Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bundespolizei-Trojaner. Ist er weg ? (https://www.trojaner-board.de/97705-bundespolizei-trojaner-weg.html)

casi1a 19.04.2011 16:22
Bundespolizei-Trojaner. Ist er weg ?
 
Hallo Leute,

ich hatte mir den Bundespolizei-Trojaner eingefangen. Zum Glück hatte ich ein altes Acronis-True-Image Backup von meiner Betriebssystem Partition.

Ich bin dann folgendermaßen vorgegangen:

- Mit einem weiteren Acronis-True-Image Backup habe ich wichtige Dateien gesichert. ( Nur Dokumente. Keine Programme ) Also nachdem der Rechner schon infiziert war.

- Dann beide Backups wieder eingespielt und fertig.

Ich habe jedoch 4 Partitionen auf 2 Festplatten und frage mich nun, ob der Trojaner wirklich weg ist, oder ob er sich auf die anderen Partitionen ausgedehnt hat ?

Ich habe die ganze Sache mit Load.exe nach Anweisung abgearbeitet. Vielleicht ist jemand so nett und sieht sich mal die Logfiles an:






OTL Logfile:
Code:
OTL logfile created on: 19.04.2011 15:02:47 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Carsten\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,23 Gb Total Space | 45,23 Gb Free Space | 60,93% Space Free | Partition Type: NTFS
Drive D: | 74,82 Gb Total Space | 21,39 Gb Free Space | 28,59% Space Free | Partition Type: NTFS
Drive E: | 74,58 Gb Total Space | 48,66 Gb Free Space | 65,25% Space Free | Partition Type: NTFS
Drive F: | 74,47 Gb Total Space | 74,38 Gb Free Space | 99,88% Space Free | Partition Type: NTFS
 
