Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Hive Cluster\49600\Megalomon_swarm (https://www.trojaner-board.de/100120-hive-cluster-49600-megalomon_swarm.html)

megalomon 09.06.2011 04:21
Hive Cluster\49600\Megalomon_swarm
 
Servus,
icch hab da ne Frage was einen Ordner samt Dateien angeht,w elcher mir äusserst suspekt ist. Ich war eben auf der Suche nach ein paar anderen dateien und bin auf diesen Ordner gestoßen:
C:\Users\Megalomon\AppData\Roaming\Hive Cluster\49600\*
In diesem Ordner in einem Unterverzeichnis befinden sich beispielsweise dateien nach dem Schema:
NEW_ACHIEVEMENT_1_X
Der Inhalt aller Dateien ist gleich und lautet:

CONGRATURATION! YOU SUCSESS!
A WINRAR IS YOU!

Das ist eigentlich der Kernpunkt der mich skeptisch gemacht hat, ich halte es unwarscheinlich das dies bestandteil eines Spiels sein kann. Zumal ich es keinem (bewusst) installierten Programm zuordnen könnte...

Von daher is meine Frage: Weis wer was es mit dem oder Hove Cluster im allgemeinen und dem Unterordner 49600 im besonderen aufsich hat?

cosinus 09.06.2011 10:34
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!


Danach OTL-Custom:


CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

megalomon 09.06.2011 16:48
Vlt. funktioniert am Ende auch der explorer wieder ohne 10x am Tag abzustürzen.

Logs im Anhang.

cosinus 09.06.2011 18:58
Malwarebytes hat garnichts gefunden oder ist das nur ein Log von einem Durchgang ohne Funde? :wtf:

megalomon 09.06.2011 19:57
nichts

allerdings ist währenddessen glaube ich 2x der explorer mal wieder abgeschmiert.

cosinus 09.06.2011 20:11
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - prefs.js..network.proxy.autoconfig_url: "http://216.254.95.2/"
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.gopher: ""
FF - prefs.js..network.proxy.backup.gopher_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "194.145.226.26"
FF - prefs.js..network.proxy.ftp_port: 53
FF - prefs.js..network.proxy.gopher: "194.145.226.26"
FF - prefs.js..network.proxy.gopher_port: 53
FF - prefs.js..network.proxy.http: "194.145.226.26"
FF - prefs.js..network.proxy.http_port: 53
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "194.145.226.26"
FF - prefs.js..network.proxy.socks_port: 53
FF - prefs.js..network.proxy.ssl: "194.145.226.26"
FF - prefs.js..network.proxy.ssl_port: 53
FF - prefs.js..network.proxy.type: 4
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{4ca04a91-7c6c-11e0-9357-00269e639272}\Shell - "" = AutoRun
O33 - MountPoints2\{4ca04a91-7c6c-11e0-9357-00269e639272}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
[2011.06.09 12:50:10 | 000,711,728 | ---- | M] () -- C:\Windows\is-2UG8C.exe
[2011.06.09 12:50:10 | 000,012,782 | ---- | M] () -- C:\Windows\is-2UG8C.msg
[2011.06.09 12:50:10 | 000,000,377 | ---- | M] () -- C:\Windows\is-2UG8C.lst
:Files
C:\Users\Megalomon\AppData\Roaming\Hive Cluster
C:\Users\Megalomon\Desktop\*.rar
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

megalomon 09.06.2011 21:37
Anscheinend kein Neustart:

Zitat:
========== OTL ==========
Prefs.js: "hxxp://216.254.95.2/" removed from network.proxy.autoconfig_url
Prefs.js: "" removed from network.proxy.backup.ftp
Prefs.js: 0 removed from network.proxy.backup.ftp_port
Prefs.js: "" removed from network.proxy.backup.gopher
Prefs.js: 0 removed from network.proxy.backup.gopher_port
Prefs.js: "" removed from network.proxy.backup.socks
Prefs.js: 0 removed from network.proxy.backup.socks_port
Prefs.js: "" removed from network.proxy.backup.ssl
Prefs.js: 0 removed from network.proxy.backup.ssl_port
Prefs.js: "194.145.226.26" removed from network.proxy.ftp
Prefs.js: 53 removed from network.proxy.ftp_port
Prefs.js: "194.145.226.26" removed from network.proxy.gopher
Prefs.js: 53 removed from network.proxy.gopher_port
Prefs.js: "194.145.226.26" removed from network.proxy.http
Prefs.js: 53 removed from network.proxy.http_port
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: "194.145.226.26" removed from network.proxy.socks
Prefs.js: 53 removed from network.proxy.socks_port
Prefs.js: "194.145.226.26" removed from network.proxy.ssl
Prefs.js: 53 removed from network.proxy.ssl_port
Prefs.js: 4 removed from network.proxy.type
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4ca04a91-7c6c-11e0-9357-00269e639272}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ca04a91-7c6c-11e0-9357-00269e639272}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4ca04a91-7c6c-11e0-9357-00269e639272}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ca04a91-7c6c-11e0-9357-00269e639272}\ not found.
File G:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\LaunchU3.exe -a not found.
C:\Windows\is-2UG8C.exe moved successfully.
C:\Windows\is-2UG8C.msg moved successfully.
C:\Windows\is-2UG8C.lst moved successfully.
========== FILES ==========
C:\Users\Megalomon\AppData\Roaming\Hive Cluster\49600\Megalomon_swarm\wins folder moved successfully.
C:\Users\Megalomon\AppData\Roaming\Hive Cluster\49600\Megalomon_swarm folder moved successfully.
C:\Users\Megalomon\AppData\Roaming\Hive Cluster\49600 folder moved successfully.
C:\Users\Megalomon\AppData\Roaming\Hive Cluster folder moved successfully.
C:\Users\Megalomon\Desktop\05junterr103theta.rar moved successfully.
C:\Users\Megalomon\Desktop\19maifaiiicrfidepm.rar moved successfully.
C:\Users\Megalomon\Desktop\19maiteiainup1unl.rar moved successfully.
C:\Users\Megalomon\Desktop\bwcedit.rar moved successfully.
C:\Users\Megalomon\Desktop\Desktop.rar moved successfully.
C:\Users\Megalomon\Desktop\UltraISO_Premium_Edition_v.9.3.6.2750.rar moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.23.0 log created on 06092011_223535

cosinus 09.06.2011 22:00
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

megalomon 09.06.2011 22:14
Liste der Anhänge anzeigen (Anzahl: 1)
Ich bin grad unsicher was ich machen soll:
Nach dem Scan (Ja, als Admin ausgeführt) kam folgende Meldung, soll ich "Continue" drücken doer was andres machen?
http://www.trojaner-board.de/attachm...1&d=1307654006

cosinus 10.06.2011 07:59
SPTD kannste lassen, ist ein legitimer Treiber für virtuelle CD/DVD Laufwerke.

megalomon 10.06.2011 14:26
Dann hier die tdss log:

Zitat:
2011/06/09 23:10:17.0782 6892 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48
2011/06/09 23:10:19.0045 6892 ================================================================================
2011/06/09 23:10:19.0045 6892 SystemInfo:
2011/06/09 23:10:19.0045 6892
2011/06/09 23:10:19.0045 6892 OS Version: 6.1.7601 ServicePack: 1.0
2011/06/09 23:10:19.0045 6892 Product type: Workstation
2011/06/09 23:10:19.0045 6892 ComputerName: SCHNOESI
2011/06/09 23:10:19.0045 6892 UserName: Megalomon
2011/06/09 23:10:19.0045 6892 Windows directory: C:\Windows
2011/06/09 23:10:19.0045 6892 System windows directory: C:\Windows
2011/06/09 23:10:19.0045 6892 Running under WOW64
2011/06/09 23:10:19.0045 6892 Processor architecture: Intel x64
2011/06/09 23:10:19.0045 6892 Number of processors: 2
2011/06/09 23:10:19.0045 6892 Page size: 0x1000
2011/06/09 23:10:19.0045 6892 Boot type: Normal boot
2011/06/09 23:10:19.0045 6892 ================================================================================
2011/06/09 23:10:23.0382 6892 Initialize success
2011/06/09 23:10:24.0708 6752 ================================================================================
2011/06/09 23:10:24.0708 6752 Scan started
2011/06/09 23:10:24.0708 6752 Mode: Manual;
2011/06/09 23:10:24.0708 6752 ================================================================================
2011/06/09 23:10:33.0179 6752 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
2011/06/09 23:10:33.0351 6752 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
2011/06/09 23:10:33.0429 6752 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
2011/06/09 23:10:33.0507 6752 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/06/09 23:10:33.0522 6752 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/06/09 23:10:33.0616 6752 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/06/09 23:10:33.0897 6752 AFD (d31dc7a16dea4a9baf179f3d6fbdb38c) C:\Windows\system32\drivers\afd.sys
2011/06/09 23:10:34.0209 6752 AgereSoftModem (98022774d9930ecbb292e70db7601df6) C:\Windows\system32\DRIVERS\agrsm64.sys
2011/06/09 23:10:34.0333 6752 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
2011/06/09 23:10:34.0427 6752 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
2011/06/09 23:10:34.0583 6752 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
2011/06/09 23:10:34.0708 6752 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/06/09 23:10:34.0755 6752 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/06/09 23:10:34.0833 6752 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
2011/06/09 23:10:34.0895 6752 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/06/09 23:10:34.0942 6752 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
2011/06/09 23:10:35.0051 6752 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
2011/06/09 23:10:35.0207 6752 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/06/09 23:10:35.0254 6752 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/06/09 23:10:35.0379 6752 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/09 23:10:35.0441 6752 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
2011/06/09 23:10:35.0519 6752 athr (e857eee6b92aaa473ebb3465add8f7e7) C:\Windows\system32\DRIVERS\athrx.sys
2011/06/09 23:10:35.0691 6752 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/06/09 23:10:35.0769 6752 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/06/09 23:10:35.0893 6752 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/06/09 23:10:36.0970 6752 BHDrvx64 (2175fbc1639e623872081b0f057409c8) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110519.002\BHDrvx64.sys
2011/06/09 23:10:37.0173 6752 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/06/09 23:10:37.0235 6752 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/09 23:10:37.0329 6752 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/06/09 23:10:37.0438 6752 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/06/09 23:10:37.0516 6752 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/06/09 23:10:37.0578 6752 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/06/09 23:10:37.0672 6752 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/06/09 23:10:37.0734 6752 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/06/09 23:10:37.0828 6752 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/06/09 23:10:37.0968 6752 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/09 23:10:38.0062 6752 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/09 23:10:38.0280 6752 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/06/09 23:10:38.0358 6752 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/06/09 23:10:38.0624 6752 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/09 23:10:38.0795 6752 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
2011/06/09 23:10:38.0936 6752 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
2011/06/09 23:10:38.0998 6752 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/09 23:10:39.0123 6752 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
2011/06/09 23:10:39.0201 6752 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/06/09 23:10:39.0622 6752 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
2011/06/09 23:10:39.0731 6752 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/06/09 23:10:39.0887 6752 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/06/09 23:10:40.0121 6752 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/06/09 23:10:40.0308 6752 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/09 23:10:40.0433 6752 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/06/09 23:10:40.0714 6752 eeCtrl (eb0883462ac43829e47929d705d40933) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
2011/06/09 23:10:41.0104 6752 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/06/09 23:10:41.0322 6752 EraserUtilRebootDrv (86fc0d272f6bb43e7214d4ba955a41e7) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/06/09 23:10:41.0385 6752 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
2011/06/09 23:10:41.0478 6752 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/06/09 23:10:41.0697 6752 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/06/09 23:10:41.0962 6752 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/09 23:10:42.0071 6752 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/06/09 23:10:42.0118 6752 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/06/09 23:10:42.0212 6752 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/09 23:10:42.0430 6752 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
2011/06/09 23:10:42.0492 6752 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/06/09 23:10:42.0680 6752 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/09 23:10:42.0726 6752 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/06/09 23:10:42.0804 6752 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/06/09 23:10:42.0898 6752 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/06/09 23:10:43.0132 6752 hamachi (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys
2011/06/09 23:10:43.0210 6752 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/06/09 23:10:43.0350 6752 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
2011/06/09 23:10:43.0475 6752 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
2011/06/09 23:10:43.0538 6752 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/06/09 23:10:43.0584 6752 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/06/09 23:10:43.0600 6752 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/06/09 23:10:43.0662 6752 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/09 23:10:43.0834 6752 HpqKbFiltr (9af482d058be59cc28bce52e7c4b747c) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
2011/06/09 23:10:43.0974 6752 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
2011/06/09 23:10:44.0037 6752 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
2011/06/09 23:10:44.0099 6752 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
2011/06/09 23:10:44.0162 6752 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
2011/06/09 23:10:44.0240 6752 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
2011/06/09 23:10:44.0583 6752 IDSVia64 (8f9faa4583e634a1505bad8d0c04c5c9) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110603.003\IDSvia64.sys
2011/06/09 23:10:44.0848 6752 igfx (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys
2011/06/09 23:10:45.0534 6752 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/06/09 23:10:45.0909 6752 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
2011/06/09 23:10:46.0002 6752 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/09 23:10:46.0626 6752 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/06/09 23:10:47.0094 6752 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
2011/06/09 23:10:47.0781 6752 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/06/09 23:10:47.0906 6752 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/06/09 23:10:47.0999 6752 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
2011/06/09 23:10:48.0093 6752 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
2011/06/09 23:10:48.0233 6752 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
2011/06/09 23:10:48.0342 6752 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
2011/06/09 23:10:48.0498 6752 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/09 23:10:48.0592 6752 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
2011/06/09 23:10:48.0670 6752 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/06/09 23:10:50.0105 6752 LHidFilt (24e09882ba51b9830ae029888a3aaf18) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2011/06/09 23:10:50.0214 6752 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/09 23:10:50.0370 6752 LMouFilt (2f94325d8c10e2b715f3d753c2422aac) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2011/06/09 23:10:50.0558 6752 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/06/09 23:10:50.0636 6752 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/06/09 23:10:50.0682 6752 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/06/09 23:10:50.0760 6752 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/06/09 23:10:50.0870 6752 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/06/09 23:10:50.0948 6752 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/06/09 23:10:51.0010 6752 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/06/09 23:10:51.0072 6752 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/06/09 23:10:51.0244 6752 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/09 23:10:51.0400 6752 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/09 23:10:51.0494 6752 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/09 23:10:51.0603 6752 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
2011/06/09 23:10:51.0743 6752 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
2011/06/09 23:10:51.0868 6752 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/09 23:10:52.0024 6752 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
2011/06/09 23:10:52.0289 6752 mrxsmb (c2b4651001a867ff3f8865863b592991) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/09 23:10:52.0554 6752 mrxsmb10 (7e79946afc5f799ab62982282be5ac13) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/09 23:10:52.0648 6752 mrxsmb20 (5fb954100cea2bfec6446fbbecaa3f79) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/09 23:10:52.0851 6752 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
2011/06/09 23:10:52.0976 6752 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
2011/06/09 23:10:53.0054 6752 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/06/09 23:10:53.0069 6752 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/06/09 23:10:53.0132 6752 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
2011/06/09 23:10:53.0319 6752 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/09 23:10:53.0381 6752 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/09 23:10:53.0490 6752 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/06/09 23:10:53.0615 6752 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
2011/06/09 23:10:53.0802 6752 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
2011/06/09 23:10:54.0021 6752 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/06/09 23:10:54.0177 6752 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/06/09 23:10:54.0255 6752 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/06/09 23:10:54.0520 6752 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/09 23:10:54.0832 6752 NAVENG (f594e1acbbb3ba48586b5dd69b3a6bc2) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110609.002\ENG64.SYS
