Trojaner-Board - Das system hat ein Problem mit einem oder mehreren installieren IDE / SATA-Festplatten erkannt.

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Das system hat ein Problem mit einem oder mehreren installieren IDE / SATA-Festplatten erkannt. (https://www.trojaner-board.de/99142-system-hat-problem-mehreren-installieren-ide-sata-festplatten-erkannt.html)

Das system hat ein Problem mit einem oder mehreren installieren IDE / SATA-Festplatten erkannt.

Hallo,

ich kriege die oben genannte Fehlermeldung und meinem Desktop fehlt nun das Hintergrundbild sowie alle Icons. Ich kann auch nicht mehr auf meine Benutzerdateien zugreifen, die sind leer, damit meine ich die Dokumenten- bilderordner usw. ebenfalls fehlen alle Icons auf der Taskleiste.

Ich habe bereits Malware durchgeführt und in der Auswahl alle infizierten Dateien gelöscht. Was muss ich nun machen, um meine Dateien wiederherzustellen?

Nach Durchführung vom Malware kommen zwar nun keine Fehlermeldungen mehr, aber nach wie vor kann ich meine fehlenden Dateien nicht mehr sehen.

*********
Kleine Aktualisierung:

habe mittlerweile mit unhide.exe auch die Dateien wieder sichtbar gemacht. Allerdings fehlen immer noch die Icons im Startmenü und ist komplett leer. Auch die Schnellstarticons in der Taskleiste fehlen nach wie vor. Muss ich diese generell wieder alle manuell einstellen oder kriege ich die alte Einstellung zurück?

Malware Log

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6587

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

16.05.11 11:09
mbam-log-2011-05-16 (11-09-17).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 163953
Laufzeit: 4 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 2
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 8
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
c:\programdata\haralsyaynwv.exe (Rogue.Installer.Gen) -> 2628 -> Unloaded process successfully.
c:\programdata\41017080.exe (Trojan.FakeAlert.Gen) -> 2400 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hARalSyaYNWv (Rogue.Installer.Gen) -> Value: hARalSyaYNWv -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\programdata\haralsyaynwv.exe (Rogue.Installer.Gen) -> Quarantined and deleted successfully.
c:\Users\***\AppData\Local\Temp\tmpAD80.tmp (Rogue.Installer.Gen) -> Quarantined and deleted successfully.
c:\programdata\41017080.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.

OTL.Txt.

Code:

OTL logfile created on: 16.05.2011 11:24:16 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\***\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19048)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 59,00% Memory free

7,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 298,09 Gb Total Space | 140,22 Gb Free Space | 47,04% Space Free | Partition Type: NTFS

Drive D: | 254,56 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ***| User Name: ***| Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.16 11:05:02 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe

PRC - [2011.05.07 19:28:08 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2011.03.21 20:56:16 | 001,230,704 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe

PRC - [2011.01.05 04:58:02 | 000,397,312 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2011.01.05 04:57:32 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2010.12.20 18:08:46 | 000,963,976 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe

PRC - [2010.09.23 18:15:18 | 000,350,256 | ---- | M] (AnchorFree Inc.) -- C:\Users\RichtigProg\Hotspot Shield\HssWPR\hsssrv.exe

PRC - [2010.09.23 01:25:24 | 000,107,568 | ---- | M] () -- C:\Users\RichtigProg\Hotspot Shield\bin\openvpntray.exe

PRC - [2010.09.23 01:24:22 | 000,265,776 | ---- | M] () -- C:\Users\RichtigProg\Hotspot Shield\bin\openvpnas.exe

PRC - [2010.09.22 21:19:06 | 000,325,168 | ---- | M] () -- C:\Programme\Hotspot Shield\bin\hsswd.exe

PRC - [2009.09.30 20:58:42 | 000,026,464 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Contacts\wlcomm.exe

PRC - [2009.07.26 17:44:14 | 000,112,464 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Mail\wlmail.exe

PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.11.26 19:18:51 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Users\RichtigProg\Avast\ashDisp.exe

PRC - [2008.11.26 19:18:46 | 000,155,160 | ---- | M] (ALWIL Software) -- C:\Users\RichtigProg\Avast\ashServ.exe

PRC - [2008.11.26 19:18:32 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Users\RichtigProg\Avast\ashMaiSv.exe

PRC - [2008.11.26 19:16:23 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Users\RichtigProg\Avast\ashWebSv.exe

PRC - [2008.11.26 19:12:08 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Users\RichtigProg\Avast\aswUpdSv.exe

PRC - [2008.07.28 16:52:46 | 000,278,264 | ---- | M] (COMODO) -- C:\Programme\COMODO\SafeSurf\cssurf.exe

PRC - [2008.07.03 11:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.05.29 22:30:18 | 002,580,480 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.bin

PRC - [2008.05.29 22:28:18 | 002,363,392 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.exe

PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.16 11:05:02 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe

MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

MOD - [2008.07.28 16:52:46 | 000,249,592 | ---- | M] (COMODO) -- C:\Windows\System32\cssdll32.dll

MOD - [2008.07.28 16:51:42 | 000,143,104 | ---- | M] () -- C:\Windows\System32\guard32.dll

MOD - [2008.01.21 04:24:48 | 000,140,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\winsta.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] --  -- (cmdAgent)

SRV - [2011.05.03 23:22:31 | 003,274,328 | ---- | M] () [Auto | Running] -- c:\Programme\Common Files\Akamai\netsession_win_3f211bc.dll -- (Akamai)

SRV - [2011.01.05 04:57:32 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2010.09.23 18:15:18 | 000,350,256 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Users\RichtigProg\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)

SRV - [2010.09.23 01:25:28 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Users\RichtigProg\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)

SRV - [2010.09.23 01:24:22 | 000,265,776 | ---- | M] () [Auto | Running] -- C:\Users\RichtigProg\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)

SRV - [2010.09.22 21:19:06 | 000,325,168 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)

SRV - [2010.01.03 18:05:06 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2008.11.26 19:18:46 | 000,155,160 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Users\RichtigProg\Avast\ashServ.exe -- (avast! Antivirus)

SRV - [2008.11.26 19:18:32 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Users\RichtigProg\Avast\ashMaiSv.exe -- (avast! Mail Scanner)

