Trojaner-Board - Trojaner im System (BKA)

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojaner im System (BKA) (https://www.trojaner-board.de/99445-trojaner-system-bka.html)

Trojaner im System (BKA)

Ja, also ich war nun auch Opfer des tollen Bundeskriminalamts-Trojaner.
Jedenfalls habe ich jetzt wieder Zugriff aufs System und den Trojaner oberflächlich aus dem System gelöscht, aber da er ja recht tief verwurzelt sein soll, brauch ich euren Rat, wie es über mein System bestellt ist. Problem ist, dass aus vielfältigen Gründen eine Neuaufsetzung des Systems nur im äußersten Notfall in Frage kommt.

Avira (jaja, ich weiß, ich besorg mir baldigst ein ordentliches Antviren Prog) habe ich eben durchlaufen lassen und dabei wurden noch zwei weitere Trojaner gefunden, die jetzt weg sein müssten ...

Malwarebytes Log:

Zitat:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6641

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

22.05.2011 21:14:45
mbam-log-2011-05-22 (21-14-45).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 147858
Laufzeit: 11 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\$Recycle.Bin\s-1-5-21-2163557324-3304686351-1061156009-1001\$R516OZH.exe (Malware.Packer.GenX) -> Quarantined and deleted successfully.
c:\$Recycle.Bin\s-1-5-21-2163557324-3304686351-1061156009-1001\$R5UHOOG.exe (Malware.Packer.GenX) -> Quarantined and deleted successfully.

OTL Log
OTL Logfile:OTL Logfile:

Code:

OTL logfile created on: 22.05.2011 22:52:50 - Run 3

OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\xxx\Downloads

 An unknown product  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,99 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 68,97% Memory free

5,99 Gb Paging File | 4,91 Gb Available in Paging File | 82,07% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 195,14 Gb Total Space | 96,56 Gb Free Space | 49,48% Space Free | Partition Type: NTFS

 

Computer Name: xxx-PC | User Name: xxx | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\xxx\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software)

PRC - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)

PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\xxx\Downloads\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)

SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (TuneUpUtilitiesDrv) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)

DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)

DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)

DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)

DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)

DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)

DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)

DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)

DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)

DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)

DRV - (ElbyCDFL) -- C:\Windows\System32\drivers\ElbyCDFL.sys (SlySoft, Inc.)

DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DA 70 85 5F 66 E6 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {e411bb40-b04c-11d8-92e7-00d09e0179f2}:4.0.4

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.01 13:21:27 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.01 13:21:27 | 000,000,000 | ---D | M]

 

[2010.11.10 18:10:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions

[2011.05.22 22:07:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\dc75recf.default\extensions

[2011.02.05 16:39:03 | 000,000,000 | ---D | M] ("iGraal") -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\dc75recf.default\extensions\{e411bb40-b04c-11d8-92e7-00d09e0179f2}

[2010.11.14 21:29:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2010.11.12 15:17:23 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2010.11.14 21:29:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2010.11.14 21:28:44 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.03.18 20:53:51 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.03.18 20:53:51 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.03.18 20:53:51 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.03.18 20:53:51 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.03.18 20:53:51 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)

O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} -  File not found

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{b468c02e-ece2-11df-9952-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b468c02e-ece2-11df-9952-806e6f6e6963}\Shell\AutoRun\command - "" = "E:\WD SmartWare.exe" autoplay=true

O33 - MountPoints2\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\Shell - "" = AutoRun

O33 - MountPoints2\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\Shell - "" = AutoRun

O33 - MountPoints2\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.22 20:59:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Malwarebytes

[2011.05.22 20:59:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.22 20:59:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.22 20:59:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.05.22 20:59:40 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.05.22 20:59:40 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.05.22 20:55:27 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe

[2011.05.22 20:55:20 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll

[2011.05.22 20:55:20 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll

[2011.05.22 20:55:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011

[2011.05.22 20:54:20 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\TuneUp Software

[2011.05.22 20:53:51 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2011

[2011.05.22 20:52:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software

[2011.05.22 20:52:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}

[2011.05.22 20:39:04 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Commander

[2011.05.22 20:39:03 | 000,000,000 | ---D | C] -- C:\totalcmd

[2011.05.22 20:39:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\GHISLER

[2011.05.22 20:30:45 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Avira

[2011.05.19 07:39:30 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe

[2011.05.14 20:20:09 | 000,000,000 | ---D | C] -- C:\Users\xxx\.jordan

[2011.05.11 18:22:05 | 003,957,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2011.05.11 18:22:05 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2011.04.28 10:55:06 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\ElevatedDiagnostics

[2011.04.27 14:08:57 | 001,686,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\esent.dll

[2011.04.27 14:08:57 | 000,146,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\storport.sys

[2011.04.27 14:08:56 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fsutil.exe

[2011.04.27 14:08:50 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe

[2011.04.27 14:08:47 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll

[2011.04.27 14:08:45 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.22 22:52:16 | 000,048,861 | ---- | M] () -- C:\Users\xxx\Desktop\51187-anleitung-malwarebytes-anti-malware.html

[2011.05.22 22:09:12 | 000,105,289 | ---- | M] () -- C:\Users\xxx\Desktop\kqM7r95q.htm.part.htm

[2011.05.22 22:06:53 | 000,014,752 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.22 22:06:53 | 000,014,752 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.22 22:03:47 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.05.22 22:03:47 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.05.22 22:03:47 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.05.22 22:03:47 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.05.22 21:59:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.22 21:59:21 | 2411,708,416 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.22 20:59:46 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.22 20:55:18 | 000,002,159 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk

[2011.05.22 20:55:18 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk

[2011.05.22 20:39:06 | 000,000,632 | ---- | M] () -- C:\Users\xxx\Desktop\Total Commander.lnk

[2011.05.21 18:01:31 | 001,098,273 | ---- | M] () -- C:\Users\xxx\Desktop\IMG_1246.JPG

[2011.05.21 17:59:38 | 001,807,615 | ---- | M] () -- C:\Users\xxx\Desktop\IMG_1245.JPG

[2011.05.21 16:10:59 | 001,356,177 | ---- | M] () -- C:\Users\xxx\Desktop\IMG_1243.JPG

[2011.05.21 15:09:59 | 002,515,576 | ---- | M] () -- C:\Users\xxx\Desktop\IMG_1237.JPG

[2011.04.30 10:44:42 | 000,091,254 | ---- | M] () -- C:\Users\xxx\Desktop\DHL-Marke-2-QR3VFP7KPM.pdf

[2011.04.30 10:44:27 | 000,088,286 | ---- | M] () -- C:\Users\xxx\Desktop\DHL-Marke-1-GF49UERNL7.pdf

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.05.22 22:52:16 | 000,048,861 | ---- | C] () -- C:\Users\xxx\Desktop\51187-anleitung-malwarebytes-anti-malware.html

[2011.05.22 22:09:11 | 000,105,289 | ---- | C] () -- C:\Users\xxx\Desktop\kqM7r95q.htm.part.htm

[2011.05.22 20:59:46 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.22 20:55:18 | 000,002,159 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk

[2011.05.22 20:55:18 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk

[2011.05.22 20:55:17 | 000,002,151 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk

[2011.05.22 20:39:06 | 000,000,632 | ---- | C] () -- C:\Users\xxx\Desktop\Total Commander.lnk

[2011.05.22 20:39:04 | 000,000,545 | ---- | C] () -- C:\Windows\UC.PIF

[2011.05.22 20:39:04 | 000,000,545 | ---- | C] () -- C:\Windows\RAR.PIF

[2011.05.22 20:39:04 | 000,000,545 | ---- | C] () -- C:\Windows\PKZIP.PIF

[2011.05.22 20:39:04 | 000,000,545 | ---- | C] () -- C:\Windows\PKUNZIP.PIF

[2011.05.22 20:39:04 | 000,000,545 | ---- | C] () -- C:\Windows\NOCLOSE.PIF

[2011.05.22 20:39:04 | 000,000,545 | ---- | C] () -- C:\Windows\LHA.PIF

[2011.05.22 20:39:03 | 000,000,545 | ---- | C] () -- C:\Windows\ARJ.PIF

[2011.05.21 18:04:01 | 001,098,273 | ---- | C] () -- C:\Users\xxx\Desktop\IMG_1246.JPG

