Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Ständiger Neustart bei Netzwerkverbindung Otl log (https://www.trojaner-board.de/89593-staendiger-neustart-netzwerkverbindung-otl-log.html)

Logi23 16.08.2010 15:48
Ständiger Neustart bei Netzwerkverbindung Otl log
 
hallo habe gelesen das einige leute das selbe problem haben habe grade wie von markusg vorgeschlagen einen otl scan gemacht und hier das log dazu

OTL Logfile:
Code:
OTL logfile created on: 16.08.2010 15:45:29 - Run 1
OTL by OldTimer - Version 3.2.10.0    Folder = I:\
 An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 73,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,79 Gb Total Space | 132,20 Gb Free Space | 56,79% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 207,53 Gb Free Space | 89,11% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 995,77 Mb Total Space | 244,28 Mb Free Space | 24,53% Space Free | Partition Type: FAT32
Drive I: | 3,82 Gb Total Space | 0,27 Gb Free Space | 7,04% Space Free | Partition Type: FAT32
 
Computer Name: PIT-PC
Current User Name: Pit
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - I:\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Panda Security\WAC\PsCtrlS.exe (Panda Security)
PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Programme\Panda Security\WAC\avengine.exe (Panda Security, S.L.)
PRC - C:\Programme\Panda Security\WAC\pavsrvx86.exe (Panda Security, S.L.)
PRC - C:\Programme\Panda Security\WAC\WEBPROXY.EXE (Panda Security International)
PRC - C:\Programme\Panda Security\WAC\PsCtrlC.exe (Panda Security)
PRC - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Programme\Panda Security\WAC\psksvc.exe (Panda Software International)
PRC - C:\Programme\Panda Security\WAC\PSIMSVC.EXE (Panda Security S.L.)
PRC - C:\Programme\Panda Security\WaAgent\WasAgent\WasAgent.exe (Panda Security)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\HP1006MC.EXE (Software 2000 Limited)
PRC - C:\Programme\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe (Panda Security)
PRC - C:\Programme\Panda Security\WaAgent\WasWD\WasWD.exe (Panda Security)
PRC - C:\Programme\Panda Security\WaAgent\Scheduler\PavSched.exe (Panda Security)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
 
