvc.exe [08.02.2011 05:33 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [27.05.2011 19:05 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [10.02.2011 07:53 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10.02.2011 07:53 27216]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [19.04.2011 17:15 10242176]
S2 AVGIDSAgent;AVGIDSAgent;c:\programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [31.01.2012 16:02 7391072]
S3 NtApm;Herkömmlicher NT APM-Schnittstellentreiber;c:\windows\system32\drivers\NtApm.sys [19.04.2011 12:30 9472]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 48617058
*Deregistered* - 48617058
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
IE: Nach Microsoft &Excel exportieren - c:\tools\Office\XP\Office10\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\dokumente und einstellungen\slimak\Anwendungsdaten\Mozilla\Firefox\Profiles\f4zj9m35.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://de.mc295.mail.yahoo.com/mc/welcome?.gx=1&.tm=1333724868&.rand=eso6i073db8l0#_pg=showMessage&sMid=2&&filterBy=&.rand=1407435733&midIndex=2&mid=1_1997314_AJ697k0AAWleT374dQsXgX%2Fe5UU&fromId=pz@trojaner-board.de&m=1_1999387_AJ%2B97k0AAWmTT38CxgCjTWxrSS4,1_1998312_AKG97k0AAUP%2FT37%2FqgmFkEV%2F1I4,1_1997314_AJ697k0AAWleT374dQsXgX%2Fe5UU,1_1996352_AJ697k0AAWqaT374VwDFulNGCeI,1_1974056_AKG97k0AADSgT33r4QUeswLmOkk,1_1950523_AKC97k0AAGw7T32KsAHsikP21f0,1_1947207_AJ697k0AAEhsT313wQh00j%2B1ftM,1_1943211_AJ697k0AAPeET31eIAfobgiI0uI,&sort=date&order=down&startMid=0&.jsrand=1530946|http://www.trojaner-board.de/113184-.../?babsrc=NT_bb
FF - user.js: extensions.BabylonToolbar_i.id - 30b6ad1d00000000000000116b95d269
FF - user.js: extensions.BabylonToolbar_i.hardId - 30b6ad1d00000000000000116b95d269
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15322
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:06
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101241
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic_i.hmpg - true
FF - user.js: extensions.Softonic_i.hmpgUrl - hxxp://search.softonic.com/MON00005/tb_v1?SearchSource=13&cc=
FF - user.js: extensions.Softonic.hpOld - hxxp://search.babylon.com/?babsrc=HP_ss&affID=101241&mntrId=30b6ad1d00000000000000116b95d269
FF - user.js: extensions.Softonic.hpNew - hxxp://search.softonic.com/MON00005/tb_v1?SearchSource=13&cc=
FF - user.js: extensions.Softonic_i.dfltSrch - true
FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)
FF - user.js: extensions.Softonic.keyWordUrl - hxxp://search.softonic.com/MON00005/tb_v1?SearchSource=2&cc=&q=
FF - user.js: extensions.Softonic.dspOld -
FF - user.js: extensions.Softonic.dspNew - Search the web (Softonic)
FF - user.js: extensions.Softonic_i.dnsErr - true
FF - user.js: extensions.Softonic_i.newTab - true
FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MON00005/tb_v1?SearchSource=15&cc=
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MON00005/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.Softonic.id - 30b6ad1d00000000000000116b95d269
FF - user.js: extensions.Softonic.instlDay - 15435
FF - user.js: extensions.Softonic.vrsn - 1.5.21.0
FF - user.js: extensions.Softonic.vrsni - 1.5.21.0
FF - user.js: extensions.Softonic_i.vrsnTs - 1.5.21.011:29
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - SD
FF - user.js: extensions.Softonic_i.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - base
FF - user.js: extensions.Softonic.instlRef - MON00005
FF - user.js: extensions.Softonic.dfltLng -
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.admin - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-APSDaemon - c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe
MSConfigStartUp-Cmaudio - cmicnfg.cpl
MSConfigStartUp-QuickTime Task - c:\programme\QuickTime\QTTask.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-06 18:07
Windows 5.1.2600 Service Pack 2, v.2096 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*žyÖw·*]
"DisplayName"="?\11"
"DeviceDesc"="?\11"
"ProviderName"="?\11???\11\08"
"MFG"="??\09"
"ReinstallString"="8.183.0.0"
"DeviceInstanceIds"=multi:"e:\\m9p\\driver\\2kxp_inf\\cx_27792.inf\00"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\ODBC32.dll
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'lsass.exe'(760)
c:\windows\system32\dssenh.dll
.
Zeit der Fertigstellung: 2012-04-06  18:09:23
ComboFix-quarantined-files.txt  2012-04-06 16:09
.
Vor Suchlauf: 9 Verzeichnis(se), 40.767.479.808 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 40.729.481.216 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
.
- - End Of File - - C00D52DE098DD583B5C9673EA510F1BE
--- --- ---