SRV - [2008.11.26 19:16:23 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Users\RichtigProg\Avast\ashWebSv.exe -- (avast! Web Scanner)

SRV - [2008.11.26 19:12:08 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Users\RichtigProg\Avast\aswUpdSv.exe -- (aswUpdSv)

SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.01.05 05:36:10 | 006,789,120 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2011.01.05 05:36:10 | 006,789,120 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)

DRV - [2011.01.05 04:19:18 | 000,235,520 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV - [2010.11.17 14:04:12 | 000,097,296 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdLH3.sys -- (AtiHDAudioService)

DRV - [2010.09.22 21:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)

DRV - [2010.05.24 20:07:14 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.11.12 23:42:16 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)

DRV - [2009.08.22 20:25:00 | 000,009,088 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys -- (RivaTuner32)

DRV - [2009.02.12 21:25:20 | 000,271,360 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.02.12 21:25:20 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2008.11.26 19:17:36 | 000,111,184 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)

DRV - [2008.11.26 19:17:25 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV - [2008.11.26 19:17:15 | 000,051,792 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV - [2008.11.26 19:16:38 | 000,050,864 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)

DRV - [2008.11.26 19:16:29 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)

DRV - [2008.07.28 16:51:42 | 000,085,008 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdguard.sys -- (cmdGuard)

DRV - [2008.07.28 16:51:42 | 000,073,232 | ---- | M] (COMODO) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\inspect.sys -- (Inspect)

DRV - [2008.07.28 16:51:42 | 000,025,104 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)

DRV - [2008.05.03 05:46:00 | 007,460,320 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2007.10.31 20:56:00 | 000,046,592 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\l160x86.sys -- (AtcL001)

DRV - [2006.11.10 15:08:50 | 000,024,064 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\ATITool.sys -- (ATITool)

DRV - [2006.10.18 14:44:48 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pureenvy.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://go.microsoft.com/fwlink/?LinkId=69157"

FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.5.2.1

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4

FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.15 16:52:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.15 16:52:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.07 19:28:13 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.07 19:28:13 | 000,000,000 | ---D | M]

 

[2008.07.31 18:28:39 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2011.05.16 09:56:18 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\a0ef4fvy.default\extensions

[2010.05.07 07:53:57 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\a0ef4fvy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.05.09 17:06:16 | 000,000,000 | -H-D | M] (ColorZilla) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\a0ef4fvy.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}

[2011.05.09 17:06:18 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\a0ef4fvy.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

[2010.08.17 15:54:38 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\a0ef4fvy.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2009.01.18 20:32:31 | 000,000,523 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\a0ef4fvy.default\searchplugins\daemon-search.xml

[2010.08.12 13:34:57 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.05.20 17:04:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.08.12 13:34:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

File not found (No name found) -- 

[2009.12.29 21:48:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}

[2010.01.02 15:26:30 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

[2010.03.30 19:40:29 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

[2010.05.20 17:04:12 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.08.12 13:34:57 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A0EF4FVY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A0EF4FVY.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

[2011.05.07 19:28:08 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2011.05.07 19:28:10 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.05.07 19:28:10 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2011.05.07 19:28:10 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2011.05.07 19:28:10 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2011.05.07 19:28:10 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2011.05.07 19:28:10 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,736 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: ::1             localhost

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Users\RichtigProg\Free Download Manager\iefdm2.dll ()

O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Users\RichtigProg\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [avast!] C:\Users\RICHTI~1\Avast\ashDisp.exe (ALWIL Software)

O4 - HKLM..\Run: [COMODO SafeSurf] C:\Program Files\COMODO\SafeSurf\cssurf.exe (COMODO)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RivaTuner] C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe ()

O4 - HKLM..\Run: [RivaTunerStartupDaemon] C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe (Simply Super Software)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [fsm]  File not found

O4 - HKCU..\Run: [PlayNC Launcher]  File not found

O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Users\RichtigProg\Free Download Manager\dlall.htm ()

O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Users\RichtigProg\Free Download Manager\dlselected.htm ()

O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Users\RichtigProg\Free Download Manager\dllink.htm ()

O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Users\RichtigProg\Free Download Manager\dlfvideo.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll ()

O20 - AppInit_DLLs: (C:\Windows\system32\cssdll32.dll) - C:\Windows\System32\cssdll32.dll (COMODO)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\Shell - "" = AutoRun

O33 - MountPoints2\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\Shell\AutoRun\command - "" = G:\autorun.exe

O33 - MountPoints2\{b323055d-675f-11df-a7c5-001fc6bbcff1}\Shell - "" = AutoRun

O33 - MountPoints2\{b323055d-675f-11df-a7c5-001fc6bbcff1}\Shell\AutoRun\command - "" = G:\autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.16 11:11:19 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

[2011.05.16 11:03:13 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2011.05.16 11:02:59 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.16 11:02:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.16 11:02:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.05.16 11:02:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.05.16 11:02:54 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.05.16 10:21:20 | 000,000,000 | -H-D | C] -- C:\Users\***\Documents\Simply Super Software

[2011.05.16 10:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover

[2011.05.16 10:21:11 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ztvcabinet.dll

[2011.05.16 10:21:08 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\Simply Super Software

[2011.05.16 10:21:08 | 000,000,000 | ---D | C] -- C:\Programme\Trojan Remover

[2011.05.16 10:21:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software

[2011.05.16 09:47:36 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery

[2011.04.28 08:26:45 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll

[2011.04.28 08:26:44 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll

[2011.04.28 08:11:29 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll

[2011.04.16 20:23:53 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll

[2011.04.16 20:23:53 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll

[2011.04.16 20:23:43 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2011.04.16 20:23:43 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2011.04.16 20:23:43 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2011.04.16 20:23:43 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2011.04.16 20:23:43 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2011.04.16 20:23:43 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2011.04.16 20:23:43 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2011.04.16 20:23:43 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2011.04.16 20:23:42 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2011.04.16 20:23:42 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2011.04.16 20:23:42 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2011.04.16 20:23:42 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2011.04.16 20:23:42 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2011.04.16 20:23:42 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2011.04.16 20:23:42 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2011.04.16 20:23:42 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2011.04.16 20:23:42 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2011.04.16 20:23:35 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe

[2011.04.16 20:23:28 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll

[2011.04.16 20:23:27 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll

[2011.04.16 20:23:24 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011.04.16 20:23:18 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll

[2011.04.16 20:23:18 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.16 11:17:28 | 000,627,880 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.05.16 11:17:28 | 000,595,264 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.05.16 11:17:28 | 000,104,940 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.05.16 11:17:27 | 000,127,708 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.05.16 11:13:19 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job

[2011.05.16 11:11:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.16 11:11:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.16 11:10:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.16 10:59:07 | 000,000,144 | ---- | M] () -- C:\ProgramData\~41017080r

[2011.05.16 10:59:07 | 000,000,120 | ---- | M] () -- C:\ProgramData\~41017080

[2011.05.16 10:05:08 | 000,000,384 | ---- | M] () -- C:\ProgramData\41017080

[2011.05.16 09:47:36 | 000,000,627 | -H-- | M] () -- C:\Users\***\Desktop\Windows Vista Recovery.lnk

[2011.05.15 16:52:58 | 000,001,428 | -H-- | M] () -- C:\Users\***\Desktop\DivX Movies.lnk

[2011.05.15 16:11:18 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{5A96D0C6-FD53-4653-9CCB-0DA1DCE87429}.job

[2011.04.29 22:55:31 | 000,026,780 | -H-- | M] () -- C:\Users\***\Documents\hj.odt

[2011.04.17 14:10:31 | 001,589,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.05.16 10:21:11 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll

[2011.05.16 10:21:11 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll

[2011.05.16 10:21:11 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll

[2011.05.16 10:21:11 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll

[2011.05.16 09:47:42 | 000,000,144 | ---- | C] () -- C:\ProgramData\~41017080r

[2011.05.16 09:47:42 | 000,000,120 | ---- | C] () -- C:\ProgramData\~41017080

[2011.05.16 09:47:36 | 000,000,627 | -H-- | C] () -- C:\Users\***\Desktop\Windows Vista Recovery.lnk

[2011.05.16 09:47:34 | 000,000,384 | ---- | C] () -- C:\ProgramData\41017080

[2011.05.07 19:28:14 | 000,000,890 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.04.29 22:55:30 | 000,026,780 | -H-- | C] () -- C:\Users\***\Documents\hj.odt

[2011.03.17 11:25:27 | 000,167,303 | ---- | C] () -- C:\Windows\Restaurant Empire II Patch 1.001 Uninstaller.exe

[2010.12.15 21:33:32 | 000,002,975 | ---- | C] () -- C:\Windows\System32\atipblag.dat

[2010.11.10 22:33:41 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.11.10 22:32:21 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat

[2010.10.28 00:13:58 | 000,226,857 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2010.09.29 03:13:06 | 000,023,040 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll

[2010.06.17 23:34:12 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat

[2010.02.27 10:58:36 | 000,003,654 | ---- | C] () -- C:\Windows\System32\drivers\Sonyhcp.dll

[2009.09.24 20:30:13 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.24 20:30:13 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.05.18 10:07:26 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll

[2009.05.17 14:14:51 | 000,054,784 | -H-- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.04.11 19:32:55 | 000,002,032 | -H-- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2009.02.24 19:47:59 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.02.12 21:25:20 | 000,271,360 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.02.12 21:25:20 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.01.10 20:28:32 | 000,000,555 | ---- | C] () -- C:\Windows\eReg.dat

[2008.07.28 16:51:43 | 000,143,104 | ---- | C] () -- C:\Windows\System32\guard32.dll

[2008.07.28 16:20:46 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.07.21 11:18:46 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys

[2008.03.06 02:38:44 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe

[2008.01.21 09:15:58 | 000,627,880 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 09:15:58 | 000,127,708 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2006.11.10 15:08:50 | 000,024,064 | ---- | C] () -- C:\Windows\System32\drivers\ATITool.sys

[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:37 | 001,589,896 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:33:01 | 000,595,264 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,104,940 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

 
 ========== LOP Check ==========

 

[2009.12.20 01:07:28 | 000,000,000 | -HSD | M] -- C:\Users\***\AppData\Roaming\.#

[2010.11.25 01:44:14 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\AnvSoft

[2010.11.24 23:51:24 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Audacity

[2010.04.01 19:28:31 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Auslogics

[2009.01.18 20:27:47 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools

[2010.05.24 20:20:16 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite

[2011.01.03 16:30:55 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers

[2010.06.14 13:48:42 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Facebook

[2011.05.02 17:28:51 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\FileZilla

[2009.12.18 11:57:44 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Free Download Manager

[2010.10.02 14:16:31 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\FTPRush

[2009.12.18 19:53:32 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Publish Providers

[2011.03.27 00:05:08 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\RIFT

[2011.05.16 10:21:08 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Simply Super Software

[2009.12.18 22:00:52 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Software Informer

[2010.11.24 21:00:40 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Sony

[2010.11.23 16:59:02 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Sony Creative Software

[2010.10.20 19:04:53 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\SPORE

[2011.02.14 21:50:06 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\TeamViewer

[2010.10.05 20:04:02 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\TS3Client

[2011.05.11 20:57:11 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\ts3overlay

[2010.05.27 19:06:17 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\TSNotifier

[2011.05.16 08:15:09 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\VoipCheapCom

[2010.11.26 11:04:18 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Worldwinner

[2011.05.16 11:10:05 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011.05.15 16:11:18 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{5A96D0C6-FD53-4653-9CCB-0DA1DCE87429}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:05EE1EEF

@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9

 

< End of report >

Zitat:

Art des Suchlaufs: Quick-Scan

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Hier ein vollständiger Scan mit Malware

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6595

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

19.05.11 11:47
mbam-log-2011-05-19 (11-47-40).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 358287
Laufzeit: 1 Stunde(n), 18 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Was das jetzt der insgesamt 2. Scan mti Malwarebytes?

Ist der dritte Scan.
Beim ersten mal hatte ich leider nur quickscan durchgeführt, beim zweiten mal zwar vollständig, aber hatte vergessen eine aktualisierung durchzuführen.