 
========== Modules (SafeList) ==========
 
MOD - I:\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Panda Software Controller) -- C:\Program Files\Panda Security\WAC\PsCtrlS.exe (Panda Security)
SRV - (PavSrv) -- C:\Program Files\Panda Security\WAC\pavsrvx86.exe (Panda Security, S.L.)
SRV - (PskSvc) -- C:\Program Files\Panda Security\WAC\psksvc.exe (Panda Software International)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (PSImSvc) -- C:\Program Files\Panda Security\WAC\PSIMSVC.EXE (Panda Security S.L.)
SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (WASAgent) -- C:\Programme\Panda Security\WaAgent\WasAgent\WasAgent.exe (Panda Security)
SRV - (PavWASLpMng) -- C:\Program Files\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe (Panda Security)
SRV - (WASWD) -- C:\Programme\Panda Security\WaAgent\WasWD\WasWD.exe (Panda Security)
SRV - (PavAt3Scheduler) -- C:\Program Files\Panda Security\WaAgent\Scheduler\PavSched.exe (Panda Security)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (catchme) -- C:\Users\Pit\AppData\Local\Temp\catchme.sys File not found
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (AmFSM) -- C:\Windows\System32\drivers\amm8660.sys (Panda Security, S.L.)
DRV - (NSFIM) -- C:\Windows\System32\drivers\nsfim.sys (Panda Security, S.L.)
DRV - (NETIMFLT01060042) -- C:\Windows\System32\drivers\neti1642.sys (Panda Security, S.L.)
DRV - (RTL8187) -- C:\Windows\System32\drivers\RTL8187.sys (Realtek Semiconductor Corporation                          )
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (AsIO) -- C:\Windows\System32\drivers\AsIO.sys ()
DRV - (TT1724ht) -- C:\Windows\System32\drivers\TT1724ht.sys (TerraTec Electronic GmbH)
DRV - (TT1724sa) -- C:\Windows\System32\drivers\TT1724sa.sys (Sensaura)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 89 4A 20 5B 03 AB CA 01  [binary data]
IE - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.06.07 19:13:16 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2010.08.16 11:23:20 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Panda Software Controller Client] C:\Program Files\Panda Security\WAC\PSCtrlC.exe (Panda Security)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2289426193-355958968-1139114157-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Program Files\Panda Security\WAC\pavlsp.dll (Panda Software International)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.104.254
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - c:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.08.11 13:11:50 | 000,000,000 | ---D | M] - I:\Autosys -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootMin: Primary disk - Driver Group
SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.16 15:06:09 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.08.16 15:06:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010.08.16 11:56:48 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Roaming\Malwarebytes
[2010.08.16 11:56:28 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Toolbar
[2010.08.16 11:55:50 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Lite
[2010.08.16 11:53:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.16 11:53:02 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.08.16 11:53:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.16 11:53:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.16 11:25:33 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010.08.16 11:25:32 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.08.16 11:25:32 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Local\temp
[2010.08.16 11:05:48 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.08.16 11:05:44 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.08.16 11:05:44 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.08.16 11:05:32 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.08.16 11:03:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.08.16 11:03:21 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.08.13 18:36:19 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Local\jjfmlsxmc
[2010.08.12 17:17:27 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\Molly Hatchet - 25th Anniversary Best Of Re-Recorded
[2010.08.11 14:35:09 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll
[2010.08.11 14:35:09 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010.08.11 14:35:08 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010.08.11 14:35:04 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010.08.11 14:35:04 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010.08.11 14:35:02 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.08.11 14:35:02 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.08.11 14:35:02 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.08.11 14:35:02 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.08.11 14:35:02 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.08.11 14:35:02 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.08.11 14:35:02 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.08.11 14:35:02 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.08.11 14:34:56 | 002,326,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.08.05 16:09:46 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Works
[2010.08.05 16:09:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio
[2010.08.05 16:09:27 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DESIGNER
[2010.08.05 16:09:06 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2010.08.05 16:07:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 8
[2010.08.05 16:06:43 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office
[2010.08.05 16:06:13 | 000,000,000 | R--D | C] -- C:\MSOCache
[2010.07.28 21:52:15 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\Green Day - Greatest Hits 2010  2 CD-2010
[2010.07.24 13:55:54 | 000,000,000 | ---D | C] -- C:\Users\Pit\AppData\Roaming\vlc
[2010.07.24 13:55:29 | 000,000,000 | ---D | C] -- C:\Programme\VideoLAN
[2010.07.24 13:43:44 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\NEUE ALBEN-Bearbeit
[2010.07.17 23:46:41 | 000,000,000 | ---D | C] -- C:\Users\Pit\Desktop\Prince-20ten-RETAIL-
[2005.01.08 22:45:30 | 000,643,120 | ---- | C] (Snelg Enterprises) -- C:\Programme\MP3GainGUI.exe
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.16 15:47:04 | 000,783,872 | ---- | M] () -- C:\Windows\System32\drivers\wmqdfixt.sys
[2010.08.16 15:46:25 | 000,014,624 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.16 15:46:25 | 000,014,624 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.16 15:43:26 | 001,507,106 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.16 15:43:26 | 000,657,438 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.16 15:43:26 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.16 15:43:26 | 000,130,810 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.16 15:43:26 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.16 15:40:52 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.16 15:39:15 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.16 15:39:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.16 15:38:58 | 2717,257,728 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.16 15:38:23 | 002,883,584 | -HS- | M] () -- C:\Users\Pit\NTUSER.DAT
[2010.08.16 15:25:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.08.16 15:06:13 | 000,001,216 | ---- | M] () -- C:\Users\Pit\Desktop\Spybot - Search & Destroy.lnk
[2010.08.16 14:35:51 | 004,976,695 | -H-- | M] () -- C:\Users\Pit\AppData\Local\IconCache.db
[2010.08.16 11:56:27 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2010.08.16 11:56:13 | 000,691,696 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys
[2010.08.16 11:53:05 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.16 11:23:25 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010.08.16 11:23:20 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010.08.16 10:26:26 | 000,002,828 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys
[2010.08.13 18:36:09 | 000,000,000 | ---- | M] () -- C:\zrpt.xml
[2010.08.12 03:20:20 | 004,784,696 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.11 17:31:41 | 000,722,606 | ---- | M] () -- C:\Users\Pit\Desktop\Urlaub-Abrechnung.cdr
[2010.08.11 16:23:43 | 000,021,083 | ---- | M] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_PITS-GROSS.cdr
[2010.08.10 18:11:07 | 000,027,708 | ---- | M] () -- C:\Users\Pit\Desktop\Montreaux.cdr
[2010.08.10 17:55:12 | 000,020,963 | ---- | M] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_Sicherungskopie_von_PITS-GROSS.cdr
[2010.08.07 13:43:35 | 000,337,097 | ---- | M] () -- C:\Users\Pit\Desktop\FRANK.cdr
[2010.08.06 18:10:16 | 000,337,935 | ---- | M] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_FRANK.cdr
[2010.08.06 17:30:03 | 000,077,998 | ---- | M] () -- C:\Users\Pit\Desktop\banner-iokai-trans_0a5b3cf8cb[1].jpg
[2010.08.06 15:38:37 | 000,624,240 | ---- | M] () -- C:\Users\Pit\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.06 03:01:32 | 000,000,478 | ---- | M] () -- C:\Windows\win.ini
[2010.08.06 02:47:00 | 000,007,018 | ---- | M] () -- C:\Users\Pit\Desktop\Angebot_AN0030.rtf
[2010.07.29 08:30:49 | 000,197,632 | ---- | M] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll
[2010.07.29 08:30:34 | 000,082,944 | ---- | M] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010.07.27 21:09:29 | 002,239,182 | ---- | M] () -- C:\Users\Pit\Desktop\Plan Alter Markt.bmp
[2010.07.24 13:55:39 | 000,001,024 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010.07.23 16:01:42 | 008,317,039 | ---- | M] () -- C:\Users\Pit\Desktop\Wishbone Ash - Argus [2002 Remaster] - 08 - Jail Bait (Bonus Live Track).mp3
[2010.07.19 15:22:09 | 005,325,745 | ---- | M] () -- C:\Users\Pit\Desktop\Grafik1.cdr
 