[2011.05.21 18:00:54 | 001,807,615 | ---- | C] () -- C:\Users\xxx\Desktop\IMG_1245.JPG

[2011.05.21 18:00:54 | 001,356,177 | ---- | C] () -- C:\Users\xxx\Desktop\IMG_1243.JPG

[2011.05.21 16:12:21 | 002,515,576 | ---- | C] () -- C:\Users\xxx\Desktop\IMG_1237.JPG

[2011.04.30 10:44:41 | 000,091,254 | ---- | C] () -- C:\Users\xxx\Desktop\DHL-Marke-2-QR3VFP7KPM.pdf

[2011.04.30 10:44:26 | 000,088,286 | ---- | C] () -- C:\Users\xxx\Desktop\DHL-Marke-1-GF49UERNL7.pdf

[2011.03.13 21:05:27 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib

[2010.12.02 00:12:24 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll

[2010.11.12 16:50:29 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

[2010.11.10 18:21:33 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2010.11.10 18:21:33 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2010.11.10 18:21:33 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2010.11.10 18:21:33 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2010.03.23 14:26:48 | 000,201,512 | ---- | C] () -- C:\Windows\System32\vpnapi.dll

[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 06:33:53 | 000,412,744 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 02:55:09 | 000,587,776 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll

[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

 
 ========== LOP Check ==========

 

[2010.12.03 12:51:06 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Amazon

[2011.01.05 12:06:17 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Canon

[2010.11.11 17:09:16 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\DAEMON Tools Lite

[2011.05.22 20:39:03 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\GHISLER

[2011.05.22 19:20:28 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ICQ

[2011.05.22 20:54:20 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TuneUp Software

[2011.02.12 12:39:06 | 000,032,618 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 24 bytes -> C:\Windows:0B7B08D3A7E5B193
 

< End of report >

--- --- ---

Ich hoffe ich habe an alles gedacht und ihr könnt mir weiterhelfen.
Vielen Dank schonmal im Vorraus.

Zitat:

Art des Suchlaufs: Quick-Scan

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Oh sorry, nicht richtig gelesen :)

Zitat:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6641

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

23.05.2011 22:23:23
mbam-log-2011-05-23 (22-23-23).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 265681
Laufzeit: 51 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\christian\AppData\LocalLow\Sun\Java\deployment\cache\6.0\44\15c0b9ac-339184f8 (Malware.Packer.GenX) -> Quarantined and deleted successfully.

Zitat:

Datenbank Version: 6641

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.

:rolleyes:

Zitat:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6664

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

24.05.2011 19:31:18
mbam-log-2011-05-24 (19-31-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 263637
Laufzeit: 49 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{b468c02e-ece2-11df-9952-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b468c02e-ece2-11df-9952-806e6f6e6963}\Shell\AutoRun\command - "" = "E:\WD SmartWare.exe" autoplay=true

O33 - MountPoints2\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\Shell - "" = AutoRun

O33 - MountPoints2\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\Shell - "" = AutoRun

O33 - MountPoints2\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\Shell\AutoRun\command - "" = E:\AutoRun.exe

@Alternate Data Stream - 24 bytes -> C:\Windows:0B7B08D3A7E5B193

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

OTL Log nach dem Fix:

Zitat:

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b468c02e-ece2-11df-9952-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b468c02e-ece2-11df-9952-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b468c02e-ece2-11df-9952-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b468c02e-ece2-11df-9952-806e6f6e6963}\ not found.
File "E:\WD SmartWare.exe" autoplay=true not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db4bfebb-1b38-11e0-9b56-00030dc2a2ef}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db4bfedd-1b38-11e0-9b56-00030dc2a2ef}\ not found.
File E:\AutoRun.exe not found.
ADS C:\Windows:0B7B08D3A7E5B193 deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.23.0 log created on 05242011_201506

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hab den suspicious object Fund mal geskipt ...

Zitat:

2011/05/25 22:32:38.0677 2460 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
2011/05/25 22:32:38.0989 2460 ================================================================================
2011/05/25 22:32:38.0989 2460 SystemInfo:
2011/05/25 22:32:38.0989 2460
2011/05/25 22:32:38.0989 2460 OS Version: 6.1.7600 ServicePack: 0.0
2011/05/25 22:32:38.0989 2460 Product type: Workstation
2011/05/25 22:32:38.0989 2460 ComputerName: xxx-PC
2011/05/25 22:32:38.0989 2460 UserName: Christian
2011/05/25 22:32:38.0989 2460 Windows directory: C:\Windows
2011/05/25 22:32:38.0989 2460 System windows directory: C:\Windows
2011/05/25 22:32:38.0989 2460 Processor architecture: Intel x86
2011/05/25 22:32:38.0989 2460 Number of processors: 2
2011/05/25 22:32:38.0989 2460 Page size: 0x1000
2011/05/25 22:32:38.0989 2460 Boot type: Normal boot
2011/05/25 22:32:38.0989 2460 ================================================================================
2011/05/25 22:32:40.0627 2460 Initialize success
2011/05/25 22:33:02.0030 3776 ================================================================================
2011/05/25 22:33:02.0030 3776 Scan started
2011/05/25 22:33:02.0030 3776 Mode: Manual;
2011/05/25 22:33:02.0030 3776 ================================================================================
2011/05/25 22:33:23.0761 3776 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/05/25 22:33:24.0229 3776 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
2011/05/25 22:33:24.0853 3776 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/05/25 22:33:25.0368 3776 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/05/25 22:33:25.0945 3776 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/05/25 22:33:26.0350 3776 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/05/25 22:33:26.0928 3776 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys
2011/05/25 22:33:27.0380 3776 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
2011/05/25 22:33:27.0832 3776 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/05/25 22:33:28.0410 3776 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
2011/05/25 22:33:28.0909 3776 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
2011/05/25 22:33:29.0782 3776 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
2011/05/25 22:33:30.0874 3776 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/05/25 22:33:31.0342 3776 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/05/25 22:33:31.0826 3776 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys
2011/05/25 22:33:32.0216 3776 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/05/25 22:33:32.0606 3776 amdxata (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys
2011/05/25 22:33:33.0386 3776 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
2011/05/25 22:33:34.0088 3776 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/05/25 22:33:34.0478 3776 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/05/25 22:33:34.0993 3776 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/05/25 22:33:35.0523 3776 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
2011/05/25 22:33:36.0256 3776 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/05/25 22:33:36.0802 3776 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys
2011/05/25 22:33:37.0567 3776 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/05/25 22:33:38.0113 3776 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/05/25 22:33:38.0924 3776 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/05/25 22:33:39.0595 3776 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/05/25 22:33:40.0234 3776 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys
2011/05/25 22:33:40.0687 3776 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/05/25 22:33:41.0280 3776 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/05/25 22:33:41.0826 3776 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/05/25 22:33:42.0216 3776 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/05/25 22:33:42.0840 3776 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/05/25 22:33:43.0214 3776 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/05/25 22:33:43.0604 3776 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/05/25 22:33:44.0041 3776 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/05/25 22:33:44.0634 3776 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
2011/05/25 22:33:45.0086 3776 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/05/25 22:33:45.0507 3776 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/05/25 22:33:46.0131 3776 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/05/25 22:33:46.0521 3776 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
2011/05/25 22:33:47.0083 3776 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/05/25 22:33:47.0551 3776 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/05/25 22:33:48.0003 3776 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/05/25 22:33:48.0721 3776 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/05/25 22:33:49.0454 3776 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys
2011/05/25 22:33:50.0062 3776 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
2011/05/25 22:33:50.0905 3776 CVPNDRVA (18994842386fd3039279d7865740abbd) C:\Windows\system32\Drivers\CVPNDRVA.sys
2011/05/25 22:33:51.0342 3776 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys
2011/05/25 22:33:51.0841 3776 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/05/25 22:33:52.0293 3776 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/05/25 22:33:53.0214 3776 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys
2011/05/25 22:33:53.0822 3776 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/05/25 22:33:54.0586 3776 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys
2011/05/25 22:33:56.0022 3776 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/05/25 22:33:56.0786 3776 ElbyCDFL (ce37e3d51912e59c80c6d84337c0b4cd) C:\Windows\system32\Drivers\ElbyCDFL.sys
2011/05/25 22:33:57.0519 3776 ElbyCDIO (178cc9403816c082d22a1d47fa1f9c85) C:\Windows\system32\Drivers\ElbyCDIO.sys
2011/05/25 22:33:58.0143 3776 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/05/25 22:33:58.0627 3776 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
2011/05/25 22:33:59.0126 3776 ewusbnet (7c18a6c99f4119d361a5ca028e788648) C:\Windows\system32\DRIVERS\ewusbnet.sys
2011/05/25 22:33:59.0625 3776 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/05/25 22:34:00.0078 3776 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/05/25 22:34:00.0561 3776 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/05/25 22:34:01.0372 3776 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/05/25 22:34:01.0903 3776 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/05/25 22:34:02.0605 3776 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/05/25 22:34:03.0042 3776 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/05/25 22:34:03.0525 3776 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/05/25 22:34:04.0305 3776 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/05/25 22:34:04.0789 3776 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys
2011/05/25 22:34:05.0179 3776 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/05/25 22:34:05.0694 3776 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/05/25 22:34:06.0115 3776 ggflt (007aea2e06e7cef7372e40c277163959) C:\Windows\system32\DRIVERS\ggflt.sys
2011/05/25 22:34:06.0630 3776 ggsemc (c73de35960ca75c5ab4ae636b127c64e) C:\Windows\system32\DRIVERS\ggsemc.sys
2011/05/25 22:34:06.0989 3776 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/05/25 22:34:07.0940 3776 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2011/05/25 22:34:08.0174 3776 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/05/25 22:34:08.0361 3776 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/05/25 22:34:08.0642 3776 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/05/25 22:34:08.0751 3776 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/05/25 22:34:09.0001 3776 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
2011/05/25 22:34:09.0219 3776 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/05/25 22:34:09.0407 3776 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
2011/05/25 22:34:09.0672 3776 hwdatacard (988c0a49f09d75d3341cb419141793c1) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/05/25 22:34:09.0797 3776 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
2011/05/25 22:34:09.0937 3776 hwusbdev (a259d3619aa23d4562581067f85e2006) C:\Windows\system32\DRIVERS\ewusbdev.sys
2011/05/25 22:34:10.0062 3776 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/05/25 22:34:10.0187 3776 iaStorV (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\Windows\system32\drivers\iaStorV.sys
2011/05/25 22:34:10.0358 3776 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/05/25 22:34:10.0436 3776 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
2011/05/25 22:34:10.0670 3776 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/05/25 22:34:10.0748 3776 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/05/25 22:34:10.0998 3776 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/05/25 22:34:11.0076 3776 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/05/25 22:34:11.0294 3776 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/05/25 22:34:11.0372 3776 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
2011/05/25 22:34:11.0466 3776 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/05/25 22:34:11.0544 3776 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/05/25 22:34:11.0637 3776 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/05/25 22:34:11.0747 3776 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
2011/05/25 22:34:11.0918 3776 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys
2011/05/25 22:34:12.0090 3776 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/05/25 22:34:12.0308 3776 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/05/25 22:34:12.0527 3776 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/05/25 22:34:12.0761 3776 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/05/25 22:34:13.0119 3776 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/05/25 22:34:13.0416 3776 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/05/25 22:34:13.0634 3776 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/05/25 22:34:13.0931 3776 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/05/25 22:34:14.0211 3776 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/05/25 22:34:14.0539 3776 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/05/25 22:34:14.0804 3776 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
2011/05/25 22:34:15.0069 3776 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/05/25 22:34:15.0397 3776 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
2011/05/25 22:34:15.0662 3776 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
2011/05/25 22:34:15.0881 3776 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/05/25 22:34:16.0115 3776 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
2011/05/25 22:34:16.0458 3776 mrxsmb (b4c76ef46322a9711c7b0f4e21ef6ea5) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/05/25 22:34:16.0629 3776 mrxsmb10 (e593d45024a3fdd11e93cc4a6ca91101) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/05/25 22:34:16.0957 3776 mrxsmb20 (a9f86c82c9cc3b679cc3957e1183a30f) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/05/25 22:34:17.0082 3776 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
2011/05/25 22:34:17.0363 3776 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
2011/05/25 22:34:17.0628 3776 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/05/25 22:34:17.0721 3776 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/05/25 22:34:18.0033 3776 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/05/25 22:34:18.0314 3776 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/05/25 22:34:18.0579 3776 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/05/25 22:34:18.0876 3776 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/05/25 22:34:19.0094 3776 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/05/25 22:34:19.0344 3776 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/05/25 22:34:19.0687 3776 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/05/25 22:34:19.0937 3776 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/05/25 22:34:20.0108 3776 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/05/25 22:34:20.0436 3776 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2011/05/25 22:34:20.0795 3776 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys
2011/05/25 22:34:21.0029 3776 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/05/25 22:34:21.0122 3776 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/05/25 22:34:21.0325 3776 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/05/25 22:34:21.0419 3776 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/05/25 22:34:21.0606 3776 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
2011/05/25 22:34:21.0777 3776 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2011/05/25 22:34:21.0980 3776 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys
2011/05/25 22:34:22.0869 3776 netw5v32 (58218ec6b61b1169cf54aab0d00f5fe2) C:\Windows\system32\DRIVERS\netw5v32.sys
2011/05/25 22:34:23.0384 3776 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/05/25 22:34:23.0665 3776 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/05/25 22:34:23.0915 3776 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2011/05/25 22:34:24.0227 3776 Ntfs (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys
2011/05/25 22:34:24.0554 3776 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/05/25 22:34:26.0021 3776 nvlddmkm (e572ebf0a86a76e7cfcaab00648f0f83) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/05/25 22:34:26.0676 3776 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys
2011/05/25 22:34:26.0957 3776 nvstor (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys
2011/05/25 22:34:27.0331 3776 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/05/25 22:34:27.0518 3776 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/05/25 22:34:27.0799 3776 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/05/25 22:34:28.0064 3776 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
2011/05/25 22:34:28.0298 3776 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/05/25 22:34:28.0439 3776 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
2011/05/25 22:34:28.0579 3776 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
2011/05/25 22:34:28.0907 3776 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/05/25 22:34:29.0125 3776 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/05/25 22:34:29.0375 3776 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/05/25 22:34:29.0687 3776 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2011/05/25 22:34:29.0889 3776 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/05/25 22:34:30.0170 3776 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/05/25 22:34:30.0607 3776 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/05/25 22:34:30.0919 3776 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/05/25 22:34:31.0059 3776 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/05/25 22:34:31.0231 3776 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2011/05/25 22:34:31.0512 3776 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/05/25 22:34:31.0715 3776 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/05/25 22:34:31.0933 3776 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/05/25 22:34:32.0183 3776 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2011/05/25 22:34:32.0495 3776 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys
2011/05/25 22:34:32.0791 3776 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/05/25 22:34:32.0947 3776 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/05/25 22:34:33.0025 3776 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys
2011/05/25 22:34:33.0477 3776 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2011/05/25 22:34:33.0727 3776 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2011/05/25 22:34:33.0945 3776 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
2011/05/25 22:34:34.0179 3776 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys
2011/05/25 22:34:34.0523 3776 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2011/05/25 22:34:34.0757 3776 RTL8167 (7dfd48e24479b68b258d8770121155a0) C:\Windows\system32\DRIVERS\Rt86win7.sys
2011/05/25 22:34:35.0037 3776 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys
2011/05/25 22:34:35.0271 3776 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/05/25 22:34:35.0537 3776 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
2011/05/25 22:34:35.0864 3776 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/05/25 22:34:36.0083 3776 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/05/25 22:34:36.0317 3776 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/05/25 22:34:36.0504 3776 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/05/25 22:34:36.0738 3776 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/05/25 22:34:36.0956 3776 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/05/25 22:34:37.0159 3776 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/05/25 22:34:37.0253 3776 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/05/25 22:34:37.0377 3776 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
2011/05/25 22:34:37.0518 3776 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/05/25 22:34:37.0721 3776 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/05/25 22:34:37.0970 3776 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/05/25 22:34:38.0204 3776 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/05/25 22:34:38.0594 3776 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/05/25 22:34:38.0594 3776 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/05/25 22:34:38.0594 3776 sptd - detected LockedFile.Multi.Generic (1)
2011/05/25 22:34:38.0875 3776 srv (4a9b0f215de2519e2363f91df25c1e97) C:\Windows\system32\DRIVERS\srv.sys
2011/05/25 22:34:39.0156 3776 srv2 (14c44875518ae1c982e54ea8c5f7fe28) C:\Windows\system32\DRIVERS\srv2.sys
2011/05/25 22:34:39.0390 3776 srvnet (07a14223b0a50e76ade003fdf95d4fec) C:\Windows\system32\DRIVERS\srvnet.sys
2011/05/25 22:34:39.0608 3776 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/05/25 22:34:39.0811 3776 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/05/25 22:34:40.0076 3776 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys
2011/05/25 22:34:40.0326 3776 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys
2011/05/25 22:34:40.0529 3776 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
2011/05/25 22:34:40.0731 3776 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers\tcpip.sys
2011/05/25 22:34:41.0168 3776 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS\tcpip.sys
2011/05/25 22:34:41.0402 3776 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys
2011/05/25 22:34:41.0636 3776 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys
2011/05/25 22:34:41.0792 3776 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys
2011/05/25 22:34:41.0901 3776 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys
2011/05/25 22:34:42.0042 3776 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys
2011/05/25 22:34:42.0135 3776 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/05/25 22:34:42.0276 3776 TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys
2011/05/25 22:34:42.0572 3776 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys
2011/05/25 22:34:42.0806 3776 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/05/25 22:34:43.0009 3776 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
2011/05/25 22:34:43.0227 3776 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/05/25 22:34:43.0337 3776 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
2011/05/25 22:34:43.0493 3776 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/05/25 22:34:43.0680 3776 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys
2011/05/25 22:34:43.0820 3776 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/05/25 22:34:43.0914 3776 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
2011/05/25 22:34:44.0039 3776 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
2011/05/25 22:34:44.0226 3776 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys
2011/05/25 22:34:44.0631 3776 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2011/05/25 22:34:44.0819 3776 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/05/25 22:34:45.0021 3776 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
2011/05/25 22:34:45.0115 3776 USBSTOR (1c4287739a93594e57e2a9e6a3ed7353) C:\Windows\system32\drivers\USBSTOR.SYS
2011/05/25 22:34:45.0302 3776 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/05/25 22:34:45.0599 3776 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/05/25 22:34:45.0864 3776 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/05/25 22:34:46.0020 3776 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/05/25 22:34:46.0129 3776 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/05/25 22:34:46.0379 3776 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
2011/05/25 22:34:46.0706 3776 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/05/25 22:34:46.0940 3776 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
2011/05/25 22:34:47.0049 3776 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys
2011/05/25 22:34:47.0096 3776 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys
2011/05/25 22:34:47.0174 3776 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/05/25 22:34:47.0252 3776 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/05/25 22:34:47.0346 3776 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
2011/05/25 22:34:47.0533 3776 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/05/25 22:34:47.0736 3776 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
2011/05/25 22:34:47.0876 3776 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/05/25 22:34:48.0032 3776 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/25 22:34:48.0095 3776 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/25 22:34:48.0360 3776 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/05/25 22:34:48.0625 3776 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/05/25 22:34:48.0921 3776 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/05/25 22:34:48.0999 3776 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/05/25 22:34:49.0233 3776 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/05/25 22:34:49.0311 3776 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/05/25 22:34:49.0561 3776 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/05/25 22:34:49.0764 3776 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
2011/05/25 22:34:49.0967 3776 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/05/25 22:34:50.0076 3776 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/05/25 22:34:50.0107 3776 ================================================================================
2011/05/25 22:34:50.0107 3776 Scan finished
2011/05/25 22:34:50.0107 3776 ================================================================================
2011/05/25 22:34:50.0123 3580 Detected object count: 1
2011/05/25 22:34:50.0123 3580 Actual detected object count: 1
2011/05/25 22:35:01.0994 3580 LockedFile.Multi.Generic(sptd) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Oh, das war eine schwere Geburt ...
Erstmal ging der Download über deinen Link nicht (kam irgendwie NFSIS Fehelr oder so ...). Über ForoSpyware.com gings dann komischerweise. :balla:

Während combofix lief, kam allerdings eine Fehlermeldung, dass die PEV.exe beendet wird, weil ein Problem festgestellt wurde. Habe aber nichts bestätigt, weil ich die Maus und so nicht bewegen wollte. Keine Ahnung was das war und ob das unter Umständen Probleme geben könnte??? :lmaa:

[code]
Combofix Logfile:

Code:

ComboFix 11-05-23.02 - Christian 26.05.2011  19:49:29.1.2 - x86

Microsoft Windows 7 Professional   6.1.7600.0.1252.49.1031.18.3067.2157 [GMT 2:00]

ausgeführt von:: c:\users\Christian\Desktop\cofi.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-26 bis 2011-05-26  ))))))))))))))))))))))))))))))

.

.

2011-05-26 17:54 . 2011-05-26 17:54        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-25 20:34 . 2011-04-22 19:36        26496        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-05-24 18:15 . 2011-05-24 18:15        --------        d-----w-        C:\_OTL

2011-05-24 13:41 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5F1D7EDD-6A6C-437E-8C6E-316484C855A9}\mpengine.dll

2011-05-22 18:59 . 2011-05-22 18:59        --------        d-----w-        c:\users\Christian\AppData\Roaming\Malwarebytes

2011-05-22 18:59 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-22 18:59 . 2011-05-22 18:59        --------        d-----w-        c:\programdata\Malwarebytes

2011-05-22 18:59 . 2011-05-22 18:59        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-05-22 18:59 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-22 18:55 . 2011-03-30 17:50        31552        ----a-w-        c:\windows\system32\TURegOpt.exe

2011-05-22 18:55 . 2011-03-30 17:45        21312        ----a-w-        c:\windows\system32\authuitu.dll

2011-05-22 18:55 . 2011-03-30 17:45        29504        ----a-w-        c:\windows\system32\uxtuneup.dll

2011-05-22 18:54 . 2011-05-22 18:54        --------        d-----w-        c:\users\Christian\AppData\Roaming\TuneUp Software

2011-05-22 18:53 . 2011-05-22 18:55        --------        d-----w-        c:\program files\TuneUp Utilities 2011

2011-05-22 18:52 . 2011-05-22 18:55        --------        d-----w-        c:\programdata\TuneUp Software

2011-05-22 18:52 . 2011-05-22 18:52        --------        d-sh--w-        c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\UC.PIF

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\RAR.PIF

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\PKZIP.PIF

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\PKUNZIP.PIF

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\NOCLOSE.PIF

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\LHA.PIF

2011-05-22 18:39 . 2011-05-22 18:39        --------        d-----w-        C:\totalcmd

2011-05-22 18:39 . 2011-05-22 18:39        --------        d-----w-        c:\users\Christian\AppData\Roaming\GHISLER

2011-05-22 18:39 . 2010-12-17 05:56        545        ----a-w-        c:\windows\ARJ.PIF

2011-05-22 18:30 . 2011-05-22 18:30        --------        d-----w-        c:\users\Christian\AppData\Roaming\Avira

2011-05-19 05:39 . 2011-04-09 05:56        123904        ----a-w-        c:\windows\system32\poqexec.exe

2011-05-14 18:20 . 2011-05-14 18:20        --------        d-----w-        c:\users\Christian\.jordan

2011-05-11 16:22 . 2011-04-09 06:13        3957632        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-05-11 16:22 . 2011-04-09 06:13        3901824        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-04-28 08:55 . 2011-04-28 08:55        --------        d-----w-        c:\users\Christian\AppData\Local\ElevatedDiagnostics

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-17 06:25 . 2010-11-10 16:23        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-03-11 05:40 . 2011-04-14 19:11        1164288        ----a-w-        c:\windows\system32\mfc42u.dll

2011-03-11 05:40 . 2011-04-14 19:11        1137664        ----a-w-        c:\windows\system32\mfc42.dll

2011-03-08 05:38 . 2011-04-14 19:11        740864        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-03 05:29 . 2011-04-14 19:12        132608        ----a-w-        c:\windows\system32\dnsrslvr.dll

2011-03-03 05:27 . 2011-04-14 19:12        28672        ----a-w-        c:\windows\system32\dnscacheugc.exe

2011-03-03 03:31 . 2011-04-14 19:11        2331136        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2011-01-05 133432]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2516296]

"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2010-11-19 6144]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-10-21 198656]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-06 13224]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-10-12 101120]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-10 691696]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2011-03-30 1523008]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2011-02-10 10064]

.