Computer Name: DELL | User Name: Carsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.04.19 14:49:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Carsten\Desktop\OTL.exe
PRC - [2011.04.18 22:30:13 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.04.18 15:34:19 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.26 10:02:44 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.26 10:02:44 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.14 23:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.09.10 12:15:24 | 000,676,520 | ---- | M] () -- C:\Program Files\Lexmark 7600 Series\lxdwmon.exe
PRC - [2008.09.10 12:15:21 | 000,025,256 | ---- | M] () -- C:\Program Files\Lexmark 7600 Series\lxdwmsdmon.exe
PRC - [2008.05.16 17:33:10 | 000,594,600 | ---- | M] ( ) -- C:\Windows\System32\lxdwcoms.exe
PRC - [2007.05.09 17:01:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe
PRC - [2007.02.16 18:49:50 | 000,411,168 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.04.19 14:49:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Carsten\Desktop\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2010.05.04 21:13:07 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
MOD - [2008.01.18 23:34:08 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\duser.dll
MOD - [2006.11.02 14:34:33 | 000,009,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IconCodecService.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.04.18 15:34:19 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.26 10:02:44 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.05.16 17:33:10 | 000,594,600 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxdwcoms.exe -- (lxdw_device)
SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.02.16 18:49:50 | 000,411,168 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2006.06.05 13:59:18 | 000,174,080 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.04.18 15:34:20 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.26 10:02:44 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.06.02 20:40:50 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.06.16 14:59:00 | 009,768,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.05.11 11:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.07.16 18:12:30 | 000,392,320 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2008.07.16 18:12:30 | 000,032,768 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\Windows\System32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2008.07.16 18:12:27 | 000,114,048 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\snapman.sys -- (snapman)
DRV - [2008.01.18 22:15:00 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2008.01.18 20:25:06 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2007.10.10 17:03:00 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007.03.05 10:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2006.11.14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006.11.02 09:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006.09.24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [2006.05.29 08:26:38 | 000,127,488 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcd.sys -- (Nokia USB Phone Parent)
DRV - [2006.05.29 08:26:36 | 000,013,312 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcj.sys -- (Nokia USB Port)
DRV - [2006.05.29 08:26:36 | 000,013,312 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcm.sys -- (Nokia USB Modem)
DRV - [2006.05.29 08:26:36 | 000,008,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdc.sys -- (Nokia USB Generic)
DRV - [1997.12.23 03:00:00 | 000,023,936 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.18 22:30:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.18 22:30:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.12.06 08:10:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2010.12.06 08:10:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carsten\AppData\Roaming\mozilla\Extensions
[2010.12.06 08:10:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carsten\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.04.18 18:01:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions
[2010.06.26 08:27:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.29 18:11:21 | 000,000,000 | ---D | M] (Winload Toolbar) -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.12.04 12:30:42 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.12.21 01:13:49 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.10.14 18:54:08 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2011.04.18 15:41:25 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Carsten\AppData\Roaming\mozilla\Firefox\Profiles\jeou4izh.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2011.04.18 15:29:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.10.22 20:55:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.10.27 13:33:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.04.18 15:29:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2011.04.18 22:30:16 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.04.18 22:30:16 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.04.18 22:30:16 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.04.18 22:30:16 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.04.18 22:30:16 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [lxdwamon] C:\Program Files\Lexmark 7600 Series\lxdwamon.exe ()
O4 - HKLM..\Run: [lxdwmon.exe] C:\Program Files\Lexmark 7600 Series\lxdwmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O18 - Protocol\Handler\haufereader {39198710-62F7-42CD-9458-069843FA5D32} - C:\Program Files\Haufe\HaufeReader\HRInstmon.dll (Haufe Mediengruppe)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O30 - LSA: Authentication Packages - (relog_ap) - C:\Windows\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e3ec7d5c-5215-11dd-bd30-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{e3ec7d5c-5215-11dd-bd30-806e6f6e6963}\Shell\AutoRun\command - "" = A:\wubi.exe --cdmenu
O33 - MountPoints2\{ec66abfc-9faa-11df-8c1b-001e4cdc7873}\Shell - "" = AutoRun
O33 - MountPoints2\{ec66abfc-9faa-11df-8c1b-001e4cdc7873}\Shell\AutoRun\command - "" = G:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: PCSuiteTrayApplication - hkey= - key= -  File not found
MsConfig - StartUpReg: PcSync - hkey= - key= -  File not found
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.19 14:59:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011.04.19 14:59:30 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011.04.19 14:49:24 | 000,791,393 | ---- | C] (Lars Hederer                                                ) -- C:\Users\Carsten\Desktop\Erunt-setup.exe
[2011.04.19 14:49:24 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Carsten\Desktop\OTL.exe
[2011.04.19 14:49:24 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Carsten\Desktop\TFC.exe
[2011.04.18 21:40:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2011.04.18 17:24:05 | 000,000,000 | ---D | C] -- C:\Program Files\IrfanView
[2011.04.18 17:13:31 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\ebay_yamaha - Kopie
[2011.04.18 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\SE_Xperia_X10
[2011.04.18 15:31:51 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\KompoZer Lektionen
[2011.04.18 15:31:49 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\ebay_yamaha
[2011.04.18 15:31:48 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\ebay
[2011.04.18 15:31:34 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\Bilder_Yamaha
[2011.04.18 15:31:32 | 000,000,000 | ---D | C] -- C:\Users\Carsten\Desktop\24
[2010.11.30 17:14:51 | 000,032,256 | ---- | C] (Microsoft) -- C:\Users\Carsten\AppData\Roaming\Microsoft Installer.exe
[2010.06.21 18:53:43 | 000,438,272 | ---- | C] ( ) -- C:\Windows\System32\LXDWhcp.dll
[2010.06.21 18:53:43 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxdwinpa.dll
[2010.06.21 18:53:42 | 001,069,056 | ---- | C] ( ) -- C:\Windows\System32\lxdwserv.dll
[2010.06.21 18:53:42 | 000,851,968 | ---- | C] ( ) -- C:\Windows\System32\lxdwusb1.dll