Hier der vollständige Scan vom 16.05.11, hatte da allerdings keine aktualisierung durchgeführt:

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6587

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

16.05.11 13:47
mbam-log-2011-05-16 (13-47-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 365901
Laufzeit: 2 Stunde(n), 4 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\downloads\Software\limewiresetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\Shell - "" = AutoRun

O33 - MountPoints2\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\Shell\AutoRun\command - "" = G:\autorun.exe

O33 - MountPoints2\{b323055d-675f-11df-a7c5-001fc6bbcff1}\Shell - "" = AutoRun

O33 - MountPoints2\{b323055d-675f-11df-a7c5-001fc6bbcff1}\Shell\AutoRun\command - "" = G:\autorun.exe

[2011.05.16 10:59:07 | 000,000,144 | ---- | M] () -- C:\ProgramData\~41017080r

[2011.05.16 10:59:07 | 000,000,120 | ---- | M] () -- C:\ProgramData\~41017080

[2011.05.16 10:05:08 | 000,000,384 | ---- | M] () -- C:\ProgramData\41017080

[2011.05.16 09:47:42 | 000,000,144 | ---- | C] () -- C:\ProgramData\~41017080r

[2011.05.16 09:47:42 | 000,000,120 | ---- | C] () -- C:\ProgramData\~41017080

[2011.05.16 09:47:36 | 000,000,627 | -H-- | C] () -- C:\Users\***\Desktop\Windows Vista Recovery.lnk

[2011.05.16 09:47:34 | 000,000,384 | ---- | C] () -- C:\ProgramData\41017080

[2009.12.20 01:07:28 | 000,000,000 | -HSD | M] -- C:\Users\***\AppData\Roaming\.#

@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:05EE1EEF

@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Code:

========== OTL ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32a96790-e58e-11dd-b2ed-001fc6bbcff1}\ not found.

File G:\autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b323055d-675f-11df-a7c5-001fc6bbcff1}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b323055d-675f-11df-a7c5-001fc6bbcff1}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b323055d-675f-11df-a7c5-001fc6bbcff1}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b323055d-675f-11df-a7c5-001fc6bbcff1}\ not found.

File G:\autorun.exe not found.

C:\ProgramData\~41017080r moved successfully.

C:\ProgramData\~41017080 moved successfully.

C:\ProgramData\41017080 moved successfully.

File C:\ProgramData\~41017080r not found.

File C:\ProgramData\~41017080 not found.

File C:\Users\***\Desktop\Windows Vista Recovery.lnk not found.

File C:\ProgramData\41017080 not found.

Folder C:\Users\***\AppData\Roaming\.#\ not found.

ADS C:\ProgramData\TEMP:05EE1EEF deleted successfully.

ADS C:\ProgramData\TEMP:CB0AACC9 deleted successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.22.3 log created on 05202011_150627

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

unhide.exe habe ich bereits durchgeführt.

Code:

2011/05/20 18:20:42.0359 2132        TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29

2011/05/20 18:20:42.0599 2132        Err:510

2011/05/20 18:20:42.0599 2132        SystemInfo:

2011/05/20 18:20:42.0599 2132        

2011/05/20 18:20:42.0600 2132        OS Version: 6.0.6002 ServicePack: 2.0

2011/05/20 18:20:42.0600 2132        Product type: Workstation

2011/05/20 18:20:42.0600 2132        ComputerName: ***

2011/05/20 18:20:42.0600 2132        UserName: ***

2011/05/20 18:20:42.0600 2132        Windows directory: C:\Windows

2011/05/20 18:20:42.0600 2132        System windows directory: C:\Windows

2011/05/20 18:20:42.0600 2132        Processor architecture: Intel x86

2011/05/20 18:20:42.0600 2132        Number of processors: 2

2011/05/20 18:20:42.0600 2132        Page size: 0x1000

2011/05/20 18:20:42.0600 2132        Boot type: Normal boot

2011/05/20 18:20:42.0600 2132        Err:510

2011/05/20 18:20:42.0821 2132        Initialize success

2011/05/20 18:20:45.0060 3380        Err:510

2011/05/20 18:20:45.0060 3380        Scan started

2011/05/20 18:20:45.0060 3380        Mode: Manual; 

2011/05/20 18:20:45.0060 3380        Err:510

2011/05/20 18:20:46.0318 3380        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2011/05/20 18:20:46.0387 3380        adfs            (6d7f09cd92a9fef3a8efce66231fdd79) C:\Windows\system32\drivers\adfs.sys

2011/05/20 18:20:46.0524 3380        adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

2011/05/20 18:20:46.0649 3380        adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

2011/05/20 18:20:46.0674 3380        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

2011/05/20 18:20:46.0697 3380        adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

2011/05/20 18:20:46.0759 3380        AFD             (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys

2011/05/20 18:20:46.0813 3380        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

2011/05/20 18:20:46.0880 3380        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2011/05/20 18:20:46.0925 3380        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

2011/05/20 18:20:46.0999 3380        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

2011/05/20 18:20:47.0022 3380        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

2011/05/20 18:20:47.0051 3380        AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

2011/05/20 18:20:47.0073 3380        AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys

2011/05/20 18:20:47.0264 3380        amdkmdag        (409d070998de0c740372531174d22c91) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/05/20 18:20:47.0431 3380        amdkmdap        (377cd7845a5c428112add976867a2819) C:\Windows\system32\DRIVERS\atikmpag.sys

2011/05/20 18:20:47.0478 3380        arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

2011/05/20 18:20:47.0509 3380        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

2011/05/20 18:20:47.0560 3380        aswFsBlk        (ad3bf0f023c8c446c5cae6c5db36c836) C:\Windows\system32\DRIVERS\aswFsBlk.sys

2011/05/20 18:20:47.0604 3380        aswMonFlt       (f58e12da806915c70245a521d4cef792) C:\Windows\system32\DRIVERS\aswMonFlt.sys

2011/05/20 18:20:47.0642 3380        aswRdr          (da7083019bf5e47a07b9bd8ece812b47) C:\Windows\system32\drivers\aswRdr.sys

2011/05/20 18:20:47.0692 3380        aswSP           (c51a8309a1f07d936a22176553dfd6a0) C:\Windows\system32\drivers\aswSP.sys