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = *.local

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: {5A147DDE-B0AD-44CE-BA81-9A9AD04FDA93} = 193.189.244.225 193.189.244.206

FF - ProfilePath - c:\users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\dc75recf.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: iGraal: {e411bb40-b04c-11d8-92e7-00d09e0179f2} - %profile%\extensions\{e411bb40-b04c-11d8-92e7-00d09e0179f2}

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-05-26  19:56:07

ComboFix-quarantined-files.txt  2011-05-26 17:56

.

Vor Suchlauf: 11 Verzeichnis(se), 106.139.078.656 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 106.115.076.096 Bytes frei

.

- - End Of File - - D8925F9885C2D4EAA4CE6E7EECD5FD05

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Danke schon mal vor ab für die Mühe :dankeschoen:

GMER Logfile:

Code:

GMER 1.0.15.15627 - hxxp://www.gmer.net

Rootkit scan 2011-05-26 21:54:15

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS543232L9A300 rev.FB4OC40C

Running: irtosqcv.exe; Driver: C:\Users\CHRIST~1\AppData\Local\Temp\kglyiuod.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13BD                                                                                     82C7F569 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              82CA4092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

?               System32\Drivers\spnw.sys                                                                                           Das System kann den angegebenen Pfad nicht finden. !

.text           USBPORT.SYS!DllUnload                                                                                               91A78CA0 5 Bytes  JMP 86A554E0 

.text           ane5azdx.SYS                                                                                                        822B0000 12 Bytes  [44, A8, C0, 82, EE, A6, C0, ...]

.text           ane5azdx.SYS                                                                                                        822B000D 9 Bytes  [87, C0, 82, 48, AB, C0, 82, ...] {XCHG EAX, EAX; OR BYTE [EAX-0x55], -0x40; ADD BYTE [EAX], 0x0}

.text           ane5azdx.SYS                                                                                                        822B0017 20 Bytes  [00, DE, 37, 1A, 8B, E6, 35, ...]

.text           ane5azdx.SYS                                                                                                        822B002C 20 Bytes  [00, 00, 00, 00, A0, A1, C7, ...]

.text           ane5azdx.SYS                                                                                                        822B0041 128 Bytes  [46, CA, 82, 60, 45, CA, 82, ...]

.text           ...                                                                                                                 

?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                          Das System kann die angegebene Datei nicht finden. !

?               C:\Users\CHRIST~1\AppData\Local\Temp\catchme.sys                                                                    Das System kann die angegebene Datei nicht finden. !
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar]                                            [8B0A7042] \SystemRoot\System32\Drivers\spnw.sys

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar]                                           [8B0A76D6] \SystemRoot\System32\Drivers\spnw.sys

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                    [8B0A7800] \SystemRoot\System32\Drivers\spnw.sys

IAT             \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                     [8B0A713E] \SystemRoot\System32\Drivers\spnw.sys

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortNotification]                                          00147880

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortQuerySystemTime]                                       78800C75

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortReadPortUchar]                                         06750015

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortStallExecution]                                        C25DC033

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortWritePortUchar]                                        458B0008

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortWritePortUlong]                                        6A006A08

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortGetPhysicalAddress]                                    50056A24

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong]                         005AB7E8

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortGetScatterGatherList]                                  0001B800

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortGetParentBusType]                                      C25D0000

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortRequestCallback]                                       CCCC0008

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortWritePortBufferUshort]                                 CCCCCCCC

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortGetUnCachedExtension]                                  CCCCCCCC

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortCompleteRequest]                                       CCCCCCCC

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortCopyMemory]                                            53EC8B55

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortEtwTraceLog]                                           800C5D8B

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests]                             7500117B

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb]                                127B806A

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb]                                  80647500

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortReadPortBufferUshort]                                  7500137B

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortInitialize]                                            157B805E

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortGetDeviceBase]                                         56587500

IAT             \SystemRoot\System32\Drivers\ane5azdx.SYS[ataport.SYS!AtaPortDeviceStateChange]                                     8008758B
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                              8557D1F8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{34EB413A-D502-41FE-9CC9-B6E11829CFB0}                                            867601F8

Device          \Driver\volmgr \Device\VolMgrControl                                                                                855781F8

Device          \Driver\ACPI_HAL \Device\00000050                                                                                   halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    86A50500

Device          \Driver\usbehci \Device\USBPDO-3                                                                                    8676B500

Device          \Driver\sptd \Device\542307247                                                                                      spnw.sys

Device          \Driver\usbuhci \Device\USBPDO-4                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBPDO-5                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBPDO-6                                                                                    86A50500

Device          \Driver\volmgr \Device\HarddiskVolume1                                                                              855781F8
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\usbehci \Device\USBPDO-7                                                                                    8676B500

Device          \Driver\volmgr \Device\HarddiskVolume2                                                                              855781F8
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\cdrom \Device\CdRom0                                                                                        866C01F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                         8557A1F8

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  8557A1F8

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  8557A1F8

Device          \Driver\atapi \Device\Ide\IdePort2                                                                                  8557A1F8

Device          \Driver\atapi \Device\Ide\IdePort3                                                                                  8557A1F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                                                                         8557A1F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel0                                                                          8557B1F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel1                                                                          8557B1F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel4                                                                          8557B1F8

Device          \Driver\msahci \Device\Ide\PciIde0Channel5                                                                          8557B1F8

Device          \Driver\cdrom \Device\CdRom1                                                                                        866C01F8

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                             867601F8

Device          \Driver\PCI_PNP3246 \Device\0000005d                                                                                spnw.sys

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    86A50500

Device          \Driver\usbehci \Device\USBFDO-3                                                                                    8676B500

Device          \Driver\usbuhci \Device\USBFDO-4                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBFDO-5                                                                                    86A50500

Device          \Driver\usbuhci \Device\USBFDO-6                                                                                    86A50500

Device          \Driver\usbehci \Device\USBFDO-7                                                                                    8676B500

Device          \Driver\ane5azdx \Device\Scsi\ane5azdx1Port4Path0Target0Lun0                                                        8676D500

Device          \Driver\ane5azdx \Device\Scsi\ane5azdx1                                                                             8676D500
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x10 0xC7 0x8B 0x3F ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x17 0x10 0x6E 0x63 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x5C 0xB2 0x75 0xAA ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x10 0xC7 0x8B 0x3F ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x17 0x10 0x6E 0x63 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x5C 0xB2 0x75 0xAA ...
 