========== Files Created - No Company Name ==========
 
[2010.08.16 15:06:13 | 000,001,216 | ---- | C] () -- C:\Users\Pit\Desktop\Spybot - Search & Destroy.lnk
[2010.08.16 11:56:27 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2010.08.16 11:53:05 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.16 11:05:48 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.08.16 11:05:44 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.08.16 11:05:44 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.08.16 11:05:44 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.08.16 11:05:44 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.08.13 18:35:28 | 000,783,872 | ---- | C] () -- C:\Windows\System32\drivers\wmqdfixt.sys
[2010.08.13 18:35:20 | 000,000,000 | ---- | C] () -- C:\zrpt.xml
[2010.08.11 17:31:41 | 000,722,606 | ---- | C] () -- C:\Users\Pit\Desktop\Urlaub-Abrechnung.cdr
[2010.08.10 18:11:07 | 000,027,708 | ---- | C] () -- C:\Users\Pit\Desktop\Montreaux.cdr
[2010.08.10 17:52:37 | 000,020,963 | ---- | C] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_Sicherungskopie_von_PITS-GROSS.cdr
[2010.08.06 17:56:54 | 000,337,935 | ---- | C] () -- C:\Users\Pit\Desktop\Sicherungskopie_von_FRANK.cdr
[2010.08.06 17:28:02 | 000,077,998 | ---- | C] () -- C:\Users\Pit\Desktop\banner-iokai-trans_0a5b3cf8cb[1].jpg
[2010.08.06 17:24:21 | 000,337,097 | ---- | C] () -- C:\Users\Pit\Desktop\FRANK.cdr
[2010.08.06 01:47:29 | 000,007,018 | ---- | C] () -- C:\Users\Pit\Desktop\Angebot_AN0030.rtf
[2010.07.27 21:09:29 | 002,239,182 | ---- | C] () -- C:\Users\Pit\Desktop\Plan Alter Markt.bmp
[2010.07.24 13:55:39 | 000,001,024 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010.07.24 13:33:35 | 008,317,039 | ---- | C] () -- C:\Users\Pit\Desktop\Wishbone Ash - Argus [2002 Remaster] - 08 - Jail Bait (Bonus Live Track).mp3
[2010.06.09 16:43:44 | 000,001,456 | ---- | C] () -- C:\Users\Pit\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2010.06.07 19:01:24 | 000,000,899 | ---- | C] () -- C:\Windows\WINCMD.INI
[2010.06.07 18:57:31 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2010.06.01 00:43:23 | 000,007,605 | ---- | C] () -- C:\Users\Pit\AppData\Local\Resmon.ResmonCfg
[2010.04.30 00:15:17 | 000,003,262 | ---- | C] () -- C:\Programme\MP3GainGUIErrors.log
[2010.04.21 00:40:32 | 000,136,714 | ---- | C] () -- C:\Programme\MP3GainGUIChanges.log
[2010.04.19 17:29:51 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2010.02.12 18:47:04 | 000,039,789 | ---- | C] () -- C:\Programme\uninst-mp3gain.exe
[2010.02.12 17:46:33 | 000,065,536 | ---- | C] () -- C:\Windows\System32\HPPLVS.dll
[2010.02.12 16:01:43 | 000,000,133 | ---- | C] () -- C:\Windows\AdminIE.ini
[2010.02.12 15:57:47 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010.02.12 15:57:47 | 000,000,088 | RHS- | C] () -- C:\ProgramData\0A6367044D.sys
[2010.02.12 15:06:24 | 000,303,104 | ---- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2010.02.12 15:06:24 | 000,002,754 | ---- | C] () -- C:\Windows\cmudax3.ini
[2010.02.12 14:17:00 | 000,704,512 | R--- | C] () -- C:\Windows\System32\cohelper.dll
[2010.02.12 14:15:21 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.02.12 14:15:18 | 000,016,051 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.02.12 12:24:35 | 000,024,576 | R--- | C] () -- C:\Windows\System32\AsIO.dll
[2010.02.12 12:24:35 | 000,012,400 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.05.13 13:11:34 | 000,006,504 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2009.04.02 14:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2005.01.09 01:58:09 | 000,131,127 | ---- | C] () -- C:\Programme\mp3gain.exe
[2004.11.02 18:05:44 | 000,330,954 | ---- | C] () -- C:\Programme\MP3Gain.chm
 