cosinus 06.04.2012 17:19
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

mikaa 06.04.2012 18:54
Hat ewig gedauert aber nun....

gmer:

GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-04-06 19:11:32
Windows 5.1.2600 Service Pack 2, v.2096 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 HDS728080PLAT20 rev.PF2OA2AA
Running: z40jxry1.exe; Driver: C:\DOKUME~1\slimak\LOKALE~1\Temp\uwddypow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwOpenProcess [0xBA52D738]
SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateProcess [0xBA52D7DC]
SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateThread [0xBA52D878]
SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwWriteVirtualMemory [0xBA52D914]

Code            \??\C:\DOKUME~1\slimak\LOKALE~1\Temp\catchme.sys                                                                            pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text          ntoskrnl.exe!_allmul + 21C                                                                                                  804E3A00 4 Bytes  [38, D7, 52, BA]
.text          ntoskrnl.exe!_allmul + 438                                                                                                  804E3C1C 8 Bytes  [DC, D7, 52, BA, 78, D8, 52, ...]
.text          ntoskrnl.exe!_allmul + 488                                                                                                  804E3C6C 4 Bytes  [14, D9, 52, BA]
?              C:\WINDOWS\system32\Drivers\PROCEXP113.SYS                                                                                  Das System kann die angegebene Datei nicht finden. !
?              C:\DOKUME~1\slimak\LOKALE~1\Temp\catchme.sys                                                                                Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                      AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                    avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                  avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                  avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                    fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                    AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}@                                                        RefDial Class
Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}\MiscStatus                                             
Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}\MiscStatus@                                              0
Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}\MiscStatus\1                                           
Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}\MiscStatus\1@                                            131473
Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}\ToolboxBitmap32                                         
Reg            HKLM\SOFTWARE\Classes\CLSID\{1E794A0A-86F4-11D1-ADD8-00p0F87734F0}\ToolboxBitmap32@                                        C:\Programme\Internet Explorer\Connection Wizard\icwhelp.dll, 1