---- EOF - GMER 1.0.15 ----

--- --- ---

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:56:54 on 26.05.2011
 

OS: Windows 7  (Build 7600), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.17
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ane5azdx" (ane5azdx) - "Microsoft Corporation" - C:\Windows\system32\drivers\ane5azdx.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\CHRIST~1\AppData\Local\Temp\catchme.sys  (File not found)

"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\Windows\system32\Drivers\CVPNDRVA.sys

"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\Windows\System32\Drivers\ElbyCDFL.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys

"kglyiuod" (kglyiuod) - ? - C:\Users\CHRIST~1\AppData\Local\Temp\kglyiuod.sys  (Hidden registry entry, rootkit activity | File not found)

"mbr" (mbr) - ? - C:\cofi\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2011\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2011\SDShelEx-win32.dll

{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10l.ocx / hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

"ICQ7.2" - "ICQ, LLC." - C:\Program Files\ICQ7.2\ICQ.exe

"PokerStars" - ? - C:\Program Files\PokerStars\PokerStarsUpdate.exe  (File not found)

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"VPN Client.lnk" - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

"ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ7.2\ICQ.exe" silent loginmode=4

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"CanonMyPrinter" - "CANON INC." - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

"CloneCDTray" - "SlySoft, Inc." - "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

MBR Check Log:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows 7 Professional

Windows Information:                 (build 7600), 32-bit

Base Board Manufacturer:        FUJITSU SIEMENS

BIOS Manufacturer:                Phoenix Technologies LTD

System Manufacturer:                FUJITSU SIEMENS

System Product Name:                AMILO Pi 3540

Logical Drives Mask:                0x0000004c
 

Kernel Drivers (total 198):

  0x82C3C000 \SystemRoot\system32\ntkrnlpa.exe

  0x82C05000 \SystemRoot\system32\halmacpi.dll

  0x80BBA000 \SystemRoot\system32\kdcom.dll

  0x83225000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x8329D000 \SystemRoot\system32\PSHED.dll

  0x832AE000 \SystemRoot\system32\BOOTVID.dll

  0x832B6000 \SystemRoot\system32\CLFS.SYS

  0x832F8000 \SystemRoot\system32\CI.dll

  0x8B026000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x8B097000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x8B0A5000 \SystemRoot\System32\Drivers\spnw.sys

  0x8B198000 \SystemRoot\System32\Drivers\WMILIB.SYS

  0x8B1A1000 \SystemRoot\System32\Drivers\SCSIPORT.SYS

  0x833A3000 \SystemRoot\system32\DRIVERS\ACPI.sys

  0x8B1C7000 \SystemRoot\system32\DRIVERS\msisadrv.sys

  0x8B1CF000 \SystemRoot\system32\DRIVERS\vdrvroot.sys

  0x8B220000 \SystemRoot\system32\DRIVERS\pci.sys

  0x8B24A000 \SystemRoot\System32\drivers\partmgr.sys

  0x8B25B000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x8B263000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x8B26E000 \SystemRoot\system32\DRIVERS\volmgr.sys

  0x8B27E000 \SystemRoot\System32\drivers\volmgrx.sys

  0x8B2C9000 \SystemRoot\System32\drivers\mountmgr.sys

  0x8B2DF000 \SystemRoot\system32\DRIVERS\atapi.sys

  0x8B2E8000 \SystemRoot\system32\DRIVERS\ataport.SYS

  0x8B30B000 \SystemRoot\system32\DRIVERS\msahci.sys

  0x8B315000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

  0x8B323000 \SystemRoot\system32\drivers\amdxata.sys

  0x8B32C000 \SystemRoot\system32\drivers\fltmgr.sys

  0x8B360000 \SystemRoot\system32\drivers\fileinfo.sys

  0x8B43D000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x8B56C000 \SystemRoot\System32\Drivers\msrpc.sys

  0x8B597000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x8B371000 \SystemRoot\System32\Drivers\cng.sys

  0x8B5AA000 \SystemRoot\System32\drivers\pcw.sys

  0x8B5B8000 \SystemRoot\System32\Drivers\Fs_Rec.sys

  0x8B61E000 \SystemRoot\system32\drivers\ndis.sys

  0x8B6D5000 \SystemRoot\system32\drivers\NETIO.SYS

  0x8B713000 \SystemRoot\System32\Drivers\ksecpkg.sys

  0x8B81D000 \SystemRoot\System32\drivers\tcpip.sys

  0x8B966000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x8B997000 \SystemRoot\system32\DRIVERS\vmstorfl.sys

  0x8B9A0000 \SystemRoot\system32\DRIVERS\volsnap.sys

  0x8B9DF000 \SystemRoot\System32\Drivers\spldr.sys

  0x8B738000 \SystemRoot\System32\drivers\rdyboost.sys

  0x8B9E7000 \SystemRoot\System32\Drivers\mup.sys

  0x8B9F7000 \SystemRoot\System32\drivers\hwpolicy.sys

  0x8B765000 \SystemRoot\System32\DRIVERS\fvevol.sys

  0x8B800000 \SystemRoot\system32\DRIVERS\disk.sys

  0x8B797000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS

  0x8B5C1000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8B7E4000 \SystemRoot\System32\Drivers\Null.SYS

  0x8B7EB000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8B7F2000 \SystemRoot\System32\drivers\vga.sys

  0x8B400000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8B600000 \SystemRoot\System32\drivers\watchdog.sys

  0x8B60D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8B615000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8B421000 \SystemRoot\system32\drivers\rdprefmp.sys

  0x8B429000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8B5E0000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8B3CE000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8B5EE000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8F815000 \SystemRoot\system32\drivers\afd.sys

  0x8F86F000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8F8A1000 \SystemRoot\system32\DRIVERS\wfplwf.sys

  0x8F8A8000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8F8C7000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8F8D5000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8F8E8000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8F8F8000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0x8F8FE000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8F93F000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8F949000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8F953000 \SystemRoot\System32\Drivers\ElbyCDIO.sys

  0x8F958000 \SystemRoot\System32\drivers\discache.sys

  0x8F964000 \SystemRoot\system32\drivers\csc.sys

  0x8F9C8000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8F9E0000 \SystemRoot\system32\DRIVERS\blbdrive.sys

  0x8B1DA000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x8B000000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x90A26000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys

  0x91344000 \SystemRoot\system32\DRIVERS\nvBridge.kmd

  0x91346000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x91A10000 \SystemRoot\System32\drivers\dxgmms1.sys

  0x91A49000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x91A54000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x91A9F000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x91AAE000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x8224B000 \SystemRoot\system32\DRIVERS\Rt86win7.sys

  0x82270000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x82288000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x82295000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x822A2000 \SystemRoot\System32\Drivers\ElbyCDFL.sys

  0x822A9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x822AF000 \SystemRoot\System32\Drivers\ane5azdx.SYS

  0x822E8000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x822EC000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x822FE000 \SystemRoot\system32\DRIVERS\CompositeBus.sys

  0x8230B000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0x8232A000 \SystemRoot\system32\DRIVERS\AgileVpn.sys

  0x8233C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x82354000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8235F000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x82381000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x82399000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x823B0000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x823C7000 \SystemRoot\system32\DRIVERS\rdpbus.sys

  0x823D1000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x81E00000 \SystemRoot\system32\DRIVERS\ks.sys

  0x823D3000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x91ACD000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x823E1000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x91B11000 \SystemRoot\system32\drivers\HdAudio.sys

  0x91B61000 \SystemRoot\system32\drivers\portcls.sys

  0x91B90000 \SystemRoot\system32\drivers\drmk.sys

  0x97480000 \SystemRoot\System32\win32k.sys

  0x823F2000 \SystemRoot\System32\drivers\Dxapi.sys

  0x91BA9000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x91BB6000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x91BC1000 \SystemRoot\System32\Drivers\dump_msahci.sys

  0x91BCB000 \SystemRoot\System32\Drivers\dump_dumpfve.sys

  0x91BDC000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0x823FC000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x91BF3000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x90A00000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x91A00000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x90A13000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x8F9EE000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0x8F800000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x976E0000 \SystemRoot\System32\TSDDD.dll

  0x8B7BC000 \SystemRoot\system32\drivers\luafv.sys

  0x8B3E5000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x8B200000 \SystemRoot\system32\drivers\WudfPf.sys

  0x97710000 \SystemRoot\System32\cdd.dll

  0x833EB000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x9A622000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x9A668000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x9A678000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x9A68B000 \SystemRoot\system32\drivers\HTTP.sys

  0x9A710000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x9A729000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x9A73B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x9A75E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x9A799000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x9D203000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys

  0x9D293000 \SystemRoot\system32\drivers\peauth.sys

  0x9D32A000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x9D334000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x9D355000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9D362000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x9D63B000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9D68D000 \??\C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