========== LOP Check ==========
 
[2010.02.17 18:05:16 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Bitstream
[2010.06.07 19:01:21 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\DAEMON Tools Lite
[2010.03.30 18:12:51 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Opera
[2010.06.08 17:06:12 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.02.12 18:33:46 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TeamViewer
[2010.02.17 19:18:38 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TuneUp Software
[2010.02.17 19:45:08 | 000,032,128 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.06.08 22:04:41 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Adobe
[2010.06.08 17:06:13 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Adobe Mini Bridge CS5
[2010.02.12 18:07:20 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Ahead
[2010.02.17 18:05:16 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Bitstream
[2010.06.01 17:17:17 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Corel
[2010.06.07 19:01:21 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\DAEMON Tools Lite
[2010.02.12 14:18:43 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Download Manager
[2010.06.08 15:12:25 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Google
[2010.02.11 12:15:56 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Identities
[2010.02.11 17:41:25 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Macromedia
[2010.08.16 11:56:48 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:56 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Media Center Programs
[2010.06.26 14:26:03 | 000,000,000 | --SD | M] -- C:\Users\Pit\AppData\Roaming\Microsoft
[2010.03.30 18:12:51 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\Opera
[2010.06.08 17:06:12 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.02.12 18:33:46 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TeamViewer
[2010.02.17 19:18:38 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\TuneUp Software
[2010.07.28 21:46:48 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\vlc
[2010.02.13 02:11:48 | 000,000,000 | ---D | M] -- C:\Users\Pit\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.06.07 19:10:20 | 000,010,134 | R--- | M] () -- C:\Users\Pit\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\hddold\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2009.07.14 04:38:05 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\AGP440.sys
[2009.07.14 04:38:05 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 04:38:05 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\ERDNT\cache\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\hddold\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\hddold\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\hddold\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2009.07.14 04:38:05 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\atapi.sys
[2009.07.14 04:38:05 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 04:38:05 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\ERDNT\cache\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.02.13 21:05:07 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\hddold\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.13 21:05:07 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.13 21:05:07 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\hddold\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\hddold\$WINDOWS.~BT\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\hddold\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\hddold\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\hddold\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\hddold\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2009.07.14 04:38:05 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\iaStorV.sys
[2009.07.14 04:38:05 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 04:38:05 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\hddold\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\hddold\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\hddold\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\hddold\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\hddold\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 00:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\hddold\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\hddold\$WINDOWS.~BT\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\ERDNT\cache\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\nvstor.sys
[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_29af12c5857181b0\nvstor.sys
[2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvstor.inf_x86_neutral_5d3b5edfbebeb7c4\nvstor.sys
[2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\Windows\System32\drivers\nvstor.sys
[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvstor.inf_bd7fd3de\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\hddold\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
[2009.07.14 04:38:05 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 04:38:05 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=2A0CC26D67B38460CC7563BC8313C1D6 -- C:\hddold\NVIDIA\nForceWinVista\15.23\IS\IDE\WinVista\sataraid\nvstor32.sys
[2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\nvstor32.sys
[2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_b900095f3aa53048\nvstor32.sys
[2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\NVIDIA\nForceWinVista\15.23\IS\IDE\WinVista\sata_ide\nvstor32.sys
[2008.08.18 19:58:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvstor32.inf_d87a3a1f\nvstor32.sys
[2007.07.03 01:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_73e25653bed8b986\nvstor32.sys
[2007.07.03 01:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvstor32.inf_efe24208\nvstor32.sys
[2006.11.10 13:41:46 | 000,097,064 | ---- | M] (NVIDIA Corporation) MD5=C090FF5B6F1E25CBE0D9627A7F407E89 -- C:\hddold\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_73983f1ccfea7d8f\nvstor32.sys
[2006.11.10 13:41:46 | 000,097,064 | ---- | M] (NVIDIA Corporation) MD5=C090FF5B6F1E25CBE0D9627A7F407E89 -- C:\hddold\Windows\System32\drivers\nvstor32.sys
[2006.11.10 13:41:46 | 000,097,064 | ---- | M] (NVIDIA Corporation) MD5=C090FF5B6F1E25CBE0D9627A7F407E89 -- C:\hddold\Windows\System32\DriverStore\FileRepository\nvraid.inf_f0461979\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\hddold\$WINDOWS.~BT\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\ERDNT\cache\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2008.01.19 00:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\hddold\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\hddold\$WINDOWS.~BT\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\ERDNT\cache\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2007.04.04 15:21:50 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\hddold\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007.04.04 15:21:50 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 00:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\hddold\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\hddold\Windows\System32\userinit.exe
[2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\hddold\$WINDOWS.~BT\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\ERDNT\cache\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\hddold\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\hddold\$WINDOWS.~BT\Windows\System32\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\hddold\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 00:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\hddold\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\hddold\$WINDOWS.~BT\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\hddold\$WINDOWS.~BT\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\hddold\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\hddold\Windows\System32\drivers\ws2ifsl.sys
[2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\hddold\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.08.16 11:56:13 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys
[2010.08.16 15:58:06 | 000,783,872 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\wmqdfixt.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 03:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2009.07.14 03:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2009.07.14 03:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\LocationApi.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:DD4DD9B9
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:1493A0EF

< End of report >
--- --- ---

markusg 16.08.2010 16:02
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Logi23 16.08.2010 16:11
so combofix hatte ich schon vorher laufen lassen hoffe das macht nichts
Combofix Logfile:
Code:
ComboFix 10-08-15.02 - Pit 16.08.2010  11:13:59.1.2 - x86
Microsoft Windows 7 Professional  6.1.7600.0.1252.49.1031.18.3455.2751 [GMT 2:00]
ausgeführt von:: I:\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\$NtUninstallMTF1011$
c:\windows\$NtUninstallMTF1011$\apUninstall.exe
c:\windows\$NtUninstallMTF1011$\zrpt.xml

Infizierte Kopie von c:\windows\system32\drivers\pci.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-16 bis 2010-08-16  ))))))))))))))))))))))))))))))
.