---- EOF - GMER 1.0.15 ----
--- --- ---


OSAM:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:19:46 on 06.04.2012

OS: Windows XP Professional Service Pack 2, v.2096 (Build 2600)
Default Browser: Mozilla Corporation Firefox 5.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
"BootExecute" - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG10\avgrsx.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AVG Anti-Rootkit Driver" (Avgrkx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgrkx86.sys
"AVG AVI Loader Driver" (Avgldx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgldx86.sys
"AVG Mini-Filter Resident Anti-Virus Shield" (Avgmfx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgmfx86.sys
"AVG TDI Driver" (Avgtdix) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgtdix.sys
"AVGIDSDriver" (AVGIDSDriver) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSDriver.Sys
"AVGIDSEH" (AVGIDSEH) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSEH.Sys
"AVGIDSFilter" (AVGIDSFilter) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSFilter.Sys
"AVGIDSShim" (AVGIDSShim) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSShim.Sys
"catchme" (catchme) - ? - C:\DOKUME~1\slimak\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"mbr" (mbr) - ? - C:\ComboFix\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Secdrv" (Secdrv) - ? - C:\WINDOWS\System32\DRIVERS\secdrv.sys  (File signed by Microsoft | File found, but it contains no detailed information)
"USB PC Camera (SNPSTD325)" (SNP325) - "Sonix Co. Ltd." - C:\WINDOWS\System32\DRIVERS\snp325.sys
"uwddypow" (uwddypow) - "GMER" - C:\DOKUME~1\slimak\LOKALE~1\Temp\uwddypow.sys  (Hidden registry entry, rootkit activity)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL
{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} "XPLPPFilter Class" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgpp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Tools\Inne\7-Zip\7-zip.dll
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} "AVG Find Extension" - ? -  (File not found | COM-object registry key not found)
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "AVG Shell Extension Class" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgse.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Tools\Office\XP\Office10\msohev.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\Tools\Office\XP\Office10\OLKFSTUB.DLL
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} "AVG Safe Search" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgssie.dll
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[Logon]
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\slimak\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AVG_TRAY" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgtray.exe
"snp325" - ? - C:\WINDOWS\vsnp325.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"EPSON Stylus DX4800 Series 2KMonitor5E" - "SEIKO EPSON CORPORATION" - C:\WINDOWS\system32\E_FLMADE.DLL
"EpsonNet Print Port" - "SEIKO EPSON CORPORATION" - C:\WINDOWS\system32\enppmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AVG WatchDog" (avgwd) - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgwdsvc.exe
"AVGIDSAgent" (AVGIDSAgent) - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru [/code]

aswMBR:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-06 19:21:57
-----------------------------
19:21:57.421    OS Version: Windows 5.1.2600 Service Pack 2, v.2096
19:21:57.421    Number of processors: 1 586 0x209
19:21:57.437    ComputerName: JAMAKSJA  UserName: slimak
19:21:57.890    Initialize success
19:32:32.390    AVAST engine defs: 12040600
19:32:39.375    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
19:32:39.390    Disk 0 Vendor: HDS728080PLAT20 PF2OA2AA Size: 78533MB BusType: 3
19:32:39.421    Disk 0 MBR read successfully
19:32:39.421    Disk 0 MBR scan
19:32:39.453    Disk 0 Windows XP default MBR code
19:32:39.453    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        49999 MB offset 63
19:32:39.453    Disk 0 Partition - 00    0F Extended LBA            28521 MB offset 102398310
19:32:39.468    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        28521 MB offset 102398373
19:32:39.484    Disk 0 scanning sectors +160810650
19:32:39.562    Disk 0 scanning C:\WINDOWS\system32\drivers
19:33:00.375    Service scanning
19:33:31.250    Modules scanning
19:34:15.453    Disk 0 trace - called modules:
19:34:15.812    ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
19:34:15.812    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89a2dab8]
19:34:15.812    3 CLASSPNP.SYS[f7648603] -> nt!IofCallDriver -> \Device\00000063[0x89a31f18]
19:34:15.812    5 ACPI.sys[f75ad600] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89a26940]
19:34:16.109    AVAST engine scan C:\WINDOWS
19:34:32.968    AVAST engine scan C:\WINDOWS\system32
19:35:08.671    File: C:\WINDOWS\system32\ctfmon.exe  **INFECTED** Win32:Malware-gen
19:40:01.796    AVAST engine scan C:\WINDOWS\system32\drivers
19:40:50.359    AVAST engine scan C:\Dokumente und Einstellungen\slimak
19:48:14.968    AVAST engine scan C:\Dokumente und Einstellungen\All Users
19:50:29.281    Scan finished successfully
19:50:44.656    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\slimak\Desktop\MBR.dat"
19:50:44.656    The log file has been saved successfully to "C:\Dokumente und Einstellungen\slimak\Desktop\aswMBR.txt"


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:54 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131