[2010.06.21 18:53:42 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdwiesc.dll
[2010.06.21 18:53:41 | 000,651,264 | ---- | C] ( ) -- C:\Windows\System32\lxdwpmui.dll
[2010.06.21 18:53:41 | 000,577,536 | ---- | C] ( ) -- C:\Windows\System32\lxdwlmpm.dll
[2010.06.21 18:53:40 | 000,679,936 | ---- | C] ( ) -- C:\Windows\System32\lxdwhbn3.dll
[2010.06.21 18:53:40 | 000,328,360 | ---- | C] ( ) -- C:\Windows\System32\lxdwih.exe
[2010.06.21 18:53:39 | 000,765,952 | ---- | C] ( ) -- C:\Windows\System32\lxdwcomc.dll
[2010.06.21 18:53:39 | 000,594,600 | ---- | C] ( ) -- C:\Windows\System32\lxdwcoms.exe
[2010.06.21 18:53:39 | 000,376,832 | ---- | C] ( ) -- C:\Windows\System32\lxdwcomm.dll
[2010.06.21 18:53:38 | 000,369,320 | ---- | C] ( ) -- C:\Windows\System32\lxdwcfg.exe
[47 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[47 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.19 14:59:30 | 000,000,693 | ---- | M] () -- C:\Users\Carsten\Desktop\NTREGOPT.lnk
[2011.04.19 14:59:30 | 000,000,674 | ---- | M] () -- C:\Users\Carsten\Desktop\ERUNT.lnk
[2011.04.19 14:57:02 | 000,639,210 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.19 14:57:02 | 000,604,764 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.19 14:57:02 | 000,131,024 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.19 14:57:02 | 000,108,096 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.19 14:52:15 | 000,032,061 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.04.19 14:52:15 | 000,032,061 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.04.19 14:52:13 | 000,004,496 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.19 14:52:13 | 000,004,496 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.19 14:52:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.04.19 14:51:16 | 000,003,204 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.04.19 14:49:32 | 000,301,568 | ---- | M] () -- C:\Users\Carsten\Desktop\g2m3e4r.exe
[2011.04.19 14:49:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Carsten\Desktop\OTL.exe
[2011.04.19 14:49:29 | 000,791,393 | ---- | M] (Lars Hederer                                                ) -- C:\Users\Carsten\Desktop\Erunt-setup.exe
[2011.04.19 14:49:28 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Carsten\Desktop\TFC.exe
[2011.04.19 14:48:06 | 000,377,260 | ---- | M] () -- C:\Users\Carsten\Desktop\Load.exe
[2011.04.18 21:44:00 | 000,263,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.18 20:27:23 | 000,155,648 | ---- | M] () -- C:\Users\Carsten\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.18 17:24:05 | 000,001,647 | ---- | M] () -- C:\Users\Public\Desktop\IrfanView Thumbnails.lnk
[2011.04.18 17:24:05 | 000,000,767 | ---- | M] () -- C:\Users\Public\Desktop\IrfanView.lnk
[2011.04.18 15:34:48 | 000,057,506 | ---- | M] () -- C:\Users\Carsten\Desktop\Yamaha-Logo.jpg
[2011.04.18 15:34:48 | 000,013,958 | ---- | M] () -- C:\Users\Carsten\Desktop\Unbenannt 1.odt
[2011.04.18 15:34:48 | 000,010,972 | ---- | M] () -- C:\Users\Carsten\Desktop\Strato.odt
[2011.04.18 15:34:48 | 000,008,752 | ---- | M] () -- C:\Users\Carsten\Desktop\Xperia X10_Tests.odt
[2011.04.18 15:34:48 | 000,000,998 | ---- | M] () -- C:\Users\Carsten\Desktop\Update Service.lnk
[2011.04.18 15:34:47 | 003,906,917 | ---- | M] () -- C:\Users\Carsten\Desktop\SME_Flyer_01_2011.pdf
[2011.04.18 15:34:20 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.04.18 15:31:52 | 000,009,216 | -H-- | M] () -- C:\Users\Carsten\Desktop\photothumb.db
[2011.04.18 15:31:52 | 000,000,895 | ---- | M] () -- C:\Users\Carsten\Desktop\Playlist Creator 3.6.2.lnk
[2011.04.18 15:31:52 | 000,000,812 | ---- | M] () -- C:\Users\Carsten\Desktop\mp3DirectCut.lnk
[2011.04.18 15:31:52 | 000,000,480 | ---- | M] () -- C:\Users\Carsten\Desktop\Rechnungen - Verknüpfung.lnk
[2011.04.18 15:31:51 | 000,001,877 | ---- | M] () -- C:\Users\Carsten\Desktop\JLC's Internet TV.lnk
[2011.04.18 15:31:51 | 000,000,501 | ---- | M] () -- C:\Users\Carsten\Desktop\homepage_kompozer - Verknüpfung.lnk
[2011.04.18 15:31:48 | 000,561,834 | ---- | M] () -- C:\Users\Carsten\Desktop\ComfortCredit.pdf
[2011.04.18 15:31:34 | 000,370,908 | ---- | M] () -- C:\Users\Carsten\Desktop\antrag.pdf
[2011.04.18 15:29:04 | 000,000,450 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{692325B4-3D4D-48E2-A700-8A0B9715E685}.job
[2011.04.18 15:14:04 | 000,000,383 | ---- | M] () -- C:\Users\Carsten\Desktop\Eigene_Dateien - Verknüpfung.lnk
[47 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[47 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.19 14:59:30 | 000,000,693 | ---- | C] () -- C:\Users\Carsten\Desktop\NTREGOPT.lnk
[2011.04.19 14:59:30 | 000,000,674 | ---- | C] () -- C:\Users\Carsten\Desktop\ERUNT.lnk
[2011.04.19 14:49:25 | 000,301,568 | ---- | C] () -- C:\Users\Carsten\Desktop\g2m3e4r.exe
[2011.04.19 14:48:05 | 000,377,260 | ---- | C] () -- C:\Users\Carsten\Desktop\Load.exe
[2011.04.18 17:24:05 | 000,001,647 | ---- | C] () -- C:\Users\Public\Desktop\IrfanView Thumbnails.lnk
[2011.04.18 17:24:05 | 000,000,767 | ---- | C] () -- C:\Users\Public\Desktop\IrfanView.lnk
[2011.04.18 15:48:25 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2011.04.18 15:48:25 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2011.04.18 15:48:25 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2011.04.18 15:34:48 | 000,057,506 | ---- | C] () -- C:\Users\Carsten\Desktop\Yamaha-Logo.jpg
[2011.04.18 15:34:48 | 000,013,958 | ---- | C] () -- C:\Users\Carsten\Desktop\Unbenannt 1.odt
[2011.04.18 15:34:48 | 000,010,972 | ---- | C] () -- C:\Users\Carsten\Desktop\Strato.odt
[2011.04.18 15:34:48 | 000,008,752 | ---- | C] () -- C:\Users\Carsten\Desktop\Xperia X10_Tests.odt
[2011.04.18 15:34:48 | 000,000,998 | ---- | C] () -- C:\Users\Carsten\Desktop\Update Service.lnk
[2011.04.18 15:34:47 | 003,906,917 | ---- | C] () -- C:\Users\Carsten\Desktop\SME_Flyer_01_2011.pdf
[2011.04.18 15:31:52 | 000,000,895 | ---- | C] () -- C:\Users\Carsten\Desktop\Playlist Creator 3.6.2.lnk
[2011.04.18 15:31:52 | 000,000,812 | ---- | C] () -- C:\Users\Carsten\Desktop\mp3DirectCut.lnk
[2011.04.18 15:31:52 | 000,000,480 | ---- | C] () -- C:\Users\Carsten\Desktop\Rechnungen - Verknüpfung.lnk
[2011.04.18 15:31:51 | 000,001,877 | ---- | C] () -- C:\Users\Carsten\Desktop\JLC's Internet TV.lnk
[2011.04.18 15:31:51 | 000,000,501 | ---- | C] () -- C:\Users\Carsten\Desktop\homepage_kompozer - Verknüpfung.lnk
[2011.04.18 15:31:48 | 000,561,834 | ---- | C] () -- C:\Users\Carsten\Desktop\ComfortCredit.pdf
[2011.04.18 15:31:34 | 000,370,908 | ---- | C] () -- C:\Users\Carsten\Desktop\antrag.pdf
[2011.04.18 15:14:04 | 000,000,383 | ---- | C] () -- C:\Users\Carsten\Desktop\Eigene_Dateien - Verknüpfung.lnk
[2010.11.30 17:15:00 | 000,000,000 | ---- | C] () -- C:\Users\Carsten\AppData\Roaming\chrtmp
[2010.11.25 15:16:57 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.10.20 16:55:33 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2010.07.26 16:53:17 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.07.02 11:35:53 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2010.06.21 18:58:57 | 000,360,448 | ---- | C] () -- C:\Windows\System32\lxdwcoin.dll
[2010.06.21 18:57:22 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxdwvs.dll
[2010.06.21 18:55:59 | 001,036,288 | ---- | C] () -- C:\Windows\System32\lxdwdrs.dll
[2010.06.21 18:55:59 | 000,081,920 | ---- | C] () -- C:\Windows\System32\lxdwcaps.dll
[2010.06.21 18:55:59 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxdwcnv4.dll
[2010.06.21 18:54:28 | 000,000,044 | ---- | C] () -- C:\Windows\System32\lxdwrwrd.ini
[2010.06.21 18:53:44 | 000,389,120 | ---- | C] () -- C:\Windows\System32\LXDWinst.dll
[2010.06.21 18:53:40 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdwgrd.dll
[2010.05.31 08:46:33 | 000,032,061 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.05.31 08:42:25 | 000,032,061 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.07.23 16:41:16 | 000,344,064 | ---- | C] () -- C:\Windows\System32\BH_DATA110VC8.dll
[2008.07.16 23:01:06 | 000,155,648 | ---- | C] () -- C:\Users\Carsten\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.07.16 22:23:27 | 000,000,096 | ---- | C] () -- C:\Windows\ktel.ini