2011/06/09 23:10:55.0019 6752 NAVEX15 (cfe00b55488acf0cd9f62b0401297864) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110609.002\EX64.SYS
2011/06/09 23:10:55.0222 6752 Nbdrv (0b5d0dd9fa104ef87801c8f58f068b3e) C:\Windows\system32\DRIVERS\nbdrv.sys
2011/06/09 23:10:55.0284 6752 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
2011/06/09 23:10:55.0534 6752 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/06/09 23:10:55.0690 6752 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/09 23:10:55.0877 6752 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/09 23:10:55.0986 6752 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/09 23:10:56.0080 6752 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
2011/06/09 23:10:56.0142 6752 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/09 23:10:56.0267 6752 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/09 23:10:56.0876 6752 NETw1v64 (e72f4522801ffb8f0456924fb0017bff) C:\Windows\system32\DRIVERS\NETw1v64.sys
2011/06/09 23:10:57.0453 6752 NETw5s64 (39ede676d17f37af4573c2b33ec28aca) C:\Windows\system32\DRIVERS\NETw5s64.sys
2011/06/09 23:10:57.0827 6752 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys
2011/06/09 23:10:58.0046 6752 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/06/09 23:10:58.0155 6752 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/06/09 23:10:58.0217 6752 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/09 23:10:58.0467 6752 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
2011/06/09 23:10:58.0498 6752 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/06/09 23:10:58.0638 6752 NVHDA (f2662fdc20518ee8a8eed4f61ba42349) C:\Windows\system32\drivers\nvhda64v.sys
2011/06/09 23:10:59.0075 6752 nvlddmkm (a963c2c276a97b088ded5d7a83be8052) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/06/09 23:10:59.0309 6752 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
2011/06/09 23:10:59.0372 6752 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
2011/06/09 23:10:59.0496 6752 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
2011/06/09 23:10:59.0606 6752 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
2011/06/09 23:10:59.0699 6752 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/06/09 23:10:59.0824 6752 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
2011/06/09 23:10:59.0980 6752 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
2011/06/09 23:11:00.0120 6752 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
2011/06/09 23:11:00.0276 6752 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/06/09 23:11:00.0339 6752 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/06/09 23:11:00.0417 6752 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/06/09 23:11:00.0635 6752 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/09 23:11:00.0698 6752 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/06/09 23:11:00.0869 6752 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/09 23:11:01.0010 6752 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/06/09 23:11:01.0041 6752 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/06/09 23:11:01.0119 6752 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/09 23:11:01.0212 6752 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/09 23:11:01.0431 6752 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/06/09 23:11:01.0524 6752 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/09 23:11:01.0634 6752 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/09 23:11:01.0696 6752 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/09 23:11:01.0883 6752 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/09 23:11:01.0977 6752 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/06/09 23:11:02.0039 6752 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/09 23:11:02.0117 6752 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/09 23:11:02.0211 6752 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/06/09 23:11:02.0554 6752 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
2011/06/09 23:11:02.0991 6752 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
2011/06/09 23:11:03.0287 6752 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/09 23:11:03.0506 6752 RTL8167 (abcb5a38a0d85bdf69b7877e1ad1eed5) C:\Windows\system32\DRIVERS\Rt64win7.sys
2011/06/09 23:11:03.0833 6752 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
2011/06/09 23:11:04.0083 6752 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
2011/06/09 23:11:04.0254 6752 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
2011/06/09 23:11:04.0863 6752 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/06/09 23:11:04.0988 6752 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/06/09 23:11:05.0284 6752 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/06/09 23:11:05.0424 6752 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/06/09 23:11:05.0580 6752 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
2011/06/09 23:11:05.0721 6752 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/09 23:11:05.0814 6752 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/09 23:11:05.0877 6752 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/06/09 23:11:06.0017 6752 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/06/09 23:11:06.0080 6752 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/06/09 23:11:06.0204 6752 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/06/09 23:11:06.0314 6752 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/06/09 23:11:06.0532 6752 sptd (4b3f898dc1378ced2f35d04e5b0ce0df) C:\Windows\System32\Drivers\sptd.sys
2011/06/09 23:11:06.0532 6752 Suspicious file (NoAccess): C:\Windows\System32\Drivers\sptd.sys. md5: 4b3f898dc1378ced2f35d04e5b0ce0df
2011/06/09 23:11:06.0548 6752 sptd - detected LockedFile.Multi.Generic (1)
2011/06/09 23:11:07.0047 6752 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\N360x64\0501000.01D\SRTSP64.SYS
2011/06/09 23:11:07.0250 6752 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\N360x64\0501000.01D\SRTSPX64.SYS
2011/06/09 23:11:07.0359 6752 srv (65bbf4920148c2ee279055da7228fc7b) C:\Windows\system32\DRIVERS\srv.sys
2011/06/09 23:11:07.0374 6752 srv2 (da939f762a1ccc2d77428621ddbd40a7) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/09 23:11:07.0437 6752 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
2011/06/09 23:11:07.0718 6752 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
2011/06/09 23:11:08.0014 6752 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
2011/06/09 23:11:08.0154 6752 srvnet (3f847c9dc87299516f7dc82fb6572865) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/09 23:11:08.0654 6752 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/06/09 23:11:08.0856 6752 STHDA (a3fb7ad8720d7e02aa0111a6b51c2744) C:\Windows\system32\DRIVERS\stwrt64.sys
2011/06/09 23:11:08.0981 6752 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
2011/06/09 23:11:09.0402 6752 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS
2011/06/09 23:11:09.0512 6752 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS
2011/06/09 23:11:09.0605 6752 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2011/06/09 23:11:09.0839 6752 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\N360x64\0501000.01D\Ironx64.SYS
2011/06/09 23:11:10.0042 6752 SymNetS (81d134628a98a22b6e054e971af525dc) C:\Windows\System32\Drivers\N360x64\0501000.01D\SYMNETS.SYS
2011/06/09 23:11:10.0260 6752 SynTP (3a706a967295e16511e40842b1a2761d) C:\Windows\system32\DRIVERS\SynTP.sys
2011/06/09 23:11:10.0370 6752 Tcpip (509383e505c973ed7534a06b3d19688d) C:\Windows\system32\drivers\tcpip.sys
2011/06/09 23:11:10.0744 6752 TCPIP6 (509383e505c973ed7534a06b3d19688d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/09 23:11:11.0181 6752 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/09 23:11:11.0430 6752 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/06/09 23:11:11.0446 6752 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/06/09 23:11:11.0976 6752 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/09 23:11:12.0320 6752 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
2011/06/09 23:11:12.0569 6752 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/09 23:11:12.0663 6752 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
2011/06/09 23:11:13.0100 6752 TuneUpUtilitiesDrv (dcc94c51d27c7ec0dadeca8f64c94fcf) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys
2011/06/09 23:11:13.0349 6752 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/09 23:11:13.0474 6752 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/06/09 23:11:13.0568 6752 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/09 23:11:13.0646 6752 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/09 23:11:13.0755 6752 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
2011/06/09 23:11:13.0817 6752 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/06/09 23:11:14.0004 6752 USBAAPL64 (54d4b48d443e7228bf64cf7cdc3118ac) C:\Windows\system32\Drivers\usbaapl64.sys
2011/06/09 23:11:14.0160 6752 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/09 23:11:14.0254 6752 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
2011/06/09 23:11:14.0379 6752 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/09 23:11:14.0691 6752 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/09 23:11:14.0769 6752 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
2011/06/09 23:11:14.0862 6752 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/09 23:11:14.0972 6752 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/09 23:11:15.0081 6752 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/09 23:11:15.0237 6752 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
2011/06/09 23:11:15.0362 6752 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
2011/06/09 23:11:15.0533 6752 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/09 23:11:15.0642 6752 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/06/09 23:11:15.0798 6752 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
2011/06/09 23:11:15.0892 6752 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
2011/06/09 23:11:15.0954 6752 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
2011/06/09 23:11:16.0048 6752 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
2011/06/09 23:11:16.0110 6752 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
2011/06/09 23:11:16.0251 6752 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/06/09 23:11:16.0329 6752 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
2011/06/09 23:11:16.0438 6752 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
2011/06/09 23:11:16.0656 6752 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
2011/06/09 23:11:16.0703 6752 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/06/09 23:11:16.0968 6752 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/09 23:11:16.0984 6752 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/09 23:11:17.0062 6752 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/06/09 23:11:17.0171 6752 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/09 23:11:17.0312 6752 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/06/09 23:11:17.0374 6752 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/06/09 23:11:17.0639 6752 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/06/09 23:11:17.0842 6752 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
2011/06/09 23:11:17.0951 6752 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/09 23:11:18.0060 6752 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
2011/06/09 23:11:18.0138 6752 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/09 23:11:18.0372 6752 xnacc (4a5ce13408945e525503b5f73d29b9c5) C:\Windows\system32\DRIVERS\xnacc.sys
2011/06/09 23:11:18.0872 6752 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
2011/06/09 23:11:18.0918 6752 MBR (0x1B8) (5dccb50e9a42af28be6406c43d72f60a) \Device\Harddisk0\DR0
2011/06/09 23:11:18.0934 6752 ================================================================================
2011/06/09 23:11:18.0934 6752 Scan finished
2011/06/09 23:11:18.0934 6752 ================================================================================
2011/06/09 23:11:18.0950 6648 Detected object count: 1
2011/06/09 23:11:18.0950 6648 Actual detected object count: 1
2011/06/10 15:24:41.0882 6648 LockedFile.Multi.Generic(sptd) - User select action: Skip