2011/05/20 18:20:47.0726 3380        aswTdi          (7353fa997054cc68ed26abcfd872bae9) C:\Windows\system32\drivers\aswTdi.sys

2011/05/20 18:20:47.0776 3380        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/05/20 18:20:47.0803 3380        atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2011/05/20 18:20:47.0843 3380        AtcL001         (b536be46c769c97ccb736ed8fdd4393c) C:\Windows\system32\DRIVERS\l160x86.sys

2011/05/20 18:20:47.0918 3380        AtiHDAudioService (0c3c2e9136397e1aaa9033dcae25ced2) C:\Windows\system32\drivers\AtihdLH3.sys

2011/05/20 18:20:48.0082 3380        atikmdag        (409d070998de0c740372531174d22c91) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/05/20 18:20:48.0165 3380        ATITool         (0e4bb35c5305099ac82053ac992e3e0e) C:\Windows\system32\DRIVERS\ATITool.sys

2011/05/20 18:20:48.0207 3380        atksgt          (6e996cf8459a2594e0e9609d0e34d41f) C:\Windows\system32\DRIVERS\atksgt.sys

2011/05/20 18:20:48.0284 3380        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2011/05/20 18:20:48.0351 3380        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

2011/05/20 18:20:48.0398 3380        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

2011/05/20 18:20:48.0428 3380        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2011/05/20 18:20:48.0449 3380        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2011/05/20 18:20:48.0489 3380        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2011/05/20 18:20:48.0512 3380        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2011/05/20 18:20:48.0534 3380        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2011/05/20 18:20:48.0548 3380        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

2011/05/20 18:20:48.0572 3380        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2011/05/20 18:20:48.0606 3380        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/05/20 18:20:48.0630 3380        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2011/05/20 18:20:48.0658 3380        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys

2011/05/20 18:20:48.0692 3380        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2011/05/20 18:20:48.0773 3380        cmdGuard        (8fd60ea0a05550f8cacf50e56251b4b8) C:\Windows\system32\DRIVERS\cmdguard.sys

2011/05/20 18:20:48.0802 3380        cmdHlp          (b74592e59d0652ca989dd5e6c679bb94) C:\Windows\system32\DRIVERS\cmdhlp.sys

2011/05/20 18:20:48.0849 3380        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

2011/05/20 18:20:48.0884 3380        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys

2011/05/20 18:20:48.0904 3380        crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

2011/05/20 18:20:48.0924 3380        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

2011/05/20 18:20:48.0990 3380        DfsC            (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys

2011/05/20 18:20:49.0052 3380        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2011/05/20 18:20:49.0123 3380        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2011/05/20 18:20:49.0161 3380        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

2011/05/20 18:20:49.0213 3380        E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

2011/05/20 18:20:49.0286 3380        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2011/05/20 18:20:49.0353 3380        elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

2011/05/20 18:20:49.0400 3380        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

2011/05/20 18:20:49.0464 3380        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2011/05/20 18:20:49.0498 3380        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2011/05/20 18:20:49.0513 3380        fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

2011/05/20 18:20:49.0562 3380        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2011/05/20 18:20:49.0592 3380        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2011/05/20 18:20:49.0631 3380        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/05/20 18:20:49.0675 3380        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2011/05/20 18:20:49.0713 3380        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2011/05/20 18:20:49.0745 3380        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

2011/05/20 18:20:49.0823 3380        HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

2011/05/20 18:20:49.0898 3380        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/05/20 18:20:49.0931 3380        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2011/05/20 18:20:49.0956 3380        HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2011/05/20 18:20:49.0981 3380        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2011/05/20 18:20:50.0031 3380        HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

2011/05/20 18:20:50.0078 3380        HssDrv          (4f28652ec514fa1ba473bc1a695a5c98) C:\Windows\system32\DRIVERS\HssDrv.sys

2011/05/20 18:20:50.0142 3380        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

2011/05/20 18:20:50.0187 3380        i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

2011/05/20 18:20:50.0249 3380        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/05/20 18:20:50.0275 3380        iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

2011/05/20 18:20:50.0308 3380        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2011/05/20 18:20:50.0477 3380        Inspect         (3443beb5535a3e9713b3f693919fe9f4) C:\Windows\system32\DRIVERS\inspect.sys

2011/05/20 18:20:50.0572 3380        IntcAzAudAddService (5d26ccb06e1f3b5c26e863df3f4f2611) C:\Windows\system32\drivers\RTKVHDA.sys

2011/05/20 18:20:50.0668 3380        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

2011/05/20 18:20:50.0701 3380        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

2011/05/20 18:20:50.0767 3380        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/05/20 18:20:50.0825 3380        IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

2011/05/20 18:20:50.0852 3380        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2011/05/20 18:20:50.0878 3380        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2011/05/20 18:20:50.0900 3380        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

2011/05/20 18:20:50.0942 3380        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/05/20 18:20:50.0966 3380        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2011/05/20 18:20:51.0002 3380        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2011/05/20 18:20:51.0020 3380        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/05/20 18:20:51.0043 3380        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/05/20 18:20:51.0090 3380        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

2011/05/20 18:20:51.0176 3380        lirsgt          (975b6cf65f44e95883f3855bae8cecaf) C:\Windows\system32\DRIVERS\lirsgt.sys

2011/05/20 18:20:51.0211 3380        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/05/20 18:20:51.0256 3380        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

2011/05/20 18:20:51.0279 3380        LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

2011/05/20 18:20:51.0310 3380        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

2011/05/20 18:20:51.0337 3380        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2011/05/20 18:20:51.0373 3380        megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

2011/05/20 18:20:51.0416 3380        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

2011/05/20 18:20:51.0445 3380        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2011/05/20 18:20:51.0472 3380        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2011/05/20 18:20:51.0494 3380        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2011/05/20 18:20:51.0506 3380        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

2011/05/20 18:20:51.0526 3380        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2011/05/20 18:20:51.0552 3380        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

2011/05/20 18:20:51.0581 3380        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2011/05/20 18:20:51.0615 3380        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2011/05/20 18:20:51.0663 3380        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2011/05/20 18:20:51.0706 3380        mrxsmb          (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/05/20 18:20:51.0726 3380        mrxsmb10        (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/05/20 18:20:51.0752 3380        mrxsmb20        (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/05/20 18:20:51.0788 3380        msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys

2011/05/20 18:20:51.0825 3380        msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

2011/05/20 18:20:51.0872 3380        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2011/05/20 18:20:51.0904 3380        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2011/05/20 18:20:51.0962 3380        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2011/05/20 18:20:51.0986 3380        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/05/20 18:20:52.0006 3380        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2011/05/20 18:20:52.0061 3380        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2011/05/20 18:20:52.0115 3380        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/05/20 18:20:52.0150 3380        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2011/05/20 18:20:52.0195 3380        MTsensor        (dcdaab8697a47894a554050ce18d0b56) C:\Windows\system32\DRIVERS\ASACPI.sys

2011/05/20 18:20:52.0230 3380        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2011/05/20 18:20:52.0267 3380        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2011/05/20 18:20:52.0319 3380        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2011/05/20 18:20:52.0339 3380        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/05/20 18:20:52.0362 3380        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/05/20 18:20:52.0409 3380        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/05/20 18:20:52.0439 3380        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2011/05/20 18:20:52.0476 3380        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2011/05/20 18:20:52.0532 3380        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2011/05/20 18:20:52.0580 3380        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2011/05/20 18:20:52.0616 3380        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2011/05/20 18:20:52.0638 3380        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2011/05/20 18:20:52.0702 3380        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2011/05/20 18:20:52.0750 3380        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2011/05/20 18:20:52.0773 3380        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2011/05/20 18:20:52.0976 3380        nvlddmkm        (69d60d2ecd43d0f9f3accc16926e9128) C:\Windows\system32\DRIVERS\nvlddmkm.sys

2011/05/20 18:20:53.0185 3380        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

2011/05/20 18:20:53.0206 3380        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

2011/05/20 18:20:53.0237 3380        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

2011/05/20 18:20:53.0317 3380        ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys

2011/05/20 18:20:53.0383 3380        Parport         (8a79fdf04a73428597e2caf9d0d67850) C:\Windows\system32\DRIVERS\parport.sys

2011/05/20 18:20:53.0418 3380        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2011/05/20 18:20:53.0443 3380        Parvdm          (6c580025c81caf3ae9e3617c22cad00e) C:\Windows\system32\DRIVERS\parvdm.sys

2011/05/20 18:20:53.0488 3380        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2011/05/20 18:20:53.0509 3380        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys

2011/05/20 18:20:53.0538 3380        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

2011/05/20 18:20:53.0589 3380        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2011/05/20 18:20:53.0695 3380        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2011/05/20 18:20:53.0718 3380        Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys

2011/05/20 18:20:53.0786 3380        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2011/05/20 18:20:53.0838 3380        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

2011/05/20 18:20:53.0892 3380        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2011/05/20 18:20:53.0923 3380        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2011/05/20 18:20:53.0944 3380        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2011/05/20 18:20:53.0987 3380        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/05/20 18:20:54.0034 3380        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/05/20 18:20:54.0063 3380        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2011/05/20 18:20:54.0095 3380        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2011/05/20 18:20:54.0140 3380        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/05/20 18:20:54.0174 3380        rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

2011/05/20 18:20:54.0191 3380        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2011/05/20 18:20:54.0224 3380        RDPWD           (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

2011/05/20 18:20:54.0298 3380        RivaTuner32     (c0c8909be3ecc9df8089112bf9be954e) C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys

2011/05/20 18:20:54.0325 3380        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2011/05/20 18:20:54.0350 3380        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2011/05/20 18:20:54.0383 3380        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/05/20 18:20:54.0418 3380        Serenum         (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys

2011/05/20 18:20:54.0440 3380        Serial          (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys

2011/05/20 18:20:54.0465 3380        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2011/05/20 18:20:54.0507 3380        sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys

2011/05/20 18:20:54.0536 3380        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

2011/05/20 18:20:54.0561 3380        sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys

2011/05/20 18:20:54.0581 3380        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2011/05/20 18:20:54.0611 3380        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

2011/05/20 18:20:54.0629 3380        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

2011/05/20 18:20:54.0655 3380        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

2011/05/20 18:20:54.0709 3380        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2011/05/20 18:20:54.0737 3380        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2011/05/20 18:20:54.0793 3380        sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys

2011/05/20 18:20:54.0794 3380        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2011/05/20 18:20:54.0799 3380        sptd - detected LockedFile.Multi.Generic (1)

2011/05/20 18:20:54.0827 3380        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

2011/05/20 18:20:54.0866 3380        srv2            (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys

2011/05/20 18:20:54.0897 3380        srvnet          (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys

2011/05/20 18:20:54.0969 3380        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2011/05/20 18:20:54.0996 3380        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2011/05/20 18:20:55.0021 3380        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2011/05/20 18:20:55.0045 3380        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2011/05/20 18:20:55.0095 3380        taphss          (0c3b2a9c4bd2dd9a6c2e4084314dd719) C:\Windows\system32\DRIVERS\taphss.sys

2011/05/20 18:20:55.0157 3380        Tcpip           (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys

2011/05/20 18:20:55.0224 3380        Tcpip6          (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys

2011/05/20 18:20:55.0268 3380        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

2011/05/20 18:20:55.0302 3380        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2011/05/20 18:20:55.0325 3380        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2011/05/20 18:20:55.0356 3380        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2011/05/20 18:20:55.0387 3380        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2011/05/20 18:20:55.0441 3380        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/05/20 18:20:55.0650 3380        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2011/05/20 18:20:55.0738 3380        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2011/05/20 18:20:55.0805 3380        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

2011/05/20 18:20:55.0850 3380        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2011/05/20 18:20:55.0990 3380        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

2011/05/20 18:20:56.0044 3380        uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

2011/05/20 18:20:56.0076 3380        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2011/05/20 18:20:56.0120 3380        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2011/05/20 18:20:56.0173 3380        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2011/05/20 18:20:56.0246 3380        usbaudio        (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

2011/05/20 18:20:56.0296 3380        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/05/20 18:20:56.0343 3380        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2011/05/20 18:20:56.0374 3380        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2011/05/20 18:20:56.0411 3380        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2011/05/20 18:20:56.0441 3380        usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