[2008.07.16 21:16:23 | 000,000,095 | ---- | C] () -- C:\Users\Carsten\AppData\Local\fusioncache.dat
[2008.07.16 21:09:46 | 000,131,072 | ---- | C] () -- C:\Windows\System32\BH_DATA100VC7.dll
[2008.07.16 21:09:45 | 000,065,536 | ---- | C] () -- C:\Windows\System32\PXTToolVC7.dll
[2008.07.16 21:09:44 | 000,303,104 | ---- | C] () -- C:\Windows\System32\LxImport50VC7.dll
[2008.07.16 21:09:44 | 000,217,088 | ---- | C] () -- C:\Windows\System32\LxImport40VC7.dll
[2008.07.16 20:56:14 | 000,233,527 | ---- | C] () -- C:\Windows\System32\dnt25.dll
[2008.07.16 20:56:14 | 000,077,882 | ---- | C] () -- C:\Windows\System32\dntvmc25.dll
[2008.07.16 20:56:14 | 000,069,689 | ---- | C] () -- C:\Windows\System32\dntvm25.dll
[2008.07.16 20:56:13 | 000,229,431 | ---- | C] () -- C:\Windows\System32\dnt23.dll
[2008.07.16 20:56:13 | 000,221,239 | ---- | C] () -- C:\Windows\System32\dnt24.dll
[2008.07.16 20:56:13 | 000,090,112 | ---- | C] () -- C:\Windows\System32\LxUtl10.dll
[2008.07.16 20:56:13 | 000,077,882 | ---- | C] () -- C:\Windows\System32\dntvmc24.dll
[2008.07.16 20:56:13 | 000,073,786 | ---- | C] () -- C:\Windows\System32\dntvmc23.dll
[2008.07.16 20:56:13 | 000,069,689 | ---- | C] () -- C:\Windows\System32\dntvm24.dll
[2008.07.16 20:56:13 | 000,061,497 | ---- | C] () -- C:\Windows\System32\dntvm23.dll
[2008.07.16 20:56:10 | 000,015,627 | ---- | C] () -- C:\Windows\System32\WBROLLRS.DLL
[2008.07.16 20:56:09 | 000,110,080 | ---- | C] () -- C:\Windows\System32\W32MKRC.DLL
[2008.07.16 20:56:08 | 000,320,512 | ---- | C] () -- C:\Windows\System32\W32MKDE.EXE
[2008.07.16 20:56:08 | 000,041,472 | ---- | C] () -- C:\Windows\System32\W32btstp.dll
[2008.07.16 20:56:08 | 000,025,088 | ---- | C] () -- C:\Windows\System32\W32btxlt.dll
[2008.07.16 20:07:59 | 000,000,023 | ---- | C] () -- C:\Windows\eps32.INI
[2008.07.16 20:07:59 | 000,000,023 | ---- | C] () -- C:\Windows\eps_stab.ini
[2008.07.16 20:07:55 | 000,000,198 | ---- | C] () -- C:\Windows\ODBCINST.ini
[2008.07.16 07:30:39 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2008.07.16 07:28:50 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.07.16 07:28:50 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.07.15 04:51:33 | 000,000,680 | ---- | C] () -- C:\Users\Carsten\AppData\Local\d3d9caps.dat
[2008.07.15 04:39:48 | 000,003,204 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007.11.15 21:27:40 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll
[2007.11.15 21:25:28 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll
[2007.11.15 21:25:12 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll
[2007.11.13 09:39:30 | 000,057,344 | ---- | C] () -- C:\Windows\System32\FKStampPainter20.dll
[2007.11.09 15:18:10 | 000,208,896 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll
[2006.11.02 17:33:31 | 000,639,210 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,131,024 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,263,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,604,764 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,096 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.04.21 10:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll
[2005.11.09 12:18:38 | 000,282,679 | ---- | C] () -- C:\Windows\System32\dnt27.dll
[2005.11.09 12:17:36 | 000,077,882 | ---- | C] () -- C:\Windows\System32\dntvmc27.dll
[2005.11.09 12:17:28 | 000,073,785 | ---- | C] () -- C:\Windows\System32\dntvm27.dll
[2005.11.09 12:13:48 | 000,282,624 | ---- | C] () -- C:\Windows\System32\dnt27VC7.dll
[2005.11.09 12:11:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvmc27VC7.dll
[2005.11.09 12:11:30 | 000,077,824 | ---- | C] () -- C:\Windows\System32\dntvm27VC7.dll
[2005.05.06 19:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2004.05.06 14:07:32 | 000,241,664 | ---- | C] () -- C:\Windows\System32\dnt26VC7.dll
[2004.05.06 14:05:04 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvmc26VC7.dll
[2004.05.06 14:04:42 | 000,073,728 | ---- | C] () -- C:\Windows\System32\dntvm26VC7.dll
[2003.09.05 12:25:54 | 000,237,623 | ---- | C] () -- C:\Windows\System32\dnt26.dll
[2003.09.05 12:25:52 | 000,073,785 | ---- | C] () -- C:\Windows\System32\dntvm26.dll
[2003.09.05 12:03:30 | 000,077,882 | ---- | C] () -- C:\Windows\System32\dntvmc26.dll
[2002.11.06 15:23:32 | 000,045,056 | ---- | C] () -- C:\Windows\System32\FKStampPainter.dll
[2001.12.13 13:30:12 | 000,036,864 | ---- | C] () -- C:\Windows\System32\SBSPAINT.DLL
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2010.10.20 19:50:53 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\AnvSoft
[2010.11.23 23:51:48 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Canneverbe Limited
[2010.10.22 08:51:00 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\DataLayer
[2010.08.17 18:34:02 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\DeepBurner
[2010.10.25 12:38:58 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.06.02 16:06:16 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\elsterformular
[2011.04.18 20:11:50 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\FileZilla
[2010.10.19 19:47:45 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\FreeAudioPack
[2010.12.24 00:30:15 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\GrabIt
[2010.09.06 18:19:17 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\gtk-2.0
[2010.12.13 09:33:37 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\install
[2008.07.16 22:24:51 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\klickTel
[2010.08.23 11:49:22 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\KompoZer
[2010.07.02 22:12:28 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Lexmark Productivity Studio
[2008.07.17 00:02:01 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Lexware
[2010.09.25 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\MyPhoneExplorer
[2010.10.22 08:49:59 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Nokia
[2010.09.13 13:49:45 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Notepad++
[2010.07.16 15:28:39 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Nvu
[2008.07.16 21:59:08 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\OpenOffice.org
[2010.10.22 07:01:35 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\PC Suite
[2010.07.15 21:22:01 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\PhotoScape
[2010.09.16 14:14:03 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Shareaza
[2010.12.06 08:10:49 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\Thunderbird
[2010.11.13 21:12:10 | 000,000,000 | ---D | M] -- C:\Users\Carsten\AppData\Roaming\XMedia Recode
[2011.04.19 14:51:16 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.04.18 15:29:04 | 000,000,450 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{692325B4-3D4D-48E2-A700-8A0B9715E685}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2008.07.15 04:51:57 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.07.29 23:34:05 | 000,000,000 | -HSD | M] -- C:\Boot
[2010.03.03 16:14:48 | 000,000,000 | ---D | M] -- C:\CHAMP
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.02.13 15:27:22 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2008.07.16 20:56:07 | 000,000,000 | ---D | M] -- C:\LEXWARE
[2010.12.19 16:57:52 | 000,000,000 | ---D | M] -- C:\logs
[2010.02.14 01:13:33 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.04.19 14:59:30 | 000,000,000 | ---D | M] -- C:\Program Files
[2010.12.24 14:36:32 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.02.13 15:27:22 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.04.19 15:04:07 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2008.07.15 04:51:28 | 000,000,000 | R--D | M] -- C:\Users
[2011.04.18 15:15:56 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.18 23:33:12 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.18 23:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-19 09:21:48
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 368 bytes -> C:\Users\Carsten\AppData\Local\desktop.ini:722b2b1c349a06abf0e866180e5a7e63
@Alternate Data Stream - 16 bytes -> C:\Users\Carsten\Downloads:Shareaza.GUID