2010-08-13 16:36 . 2010-08-13 16:38        --------        d-----w-        c:\users\Pit\AppData\Local\jjfmlsxmc
2010-08-13 16:36 . 2010-08-13 16:36        190464        ----a-w-        c:\windows\Jqapya.exe
2010-08-11 12:34 . 2010-06-19 04:07        2326016        ----a-w-        c:\windows\system32\win32k.sys
2010-08-11 12:34 . 2010-06-16 05:48        224256        ----a-w-        c:\windows\system32\schannel.dll
2010-08-06 01:01 . 2010-08-06 01:01        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2010-08-05 15:09 . 2010-08-05 15:09        --------        d-----w-        c:\users\Administrator\AppData\Local\Google
2010-08-05 14:09 . 2010-08-06 01:02        --------        d-----w-        c:\program files\Microsoft Works
2010-08-05 14:09 . 2010-08-05 14:09        --------        d-----w-        c:\windows\PCHEALTH
2010-08-05 14:07 . 2010-08-05 14:07        --------        d-----w-        c:\program files\Microsoft Visual Studio 8
2010-08-05 14:06 . 2010-08-05 14:06        --------        d-----r-        C:\MSOCache
2010-07-24 11:55 . 2010-07-28 19:46        --------        d-----w-        c:\users\Pit\AppData\Roaming\vlc
2010-07-24 11:55 . 2010-07-24 11:55        --------        d-----w-        c:\program files\VideoLAN

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 09:16 . 2009-07-14 08:47        657438        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-16 09:16 . 2009-07-14 08:47        130810        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-16 08:26 . 2010-02-12 13:57        2828        --sha-w-        c:\programdata\KGyGaAvL.sys
2010-08-16 08:26 . 2010-02-12 13:57        2828        --sha-w-        c:\programdata\KGyGaAvL.sys
2010-08-13 16:30 . 2010-04-20 22:40        136714        ----a-w-        c:\program files\MP3GainGUIChanges.log
2010-08-13 14:26 . 2010-02-11 15:39        --------        d-----w-        c:\programdata\Microsoft Help
2010-08-06 13:38 . 2010-02-11 14:21        624240        ----a-w-        c:\users\Pit\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-05 14:09 . 2009-07-14 04:52        --------        d-----w-        c:\program files\MSBuild
2010-07-29 06:30 . 2010-08-11 12:35        197632        ----a-w-        c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:35        82944        ----a-w-        c:\windows\system32\iccvid.dll
2010-07-19 14:55 . 2010-02-17 17:37        --------        d-----w-        c:\program files\TuneUp Utilities 2010
2010-07-16 00:53 . 2010-04-29 22:15        3262        ----a-w-        c:\program files\MP3GainGUIErrors.log
2010-07-12 13:21 . 2010-02-12 14:04        --------        d-----w-        c:\programdata\sentinel
2010-07-06 11:26 . 2010-02-17 17:37        30528        ----a-w-        c:\windows\system32\TURegOpt.exe
2010-07-06 11:20 . 2010-02-17 17:37        21312        ----a-w-        c:\windows\system32\authuitu.dll
2010-07-06 11:20 . 2010-02-17 17:37        30016        ----a-w-        c:\windows\system32\uxtuneup.dll
2010-06-30 06:25 . 2010-08-11 12:35        978432        ----a-w-        c:\windows\system32\wininet.dll
2010-06-26 01:00 . 2010-02-11 15:41        --------        d-----w-        c:\program files\Microsoft.NET
2010-06-22 20:05 . 2010-06-22 20:05        501936        ----a-w-        c:\programdata\Google\Google Toolbar\Update\gtb6893.tmp.exe
2010-06-22 02:47 . 2010-08-11 12:35        310784        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-11 12:35        307200        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-11 12:35        113664        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-11 12:35        3955080        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-11 12:35        3899784        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-11 12:35        37376        ----a-w-        c:\windows\system32\rtutils.dll
2010-06-14 06:12 . 2010-08-11 12:35        1286016        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2010-06-08 06:02 . 2010-08-11 12:35        1233920        ----a-w-        c:\windows\system32\msxml3.dll
2010-06-07 17:10 . 2010-06-07 17:10        10134        ----a-r-        c:\users\Pit\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
2010-06-07 17:08 . 2010-08-05 15:03        38784        ----a-w-        c:\users\Administrator\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-07 17:08 . 2010-06-07 17:08        38784        ----a-w-        c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-07 16:57 . 2010-06-07 16:57        691696        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-06-03 12:17 . 2010-02-12 13:57        88        --sh--r-        c:\programdata\0A6367044D.sys
2010-06-03 12:17 . 2010-02-12 13:57        88        --sh--r-        c:\programdata\0A6367044D.sys
2010-06-01 15:20 . 2010-06-01 15:13        2828        --sha-w-        c:\programdata\Protexis\KGyGaAvL.sys
2010-06-01 15:20 . 2010-06-01 15:17        88        --sh--r-        c:\programdata\Protexis\0A6367044D.sys
2010-05-27 07:24 . 2010-06-09 05:35        34304        ----a-w-        c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-09 05:35        293888        ----a-w-        c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2010-02-11 10:19        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-21 11:50 . 2010-07-12 13:21        54344        ----a-w-        c:\windows\system32\drivers\amm8660.sys
2010-02-12 16:47 . 2010-02-12 16:47        39789        ----a-w-        c:\program files\uninst-mp3gain.exe
2005-01-08 23:58 . 2005-01-08 23:58        131127        ----a-w-        c:\program files\mp3gain.exe
2005-01-08 20:45 . 2005-01-08 20:45        643120        ----a-w-        c:\program files\MP3GainGUI.exe
2004-11-02 16:05 . 2004-11-02 16:05        330954        ----a-w-        c:\program files\MP3Gain.chm
2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42        396800        --sha-w-        c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-08 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Panda Software Controller Client"="c:\program files\Panda Security\WAC\PSCtrlC.exe" [2010-04-09 143616]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 135664]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-07 375808]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TT1724ht;AureonWDM;c:\windows\system32\drivers\TT1724ht.sys [2004-12-01 73344]
R3 TT1724sa;TT1724sa;c:\windows\system32\drivers\TT1724sa.sys [2004-05-11 400640]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-06-07 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2010-05-21 54344]
S2 NSFIM;Network Shared Files Information Manager Plugin;c:\windows\system32\Drivers\NSFIM.SYS [2010-03-30 54792]
S2 PavAt3Scheduler;Panda Endpoint Scheduler;c:\program files\Panda Security\WaAgent\Scheduler\PavSched.exe [2009-09-17 140544]
S2 PavWASLpMng;Panda Endpoint Local Process Manager;c:\program files\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe [2009-09-17 295680]
S2 PskSvc;Panda Kernel Service;c:\program files\Panda Security\WAC\psksvc.exe [2010-03-31 27904]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-07-06 1051968]
S2 WASAgent;Panda Endpoint Communications Agent;c:\program files\Panda Security\WaAgent\WasAgent\WasAgent.exe [2009-12-31 320768]
S2 WASWD;Panda Endpoint Watchdog;c:\program files\Panda Security\WaAgent\WasWD\WasWD.exe [2009-09-17 206080]
S3 NETIMFLT01060042;PANDA NDIS IM Filter Miniport v1.6.0.42;c:\windows\system32\DRIVERS\neti1642.sys [2010-02-18 199688]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]