2011/05/20 18:20:56.0467 3380        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys

2011/05/20 18:20:56.0492 3380        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/05/20 18:20:56.0528 3380        usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/05/20 18:20:56.0589 3380        vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/05/20 18:20:56.0611 3380        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2011/05/20 18:20:56.0655 3380        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

2011/05/20 18:20:56.0678 3380        ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

2011/05/20 18:20:56.0701 3380        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

2011/05/20 18:20:56.0734 3380        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2011/05/20 18:20:56.0777 3380        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2011/05/20 18:20:56.0816 3380        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2011/05/20 18:20:56.0859 3380        vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

2011/05/20 18:20:56.0893 3380        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2011/05/20 18:20:56.0917 3380        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/05/20 18:20:56.0936 3380        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/05/20 18:20:56.0992 3380        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

2011/05/20 18:20:57.0031 3380        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2011/05/20 18:20:57.0123 3380        WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys

2011/05/20 18:20:57.0192 3380        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

2011/05/20 18:20:57.0212 3380        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/05/20 18:20:57.0268 3380        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/05/20 18:20:57.0314 3380        Err:510

2011/05/20 18:20:57.0314 3380        Scan finished

2011/05/20 18:20:57.0314 3380        Err:510

2011/05/20 18:20:57.0325 2904        Detected object count: 1

2011/05/20 18:21:15.0866 2904        LockedFile.Multi.Generic(sptd) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Code:

ComboFix 11-05-19.02 - *** 21.05.2011   7:52.1.2 - x86                                

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3326.2040 [GMT 2:00]                                

ausgeführt von:: c:\users\***\Desktop\cofi.exe.exe                                

AV: avast! antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}                                

SP: avast! antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}                                

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}                                

.                                

.                                

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))                                

.                                

.                                

C:\Install.exe                                

c:\users\RichtigProg\Hotspot Shield\HssIE\HsSIe.dll                                

c:\users\***\AppData\Roaming\.#                                

.                                

.                                

(((((((((((((((((((((((   Dateien erstellt von 2011-04-21 bis 2011-05-21  ))))))))))))))))))))))))))))))                                

.                                

.                                

2011-05-21 05:59 . 2011-05-21 06:00        --------        d-----w-        c:\users\***\AppData\Local\temp        

2011-05-21 05:59 . 2011-05-21 05:59        --------        d-----w-        c:\users\Gast\AppData\Local\temp        

2011-05-21 05:59 . 2011-05-21 05:59        --------        d-----w-        c:\users\Default\AppData\Local\temp        

2011-05-20 13:06 . 2011-05-20 13:06        --------        d-----w-        C:\_OTL        

2011-05-20 07:01 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3DEC93A-7E7A-420F-8773-6B0B0530AE56}\mpengine.dll        

2011-05-16 09:03 . 2011-05-16 09:03        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes        

2011-05-16 09:02 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys        

2011-05-16 09:02 . 2011-05-16 09:02        --------        d-----w-        c:\programdata\Malwarebytes        

2011-05-16 09:02 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys        

2011-05-16 09:02 . 2011-05-16 09:02        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware        

2011-05-11 18:21 . 2011-04-07 12:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat        

2011-05-07 17:28 . 2011-05-07 17:28        89048        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll        

2011-05-07 17:28 . 2011-05-07 17:28        781272        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll        

2011-05-07 17:28 . 2011-05-07 17:28        465880        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll        

2011-05-07 17:28 . 2011-05-07 17:28        1874904        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll        

2011-05-07 17:28 . 2011-05-07 17:28        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll        

2011-05-07 17:28 . 2011-05-07 17:28        1974616        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll        

2011-05-07 17:28 . 2011-05-07 17:28        1892184        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll        

2011-05-07 17:28 . 2011-05-07 17:28        142296        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll        

2011-04-28 06:26 . 2011-03-03 15:40        28672        ----a-w-        c:\windows\system32\Apphlpdm.dll        

2011-04-28 06:26 . 2011-03-03 13:35        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll        

2011-04-28 06:11 . 2011-03-12 21:55        876032        ----a-w-        c:\windows\system32\XpsPrint.dll        

.                                

.                                

.                                

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))                                

.                                

2011-03-17 09:25 . 2011-03-17 09:25        167303        ----a-w-        c:\windows\Restaurant Empire II Patch 1.001 Uninstaller.exe        

2011-03-10 17:03 . 2011-04-16 18:23        1162240        ----a-w-        c:\windows\system32\mfc42u.dll        

2011-03-10 17:03 . 2011-04-16 18:23        1136640        ----a-w-        c:\windows\system32\mfc42.dll        

2011-03-03 15:42 . 2011-04-16 18:23        739328        ----a-w-        c:\windows\system32\inetcomm.dll        

2011-03-03 15:40 . 2011-04-28 06:26        173056        ----a-w-        c:\windows\apppatch\AcXtrnal.dll        

2011-03-03 15:40 . 2011-04-28 06:26        542720        ----a-w-        c:\windows\apppatch\AcLayers.dll        

2011-03-03 15:40 . 2011-04-28 06:26        458752        ----a-w-        c:\windows\apppatch\AcSpecfc.dll        

2011-03-03 15:40 . 2011-04-28 06:26        2159616        ----a-w-        c:\windows\apppatch\AcGenral.dll        

2011-03-03 13:25 . 2011-04-16 18:23        2041856        ----a-w-        c:\windows\system32\win32k.sys        

2011-03-02 15:44 . 2011-04-16 18:23        86528        ----a-w-        c:\windows\system32\dnsrslvr.dll        

2011-02-22 14:13 . 2011-03-23 17:28        288768        ----a-w-        c:\windows\system32\XpsGdiConverter.dll        

2011-02-22 13:33 . 2011-03-23 17:28        1068544        ----a-w-        c:\windows\system32\DWrite.dll        

2011-02-22 13:33 . 2011-03-23 17:28        797696        ----a-w-        c:\windows\system32\FntCache.dll        

2011-02-22 13:24 . 2011-04-16 18:23        213504        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys        

2011-02-22 13:24 . 2011-04-16 18:23        79360        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys        