< End of report >
--- --- ---






OTL Logfile:
Code:
OTL Extras logfile created on: 19.04.2011 15:02:47 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Carsten\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,23 Gb Total Space | 45,23 Gb Free Space | 60,93% Space Free | Partition Type: NTFS
Drive D: | 74,82 Gb Total Space | 21,39 Gb Free Space | 28,59% Space Free | Partition Type: NTFS
Drive E: | 74,58 Gb Total Space | 48,66 Gb Free Space | 65,25% Space Free | Partition Type: NTFS
Drive F: | 74,47 Gb Total Space | 74,38 Gb Free Space | 99,88% Space Free | Partition Type: NTFS
 
Computer Name: DELL | User Name: Carsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3DF7010A-5A93-40EC-AC2F-E5A689A95D5F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4A88DA12-7675-4531-BDB3-CB00BC450B28}" = lport=139 | protocol=6 | dir=in | app=system |
"{5E71C421-EF83-4EC6-9220-6614AFE27587}" = rport=138 | protocol=17 | dir=out | app=system |
"{6EBC8F0F-8BEC-4B19-BE27-42FECB3130DD}" = rport=445 | protocol=6 | dir=out | app=system |
"{9A574BC5-C269-493C-B06D-1AAE7FC67DA6}" = rport=137 | protocol=17 | dir=out | app=system |
"{B87811DA-F250-45FC-894F-A9CE53F6A825}" = lport=138 | protocol=17 | dir=in | app=system |
"{D18D22B5-44B4-4187-9640-05E03D4012DC}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D509A1D9-D2AD-4465-A811-5D5945C89AE3}" = rport=139 | protocol=6 | dir=out | app=system |
"{EBCCC037-CE96-4965-A9E9-5BB66413CA2D}" = lport=445 | protocol=6 | dir=in | app=system |
"{FB57684C-2C70-4C85-B3ED-C0B250710D9A}" = lport=137 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{131374F0-7094-481F-99AA-DD95482507E5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{27CF8E99-5DC5-4847-9F42-A226CB750CBB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{287B4C99-E14F-4FEE-850B-3851BC098443}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{35AA79E0-DA5F-476D-9795-3D1C48F7D385}" = protocol=6 | dir=in | app=c:\program files\lexmark 7600 series\lxdwamon.exe |
"{3B880C29-41A8-4CE3-85A2-887911AA1A84}" = protocol=17 | dir=in | app=c:\program files\grabit\grabit.exe |
"{52B4F851-40BA-4B96-BD4A-E8072B0E480B}" = protocol=17 | dir=in | app=c:\program files\lexmark 7600 series\frun.exe |
"{59DD55D8-83C6-4F0E-A817-11559B15A3CA}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdwpswx.exe |
"{65170697-3553-40ED-852C-075000736D12}" = protocol=6 | dir=in | app=c:\program files\lexmark 7600 series\frun.exe |
"{80DEE436-0C55-4D38-A951-BFDE3378ECAB}" = protocol=6 | dir=in | app=c:\program files\grabit\grabit.exe |
"{996899A6-9B84-4504-89B4-8D380826A2E6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CE8E871B-E8E7-4014-ACEB-7F4311E9610F}" = protocol=17 | dir=in | app=c:\windows\system32\lxdwcoms.exe |
"{D2AC5D5C-E4C0-4EA1-8E34-7C52DBEF5C9E}" = protocol=6 | dir=in | app=c:\windows\system32\lxdwcoms.exe |
"{D4DCD057-38AE-48EF-8127-2A045B7872B2}" = protocol=17 | dir=in | app=c:\program files\lexmark 7600 series\lxdwamon.exe |
"{DD418FF8-38D2-407B-975C-4EA28A0A7AFE}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdwpswx.exe |
"TCP Query User{2AC91CB1-BFD8-4BFB-B5EB-642419F1B0EB}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{372558C3-ED79-403D-BEB4-35BFF7CA7612}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{933CB071-0C19-4FAA-9E07-B81243BE8FA9}C:\program files\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"TCP Query User{FF216E2D-2D3F-44F9-891E-35E9FFD5D9A4}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{0321CF7A-4933-41E2-8EAE-4DB8BB3D43F2}C:\program files\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"UDP Query User{0DC8A2F0-F309-48A7-8B97-FC22E956A515}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{368BE4C8-A545-4667-8E40-87E09F85F4BD}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{BB0EE5BE-41CF-459E-817D-9ABB4D5049A4}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0D80391C-0A72-43BB-9BC2-143F63CC111D}" = Nokia PC Connectivity Solution
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21C1E6B6-8796-4EEE-ACF3-F318CEFC257C}" = Lexware buchhalter 2006
"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}" = Acronis True Image Home
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{59624372-3B85-47f4-9B04-4911E551DF1E}" = Lexware Info Service
"{5C5B0836-9648-4057-8044-2DF181E073E2}" = TAXMAN 2010
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6E9B276F-77BE-49F7-8676-C10017F9E20B}" = Lexware buchhalter Servicepack 2008, Version 13.50
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8B50F367-2686-4256-BA05-708B299961DF}" = Lexware Elster
"{9324A633-2B64-411F-BD1A-849E6438EC18}" = klickTel Routenplaner Winter 2006
"{9762315F-29C6-488C-98D4-80CDE3418102}" = Lexware buchhalter 2006
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD3BC83-C14A-4C54-A5FB-F43D93D5E4EF}" = Nokia Connectivity Cable Driver
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.5 - Deutsch
"{BC63A4AC-435D-4AAD-9881-D0ED60804D1A}" = Lexware buchhalter Aktualisierung Februar 2008, Version 13.10
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark
"{DA82A3EB-9C78-411D-B389-5323CE29BA88}" = Lexware buchhalter 2003
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E98371BD-6C0D-463E-B004-E6303F9A34A7}" = Lexware buchhalter 2008
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}" = Paint.NET v3.5.5
"{F49F760A-05DD-4424-BE2B-E084B9FDA9C0}" = Lexware buchhalter 2006
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FE688026-1C8C-4E50-889D-4B6607CADC24}" = Lexware buchhalter 2008
"{FF1B3317-EADD-4AC3-BE54-37265FC9A133}" = Lexware buchhalter Servicepack 2008, Version 13.50
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Any Video Converter_is1" = Any Video Converter 3.0.7
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"ClearProg" = ClearProg 1.6.0 Final
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011) 
"EasyBCD" = EasyBCD 1.7.2
"ElsterFormular 11.4.1.4323" = ElsterFormular
"ERUNT_is1" = ERUNT 1.1j
"FileZilla Client" = FileZilla Client 3.3.5.1
"Free Studio_is1" = Free Studio version 4.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9
"GrabIt_is1" = GrabIt 1.7.2 Beta 4 (build 997)
"HaufeReader" = HaufeReader
"IrfanView" = IrfanView (remove only)
"JDownloader" = JDownloader
"KHB_BH_M" = Lexware know how buchhaltung mini
"Lexmark 7600 Series" = Lexmark 7600 Series
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Mozilla Thunderbird (3.1.6)" = Mozilla Thunderbird (3.1.6)
"MPE" = MyPhoneExplorer
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoScape" = PhotoScape
"SpeedFan" = SpeedFan (remove only)
"SUPER ©" = SUPER © Version 2010.bld.38 (May 2, 2010)
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.4
"WinGimp-2.0_is1" = GIMP 2.6.10
"XMedia Recode" = XMedia Recode 2.2.8.4
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 18.04.2011 15:59:27 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 18.04.2011 15:59:27 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 18.04.2011 16:00:41 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 18.04.2011 16:00:41 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 18.04.2011 21:18:14 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 18.04.2011 21:18:14 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 19.04.2011 05:16:26 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 19.04.2011 05:16:26 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 19.04.2011 08:52:30 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 19.04.2011 08:52:30 | Computer Name = Dell | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
[ System Events ]
Error - 11.08.2010 10:30:50 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 12.08.2010 21:20:04 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 13.08.2010 10:38:27 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 13.08.2010 10:46:23 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 14.08.2010 10:28:45 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 15.08.2010 14:23:12 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 17.08.2010 01:22:50 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
Error - 18.08.2010 03:22:53 | Computer Name = Dell | Source = BTHUSB | ID = 327697
Description = Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen
 und wird nicht verwendet. Der Treiber wurde entladen.
 
Error - 22.08.2010 14:26:43 | Computer Name = Dell | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 22.08.2010 um 20:24:52 unerwartet heruntergefahren.
 
Error - 22.08.2010 14:28:21 | Computer Name = Dell | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >
--- --- ---






GMER Logfile:
Code:
GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-19 16:20:16
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 ST9160821AS rev.3.CDE
Running: g2m3e4r.exe; Driver: C:\Users\Carsten\AppData\Local\Temp\pxldapod.sys


---- System - GMER 1.0.15 ----

INT 0x52        ?                                                                                                85CD6F00
INT 0x62        ?                                                                                                85CD6F00
INT 0x62        ?                                                                                                85CD6F00
INT 0x62        ?                                                                                                85CD6F00
INT 0x72        ?                                                                                                85CD6F00
INT 0x72        ?                                                                                                85CD6F00
INT 0x72        ?                                                                                                85CD6F00
INT 0x72        ?                                                                                                85CD6F00
INT 0x92        ?                                                                                                84487BF8
INT 0xB2        ?                                                                                                84487BF8
INT 0xB2        ?                                                                                                84487BF8
INT 0xB2        ?                                                                                                84487BF8

---- Kernel code sections - GMER 1.0.15 ----

?              System32\Drivers\spum.sys                                                                        Das System kann den angegebenen Pfad nicht finden. !
.text          USBPORT.SYS!DllUnload                                                                            881D441B 5 Bytes  JMP 85CD64E0