cosinus 10.06.2011 14:44
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

megalomon 11.06.2011 00:24
Ist es normal dasses bei Stufe 4 bereits seit ca. 30 min bleibt?

cosinus 11.06.2011 00:59
Nein. Steht er immer noch?

megalomon 11.06.2011 01:15
Innerlich bei Stufe 4. Der malerische unterstrich blinkt auchnoch, von daher ist combofix wohl nich komplett abgeschmiert.

cosinus 11.06.2011 01:17
Dann beende das mal. Starte Windows danach neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und probier es bitte nochmal.

megalomon 11.06.2011 02:15
Und hier Combofix log:

Combofix Logfile:
Code:
ComboFix 11-06-10.09 - Megalomon 11.06.2011  2:40.2.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4063.2487 [GMT 2:00]
ausgeführt von:: c:\users\Megalomon\Desktop\Cofi.exe
AV: Norton 360 Online *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 Online *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 Online *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Images
c:\users\Megalomon\Documents\mspaint.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-11 bis 2011-06-11  ))))))))))))))))))))))))))))))
.
.
2011-06-11 00:48 . 2011-06-11 00:48        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2011-06-11 00:48 . 2011-06-11 00:48        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-10 22:29 . 2011-06-10 22:29        --------        d-----w-        C:\Cofi
2011-06-10 16:19 . 2011-06-10 16:19        --------        d-----w-        c:\program files\Microsoft Visual Studio 8
2011-06-09 20:35 . 2011-06-09 20:35        --------        d-----w-        C:\_OTL
2011-06-09 10:46 . 2011-06-09 10:46        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Malwarebytes
2011-06-09 10:46 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-06-09 10:46 . 2011-06-09 10:46        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-09 10:46 . 2011-06-09 20:40        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2011-06-09 10:46 . 2011-05-29 07:11        25912        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-07 17:37 . 2011-06-07 17:37        --------        d-----w-        c:\program files (x86)\Microsoft XNA
2011-06-07 17:14 . 2011-06-07 22:35        --------        d-----w-        c:\program files (x86)\Terraria
2011-06-06 14:44 . 2011-06-06 14:44        --------        d-----w-        c:\program files (x86)\Common Files\EZB Systems
2011-06-06 12:00 . 2011-06-06 14:44        --------        d-----w-        c:\program files (x86)\UltraISO
2011-06-06 11:36 . 2011-06-06 11:36        --------        d-----w-        c:\program files (x86)\Smart Projects
2011-06-06 11:24 . 2011-06-11 00:26        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Bitcoin
2011-06-06 11:24 . 2011-06-06 11:24        --------        d-----w-        c:\program files (x86)\Bitcoin
2011-06-06 08:45 . 2011-05-20 11:49        34624        ----a-w-        c:\windows\system32\TURegOpt.exe
2011-06-06 08:45 . 2011-05-20 11:43        36160        ----a-w-        c:\windows\system32\uxtuneup.dll
2011-06-06 08:45 . 2011-05-20 11:43        25920        ----a-w-        c:\windows\system32\authuitu.dll
2011-06-06 08:45 . 2011-05-20 11:43        29504        ----a-w-        c:\windows\SysWow64\uxtuneup.dll
2011-06-06 08:45 . 2011-05-20 11:43        21312        ----a-w-        c:\windows\SysWow64\authuitu.dll
2011-06-06 08:44 . 2011-06-06 08:44        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\TuneUp Software
2011-06-06 08:44 . 2011-06-06 08:45        --------        d-----w-        c:\program files (x86)\TuneUp Utilities 2011
2011-06-06 08:43 . 2011-06-06 08:45        --------        d-----w-        c:\programdata\TuneUp Software
2011-06-06 08:43 . 2011-06-06 08:43        --------        d-sh--w-        c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-06-05 22:30 . 2011-06-10 22:33        --------        d-----w-        c:\programdata\SecTaskMan
2011-06-05 22:30 . 2011-06-05 22:30        --------        d-----w-        c:\program files (x86)\Security Task Manager
2011-06-05 12:24 . 2011-06-05 12:25        --------        d-----w-        c:\program files (x86)\TweakMe!
2011-06-04 13:14 . 2011-06-04 13:14        --------        d-sh--w-        c:\programdata\DSS
2011-06-04 13:12 . 2011-05-19 20:30        446976        ----a-w-        c:\program files (x86)\Microsoft Games\Fable III\paul.dll
2011-06-04 13:11 . 2011-06-04 13:11        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Lionhead Studios
2011-06-04 13:08 . 2011-05-17 19:42        79648        ----a-r-        c:\program files (x86)\Microsoft Games\Fable III\UPDATE\setup.exe
2011-06-03 15:24 . 2011-06-03 15:24        --------        d-----w-        c:\program files (x86)\Lionhead Studios Ltd
2011-06-03 15:11 . 2011-06-03 15:18        --------        d-----w-        c:\program files\CCleaner
2011-06-03 12:33 . 2011-06-03 12:33        --------        d-----w-        c:\program files (x86)\Visual Basic 6.0 Runtime&Steuerelemente
2011-06-03 12:32 . 2011-06-03 12:32        290816        ------w-        c:\windows\Setup1.exe
2011-06-03 12:32 . 2011-06-03 12:32        74752        ----a-w-        c:\windows\ST6UNST.EXE
2011-06-02 17:32 . 2011-06-02 17:32        53248        ----a-r-        c:\users\Megalomon\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-06-02 17:32 . 2011-06-02 17:32        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Leadertech
2011-06-02 17:32 . 2011-06-02 17:32        --------        d-----w-        c:\program files (x86)\Common Files\LogiShrd
2011-06-02 17:32 . 2011-06-02 17:32        18960        ----a-w-        c:\windows\system32\drivers\LNonPnP.sys
2011-06-02 17:31 . 2011-06-02 17:44        --------        d-----w-        c:\programdata\Logishrd
2011-06-02 17:31 . 2011-06-02 17:31        --------        d-----w-        c:\program files\Logitech
2011-06-02 17:31 . 2011-06-02 17:32        --------        d-----w-        c:\program files\Common Files\Logishrd
2011-06-02 17:21 . 2011-06-02 17:44        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Logitech
2011-06-02 17:21 . 2011-06-02 17:21        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Logishrd
2011-06-02 16:44 . 2011-06-02 16:49        --------        d-----w-        c:\users\Megalomon\ThingZ
2011-06-02 14:15 . 2011-06-02 14:15        --------        d-----w-        c:\program files (x86)\XMedia Recode
2011-06-01 23:52 . 2002-07-19 18:27        122350        ----a-w-        c:\windows\system32\xbadpcm.acm
2011-06-01 23:37 . 2011-06-01 23:37        --------        d-----w-        c:\program files (x86)\Software4u
2011-05-31 03:36 . 2011-05-31 03:36        --------        d-----w-        c:\program files (x86)\MAGIX
2011-05-31 03:36 . 2011-05-31 03:36        --------        d-----w-        c:\programdata\MAGIX
2011-05-31 03:36 . 2011-05-31 03:36        --------        d-----w-        c:\program files (x86)\Common Files\MAGIX Services
2011-05-30 13:15 . 2009-03-18 15:35        33856        ---ha-w-        c:\windows\system32\hamachi.sys
2011-05-30 13:15 . 2011-05-30 13:15        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi
2011-05-29 19:16 . 2011-05-31 03:37        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\MAGIX
2011-05-29 18:17 . 2001-04-12 16:00        182272        ----a-w-        c:\windows\patchw32.dll
2011-05-26 10:49 . 2009-07-14 01:41        99840        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\LXKPTPRC.DLL
2011-05-26 09:43 . 2011-04-22 22:15        27520        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-05-26 05:18 . 2011-05-26 05:18        466456        ----a-w-        c:\windows\system32\wrap_oal.dll
2011-05-26 05:18 . 2011-05-26 05:18        444952        ----a-w-        c:\windows\SysWow64\wrap_oal.dll
2011-05-26 05:18 . 2011-05-26 05:18        122904        ----a-w-        c:\windows\system32\OpenAL32.dll
2011-05-26 05:18 . 2011-05-26 05:18        109080        ----a-w-        c:\windows\SysWow64\OpenAL32.dll
2011-05-26 05:18 . 2011-05-26 05:18        --------        d-----w-        c:\program files (x86)\OpenAL
2011-05-26 05:16 . 2011-05-26 05:18        --------        d-----w-        c:\program files (x86)\Penumbra Overture
2011-05-25 15:22 . 2011-05-25 20:19        --------        d-----w-        c:\users\Megalomon\.revenge_of_the_titans_1.80
2011-05-25 15:22 . 2011-05-25 15:22        --------        d-----w-        c:\program files (x86)\Revenge Of The Titans HIB
2011-05-25 14:34 . 2009-10-27 17:31        3982240        ----a-w-        c:\windows\SysWow64\Flash10d.ocx
2011-05-25 14:34 . 2011-05-25 14:34        --------        d-----w-        c:\program files (x86)\StreamTransport
2011-05-25 10:22 . 2011-05-25 10:22        --------        d-----w-        c:\program files (x86)\Data Realms
2011-05-25 07:47 . 2011-05-25 07:47        --------        d-----w-        c:\users\Public\CyberLink
2011-05-25 07:47 . 2011-05-25 07:47        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\CyberLink
2011-05-25 06:34 . 2011-05-25 06:35        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\Teeworlds
2011-05-24 10:23 . 2011-05-24 10:23        --------        d-----w-        c:\program files (x86)\TeamViewer
2011-05-24 10:18 . 2011-05-24 10:18        --------        d-----w-        c:\users\Megalomon\AppData\Roaming\TeamViewer
2011-05-24 09:36 . 2011-05-24 10:52        --------        d-----w-        c:\users\Megalomon\AppData\Local\Temporary Projects
2011-05-23 13:56 . 2011-05-23 13:56        --------        d-----w-        c:\program files (x86)\EA
2011-05-23 13:54 . 2011-05-23 13:54        --------        d-----w-        c:\windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2011-05-22 16:40 . 2011-05-22 16:40        --------        d-----w-        C:\Sierra
2011-05-19 17:39 . 2011-05-19 17:39        --------        d-----w-        c:\programdata\NexonEU
2011-05-19 06:28 . 2011-06-10 13:31        --------        d-----w-        C:\Downloads
2011-05-18 14:05 . 2011-05-18 14:06        --------        d-----w-        c:\windows\msdownld.tmp
2011-05-18 14:05 . 2011-05-18 14:34        --------        d-----w-        c:\program files (x86)\N8
2011-05-16 12:59 . 2011-04-09 06:58        142336        ----a-w-        c:\windows\system32\poqexec.exe
2011-05-16 12:59 . 2011-04-09 05:56        123904        ----a-w-        c:\windows\SysWow64\poqexec.exe
2011-05-15 20:41 . 2011-05-15 20:41        --------        d-----w-        c:\programdata\CanonBJ
2011-05-15 20:41 . 2009-07-14 01:40        84992        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\CNBPP4.DLL
2011-05-15 02:18 . 2011-05-15 02:18        --------        d-----w-        c:\program files (x86)\Croteam
2011-05-13 06:09 . 2011-05-15 21:02        --------        d-----w-        c:\users\Megalomon\AppData\Local\ElevatedDiagnostics
2011-05-12 10:24 . 2011-04-09 07:02        5562240        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-05-12 10:24 . 2011-04-09 06:02        3967872        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2011-05-12 10:24 . 2011-04-09 06:02        3912576        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2011-05-12 10:24 . 2011-03-25 03:29        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys
2011-05-12 10:24 . 2011-03-25 03:29        98816        ----a-w-        c:\windows\system32\drivers\usbccgp.sys
2011-05-12 10:24 . 2011-03-25 03:29        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys
2011-05-12 10:24 . 2011-03-25 03:29        52736        ----a-w-        c:\windows\system32\drivers\usbehci.sys
2011-05-12 10:24 . 2011-03-25 03:29        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys
2011-05-12 10:24 . 2011-03-25 03:28        7936        ----a-w-        c:\windows\system32\drivers\usbd.sys
2011-05-12 08:49 . 2011-06-07 17:30        --------        d-----w-        c:\users\Megalomon\AppData\Local\CrashDumps
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-19 13:17 . 2011-05-01 07:24        235        ----a-w-        c:\windows\SysWow64\nxEuUninstall.bat
2011-05-19 13:17 . 2011-05-01 07:24        446464        ----a-w-        c:\windows\NEXON_EU_DownloaderUpdater.exe
2011-05-12 07:15 . 2011-04-30 09:45        174200        ----a-w-        c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-05-06 19:50 . 2009-08-18 10:49        564632        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-05-06 19:50 . 2009-08-18 09:24        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-30 10:00 . 2011-04-30 10:01        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2011-04-30 03:39 . 2011-04-30 03:39        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2011-04-30 03:39 . 2011-04-30 03:39        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2011-04-30 03:39 . 2011-04-30 03:39        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2011-04-30 03:39 . 2011-04-30 03:39        85504        ----a-w-        c:\windows\system32\iesetup.dll