2011-02-22 13:23 . 2011-04-16 18:23        106496        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys        

2011-02-22 13:23 . 2011-04-16 18:23        69632        ----a-w-        c:\windows\system32\drivers\bowser.sys        

2011-02-22 06:21 . 2011-04-16 18:23        916480        ----a-w-        c:\windows\system32\wininet.dll        

2011-02-22 06:17 . 2011-04-16 18:23        43520        ----a-w-        c:\windows\system32\licmgr10.dll        

2011-02-22 06:16 . 2011-04-16 18:23        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl        

2011-02-22 06:16 . 2011-04-16 18:23        71680        ----a-w-        c:\windows\system32\iesetup.dll        

2011-02-22 06:16 . 2011-04-16 18:23        109056        ----a-w-        c:\windows\system32\iesysprep.dll        

2011-02-22 05:20 . 2011-04-16 18:23        385024        ----a-w-        c:\windows\system32\html.iec        

2011-02-22 04:43 . 2011-04-16 18:23        133632        ----a-w-        c:\windows\system32\ieUnatt.exe        

2011-02-22 04:42 . 2011-04-16 18:23        1638912        ----a-w-        c:\windows\system32\mshtml.tlb        

2011-05-07 17:28 . 2011-05-07 17:28        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll        

03.05.06 10:06        163328        --sh--r-        c:\windows\System32\flvDX.dll        

21.02.07 11:47        31232        --sh--r-        c:\windows\System32\msfDX.dll        

16.03.08 13:30        216064        --sh--r-        c:\windows\System32\nbDX.dll        

.                                

.                                

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))                                

.                                

.                                

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.                                 

REGEDIT4                                

.                                

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]                                

Sidebar="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]                                

swg="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-28 68856]                                

ehTray.exe="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]                                

WMPNSCFG="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]                                

.                                

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]                                

RtHDVCpl="RtHDVCpl.exe" [2008-07-03 6266880]                                

LanguageShortcut="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]                                

NvCplDaemon="c:\windows\system32\NvCpl.dll" [2008-05-03 13535776]                                

NvMediaCenter="c:\windows\system32\NvMcTray.dll" [2008-05-03 92704]                                

COMODO SafeSurf="c:\program files\COMODO\SafeSurf\cssurf.exe" [2008-07-28 278264]                                

Adobe Reader Speed Launcher="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]                                

avast!="c:\users\RICHTI~1\Avast\ashDisp.exe" [2008-11-26 81000]                                

Skytel="Skytel.exe" [2008-06-25 1826816]                                

AdobeCS4ServiceManager="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]                                

RivaTuner="c:\program files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe" [2009-08-22 24576]                                

StartCCC="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-04 336384]                                

ATICustomerCare="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]                                

RivaTunerStartupDaemon="c:\program files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe" [2009-08-22 24576]                                

DivXUpdate="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]                                

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]                                

EnableUIADesktopToggle= 0 (0x0)                                

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]                                

AppInit_DLLs=c:\windows\System32\guard32.dll c:\windows\System32\cssdll32.dll                                

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]                                

aux3=wdmaud.drv                                

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]                                

01.04.10 09:16        357696        ----a-w-        c:\program files\DAEMON Tools Lite\DTLite.exe        

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]                                

23.11.06 13:10        56928        ----a-w-        c:\program files\CyberLink\PowerDVD\PDVDServ.exe        

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]                                

14.05.10 09:44        248552        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe        

.                                

R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [2010-09-22 325168]                                

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-24 691696]                                

S1 aswSP;avast! Self Protection; [x]                                

S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2008-07-28 85008]                                

S1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2008-07-28 25104]                                

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]                                

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-05 176128]                                

S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]                                

S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-11-26 51792]                                

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-05 6789120]                                

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-05 235520]                                

S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x86.sys [2007-10-31 46592]                                

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-11-17 97296]                                

.                                

.                                

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]                                

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache                

Akamai        REG_MULTI_SZ           Akamai                

.                                

Inhalt des "geplante Tasks" Ordners                                

.                                

2011-05-21 c:\windows\Tasks\Google Software Updater.job                                

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-28 17:47]                                

.                                

2011-05-20 c:\windows\Tasks\User_Feed_Synchronization-{5A96D0C6-FD53-4653-9CCB-0DA1DCE87429}.job                                

- c:\windows\system32\msfeedssync.exe [2011-04-16 04:43]                                

.                                

.                                

------- Zusätzlicher Suchlauf -------                                

.                                

uStart Page = hxxp://www.pureenvy.de/                                

uInternet Settings,ProxyOverride = *.local                                

IE: Add to AMV Convert Tool... - c:\users\RichtigProg\MP3\AMVConverter\grab.html                                

IE: Alles mit FDM herunterladen - file://c:\users\RichtigProg\Free Download Manager\dlall.htm                                

IE: Auswahl mit FDM herunterladen - file://c:\users\RichtigProg\Free Download Manager\dlselected.htm                                

IE: Datei mit FDM herunterladen - file://c:\users\RichtigProg\Free Download Manager\dllink.htm                                

IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm                                

IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm                                

IE: Videos mit FDM herunterladen - file://c:\users\RichtigProg\Free Download Manager\dlfvideo.htm                                

TCP: {046C56BC-EBC9-4A68-9099-2A369C71A8A0} = 192.168.178.1                                

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab                                

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\a0ef4fvy.default\                                

FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157                                

.                                

.                                

------- Dateityp-Verknüpfung -------                                

.                                

.txt=                                

.                                

- - - - Entfernte verwaiste Registrierungseinträge - - - -                                

.                                

HKCU-Run-fsm - (no file)                                

HKCU-Run-PlayNC Launcher - (no file)                                

AddRemove-Restaurant Empire II Patch 1.001 - c:\windows\Restaurant Empire II Patch 1.001                                

.                                

.                                

.                                

**************************************************************************                                

.                                

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net                                

Rootkit scan 2011-05-21 08:00                                

Windows 6.0.6002 Service Pack 2 NTFS

Zitat:

S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2008-07-28 85008]
S1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2008-07-28 25104]

Ist Comodo noch installiert?
Wenn ja bitte deinstallieren und die Windows-Firewall einschalten.