--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - wmqdfixt

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]

2010-08-16 c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
- c:\windows\Jqapya.exe [2010-08-13 16:36]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\WAC\pavlsp.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-sta - reaip.dll
AddRemove-$NtUninstallMTF1011$ - c:\windows\$NtUninstallMTF1011$\apUninstall.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmqdfixt]

.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2EDFD31B-F5E9-01F1-12DB-AD1F9A360B2B}*]
"hagcicajgnpkedjm"=hex:6b,61,62,69,68,6f,66,63,63,6f,65,6d,64,68,6f,6e,6e,62,
  68,6b,67,70,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-08-16  11:25:30
ComboFix-quarantined-files.txt  2010-08-16 09:25

Vor Suchlauf: 12 Verzeichnis(se), 140.336.312.320 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 140.029.194.240 Bytes frei

- - End Of File - - BA001C82D2722BB188574774016F02F9
--- --- ---

markusg 16.08.2010 16:21
start programme, zubehör, editor, kopiere rein:

Killall::
Rootkit::
c:\windows\Jqapya.exe
c:\windows\system32\drivers\wmqdfixt.sys
c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
driver::
wmqdfixt


Datei speichern unter, typ alle dateien, name cfscript.txt
speicherort, dort wo sich combofix.exe befindet.
ziehe cfscript auf combofix, programm startet, log posten.

Download malwarebytes:
Malwarebytes

update das programm über die registerkarte aktualisierung, schalte nun alles an laufenden programmen ab, auch antivirus, trenne die internetverbindung.
starte nen komplett scan, funde löschen, log posten.

Logi23 16.08.2010 17:04
so hier die log von combofix

Combofix Logfile:
Code:
ComboFix 10-08-15.02 - Pit 16.08.2010  17:41:19.2.2 - x86
Microsoft Windows 7 Professional  6.1.7600.0.1252.49.1031.18.3455.2605 [GMT 2:00]
ausgeführt von:: H:\ComboFix.exe
Benutzte Befehlsschalter :: H:\cfscript.txt
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WMQDFIXT
-------\Service_wmqdfixt


(((((((((((((((((((((((  Dateien erstellt von 2010-07-16 bis 2010-08-16  ))))))))))))))))))))))))))))))
.

2010-08-16 15:53 . 2010-08-16 15:53        --------        d-----w-        C:\Device
2010-08-16 15:48 . 2010-08-16 15:54        --------        d-----w-        c:\users\Pit\AppData\Local\temp
2010-08-16 15:48 . 2010-08-16 15:48        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-08-16 15:48 . 2010-08-16 15:48        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-08-16 15:48 . 2010-08-16 15:48        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2010-08-16 13:06 . 2010-08-16 13:36        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2010-08-16 13:06 . 2010-08-16 13:06        --------        d-----w-        c:\program files\Spybot - Search & Destroy
2010-08-16 09:56 . 2010-08-16 09:56        --------        d-----w-        c:\users\Pit\AppData\Roaming\Malwarebytes
2010-08-16 09:56 . 2010-08-16 09:56        --------        d-----w-        c:\program files\DAEMON Tools Toolbar
2010-08-16 09:55 . 2010-08-16 09:56        --------        d-----w-        c:\program files\DAEMON Tools Lite
2010-08-16 09:53 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-16 09:53 . 2010-08-16 09:53        --------        d-----w-        c:\programdata\Malwarebytes
2010-08-16 09:53 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-16 09:53 . 2010-08-16 09:53        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-13 16:36 . 2010-08-13 16:38        --------        d-----w-        c:\users\Pit\AppData\Local\jjfmlsxmc
2010-08-13 16:35 . 2010-08-16 15:53        783872        ----a-w-        c:\windows\system32\drivers\wmqdfixt.sys
2010-08-11 12:34 . 2010-06-19 04:07        2326016        ----a-w-        c:\windows\system32\win32k.sys
2010-08-11 12:34 . 2010-06-16 05:48        224256        ----a-w-        c:\windows\system32\schannel.dll
2010-08-06 01:01 . 2010-08-06 01:01        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2010-08-05 15:09 . 2010-08-05 15:09        --------        d-----w-        c:\users\Administrator\AppData\Local\Google
2010-08-05 14:09 . 2010-08-06 01:02        --------        d-----w-        c:\program files\Microsoft Works
2010-08-05 14:09 . 2010-08-05 14:09        --------        d-----w-        c:\windows\PCHEALTH
2010-08-05 14:07 . 2010-08-05 14:07        --------        d-----w-        c:\program files\Microsoft Visual Studio 8
2010-08-05 14:06 . 2010-08-05 14:06        --------        d-----r-        C:\MSOCache
2010-07-24 11:55 . 2010-07-28 19:46        --------        d-----w-        c:\users\Pit\AppData\Roaming\vlc
2010-07-24 11:55 . 2010-07-24 11:55        --------        d-----w-        c:\program files\VideoLAN