---- User code sections - GMER 1.0.15 ----

.text          C:\Program Files\Mozilla Firefox\firefox.exe[3832] ntdll.dll!LdrLoadDll                          77A393A8 5 Bytes  JMP 003B13F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                          84E1A1F8
Device          \Driver\volmgr \Device\VolMgrControl                                                            844891F8
Device          \Driver\usbuhci \Device\USBPDO-0                                                                85D011F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                85D011F8
Device          \Driver\usbehci \Device\USBPDO-2                                                                85CA41F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                85D011F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{172F17B8-BDA7-467B-91E7-3F57134886A7}                        873DA500
Device          \Driver\usbuhci \Device\USBPDO-4                                                                85D011F8
Device          \Driver\usbuhci \Device\USBPDO-5                                                                85D011F8
Device          \Driver\usbehci \Device\USBPDO-6                                                                85CA41F8
Device          \Driver\volmgr \Device\HarddiskVolume1                                                          844891F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                          snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                          timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

Device          \Driver\volmgr \Device\HarddiskVolume2                                                          844891F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                          snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                          timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

Device          \Driver\cdrom \Device\CdRom0                                                                    85DE81F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                      84E181F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-3                                                      84E181F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                              84E181F8
Device          \Driver\atapi \Device\Ide\IdePort1                                                              84E181F8
Device          \Driver\atapi \Device\Ide\IdePort2                                                              84E181F8
Device          \Driver\msahci \Device\Ide\PciIde1Channel0                                                      84E191F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2                                                      84E181F8
Device          \Driver\msahci \Device\Ide\PciIde1Channel2                                                      84E191F8
Device          \Driver\volmgr \Device\HarddiskVolume3                                                          844891F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                          snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                          timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

Device          \Driver\volmgr \Device\HarddiskVolume4                                                          844891F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                          snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                          timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

Device          \Driver\netbt \Device\NetBt_Wins_Export                                                          873DA500
Device          \Driver\Smb \Device\NetbiosSmb                                                                  873C61F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{694715B8-88F3-4488-807E-6BD8ACED2B03}                        873DA500
Device          \Driver\iScsiPrt \Device\RaidPort0                                                              85E0B1F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{BFEF0390-4D4F-486A-BF07-063D753059C5}                        873DA500
Device          \Driver\usbuhci \Device\USBFDO-0                                                                85D011F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                85D011F8
Device          \Driver\usbehci \Device\USBFDO-2                                                                85CA41F8
Device          \Driver\usbuhci \Device\USBFDO-3                                                                85D011F8
Device          \Driver\usbuhci \Device\USBFDO-4                                                                85D011F8
Device          \Driver\usbuhci \Device\USBFDO-5                                                                85D011F8
Device          \Driver\usbehci \Device\USBFDO-6                                                                85CA41F8
Device          \FileSystem\cdfs \Cdfs                                                                          A20971F8

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e4cdc7873                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                              771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                              285507792
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e4cdc7873 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 20.04.2011 18:11
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

casi1a 22.04.2011 07:09
Hallo,

habe jetzt noch einen Scan mit Malewarebytes durchgeführt. Ich weiss zwar nicht, ob es wichtig ist, aber der Vollständigkeit halber: Es waren bei diesem Scan noch eine zusätzliche externe Festplatte und ein USB-Stick angeschlossen.








Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6417

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

22.04.2011 07:36:37
mbam-log-2011-04-22 (07-36-24).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 143890
Laufzeit: 4 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
c:\program files\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> No action taken.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\DC3_FEXEC (Malware.Trace) -> No action taken.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM\COMPONENTS\WIDGITOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: WIDGITOOLBARFF.DLL -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> No action taken.




___________________________________________

Gruß
Carsten

cosinus 22.04.2011 12:19
Zitat:
Art des Suchlaufs: Quick-Scan

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

casi1a 22.04.2011 14:00
Okay,

dieses hier ist der vorletzte Scan:




Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6417

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

22.04.2011 08:55:52
mbam-log-2011-04-22 (08-55-52).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 143456
Laufzeit: 3 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)







dieses hier ist der letzte Scan mit aktualisierter Datenbank:





Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6418

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

22.04.2011 14:51:11
mbam-log-2011-04-22 (14-51-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|K:\|)
Durchsuchte Objekte: 274685
Laufzeit: 1 Stunde(n), 2 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)




_____________________________________________________________

Gruß
Carsten

cosinus 22.04.2011 14:02
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

casi1a 22.04.2011 15:38
Sooo,

- unhide.exe war nicht nötig,
- das Tool von kaspersky hat 4 oder 5 Probleme gefunden, die ich dann gelöscht habe.
- danach nochmal Vollscan mit Malwarebyte.


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6418

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

22.04.2011 16:30:51
mbam-log-2011-04-22 (16-30-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|K:\|)
Durchsuchte Objekte: 274696
Laufzeit: 1 Stunde(n), 7 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


___________________________________________________

Gruß
Carsten

cosinus 23.04.2011 14:11
Ich wollte das Log vom TDSS-Killer sehen...

casi1a 23.04.2011 14:48
Aaaaaahhhhhhhh,

habs nochmal scannen lassen.