2011-04-30 03:39 . 2011-04-30 03:39        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2011-04-30 03:39 . 2011-04-30 03:39        76800        ----a-w-        c:\windows\system32\tdc.ocx
2011-04-30 03:39 . 2011-04-30 03:39        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-04-30 03:39 . 2011-04-30 03:39        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll
2011-04-30 03:39 . 2011-04-30 03:39        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx
2011-04-30 03:39 . 2011-04-30 03:39        603648        ----a-w-        c:\windows\system32\vbscript.dll
2011-04-30 03:39 . 2011-04-30 03:39        49664        ----a-w-        c:\windows\system32\imgutil.dll
2011-04-30 03:39 . 2011-04-30 03:39        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2011-04-30 03:39 . 2011-04-30 03:39        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2011-04-30 03:39 . 2011-04-30 03:39        448512        ----a-w-        c:\windows\system32\html.iec
2011-04-30 03:39 . 2011-04-30 03:39        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2011-04-30 03:39 . 2011-04-30 03:39        367104        ----a-w-        c:\windows\SysWow64\html.iec
2011-04-30 03:39 . 2011-04-30 03:39        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll
2011-04-30 03:39 . 2011-04-30 03:39        30720        ----a-w-        c:\windows\system32\licmgr10.dll
2011-04-30 03:39 . 2011-04-30 03:39        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2011-04-30 03:39 . 2011-04-30 03:39        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-04-30 03:39 . 2011-04-30 03:39        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2011-04-30 03:39 . 2011-04-30 03:39        2303488        ----a-w-        c:\windows\system32\jscript9.dll
2011-04-30 03:39 . 2011-04-30 03:39        222208        ----a-w-        c:\windows\system32\msls31.dll
2011-04-30 03:39 . 2011-04-30 03:39        1797632        ----a-w-        c:\windows\SysWow64\jscript9.dll
2011-04-30 03:39 . 2011-04-30 03:39        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2011-04-30 03:39 . 2011-04-30 03:39        165888        ----a-w-        c:\windows\system32\iexpress.exe
2011-04-30 03:39 . 2011-04-30 03:39        161792        ----a-w-        c:\windows\SysWow64\msls31.dll
2011-04-30 03:39 . 2011-04-30 03:39        160256        ----a-w-        c:\windows\system32\wextract.exe
2011-04-30 03:39 . 2011-04-30 03:39        152064        ----a-w-        c:\windows\SysWow64\wextract.exe
2011-04-30 03:39 . 2011-04-30 03:39        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2011-04-30 03:39 . 2011-04-30 03:39        1492992        ----a-w-        c:\windows\system32\inetcpl.cpl
2011-04-30 03:39 . 2011-04-30 03:39        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2011-04-30 03:39 . 2011-04-30 03:39        1427456        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2011-04-30 03:39 . 2011-04-30 03:39        1389056        ----a-w-        c:\windows\system32\wininet.dll
2011-04-30 03:39 . 2011-04-30 03:39        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll
2011-04-30 03:39 . 2011-04-30 03:39        12288        ----a-w-        c:\windows\system32\mshta.exe
2011-04-30 03:39 . 2011-04-30 03:39        11776        ----a-w-        c:\windows\SysWow64\mshta.exe
2011-04-30 03:39 . 2011-04-30 03:39        114176        ----a-w-        c:\windows\system32\admparse.dll
2011-04-30 03:39 . 2011-04-30 03:39        1126912        ----a-w-        c:\windows\SysWow64\wininet.dll
2011-04-30 03:39 . 2011-04-30 03:39        111616        ----a-w-        c:\windows\system32\iesysprep.dll
2011-04-30 03:39 . 2011-04-30 03:39        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2011-04-30 03:39 . 2011-04-30 03:39        101888        ----a-w-        c:\windows\SysWow64\admparse.dll
2011-04-30 03:07 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2011-04-30 03:07 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2011-04-30 01:37 . 2009-11-07 20:54        588472        ----a-w-        c:\windows\SysWow64\ezsvc7x.dll
2011-04-18 07:15 . 2011-04-30 02:00        8802128        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B0804166-B8DE-46CB-A80C-C36F9FC4C858}\mpengine.dll
2011-04-09 16:55 . 2011-04-09 16:55        15453336        ----a-w-        c:\windows\SysWow64\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55        13642904        ----a-w-        c:\windows\SysWow64\xlivefnt.dll
2011-04-08 05:14 . 2011-04-30 09:31        8411752        ----a-w-        c:\windows\system32\nvwgf2umx.dll
2011-04-08 05:14 . 2011-04-30 09:31        6974056        ----a-w-        c:\windows\system32\nvcuda.dll
2011-04-08 05:14 . 2011-04-30 09:31        67176        ----a-w-        c:\windows\system32\OpenCL.dll
2011-04-08 05:14 . 2011-04-30 09:31        6299752        ----a-w-        c:\windows\SysWow64\nvwgf2um.dll
2011-04-08 05:14 . 2011-04-30 09:31        57960        ----a-w-        c:\windows\SysWow64\OpenCL.dll
2011-04-08 05:14 . 2011-04-30 09:31        5183080        ----a-w-        c:\windows\SysWow64\nvcuda.dll
2011-04-08 05:14 . 2011-04-30 09:31        2893416        ----a-w-        c:\windows\system32\nvcuvid.dll
2011-04-08 05:14 . 2011-04-30 09:31        2765928        ----a-w-        c:\windows\SysWow64\nvcuvid.dll
2011-04-08 05:14 . 2011-04-30 09:31        2273896        ----a-w-        c:\windows\system32\nvapi64.dll
2011-04-08 05:14 . 2011-04-30 09:31        2204264        ----a-w-        c:\windows\system32\nvcuvenc.dll
2011-04-08 05:14 . 2011-04-30 09:31        2074216        ----a-w-        c:\windows\SysWow64\nvcuvenc.dll
2011-04-08 05:14 . 2011-04-30 09:31        20700264        ----a-w-        c:\windows\system32\nvoglv64.dll
2011-04-08 05:14 . 2011-04-30 09:31        2034280        ----a-w-        c:\windows\SysWow64\nvapi.dll
2011-04-08 05:14 . 2011-04-30 09:31        18578536        ----a-w-        c:\windows\system32\nvcompiler.dll
2011-04-08 05:14 . 2011-04-30 09:31        1619048        ----a-w-        c:\windows\system32\nvdispco6420140.dll
2011-04-08 05:14 . 2011-04-30 09:31        15227496        ----a-w-        c:\windows\SysWow64\nvoglv32.dll
2011-04-08 05:14 . 2011-04-30 09:31        1404008        ----a-w-        c:\windows\system32\nvgenco642060.dll
2011-04-08 05:14 . 2011-04-30 09:31        13262184        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys
2011-04-08 05:14 . 2011-04-30 09:31        13007464        ----a-w-        c:\windows\SysWow64\nvcompiler.dll
2011-04-08 05:14 . 2011-04-30 09:31        12934248        ----a-w-        c:\windows\system32\nvd3dumx.dll
2011-04-08 05:14 . 2011-04-30 09:31        10071656        ----a-w-        c:\windows\SysWow64\nvd3dum.dll
2011-04-07 21:19 . 2011-04-07 21:19        61032        ----a-w-        c:\windows\system32\nvshext.dll
2011-04-07 21:19 . 2011-04-07 21:19        318056        ----a-w-        c:\windows\system32\nvhotkey.dll
2011-04-07 21:19 . 2011-04-07 21:19        2582120        ----a-w-        c:\windows\system32\nvsvcr.dll
2011-04-07 21:19 . 2011-04-07 21:19        117864        ----a-w-        c:\windows\system32\nvmctray.dll
2011-04-07 21:19 . 2011-04-07 21:19        1012328        ----a-w-        c:\windows\system32\nvvsvc.exe
2011-04-07 21:19 . 2011-04-07 21:19        797288        ----a-w-        c:\windows\system32\easyUpdatusAPIU64.dll
2011-04-07 21:19 . 2011-04-07 21:19        6338152        ----a-w-        c:\windows\system32\nvcpl.dll
2011-04-07 21:18 . 2011-04-07 21:18        3041384        ----a-w-        c:\windows\system32\nvsvc64.dll
2011-04-06 14:26 . 2011-04-06 14:26        96544        ----a-w-        c:\windows\system32\dnssd.dll
2011-04-06 14:26 . 2011-04-06 14:26        69408        ----a-w-        c:\windows\system32\jdns_sd.dll
2011-04-06 14:26 . 2011-04-06 14:26        237856        ----a-w-        c:\windows\system32\dnssdX.dll
2011-04-06 14:26 . 2011-04-06 14:26        119584        ----a-w-        c:\windows\system32\dns-sd.exe
2011-04-06 14:20 . 2011-04-06 14:20        91424        ----a-w-        c:\windows\SysWow64\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20        75040        ----a-w-        c:\windows\SysWow64\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20        197920        ----a-w-        c:\windows\SysWow64\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20        107808        ----a-w-        c:\windows\SysWow64\dns-sd.exe
2011-03-31 03:00 . 2011-05-10 06:36        744568        ----a-w-        c:\windows\system32\drivers\N360x64\0501000.01D\srtsp64.sys
2011-03-31 03:00 . 2011-05-10 06:36        40568        ----a-w-        c:\windows\system32\drivers\N360x64\0501000.01D\srtspx64.sys
2011-03-22 00:39 . 2011-05-10 06:36        382584        ----a-w-        c:\windows\system32\drivers\N360x64\0501000.01D\symnets.sys
2011-03-15 02:31 . 2011-05-10 06:36        912504        ----a-w-        c:\windows\system32\drivers\N360x64\0501000.01D\symefa64.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2011-03-28 843072]
"iTeleportConnect"="c:\program files (x86)\iTeleport\iTeleport Connect\iTeleportConnect.exe" [2011-04-11 1989120]
"ShowBatteryBar"="c:\program files\BatteryBar\ShowBatteryBar.exe" [2009-05-28 89600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"iTeleportService"="c:\program files (x86)\iTeleport\iTeleport Connect\iTeleportService.exe" [2011-04-11 20480]
.
c:\users\Megalomon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BatteryBar.lnk - c:\program files\BatteryBar\BatteryBar.exe [N/A]
Bitcoin.lnk - c:\program files (x86)\Bitcoin\bitcoin.exe [2011-4-27 7490048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"LogMeIn Hamachi Ui"=-"c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
R3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater;c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 51456888]
R3 NETw1v64;Intel(R) Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw1v64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110519.002\BHDrvx64.sys [2011-05-19 1143416]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110604.001\IDSvia64.sys [2011-06-03 488056]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0501000.01D\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0501000.01D\SYMNETS.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2010-10-18 20549]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 2275720]
S2 iTeleportService;iTeleportService;c:\program files (x86)\iTeleport\iTeleport Connect\iTeleportService.exe [2011-04-11 20480]
S2 N360;Norton 360;c:\program files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 NetBalancer Windows Service;NetBalancer Windows Service;c:\program files\NetBalancer\SeriousBit.NetBalancer.Service.exe [2010-11-22 10240]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-05-20 2026304]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-05-10 136824]
S3 Nbdrv;NetBalancer Service;c:\windows\system32\DRIVERS\nbdrv.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-04-26 11856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 11:24        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-09 c:\windows\Tasks\HPCeeScheduleForMegalomon.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 03:22]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-05-13 487424]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Megalomon\AppData\Roaming\Mozilla\Firefox\Profiles\vem6yn1k.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-QlbCtrl.exe - -c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\5.1.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\xampp\mysql\bin\mysqld.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\TeamViewer\Version6\TeamViewer.exe
c:\program files\NORTON 360\ENGINE\5.1.0.29\cltLMH.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-06-11  03:06:25 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-06-11 01:06
.
Vor Suchlauf: 27 Verzeichnis(se), 108.097.830.912 Bytes frei
Nach Suchlauf: 33 Verzeichnis(se), 107.947.724.800 Bytes frei
.
- - End Of File - - 009DB80BEF683B6FF28E1A447236829A
--- --- ---
Ich bin grad etwas verwirrt, wieso wurde mspaint und der images ordner gelöscht?