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 15:47 . 2009-07-14 08:47        657438        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-16 15:47 . 2009-07-14 08:47        130810        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-16 11:06 . 2010-02-17 17:17        --------        d-----w-        c:\program files\TU2010TrialDE
2010-08-16 09:56 . 2010-06-07 16:57        691696        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-08-16 08:26 . 2010-02-12 13:57        2828        --sha-w-        c:\programdata\KGyGaAvL.sys
2010-08-16 08:26 . 2010-02-12 13:57        2828        --sha-w-        c:\programdata\KGyGaAvL.sys
2010-08-13 16:30 . 2010-04-20 22:40        136714        ----a-w-        c:\program files\MP3GainGUIChanges.log
2010-08-13 14:26 . 2010-02-11 15:39        --------        d-----w-        c:\programdata\Microsoft Help
2010-08-06 13:38 . 2010-02-11 14:21        624240        ----a-w-        c:\users\Pit\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-05 14:09 . 2009-07-14 04:52        --------        d-----w-        c:\program files\MSBuild
2010-07-29 06:30 . 2010-08-11 12:35        197632        ----a-w-        c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:35        82944        ----a-w-        c:\windows\system32\iccvid.dll
2010-07-16 00:53 . 2010-04-29 22:15        3262        ----a-w-        c:\program files\MP3GainGUIErrors.log
2010-07-12 13:21 . 2010-02-12 14:04        --------        d-----w-        c:\programdata\sentinel
2010-06-30 06:25 . 2010-08-11 12:35        978432        ----a-w-        c:\windows\system32\wininet.dll
2010-06-26 01:00 . 2010-02-11 15:41        --------        d-----w-        c:\program files\Microsoft.NET
2010-06-22 20:05 . 2010-06-22 20:05        501936        ----a-w-        c:\programdata\Google\Google Toolbar\Update\gtb6893.tmp.exe
2010-06-22 02:47 . 2010-08-11 12:35        310784        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-11 12:35        307200        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-11 12:35        113664        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-11 12:35        3955080        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-11 12:35        3899784        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-11 12:35        37376        ----a-w-        c:\windows\system32\rtutils.dll
2010-06-14 06:12 . 2010-08-11 12:35        1286016        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2010-06-08 06:02 . 2010-08-11 12:35        1233920        ----a-w-        c:\windows\system32\msxml3.dll
2010-06-07 17:10 . 2010-06-07 17:10        10134        ----a-r-        c:\users\Pit\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
2010-06-07 17:08 . 2010-08-05 15:03        38784        ----a-w-        c:\users\Administrator\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-07 17:08 . 2010-06-07 17:08        38784        ----a-w-        c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-03 12:17 . 2010-02-12 13:57        88        --sh--r-        c:\programdata\0A6367044D.sys
2010-06-03 12:17 . 2010-02-12 13:57        88        --sh--r-        c:\programdata\0A6367044D.sys
2010-06-01 15:20 . 2010-06-01 15:13        2828        --sha-w-        c:\programdata\Protexis\KGyGaAvL.sys
2010-06-01 15:20 . 2010-06-01 15:17        88        --sh--r-        c:\programdata\Protexis\0A6367044D.sys
2010-05-27 07:24 . 2010-06-09 05:35        34304        ----a-w-        c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-09 05:35        293888        ----a-w-        c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2010-02-11 10:19        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-21 11:50 . 2010-07-12 13:21        54344        ----a-w-        c:\windows\system32\drivers\amm8660.sys
2010-02-12 16:47 . 2010-02-12 16:47        39789        ----a-w-        c:\program files\uninst-mp3gain.exe
2005-01-08 23:58 . 2005-01-08 23:58        131127        ----a-w-        c:\program files\mp3gain.exe
2005-01-08 20:45 . 2005-01-08 20:45        643120        ----a-w-        c:\program files\MP3GainGUI.exe
2004-11-02 16:05 . 2004-11-02 16:05        330954        ----a-w-        c:\program files\MP3Gain.chm
2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42        396800        --sha-w-        c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((  SnapShot@2010-08-16_09.23.25  )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-11 14:26 . 2010-08-16 15:41        32220              c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2010-08-16 15:56        44170              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-02-11 10:46 . 2010-08-16 15:41        10800              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2289426193-355958968-1139114157-1000_UserData.bin
+ 2010-08-16 08:16 . 2010-08-16 14:47        16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
- 2010-08-16 08:16 . 2010-08-16 08:31        16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
- 2010-02-11 10:12 . 2010-08-16 09:05        16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-11 10:12 . 2010-08-16 14:47        16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-08-16 08:16 . 2010-08-16 14:47        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat
- 2010-08-16 08:16 . 2010-08-16 08:31        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat
+ 2010-02-11 10:12 . 2010-08-16 14:47        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-02-11 10:12 . 2010-08-16 09:05        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-08-16 08:16 . 2010-08-16 08:31        16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat
+ 2010-08-16 08:16 . 2010-08-16 14:47        16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat
- 2009-07-14 04:41 . 2010-08-16 09:05        16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2010-08-16 14:47        16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 10:16 . 2010-08-16 09:14        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-11 10:16 . 2010-08-16 15:43        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-11 10:16 . 2010-08-16 09:14        32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 10:16 . 2010-08-16 15:43        32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 10:16 . 2010-08-16 15:43        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 10:16 . 2010-08-16 09:14        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 12:01 . 2010-08-16 09:14        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-11 12:01 . 2010-08-16 15:43        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-12 15:22 . 2010-08-16 15:48        32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-02-12 15:22 . 2010-08-16 09:01        32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-12 15:22 . 2010-08-16 15:48        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2010-02-12 15:22 . 2010-08-16 09:01        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2010-02-12 15:22 . 2010-08-16 15:48        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
- 2010-02-12 15:22 . 2010-08-16 09:01        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
- 2010-02-11 12:01 . 2010-08-16 09:14        32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 12:01 . 2010-08-16 15:48        32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-11 12:01 . 2010-08-16 15:43        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-11 12:01 . 2010-08-16 09:14        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-08-16 15:40 . 2010-08-16 15:54        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-08-16 09:12 . 2010-08-16 09:12        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-08-16 09:12 . 2010-08-16 09:12        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-08-16 15:40 . 2010-08-16 15:54        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:05 . 2010-08-16 09:16        618714              c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2010-08-16 15:47        618714              c:\windows\System32\perfh009.dat
- 2009-07-14 02:05 . 2010-08-16 09:16        107034              c:\windows\System32\perfc009.dat
+ 2009-07-14 02:05 . 2010-08-16 15:47        107034              c:\windows\System32\perfc009.dat
- 2009-07-14 02:03 . 2010-08-13 05:16        7077888              c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:03 . 2010-08-16 09:26        7077888              c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-08 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Panda Software Controller Client"="c:\program files\Panda Security\WAC\PSCtrlC.exe" [2010-04-09 143616]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 135664]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-07 375808]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TT1724ht;AureonWDM;c:\windows\system32\drivers\TT1724ht.sys [2004-12-01 73344]
R3 TT1724sa;TT1724sa;c:\windows\system32\drivers\TT1724sa.sys [2004-05-11 400640]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-08-16 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2010-05-21 54344]
S2 NSFIM;Network Shared Files Information Manager Plugin;c:\windows\system32\Drivers\NSFIM.SYS [2010-03-30 54792]
S2 PavAt3Scheduler;Panda Endpoint Scheduler;c:\program files\Panda Security\WaAgent\Scheduler\PavSched.exe [2009-09-17 140544]
S2 PavWASLpMng;Panda Endpoint Local Process Manager;c:\program files\Panda Security\WaAgent\WasLpMng\WASLPMNG.exe [2009-09-17 295680]
S2 PskSvc;Panda Kernel Service;c:\program files\Panda Security\WAC\psksvc.exe [2010-03-31 27904]
S2 WASAgent;Panda Endpoint Communications Agent;c:\program files\Panda Security\WaAgent\WasAgent\WasAgent.exe [2009-12-31 320768]
S2 WASWD;Panda Endpoint Watchdog;c:\program files\Panda Security\WaAgent\WasWD\WasWD.exe [2009-09-17 206080]
S3 NETIMFLT01060042;PANDA NDIS IM Filter Miniport v1.6.0.42;c:\windows\system32\DRIVERS\neti1642.sys [2010-02-18 199688]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-08 13:10]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\WAC\pavlsp.dll
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-2289426193-355958968-1139114157-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2EDFD31B-F5E9-01F1-12DB-AD1F9A360B2B}*]
"hagcicajgnpkedjm"=hex:6b,61,62,69,68,6f,66,63,63,6f,65,6d,64,68,6f,6e,6e,62,
  68,6b,67,70,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Panda Security\WAC\pavsrvx86.exe
c:\program files\Panda Security\WAC\AVENGINE.EXE
c:\windows\system32\nvvsvc.exe
c:\program files\Panda Security\WAC\PsCtrlS.exe
c:\program files\Panda Security\WAC\PSIMSVC.EXE
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\windows\system32\conhost.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Panda Security\WAC\WebProxy.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-16  17:59:55 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-08-16 15:59
ComboFix2.txt  2010-08-16 09:25

Vor Suchlauf: 16 Verzeichnis(se), 141.577.547.776 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 140.883.243.008 Bytes frei

- - End Of File - - C0F47765C067BAAFAF3C21AEA825CD55
--- --- ---

markusg 16.08.2010 17:10
ok weiter mit malwarebytes

Logi23 16.08.2010 18:10
schon mal vielen dank für die hilfe das problem ist behoben malwarebytes läuft noch über 1 stunde und ich muss gleich weg kann ich erst morgen posten vielen dank nochmal

markusg 16.08.2010 18:12
keine eile. bis morgen

Logi23 18.08.2010 16:20
so leider kann ich den log von mbam nicht mehr posten mein kumpel hat den gelöscht aber es wurde auch nichts mehr gefunden nochmal vielen dank an markusg für die schnelle und gute hilfe


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:25 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131