2011/04/23 15:40:36.0385 2728 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/23 15:40:36.0681 2728 ================================================================================
2011/04/23 15:40:36.0681 2728 SystemInfo:
2011/04/23 15:40:36.0681 2728
2011/04/23 15:40:36.0681 2728 OS Version: 6.0.6002 ServicePack: 2.0
2011/04/23 15:40:36.0681 2728 Product type: Workstation
2011/04/23 15:40:36.0681 2728 ComputerName: DELL
2011/04/23 15:40:36.0681 2728 UserName: Carsten
2011/04/23 15:40:36.0681 2728 Windows directory: C:\Windows
2011/04/23 15:40:36.0681 2728 System windows directory: C:\Windows
2011/04/23 15:40:36.0681 2728 Processor architecture: Intel x86
2011/04/23 15:40:36.0681 2728 Number of processors: 2
2011/04/23 15:40:36.0681 2728 Page size: 0x1000
2011/04/23 15:40:36.0681 2728 Boot type: Normal boot
2011/04/23 15:40:36.0681 2728 ================================================================================
2011/04/23 15:40:39.0130 2728 Initialize success
2011/04/23 15:40:41.0845 0900 ================================================================================
2011/04/23 15:40:41.0845 0900 Scan started
2011/04/23 15:40:41.0845 0900 Mode: Manual;
2011/04/23 15:40:41.0845 0900 ================================================================================
2011/04/23 15:40:42.0562 0900 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/04/23 15:40:42.0687 0900 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/04/23 15:40:42.0749 0900 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/04/23 15:40:42.0796 0900 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/04/23 15:40:42.0827 0900 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/04/23 15:40:42.0952 0900 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/04/23 15:40:43.0015 0900 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/04/23 15:40:43.0077 0900 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/04/23 15:40:43.0155 0900 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/04/23 15:40:43.0217 0900 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/04/23 15:40:43.0249 0900 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/04/23 15:40:43.0327 0900 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/04/23 15:40:43.0389 0900 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/04/23 15:40:43.0467 0900 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/04/23 15:40:43.0498 0900 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/04/23 15:40:43.0607 0900 Aspi32 (20d04091eba710f6988f710507d85868) C:\Windows\system32\drivers\Aspi32.sys
2011/04/23 15:40:43.0685 0900 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/04/23 15:40:43.0748 0900 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/04/23 15:40:43.0857 0900 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/04/23 15:40:43.0982 0900 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/04/23 15:40:44.0029 0900 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys
2011/04/23 15:40:44.0169 0900 bcm4sbxp (08015d34f6fdd0b355805bad978497c3) C:\Windows\system32\DRIVERS\bcm4sbxp.sys
2011/04/23 15:40:44.0247 0900 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/04/23 15:40:44.0387 0900 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
2011/04/23 15:40:44.0450 0900 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/04/23 15:40:44.0497 0900 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/04/23 15:40:44.0590 0900 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/04/23 15:40:44.0637 0900 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/04/23 15:40:44.0684 0900 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/04/23 15:40:44.0731 0900 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/04/23 15:40:44.0840 0900 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys
2011/04/23 15:40:44.0902 0900 BTHMODEM (9a966a8e86d1771911ae34a20d11bff3) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/04/23 15:40:45.0011 0900 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys
2011/04/23 15:40:45.0089 0900 BTHPORT (5a3abaa2f8eece7aefb942773766e3db) C:\Windows\system32\Drivers\BTHport.sys
2011/04/23 15:40:45.0152 0900 BTHUSB (94e2941280e3756a5e0bcb467865c43a) C:\Windows\system32\Drivers\BTHUSB.sys
2011/04/23 15:40:45.0292 0900 CAPI20 (d548fe9b6841141cb4c93bb52015567e) C:\Windows\system32\drivers\CAPI20.sys
2011/04/23 15:40:45.0464 0900 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/04/23 15:40:45.0542 0900 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/04/23 15:40:45.0838 0900 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/04/23 15:40:46.0010 0900 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/04/23 15:40:46.0197 0900 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/04/23 15:40:46.0259 0900 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/04/23 15:40:46.0322 0900 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/04/23 15:40:46.0493 0900 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/04/23 15:40:46.0540 0900 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/04/23 15:40:46.0743 0900 DETEWECP (d24bab151777f35f24651ae40005510b) C:\Windows\System32\drivers\detewecp.sys
2011/04/23 15:40:46.0837 0900 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/04/23 15:40:47.0102 0900 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/04/23 15:40:47.0195 0900 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/04/23 15:40:47.0320 0900 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
2011/04/23 15:40:47.0570 0900 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/04/23 15:40:47.0835 0900 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/04/23 15:40:48.0085 0900 ElbyCDIO (d71233d7ccc2e64f8715a20428d5a33b) C:\Windows\system32\Drivers\ElbyCDIO.sys
2011/04/23 15:40:48.0412 0900 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/04/23 15:40:48.0787 0900 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/04/23 15:40:48.0943 0900 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/04/23 15:40:49.0255 0900 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/04/23 15:40:49.0457 0900 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/04/23 15:40:49.0504 0900 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/04/23 15:40:49.0582 0900 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/04/23 15:40:49.0629 0900 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/04/23 15:40:49.0832 0900 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/04/23 15:40:50.0159 0900 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/04/23 15:40:50.0300 0900 giveio (77ebf3e9386daa51551af429052d88d0) C:\Windows\system32\giveio.sys
2011/04/23 15:40:50.0425 0900 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
2011/04/23 15:40:50.0549 0900 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/04/23 15:40:50.0674 0900 HidBth (fcb3f4be408f72c1bd81bcaba87fc22f) C:\Windows\system32\DRIVERS\hidbth.sys
2011/04/23 15:40:50.0861 0900 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/04/23 15:40:51.0173 0900 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/04/23 15:40:51.0220 0900 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/04/23 15:40:51.0298 0900 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/04/23 15:40:51.0485 0900 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/04/23 15:40:51.0875 0900 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/04/23 15:40:52.0203 0900 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/04/23 15:40:52.0281 0900 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/04/23 15:40:52.0421 0900 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/04/23 15:40:52.0484 0900 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/04/23 15:40:52.0531 0900 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/04/23 15:40:52.0593 0900 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/04/23 15:40:52.0671 0900 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/04/23 15:40:52.0780 0900 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/04/23 15:40:52.0827 0900 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/04/23 15:40:53.0030 0900 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/04/23 15:40:53.0155 0900 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/04/23 15:40:53.0326 0900 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/04/23 15:40:53.0576 0900 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/04/23 15:40:53.0857 0900 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/04/23 15:40:54.0106 0900 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/04/23 15:40:54.0215 0900 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/04/23 15:40:54.0293 0900 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/04/23 15:40:54.0434 0900 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/04/23 15:40:54.0512 0900 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/04/23 15:40:54.0605 0900 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/04/23 15:40:54.0652 0900 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/04/23 15:40:54.0730 0900 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/04/23 15:40:54.0855 0900 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/04/23 15:40:54.0933 0900 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/04/23 15:40:55.0011 0900 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/04/23 15:40:55.0058 0900 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/04/23 15:40:55.0105 0900 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/04/23 15:40:55.0167 0900 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/04/23 15:40:55.0229 0900 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/04/23 15:40:55.0292 0900 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/04/23 15:40:55.0339 0900 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/04/23 15:40:55.0401 0900 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/04/23 15:40:55.0479 0900 mrxsmb (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/04/23 15:40:55.0541 0900 mrxsmb10 (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/04/23 15:40:55.0573 0900 mrxsmb20 (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/04/23 15:40:55.0635 0900 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys
2011/04/23 15:40:55.0697 0900 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/04/23 15:40:55.0744 0900 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/04/23 15:40:55.0838 0900 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/04/23 15:40:55.0916 0900 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/04/23 15:40:55.0994 0900 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/04/23 15:40:56.0056 0900 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/04/23 15:40:56.0119 0900 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/04/23 15:40:56.0212 0900 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/04/23 15:40:56.0259 0900 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/04/23 15:40:56.0306 0900 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/04/23 15:40:56.0384 0900 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/04/23 15:40:56.0477 0900 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/04/23 15:40:56.0587 0900 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/04/23 15:40:56.0618 0900 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/04/23 15:40:56.0665 0900 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/04/23 15:40:56.0743 0900 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/04/23 15:40:56.0805 0900 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/04/23 15:40:56.0867 0900 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/04/23 15:40:57.0039 0900 NETw3v32 (35d5458d9a1b26b2005abffbf4c1c5e7) C:\Windows\system32\DRIVERS\NETw3v32.sys