cosinus 11.06.2011 16:45
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

megalomon 11.06.2011 18:47
Scan lief ohne Probleme.
Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Compaq Presario CQ71 Notebook PC
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 212):
0x02C15000 \SystemRoot\system32\ntoskrnl.exe
0x031FE000 \SystemRoot\system32\hal.dll
0x00BB2000 \SystemRoot\system32\kdcom.dll
0x00C34000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00C83000 \SystemRoot\system32\PSHED.dll
0x00C97000 \SystemRoot\system32\CLFS.SYS
0x00CF5000 \SystemRoot\system32\CI.dll
0x00E01000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00EA5000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x01018000 \SystemRoot\System32\Drivers\sptd.sys
0x0117A000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x01183000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x00EB4000 \SystemRoot\system32\drivers\ACPI.sys
0x011B2000 \SystemRoot\system32\drivers\msisadrv.sys
0x011BC000 \SystemRoot\system32\drivers\vdrvroot.sys
0x011C9000 \SystemRoot\system32\drivers\pci.sys
0x01000000 \SystemRoot\system32\drivers\isapnp.sys
0x00F0B000 \SystemRoot\system32\drivers\mpio.sys
0x00F35000 \SystemRoot\System32\drivers\partmgr.sys
0x01009000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00F4A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00F56000 \SystemRoot\system32\drivers\volmgr.sys
0x00F6B000 \SystemRoot\System32\drivers\volmgrx.sys
0x00FC7000 \SystemRoot\system32\drivers\intelide.sys
0x00FCF000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x00FDF000 \SystemRoot\system32\drivers\aliide.sys
0x00FE6000 \SystemRoot\system32\drivers\amdide.sys
0x00FED000 \SystemRoot\system32\drivers\cmdide.sys
0x00DB5000 \SystemRoot\System32\drivers\mountmgr.sys
0x00DCF000 \SystemRoot\system32\drivers\msdsm.sys
0x00C00000 \SystemRoot\system32\drivers\nvraid.sys
0x012BF000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x012EF000 \SystemRoot\system32\drivers\pciide.sys
0x012F6000 \SystemRoot\system32\drivers\viaide.sys
0x01434000 \SystemRoot\system32\drivers\iaStorV.sys
0x01552000 \SystemRoot\system32\drivers\atapi.sys
0x0155B000 \SystemRoot\system32\drivers\ataport.SYS
0x01585000 \SystemRoot\system32\DRIVERS\lsi_sas.sys
0x012FE000 \SystemRoot\system32\DRIVERS\storport.sys
0x015A2000 \SystemRoot\system32\drivers\msahci.sys
0x015AD000 \SystemRoot\system32\drivers\HpSAMD.sys
0x01361000 \SystemRoot\system32\DRIVERS\adp94xx.sys
0x01200000 \SystemRoot\system32\DRIVERS\adpahci.sys
0x015C4000 \SystemRoot\system32\DRIVERS\adpu320.sys
0x01400000 \SystemRoot\system32\drivers\amdsata.sys
0x01256000 \SystemRoot\system32\DRIVERS\amdsbs.sys
0x0141E000 \SystemRoot\system32\drivers\amdxata.sys
0x0129D000 \SystemRoot\system32\DRIVERS\arc.sys
0x013DC000 \SystemRoot\system32\DRIVERS\arcsas.sys
0x01634000 \SystemRoot\system32\DRIVERS\elxstor.sys
0x016BB000 \SystemRoot\system32\DRIVERS\iirsp.sys
0x016CC000 \SystemRoot\system32\DRIVERS\lsi_fc.sys
0x016EB000 \SystemRoot\system32\DRIVERS\lsi_sas2.sys
0x016FE000 \SystemRoot\system32\DRIVERS\lsi_scsi.sys
0x0171D000 \SystemRoot\system32\DRIVERS\megasas.sys
0x01729000 \SystemRoot\system32\DRIVERS\MegaSR.sys
0x017CD000 \SystemRoot\system32\DRIVERS\nfrd960.sys
0x01600000 \SystemRoot\system32\drivers\nvstor.sys
0x0180C000 \SystemRoot\system32\DRIVERS\ql2300.sys
0x01ABA000 \SystemRoot\system32\DRIVERS\ql40xx.sys
0x01B19000 \SystemRoot\system32\DRIVERS\SiSRaid2.sys
0x01B27000 \SystemRoot\system32\DRIVERS\sisraid4.sys
0x01B3F000 \SystemRoot\system32\DRIVERS\stexstor.sys
0x01B49000 \SystemRoot\system32\DRIVERS\vsmraid.sys
0x01B73000 \SystemRoot\system32\drivers\fltmgr.sys
0x01A00000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS
0x01A71000 \SystemRoot\system32\drivers\fileinfo.sys
0x01C6D000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS
0x01E1A000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01D51000 \SystemRoot\System32\Drivers\msrpc.sys
0x01FBD000 \SystemRoot\System32\Drivers\ksecdd.sys
0x02085000 \SystemRoot\System32\Drivers\cng.sys
0x020F7000 \SystemRoot\System32\drivers\pcw.sys
0x02108000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x022A5000 \SystemRoot\system32\drivers\ndis.sys
0x02398000 \SystemRoot\system32\drivers\NETIO.SYS
0x02200000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x02470000 \SystemRoot\System32\drivers\tcpip.sys
0x02674000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x026BE000 \SystemRoot\system32\DRIVERS\wd.sys
0x026C6000 \SystemRoot\system32\drivers\volsnap.sys
0x02712000 \SystemRoot\System32\Drivers\spldr.sys
0x0271A000 \SystemRoot\system32\drivers\sbp2port.sys
0x02737000 \SystemRoot\System32\drivers\rdyboost.sys
0x02771000 \SystemRoot\System32\Drivers\mup.sys
0x02783000 \SystemRoot\System32\drivers\hwpolicy.sys
0x0278C000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x027C6000 \SystemRoot\system32\DRIVERS\disk.sys
0x0241E000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x02448000 \SystemRoot\System32\Drivers\Null.SYS
0x02451000 \SystemRoot\System32\Drivers\Beep.SYS
0x02458000 \SystemRoot\System32\drivers\vga.sys
0x0222B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x02250000 \SystemRoot\System32\drivers\watchdog.sys
0x02466000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x027F6000 \SystemRoot\system32\drivers\rdpencdd.sys
0x02260000 \SystemRoot\system32\drivers\rdprefmp.sys
0x02269000 \SystemRoot\System32\Drivers\Msfs.SYS
0x02274000 \SystemRoot\System32\Drivers\Npfs.SYS
0x02112000 \SystemRoot\system32\DRIVERS\tdx.sys
0x02285000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x02134000 \SystemRoot\system32\drivers\afd.sys
0x02000000 \SystemRoot\System32\DRIVERS\netbt.sys
0x02292000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x02045000 \SystemRoot\system32\DRIVERS\pacer.sys
0x0206B000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x021BD000 \SystemRoot\system32\DRIVERS\netbios.sys
0x021CC000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x021E7000 \SystemRoot\system32\drivers\termdd.sys
0x01C00000 \SystemRoot\System32\Drivers\N360x64\0501000.01D\SYMNETS.SYS
0x01DAF000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x01A85000 \SystemRoot\system32\drivers\N360x64\0501000.01D\Ironx64.SYS
0x01FD8000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SRTSPX64.SYS
0x03A3A000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x03A8B000 \SystemRoot\system32\drivers\nsiproxy.sys
0x03A97000 \SystemRoot\system32\drivers\mssmbios.sys
0x03AA2000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110604.001\IDSvia64.sys
0x03B1F000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x03B98000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0x03BBE000 \SystemRoot\System32\drivers\discache.sys
0x03BCD000 \SystemRoot\System32\Drivers\dfsc.sys
0x03BEB000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x04C35000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110519.002\BHDrvx64.sys
0x04D51000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x04D77000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x04D8D000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x0FE24000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x10AC9000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x10ACB000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04D92000 \SystemRoot\System32\drivers\dxgmms1.sys
0x10BBF000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x04A20000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x04A76000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04A87000 \SystemRoot\system32\drivers\HDAudBus.sys
0x05635000 \SystemRoot\system32\DRIVERS\NETw5s64.sys
0x05D94000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x05DA1000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x05DD3000 \SystemRoot\system32\drivers\i8042prt.sys
0x05DF1000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x05600000 \SystemRoot\system32\drivers\kbdclass.sys
0x04AAB000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x0560F000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x05611000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x05620000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x04AFE000 \SystemRoot\System32\Drivers\agv7qvgm.SYS
0x04B46000 \SystemRoot\system32\drivers\wmiacpi.sys
0x04B4F000 \SystemRoot\system32\drivers\CompositeBus.sys
0x04B5F000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04B75000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04B99000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04BA5000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04BD4000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x10BCC000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04A00000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04BEF000 \SystemRoot\system32\DRIVERS\hamachi.sys
0x10BED000 \SystemRoot\system32\DRIVERS\nbdrv.sys
0x0562D000 \SystemRoot\system32\drivers\swenum.sys
0x019B0000 \SystemRoot\system32\drivers\ks.sys
0x0FE00000 \SystemRoot\system32\drivers\umbus.sys
0x0505C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x050B6000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x050CB000 \SystemRoot\system32\DRIVERS\stwrt64.sys
0x0514A000 \SystemRoot\system32\DRIVERS\portcls.sys
0x05187000 \SystemRoot\system32\DRIVERS\drmk.sys
0x051A9000 \SystemRoot\system32\drivers\ksthunk.sys
0x051AF000 \SystemRoot\system32\drivers\nvhda64v.sys
0x051DC000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x05000000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x0500E000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x05027000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x05030000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x05045000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x04DD8000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x04C00000 \SystemRoot\System32\Drivers\usbvideo.sys
0x0FE12000 \SystemRoot\System32\Drivers\crashdmp.sys
0x04DEC000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x03A00000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x03A0B000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00080000 \SystemRoot\System32\win32k.sys
0x03A1E000 \SystemRoot\System32\drivers\Dxapi.sys
0x03A2A000 \SystemRoot\system32\DRIVERS\monitor.sys
0x005C0000 \SystemRoot\System32\TSDDD.dll
0x006D0000 \SystemRoot\System32\cdd.dll
0x00840000 \SystemRoot\System32\ATMFD.DLL
0x01BBF000 \SystemRoot\system32\drivers\luafv.sys
0x017DD000 \SystemRoot\system32\drivers\WudfPf.sys
0x02400000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x07C8A000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x07CDD000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x07CF0000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x07D08000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x07D12000 \SystemRoot\system32\drivers\HTTP.sys
0x07DDB000 \SystemRoot\system32\DRIVERS\bowser.sys
0x07C00000 \SystemRoot\System32\drivers\mpsdrv.sys
0x07C18000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x0807A000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x080C7000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x080EB000 \SystemRoot\system32\drivers\peauth.sys
0x08191000 \SystemRoot\System32\Drivers\secdrv.SYS
0x0819C000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x081CD000 \SystemRoot\System32\drivers\tcpipreg.sys
0x08000000 \SystemRoot\System32\DRIVERS\srv2.sys
0x09846000 \SystemRoot\System32\DRIVERS\srv.sys
0x098DE000 \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys
0x09957000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x0D0E3000 \SystemRoot\System32\Drivers\N360x64\0501000.01D\SRTSP64.SYS
0x0D40E000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110610.033\EX64.SYS
0x0D020000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110610.033\ENG64.SYS
0x77100000 \Windows\System32\ntdll.dll
0x47610000 \Windows\System32\smss.exe
0xFF420000 \Windows\System32\apisetschema.dll
0xFFE60000 \Windows\System32\autochk.exe