  0x9D6F8000 \SystemRoot\system32\DRIVERS\asyncmac.sys

  0x9D701000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS

  0x9D703000 \??\C:\Users\CHRIST~1\AppData\Local\Temp\catchme.sys

  0x9D712000 \??\C:\Users\CHRIST~1\AppData\Local\Temp\kglyiuod.sys

  0x81E34000 \SystemRoot\system32\DRIVERS\netw5v32.sys

  0x777A0000 \Windows\System32\ntdll.dll

  0x48310000 \Windows\System32\smss.exe

  0x779E0000 \Windows\System32\apisetschema.dll

  0x00FF0000 \Windows\System32\autochk.exe

  0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll

  0x77900000 \Windows\System32\msctf.dll

  0x77700000 \Windows\System32\advapi32.dll

  0x778F0000 \Windows\System32\psapi.dll

  0x776A0000 \Windows\System32\difxapi.dll

  0x77600000 \Windows\System32\usp10.dll

  0x775E0000 \Windows\System32\imm32.dll

  0x775C0000 \Windows\System32\sechost.dll

  0x77590000 \Windows\System32\imagehlp.dll

  0x774E0000 \Windows\System32\rpcrt4.dll

  0x77430000 \Windows\System32\msvcrt.dll

  0x77330000 \Windows\System32\wininet.dll

  0x772A0000 \Windows\System32\oleaut32.dll

  0x77160000 \Windows\System32\urlmon.dll

  0x770D0000 \Windows\System32\clbcatq.dll

  0x76FF0000 \Windows\System32\kernel32.dll

  0x778E0000 \Windows\System32\lpk.dll

  0x76F70000 \Windows\System32\comdlg32.dll

  0x76F10000 \Windows\System32\shlwapi.dll

  0x76ED0000 \Windows\System32\ws2_32.dll

  0x76E00000 \Windows\System32\user32.dll

  0x76DF0000 \Windows\System32\nsi.dll

  0x76C90000 \Windows\System32\ole32.dll

  0x76040000 \Windows\System32\shell32.dll

  0x75E40000 \Windows\System32\iertutil.dll

  0x75DF0000 \Windows\System32\gdi32.dll

  0x75DA0000 \Windows\System32\Wldap32.dll

  0x75C00000 \Windows\System32\setupapi.dll

  0x75BF0000 \Windows\System32\normaliz.dll

  0x75BC0000 \Windows\System32\cfgmgr32.dll

  0x75BA0000 \Windows\System32\devobj.dll

  0x75B50000 \Windows\System32\KernelBase.dll

  0x75AC0000 \Windows\System32\comctl32.dll

  0x759A0000 \Windows\System32\crypt32.dll

  0x75970000 \Windows\System32\wintrust.dll

  0x75960000 \Windows\System32\msasn1.dll
 

Processes (total 52):

       0 System Idle Process

       4 System

     276 C:\Windows\System32\smss.exe

     360 csrss.exe

     420 C:\Windows\System32\wininit.exe

     432 csrss.exe

     468 C:\Windows\System32\services.exe

     484 C:\Windows\System32\lsass.exe

     492 C:\Windows\System32\lsm.exe

     580 C:\Windows\System32\svchost.exe

     664 C:\Windows\System32\nvvsvc.exe

     692 C:\Windows\System32\svchost.exe

     744 C:\Windows\System32\svchost.exe

     796 C:\Windows\System32\svchost.exe

     836 C:\Windows\System32\svchost.exe

     976 C:\Windows\System32\svchost.exe

    1092 C:\Windows\System32\svchost.exe

    1192 C:\Windows\System32\svchost.exe

    1240

Log von mbrcheck ist nicht vollständig. Lass es lange genug laufen und führt es per Rechtsklick als Admin aus!

hab wohl beim kopieren etwas vergessen ... :stirn:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows 7 Professional

Windows Information:                 (build 7600), 32-bit

Base Board Manufacturer:        FUJITSU SIEMENS

BIOS Manufacturer:                Phoenix Technologies LTD

System Manufacturer:                FUJITSU SIEMENS

System Product Name:                AMILO Pi 3540

Logical Drives Mask:                0x0000004c
 

Kernel Drivers (total 198):

  0x82C3C000 \SystemRoot\system32\ntkrnlpa.exe

  0x82C05000 \SystemRoot\system32\halmacpi.dll

  0x80BBA000 \SystemRoot\system32\kdcom.dll

  0x83225000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x8329D000 \SystemRoot\system32\PSHED.dll

  0x832AE000 \SystemRoot\system32\BOOTVID.dll

  0x832B6000 \SystemRoot\system32\CLFS.SYS

  0x832F8000 \SystemRoot\system32\CI.dll

  0x8B026000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x8B097000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x8B0A5000 \SystemRoot\System32\Drivers\spnw.sys

  0x8B198000 \SystemRoot\System32\Drivers\WMILIB.SYS

  0x8B1A1000 \SystemRoot\System32\Drivers\SCSIPORT.SYS

  0x833A3000 \SystemRoot\system32\DRIVERS\ACPI.sys

  0x8B1C7000 \SystemRoot\system32\DRIVERS\msisadrv.sys

  0x8B1CF000 \SystemRoot\system32\DRIVERS\vdrvroot.sys

  0x8B220000 \SystemRoot\system32\DRIVERS\pci.sys

  0x8B24A000 \SystemRoot\System32\drivers\partmgr.sys

  0x8B25B000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x8B263000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x8B26E000 \SystemRoot\system32\DRIVERS\volmgr.sys

  0x8B27E000 \SystemRoot\System32\drivers\volmgrx.sys

  0x8B2C9000 \SystemRoot\System32\drivers\mountmgr.sys

  0x8B2DF000 \SystemRoot\system32\DRIVERS\atapi.sys

  0x8B2E8000 \SystemRoot\system32\DRIVERS\ataport.SYS

  0x8B30B000 \SystemRoot\system32\DRIVERS\msahci.sys

  0x8B315000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

  0x8B323000 \SystemRoot\system32\drivers\amdxata.sys

  0x8B32C000 \SystemRoot\system32\drivers\fltmgr.sys

  0x8B360000 \SystemRoot\system32\drivers\fileinfo.sys

  0x8B43D000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x8B56C000 \SystemRoot\System32\Drivers\msrpc.sys

  0x8B597000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x8B371000 \SystemRoot\System32\Drivers\cng.sys

  0x8B5AA000 \SystemRoot\System32\drivers\pcw.sys

  0x8B5B8000 \SystemRoot\System32\Drivers\Fs_Rec.sys

  0x8B61E000 \SystemRoot\system32\drivers\ndis.sys

  0x8B6D5000 \SystemRoot\system32\drivers\NETIO.SYS

  0x8B713000 \SystemRoot\System32\Drivers\ksecpkg.sys

  0x8B81D000 \SystemRoot\System32\drivers\tcpip.sys

  0x8B966000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x8B997000 \SystemRoot\system32\DRIVERS\vmstorfl.sys

  0x8B9A0000 \SystemRoot\system32\DRIVERS\volsnap.sys

  0x8B9DF000 \SystemRoot\System32\Drivers\spldr.sys

  0x8B738000 \SystemRoot\System32\drivers\rdyboost.sys

  0x8B9E7000 \SystemRoot\System32\Drivers\mup.sys

  0x8B9F7000 \SystemRoot\System32\drivers\hwpolicy.sys

  0x8B765000 \SystemRoot\System32\DRIVERS\fvevol.sys

  0x8B800000 \SystemRoot\system32\DRIVERS\disk.sys

  0x8B797000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS

  0x8B5C1000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8B7E4000 \SystemRoot\System32\Drivers\Null.SYS

  0x8B7EB000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8B7F2000 \SystemRoot\System32\drivers\vga.sys

  0x8B400000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8B600000 \SystemRoot\System32\drivers\watchdog.sys

  0x8B60D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8B615000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8B421000 \SystemRoot\system32\drivers\rdprefmp.sys

  0x8B429000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8B5E0000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8B3CE000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8B5EE000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8F815000 \SystemRoot\system32\drivers\afd.sys

  0x8F86F000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8F8A1000 \SystemRoot\system32\DRIVERS\wfplwf.sys

  0x8F8A8000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8F8C7000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8F8D5000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8F8E8000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8F8F8000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0x8F8FE000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8F93F000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8F949000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8F953000 \SystemRoot\System32\Drivers\ElbyCDIO.sys