2011/04/23 15:40:57.0148 0900 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/04/23 15:40:57.0273 0900 Nokia USB Generic (5abb6b2461c4eb0afdf1bf7f03963d59) C:\Windows\system32\drivers\nmwcdc.sys
2011/04/23 15:40:57.0335 0900 Nokia USB Modem (353c16d21eec1f11306270040b3713c1) C:\Windows\system32\drivers\nmwcdcm.sys
2011/04/23 15:40:57.0382 0900 Nokia USB Phone Parent (f5b1200c75b160c81e7e48cc0489aa5e) C:\Windows\system32\drivers\nmwcd.sys
2011/04/23 15:40:57.0445 0900 Nokia USB Port (353c16d21eec1f11306270040b3713c1) C:\Windows\system32\drivers\nmwcdcj.sys
2011/04/23 15:40:57.0491 0900 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/04/23 15:40:57.0538 0900 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/04/23 15:40:57.0616 0900 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/04/23 15:40:57.0725 0900 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/04/23 15:40:57.0772 0900 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/04/23 15:40:58.0115 0900 nvlddmkm (8fe5350fa6a9f0b6633aee811c468954) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/04/23 15:40:58.0521 0900 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/04/23 15:40:58.0583 0900 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/04/23 15:40:58.0661 0900 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/04/23 15:40:58.0786 0900 OEM02Dev (19cac780b858822055f46c58a111723c) C:\Windows\system32\DRIVERS\OEM02Dev.sys
2011/04/23 15:40:58.0817 0900 OEM02Vfx (86326062a90494bdd79ce383511d7d69) C:\Windows\system32\DRIVERS\OEM02Vfx.sys
2011/04/23 15:40:58.0895 0900 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/04/23 15:40:58.0973 0900 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/04/23 15:40:59.0036 0900 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/04/23 15:40:59.0083 0900 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/04/23 15:40:59.0129 0900 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/04/23 15:40:59.0176 0900 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/04/23 15:40:59.0207 0900 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/04/23 15:40:59.0301 0900 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/04/23 15:40:59.0473 0900 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/04/23 15:40:59.0535 0900 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/04/23 15:40:59.0629 0900 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/04/23 15:40:59.0722 0900 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/04/23 15:40:59.0785 0900 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/04/23 15:40:59.0831 0900 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/04/23 15:40:59.0878 0900 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/04/23 15:40:59.0941 0900 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/04/23 15:40:59.0987 0900 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/04/23 15:41:00.0050 0900 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/04/23 15:41:00.0097 0900 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/04/23 15:41:00.0190 0900 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/04/23 15:41:00.0253 0900 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/04/23 15:41:00.0315 0900 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/04/23 15:41:00.0377 0900 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/04/23 15:41:00.0440 0900 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys
2011/04/23 15:41:00.0502 0900 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
2011/04/23 15:41:00.0549 0900 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/04/23 15:41:00.0643 0900 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/04/23 15:41:00.0705 0900 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/04/23 15:41:00.0814 0900 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2011/04/23 15:41:00.0877 0900 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/04/23 15:41:00.0923 0900 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/04/23 15:41:00.0970 0900 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/04/23 15:41:01.0033 0900 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/04/23 15:41:01.0126 0900 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/04/23 15:41:01.0173 0900 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/04/23 15:41:01.0204 0900 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/04/23 15:41:01.0267 0900 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/04/23 15:41:01.0329 0900 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/04/23 15:41:01.0360 0900 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/04/23 15:41:01.0407 0900 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/04/23 15:41:01.0485 0900 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/04/23 15:41:01.0532 0900 snapman (e78c98378a071ce4d48a7c514fa98fa1) C:\Windows\system32\DRIVERS\snapman.sys
2011/04/23 15:41:01.0610 0900 speedfan (5d6401db90ec81b71f8e2c5c8f0fef23) C:\Windows\system32\speedfan.sys
2011/04/23 15:41:01.0672 0900 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/04/23 15:41:01.0750 0900 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
2011/04/23 15:41:01.0797 0900 srv2 (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys
2011/04/23 15:41:01.0875 0900 srvnet (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys
2011/04/23 15:41:01.0953 0900 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/04/23 15:41:02.0031 0900 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/04/23 15:41:02.0093 0900 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/04/23 15:41:02.0140 0900 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/04/23 15:41:02.0468 0900 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/04/23 15:41:02.0889 0900 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/04/23 15:41:03.0419 0900 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/04/23 15:41:03.0638 0900 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/04/23 15:41:03.0809 0900 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/04/23 15:41:03.0950 0900 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/04/23 15:41:04.0153 0900 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/04/23 15:41:04.0418 0900 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/04/23 15:41:04.0543 0900 tifsfilter (b84b82c0cbeb1b0d7eb7a946bade5830) C:\Windows\system32\DRIVERS\tifsfilt.sys
2011/04/23 15:41:04.0901 0900 timounter (74711884439bdf9ccf446c79cb05fac0) C:\Windows\system32\DRIVERS\timntr.sys
2011/04/23 15:41:05.0167 0900 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/04/23 15:41:05.0276 0900 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/04/23 15:41:05.0354 0900 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/04/23 15:41:05.0401 0900 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/04/23 15:41:05.0494 0900 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/04/23 15:41:05.0603 0900 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/04/23 15:41:05.0713 0900 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/04/23 15:41:05.0775 0900 ulisa (921ddeb4bbc370ecaa71aab3f101e68e) C:\Windows\system32\Drivers\ulisa.sys
2011/04/23 15:41:05.0837 0900 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/04/23 15:41:05.0869 0900 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/04/23 15:41:05.0931 0900 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/04/23 15:41:05.0993 0900 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/04/23 15:41:06.0071 0900 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/04/23 15:41:06.0134 0900 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/04/23 15:41:06.0181 0900 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/04/23 15:41:06.0243 0900 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/04/23 15:41:06.0305 0900 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/04/23 15:41:06.0368 0900 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/04/23 15:41:06.0415 0900 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/04/23 15:41:06.0461 0900 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/04/23 15:41:06.0508 0900 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/04/23 15:41:06.0571 0900 usb_rndisx (35c9095fa7076466afbfc5b9ec4b779e) C:\Windows\system32\DRIVERS\usb8023x.sys
2011/04/23 15:41:06.0664 0900 VClone (fce98c43b5c5db8e0da8ea0e2b45e044) C:\Windows\system32\DRIVERS\VClone.sys
2011/04/23 15:41:06.0711 0900 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/04/23 15:41:06.0758 0900 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/04/23 15:41:06.0789 0900 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/04/23 15:41:06.0836 0900 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/04/23 15:41:06.0898 0900 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/04/23 15:41:06.0945 0900 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/04/23 15:41:06.0992 0900 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/04/23 15:41:07.0054 0900 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/04/23 15:41:07.0148 0900 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/04/23 15:41:07.0257 0900 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/04/23 15:41:07.0304 0900 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/04/23 15:41:07.0335 0900 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/04/23 15:41:07.0429 0900 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/04/23 15:41:07.0507 0900 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/04/23 15:41:07.0663 0900 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/04/23 15:41:07.0819 0900 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/04/23 15:41:07.0897 0900 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/04/23 15:41:07.0943 0900 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/04/23 15:41:07.0990 0900 WSDPrintDevice (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
2011/04/23 15:41:08.0068 0900 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/04/23 15:41:08.0396 0900 ================================================================================
2011/04/23 15:41:08.0396 0900 Scan finished
2011/04/23 15:41:08.0396 0900 ================================================================================






____________________________________________________

Gruß
Carsten

cosinus 23.04.2011 15:54
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

casi1a 23.04.2011 20:19
Hallo Arne,

mein Laptop läuft mittlerweile immer schlechter. Sicher habe irgendwo etwas falsch gemacht. Wie auch immer, ich habe jetzt keinen Bock mehr und setze das System neu auf. Meine Daten hatte ich ausreichend gesichert, so dass es hier für mich nur um den Zeitaufwand geht.
Auf jeden Fall möchte ich dir aber sagen, daß ich deine Kompetenz und deine Hilfsbereitschaft sehr zu schätzen weiss und ich möchte mich bei dir recht herzlich bedanken.

Gruß
Carsten


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:08 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131