  0x8F958000 \SystemRoot\System32\drivers\discache.sys

  0x8F964000 \SystemRoot\system32\drivers\csc.sys

  0x8F9C8000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8F9E0000 \SystemRoot\system32\DRIVERS\blbdrive.sys

  0x8B1DA000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x8B000000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x90A26000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys

  0x91344000 \SystemRoot\system32\DRIVERS\nvBridge.kmd

  0x91346000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x91A10000 \SystemRoot\System32\drivers\dxgmms1.sys

  0x91A49000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x91A54000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x91A9F000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x91AAE000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x8224B000 \SystemRoot\system32\DRIVERS\Rt86win7.sys

  0x82270000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x82288000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x82295000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x822A2000 \SystemRoot\System32\Drivers\ElbyCDFL.sys

  0x822A9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x822AF000 \SystemRoot\System32\Drivers\ane5azdx.SYS

  0x822E8000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x822EC000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x822FE000 \SystemRoot\system32\DRIVERS\CompositeBus.sys

  0x8230B000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0x8232A000 \SystemRoot\system32\DRIVERS\AgileVpn.sys

  0x8233C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x82354000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8235F000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x82381000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x82399000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x823B0000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x823C7000 \SystemRoot\system32\DRIVERS\rdpbus.sys

  0x823D1000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x81E00000 \SystemRoot\system32\DRIVERS\ks.sys

  0x823D3000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x91ACD000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x823E1000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x91B11000 \SystemRoot\system32\drivers\HdAudio.sys

  0x91B61000 \SystemRoot\system32\drivers\portcls.sys

  0x91B90000 \SystemRoot\system32\drivers\drmk.sys

  0x97480000 \SystemRoot\System32\win32k.sys

  0x823F2000 \SystemRoot\System32\drivers\Dxapi.sys

  0x91BA9000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x91BB6000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x91BC1000 \SystemRoot\System32\Drivers\dump_msahci.sys

  0x91BCB000 \SystemRoot\System32\Drivers\dump_dumpfve.sys

  0x91BDC000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0x823FC000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x91BF3000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x90A00000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x91A00000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x90A13000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x8F9EE000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0x8F800000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x976E0000 \SystemRoot\System32\TSDDD.dll

  0x8B7BC000 \SystemRoot\system32\drivers\luafv.sys

  0x8B3E5000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x8B200000 \SystemRoot\system32\drivers\WudfPf.sys

  0x97710000 \SystemRoot\System32\cdd.dll

  0x833EB000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x9A622000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x9A668000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x9A678000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x9A68B000 \SystemRoot\system32\drivers\HTTP.sys

  0x9A710000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x9A729000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x9A73B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x9A75E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x9A799000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x9D203000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys

  0x9D293000 \SystemRoot\system32\drivers\peauth.sys

  0x9D32A000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x9D334000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x9D355000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9D362000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x9D63B000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9D68D000 \??\C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

  0x9D6F8000 \SystemRoot\system32\DRIVERS\asyncmac.sys

  0x9D701000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS

  0x9D703000 \??\C:\Users\CHRIST~1\AppData\Local\Temp\catchme.sys

  0x9D712000 \??\C:\Users\CHRIST~1\AppData\Local\Temp\kglyiuod.sys

  0x81E34000 \SystemRoot\system32\DRIVERS\netw5v32.sys

  0x777A0000 \Windows\System32\ntdll.dll

  0x48310000 \Windows\System32\smss.exe

  0x779E0000 \Windows\System32\apisetschema.dll

  0x00FF0000 \Windows\System32\autochk.exe

  0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll

  0x77900000 \Windows\System32\msctf.dll

  0x77700000 \Windows\System32\advapi32.dll

  0x778F0000 \Windows\System32\psapi.dll

  0x776A0000 \Windows\System32\difxapi.dll

  0x77600000 \Windows\System32\usp10.dll

  0x775E0000 \Windows\System32\imm32.dll

  0x775C0000 \Windows\System32\sechost.dll

  0x77590000 \Windows\System32\imagehlp.dll

  0x774E0000 \Windows\System32\rpcrt4.dll

  0x77430000 \Windows\System32\msvcrt.dll

  0x77330000 \Windows\System32\wininet.dll

  0x772A0000 \Windows\System32\oleaut32.dll

  0x77160000 \Windows\System32\urlmon.dll

  0x770D0000 \Windows\System32\clbcatq.dll

  0x76FF0000 \Windows\System32\kernel32.dll

  0x778E0000 \Windows\System32\lpk.dll

  0x76F70000 \Windows\System32\comdlg32.dll

  0x76F10000 \Windows\System32\shlwapi.dll

  0x76ED0000 \Windows\System32\ws2_32.dll

  0x76E00000 \Windows\System32\user32.dll

  0x76DF0000 \Windows\System32\nsi.dll

  0x76C90000 \Windows\System32\ole32.dll

  0x76040000 \Windows\System32\shell32.dll

  0x75E40000 \Windows\System32\iertutil.dll

  0x75DF0000 \Windows\System32\gdi32.dll

  0x75DA0000 \Windows\System32\Wldap32.dll

  0x75C00000 \Windows\System32\setupapi.dll

  0x75BF0000 \Windows\System32\normaliz.dll

  0x75BC0000 \Windows\System32\cfgmgr32.dll

  0x75BA0000 \Windows\System32\devobj.dll

  0x75B50000 \Windows\System32\KernelBase.dll

  0x75AC0000 \Windows\System32\comctl32.dll

  0x759A0000 \Windows\System32\crypt32.dll

  0x75970000 \Windows\System32\wintrust.dll

  0x75960000 \Windows\System32\msasn1.dll
 

Processes (total 52):

       0 System Idle Process

       4 System

     276 C:\Windows\System32\smss.exe

     360 csrss.exe

     420 C:\Windows\System32\wininit.exe

     432 csrss.exe

     468 C:\Windows\System32\services.exe

     484 C:\Windows\System32\lsass.exe

     492 C:\Windows\System32\lsm.exe

     580 C:\Windows\System32\svchost.exe

     664 C:\Windows\System32\nvvsvc.exe

     692 C:\Windows\System32\svchost.exe

     744 C:\Windows\System32\svchost.exe

     796 C:\Windows\System32\svchost.exe

     836 C:\Windows\System32\svchost.exe

     976 C:\Windows\System32\svchost.exe

    1092 C:\Windows\System32\svchost.exe

    1192 C:\Windows\System32\svchost.exe

    1240 C:\Windows\System32\winlogon.exe

    1368 C:\Windows\System32\spoolsv.exe

    1420 C:\Program Files\Avira\AntiVir Desktop\sched.exe

    1476 C:\Windows\System32\nvvsvc.exe

    1576 C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    1604 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    1640 C:\Program Files\Bonjour\mDNSResponder.exe

    1684 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

    1692 C:\Windows\System32\conhost.exe

    1776 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

    1820 C:\Windows\System32\taskhost.exe

    1868 C:\Windows\System32\dwm.exe

    2044 C:\Windows\System32\svchost.exe

     348 C:\Windows\System32\svchost.exe

     720 C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

    2092 C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

    2228 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    2236 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    2256 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

    2284 C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

    2352 C:\Program Files\DAEMON Tools Lite\DTLite.exe

    2608 C:\Windows\System32\SearchIndexer.exe

    3028 C:\Windows\System32\svchost.exe

    3188 C:\Program Files\Windows Media Player\wmpnetwk.exe

    3660 C:\Windows\System32\svchost.exe

    4088 C:\Windows\System32\wuauclt.exe

    3488 C:\Windows\explorer.exe

    2432 C:\Windows\System32\audiodg.exe

    2400 WmiPrvSE.exe

    2904 C:\Program Files\Mozilla Firefox\firefox.exe

     948 C:\Program Files\Mozilla Firefox\plugin-container.exe

    2148 C:\Users\Christian\Desktop\MBRCheck.exe

    2868 C:\Windows\System32\conhost.exe

    1012 C:\Windows\System32\dllhost.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000019`bcc00000  (NTFS)
 

PhysicalDrive0 Model Number: HitachiHTS543232L9A300, Rev: FB4OC40C
 

      Size  Device Name          MBR Status

  --------------------------------------------

    298 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected

            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
 
 

Done!