Processes (total 96):
0 System Idle Process
4 System
296 C:\Windows\System32\smss.exe
396 csrss.exe
456 C:\Windows\System32\wininit.exe
472 csrss.exe
516 C:\Windows\System32\services.exe
524 C:\Windows\System32\lsass.exe
536 C:\Windows\System32\lsm.exe
568 C:\Windows\System32\winlogon.exe
680 C:\Windows\System32\svchost.exe
744 C:\Windows\System32\nvvsvc.exe
784 C:\Windows\System32\svchost.exe
876 C:\Windows\System32\svchost.exe
920 C:\Windows\System32\svchost.exe
948 C:\Windows\System32\svchost.exe
1008 C:\Program Files\IDT\WDM\stacsv64.exe
768 C:\Windows\System32\svchost.exe
1132 C:\Windows\System32\svchost.exe
1360 C:\Windows\System32\spoolsv.exe
1408 C:\Windows\System32\svchost.exe
1468 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1480 C:\Windows\System32\nvvsvc.exe
1592 C:\Program Files\IDT\WDM\AESTSr64.exe
1616 C:\xampp\apache\bin\httpd.exe
1700 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1768 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1832 C:\Windows\SysWOW64\svchost.exe
1856 C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
1888 C:\Windows\System32\svchost.exe
1916 C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
1972 C:\Program Files (x86)\iTeleport\iTeleport Connect\iTeleportService.exe
1092 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
1216 C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
1492 C:\xampp\mysql\bin\mysqld.exe
1708 C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe
1544 C:\xampp\apache\bin\httpd.exe
1744 C:\Program Files\NetBalancer\SeriousBit.NetBalancer.Service.exe
2760 C:\Windows\System32\taskhost.exe
3204 C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe
3552 C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
3584 C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
3612 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
3716 C:\Windows\System32\dwm.exe
3732 C:\Windows\System32\svchost.exe
3780 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
3820 C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
3912 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
4028 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
4368 C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe
4504 C:\Windows\System32\SearchIndexer.exe
4588 C:\Windows\System32\rundll32.exe
4756 C:\Windows\System32\svchost.exe
4944 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
5004 C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
5024 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
5096 C:\Program Files\IDT\WDM\sttray64.exe
5104 C:\Program Files\Logitech\SetPointP\SetPoint.exe
4788 C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
4300 C:\Program Files (x86)\iTeleport\iTeleport Connect\iTeleportConnect.exe
5124 C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
5140 C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
5352 C:\Program Files\iTunes\iTunesHelper.exe
5388 C:\PROGRA~2\Bitcoin\bitcoin.exe
5492 C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
5536 WmiPrvSE.exe
5756 C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
5816 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
6008 C:\Program Files\Windows Media Player\wmpnetwk.exe
4452 C:\Windows\System32\svchost.exe
5416 C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
5752 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
6000 C:\Program Files\iPod\bin\iPodService.exe
6556 dllhost.exe
6636 C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
1328 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
3888 C:\Windows\explorer.exe
304 C:\Program Files (x86)\Skype\Phone\Skype.exe
5484 C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
7008 C:\Program Files (x86)\Java\jre6\bin\javaw.exe
3724 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
4856 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
7152 C:\Windows\System32\audiodg.exe
4156 C:\Windows\explorer.exe
1676 C:\Windows\System32\wuauclt.exe
3984 C:\Program Files\iTunes\iTunes.exe
332 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
5172 C:\Windows\System32\conhost.exe
1668 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
872 C:\Windows\System32\conhost.exe
6072 WmiPrvSE.exe
4876 C:\Windows\System32\SearchProtocolHost.exe
5324 C:\Windows\System32\SearchFilterHost.exe
3040 C:\Users\Megalomon\Desktop\MBRCheck.exe
3692 C:\Windows\System32\conhost.exe
4260 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c800000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000047`55000000 (NTFS)

PhysicalDrive0 Model Number: WDCWD3200BEVT-60ZCT1, Rev: 13.01A13

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 33E8A4DBD7DAAA8B1CAFF75E7D4B8B3F02B4A20E


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

cosinus 11.06.2011 19:25
Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Win7 (64-Bit) installiert?
Wenn nicht: Schau mal hier => RescueDisc-Win7-64-Bit

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Win7-Installations-DVD (64-Bit) hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der dieser DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

megalomon 11.06.2011 20:24
Ich hätte sone DVD-Sammlung von HP zu der ich aufgefordert wurde diese zu brennen nachdem ich das Laptop das erste mal in betrieb genommen habe. Es sind 4 DVD's. Sind wohl dafür da, falls die recovery-partition nen schaden hat.
Könnte einen von denen auch gehen?

cosinus 11.06.2011 20:52
Nein, nimm lieber die ISO und brenn es.

megalomon 11.06.2011 23:30
Beides Problemlos verlaufen:

MBRCheck:
Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Compaq Presario CQ71 Notebook PC
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 249):
0x02C13000 \SystemRoot\system32\ntoskrnl.exe
0x031FC000 \SystemRoot\system32\hal.dll
0x00B9F000 \SystemRoot\system32\kdcom.dll
0x00C78000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CC7000 \SystemRoot\system32\PSHED.dll
0x00CDB000 \SystemRoot\system32\CLFS.SYS
0x00D39000 \SystemRoot\system32\CI.dll
0x00E66000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F0A000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x0108D000 \SystemRoot\System32\Drivers\sptd.sys
0x011EF000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x01000000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x0102F000 \SystemRoot\system32\drivers\ACPI.sys
0x00F19000 \SystemRoot\system32\drivers\msisadrv.sys
0x00F23000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00F30000 \SystemRoot\system32\drivers\pci.sys
0x00F63000 \SystemRoot\system32\drivers\isapnp.sys
0x00F6C000 \SystemRoot\system32\drivers\mpio.sys
0x00F96000 \SystemRoot\System32\drivers\partmgr.sys
0x00FAB000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00FB4000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00FC0000 \SystemRoot\system32\drivers\volmgr.sys
0x00E00000 \SystemRoot\System32\drivers\volmgrx.sys
0x011F8000 \SystemRoot\system32\drivers\intelide.sys
0x00FD5000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x01086000 \SystemRoot\system32\drivers\aliide.sys
0x00FE5000 \SystemRoot\system32\drivers\amdide.sys
0x00FEC000 \SystemRoot\system32\drivers\cmdide.sys
0x00C00000 \SystemRoot\System32\drivers\mountmgr.sys
0x00C1A000 \SystemRoot\system32\drivers\msdsm.sys
0x00C40000 \SystemRoot\system32\drivers\nvraid.sys
0x012B0000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x012E0000 \SystemRoot\system32\drivers\pciide.sys
0x012E7000 \SystemRoot\system32\drivers\viaide.sys
0x014C7000 \SystemRoot\system32\drivers\iaStorV.sys
0x015E5000 \SystemRoot\system32\drivers\atapi.sys
0x01400000 \SystemRoot\system32\drivers\ataport.SYS
0x0142A000 \SystemRoot\system32\DRIVERS\lsi_sas.sys
0x01447000 \SystemRoot\system32\DRIVERS\storport.sys
0x014AA000 \SystemRoot\system32\drivers\msahci.sys
0x012EF000 \SystemRoot\system32\drivers\HpSAMD.sys
0x01306000 \SystemRoot\system32\DRIVERS\adp94xx.sys
0x01381000 \SystemRoot\system32\DRIVERS\adpahci.sys
0x01200000 \SystemRoot\system32\DRIVERS\adpu320.sys
0x0122F000 \SystemRoot\system32\drivers\amdsata.sys
0x0124D000 \SystemRoot\system32\DRIVERS\amdsbs.sys
0x014B5000 \SystemRoot\system32\drivers\amdxata.sys
0x01294000 \SystemRoot\system32\DRIVERS\arc.sys
0x013D7000 \SystemRoot\system32\DRIVERS\arcsas.sys
0x0165D000 \SystemRoot\system32\DRIVERS\elxstor.sys
0x016E4000 \SystemRoot\system32\DRIVERS\iirsp.sys
0x016F5000 \SystemRoot\system32\DRIVERS\lsi_fc.sys
0x01714000 \SystemRoot\system32\DRIVERS\lsi_sas2.sys
0x01727000 \SystemRoot\system32\DRIVERS\lsi_scsi.sys
0x01746000 \SystemRoot\system32\DRIVERS\megasas.sys
0x01752000 \SystemRoot\system32\DRIVERS\MegaSR.sys
0x01600000 \SystemRoot\system32\DRIVERS\nfrd960.sys
0x01610000 \SystemRoot\system32\drivers\nvstor.sys
0x0184D000 \SystemRoot\system32\DRIVERS\ql2300.sys
0x01A73000 \SystemRoot\system32\DRIVERS\ql40xx.sys
0x01AD2000 \SystemRoot\system32\DRIVERS\SiSRaid2.sys
0x01AE0000 \SystemRoot\system32\DRIVERS\sisraid4.sys
0x01AF8000 \SystemRoot\system32\DRIVERS\stexstor.sys
0x01B02000 \SystemRoot\system32\DRIVERS\vsmraid.sys
0x01B2C000 \SystemRoot\system32\drivers\fltmgr.sys
0x01B78000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS
0x01BE9000 \SystemRoot\system32\drivers\fileinfo.sys
0x01C2E000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS
0x01E08000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01D12000 \SystemRoot\System32\Drivers\msrpc.sys
0x01FAB000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01D70000 \SystemRoot\System32\Drivers\cng.sys
0x01FC6000 \SystemRoot\System32\drivers\pcw.sys
0x01FD7000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x020CA000 \SystemRoot\system32\drivers\ndis.sys
0x02000000 \SystemRoot\system32\drivers\NETIO.SYS
0x02060000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x022F2000 \SystemRoot\System32\drivers\tcpip.sys
0x024F6000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x02540000 \SystemRoot\system32\DRIVERS\wd.sys
0x02548000 \SystemRoot\system32\drivers\volsnap.sys
0x02594000 \SystemRoot\System32\Drivers\spldr.sys
0x0259C000 \SystemRoot\system32\drivers\sbp2port.sys
0x025B9000 \SystemRoot\System32\drivers\rdyboost.sys
0x02200000 \SystemRoot\System32\Drivers\mup.sys
0x02212000 \SystemRoot\System32\drivers\hwpolicy.sys
0x0221B000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x02255000 \SystemRoot\system32\DRIVERS\disk.sys
0x022A3000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x022CD000 \SystemRoot\System32\Drivers\Null.SYS
0x022D6000 \SystemRoot\System32\Drivers\Beep.SYS
0x022DD000 \SystemRoot\System32\drivers\vga.sys
0x0208B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x020B0000 \SystemRoot\System32\drivers\watchdog.sys
0x025F3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x020C0000 \SystemRoot\system32\drivers\rdpencdd.sys
0x021BD000 \SystemRoot\system32\drivers\rdprefmp.sys
0x021C6000 \SystemRoot\System32\Drivers\Msfs.SYS
0x021D1000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01C00000 \SystemRoot\system32\DRIVERS\tdx.sys
0x021E2000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x038B3000 \SystemRoot\system32\drivers\afd.sys
0x0393C000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03981000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x0398A000 \SystemRoot\system32\DRIVERS\pacer.sys
0x039B0000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x039C6000 \SystemRoot\system32\DRIVERS\netbios.sys
0x03800000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x0381B000 \SystemRoot\system32\drivers\termdd.sys
0x0382F000 \SystemRoot\System32\Drivers\N360x64\0501000.01D\SYMNETS.SYS
0x01A00000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x01A36000 \SystemRoot\system32\drivers\N360x64\0501000.01D\Ironx64.SYS
0x03895000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SRTSPX64.SYS
0x04A7F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x04AD0000 \SystemRoot\system32\drivers\nsiproxy.sys
0x04ADC000 \SystemRoot\system32\drivers\mssmbios.sys
0x04AE7000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110604.001\IDSvia64.sys
0x04B64000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x04A00000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0x04A26000 \SystemRoot\System32\drivers\discache.sys
0x04A35000 \SystemRoot\System32\Drivers\dfsc.sys
0x04A53000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x04C4F000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110519.002\BHDrvx64.sys
0x04D6B000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x04D91000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x04DA7000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x0FC40000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x108E5000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x108E7000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04DAC000 \SystemRoot\System32\drivers\dxgmms1.sys
0x109DB000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x04EB0000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x04F06000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04F17000 \SystemRoot\system32\drivers\HDAudBus.sys
0x05466000 \SystemRoot\system32\DRIVERS\NETw5s64.sys
0x05BC5000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x05400000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x05432000 \SystemRoot\system32\drivers\i8042prt.sys
0x05450000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x05BD2000 \SystemRoot\system32\drivers\kbdclass.sys
0x04F3B000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x05BE1000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x05BE3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x05BF2000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x04F8E000 \SystemRoot\System32\Drivers\aj4vmejx.SYS
0x0545C000 \SystemRoot\system32\drivers\wmiacpi.sys
0x04FD6000 \SystemRoot\system32\drivers\CompositeBus.sys
0x04FE6000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04E00000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04E24000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04E30000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04E5F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04E7A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x0FC00000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04E9B000 \SystemRoot\system32\DRIVERS\hamachi.sys
0x0FC1A000 \SystemRoot\system32\DRIVERS\nbdrv.sys
0x04EA6000 \SystemRoot\system32\drivers\swenum.sys
0x04C00000 \SystemRoot\system32\drivers\ks.sys
0x0FC25000 \SystemRoot\system32\drivers\umbus.sys
0x0507C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x050D6000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x050EB000 \SystemRoot\system32\DRIVERS\stwrt64.sys
0x0516A000 \SystemRoot\system32\DRIVERS\portcls.sys
0x051A7000 \SystemRoot\system32\DRIVERS\drmk.sys
0x051C9000 \SystemRoot\system32\drivers\ksthunk.sys
0x051CF000 \SystemRoot\system32\drivers\nvhda64v.sys
0x000E0000 \SystemRoot\System32\win32k.sys
0x05000000 \SystemRoot\System32\drivers\Dxapi.sys
0x0500C000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00520000 \SystemRoot\System32\TSDDD.dll
0x007D0000 \SystemRoot\System32\cdd.dll
0x00970000 \SystemRoot\System32\ATMFD.DLL
0x0501A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x05037000 \SystemRoot\System32\Drivers\usbvideo.sys
0x05065000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x04A64000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x05073000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x109E8000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x04DF2000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x04BDD000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x07838000 \SystemRoot\system32\DRIVERS\udfs.sys
0x0788D000 \SystemRoot\System32\Drivers\crashdmp.sys
0x0789B000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x078A7000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x078B2000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x078C5000 \SystemRoot\system32\drivers\luafv.sys
0x078E8000 \SystemRoot\system32\drivers\WudfPf.sys
0x07909000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x0791E000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x07971000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x07984000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x0799C000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x0849E000 \SystemRoot\system32\drivers\HTTP.sys
0x08567000 \SystemRoot\system32\DRIVERS\bowser.sys
0x08585000 \SystemRoot\System32\drivers\mpsdrv.sys
0x0859D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x08400000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0844D000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x0AC41000 \SystemRoot\system32\drivers\peauth.sys
0x0ACE7000 \SystemRoot\System32\Drivers\secdrv.SYS
0x0ACF2000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0AD23000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0AD35000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0B294000 \SystemRoot\System32\DRIVERS\srv.sys
0x0B32C000 \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys
0x0B334000 \SystemRoot\System32\Drivers\N360x64\0501000.01D\SRTSP64.SYS
0x0BC02000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110611.006\EX64.SYS
0x0B200000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110611.006\ENG64.SYS
0x0B220000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77270000 \Windows\System32\ntdll.dll
0x47C00000 \Windows\System32\smss.exe
0xFF590000 \Windows\System32\apisetschema.dll
0xFF740000 \Windows\System32\autochk.exe
0x77440000 \Windows\System32\normaliz.dll
0xFF530000 \Windows\System32\ws2_32.dll
0xFF4D0000 \Windows\System32\Wldap32.dll
0xFF4A0000 \Windows\System32\imm32.dll
0xFF3D0000 \Windows\System32\usp10.dll
0x77170000 \Windows\System32\user32.dll
0x77430000 \Windows\System32\psapi.dll
0xFF350000 \Windows\System32\difxapi.dll
0xFF140000 \Windows\System32\ole32.dll
0xFF060000 \Windows\System32\oleaut32.dll
0x77010000 \Windows\System32\wininet.dll
0xFEE80000 \Windows\System32\setupapi.dll
0x76EF0000 \Windows\System32\kernel32.dll
0xFEE00000 \Windows\System32\shlwapi.dll
0xFED60000 \Windows\System32\msvcrt.dll
0xFED50000 \Windows\System32\nsi.dll
0xFECE0000 \Windows\System32\gdi32.dll
0xFEC40000 \Windows\System32\clbcatq.dll
0xFEC20000 \Windows\System32\sechost.dll
0x76DA0000 \Windows\System32\urlmon.dll
0xFEC10000 \Windows\System32\lpk.dll
0x76B90000 \Windows\System32\iertutil.dll
0xFEBF0000 \Windows\System32\imagehlp.dll
0xFEAE0000 \Windows\System32\msctf.dll
0xFDD50000 \Windows\System32\shell32.dll
0xFDC20000 \Windows\System32\rpcrt4.dll
0xFDB40000 \Windows\System32\advapi32.dll
0xFDAA0000 \Windows\System32\comdlg32.dll
0xFDA60000 \Windows\System32\cfgmgr32.dll
0xFD9C0000 \Windows\System32\comctl32.dll
0xFD9A0000 \Windows\System32\devobj.dll
0xFD960000 \Windows\System32\wintrust.dll
0xFD7F0000 \Windows\System32\crypt32.dll
0xFD780000 \Windows\System32\KernelBase.dll
0xFD770000 \Windows\System32\msasn1.dll
0x757A0000 \Windows\SysWOW64\normaliz.dll

Processes (total 82):
0 System Idle Process
4 System
296 C:\Windows\System32\smss.exe
396 csrss.exe
456 C:\Windows\System32\wininit.exe
468 csrss.exe
504 C:\Windows\System32\services.exe
528 C:\Windows\System32\lsass.exe
536 C:\Windows\System32\lsm.exe
636 C:\Windows\System32\winlogon.exe
700 C:\Windows\System32\svchost.exe
764 C:\Windows\System32\nvvsvc.exe
804 C:\Windows\System32\svchost.exe
868 C:\Windows\System32\svchost.exe
944 C:\Windows\System32\svchost.exe
980 C:\Windows\System32\svchost.exe
1008 C:\Program Files\IDT\WDM\stacsv64.exe
472 C:\Windows\System32\audiodg.exe
716 C:\Windows\System32\svchost.exe
1096 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1108 C:\Windows\System32\nvvsvc.exe
1264 C:\Windows\System32\svchost.exe
1556 C:\Windows\System32\spoolsv.exe
1588 C:\Windows\System32\svchost.exe
1680 C:\Program Files\IDT\WDM\AESTSr64.exe
1720 C:\xampp\apache\bin\httpd.exe
1772 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1804 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1840 C:\Windows\SysWOW64\svchost.exe
1880 C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
1920 C:\Windows\System32\svchost.exe
1952 C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
1976 C:\Program Files (x86)\iTeleport\iTeleport Connect\iTeleportService.exe
1144 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
1220 C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
1500 C:\xampp\mysql\bin\mysqld.exe
1632 C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe
1824 C:\xampp\apache\bin\httpd.exe
2052 C:\Program Files\NetBalancer\SeriousBit.NetBalancer.Service.exe
2196 C:\Windows\System32\taskhost.exe
3256 C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe
3408 C:\Windows\System32\dwm.exe
3440 C:\Windows\explorer.exe
3732 C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
3760 C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
3796 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
3876 C:\Windows\System32\svchost.exe
3916 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
3956 C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
4044 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
3684 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
4356 WmiPrvSE.exe
4468 C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe
4852 C:\Windows\System32\rundll32.exe
4912 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
5056 C:\Windows\System32\SearchIndexer.exe
4328 C:\Windows\System32\svchost.exe
5076 C:\Windows\System32\SearchProtocolHost.exe
4432 C:\Windows\System32\SearchFilterHost.exe
3328 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
888 C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
5144 C:\Program Files\IDT\WDM\sttray64.exe
5152 C:\Program Files\Logitech\SetPointP\SetPoint.exe
5184 C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
5584 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
5592 C:\Program Files (x86)\iTeleport\iTeleport Connect\iTeleportConnect.exe
5744 C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
5752 C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
5764 C:\Program Files\iTunes\iTunesHelper.exe
5844 C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
5880 WmiPrvSE.exe
6068 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
6100 C:\PROGRA~2\Bitcoin\bitcoin.exe
5324 C:\Program Files\iPod\bin\iPodService.exe
3712 C:\Program Files\Windows Media Player\wmpnetwk.exe
5576 C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
4304 C:\Windows\System32\svchost.exe
6844 C:\Users\Megalomon\Desktop\MBRCheck.exe
6856 C:\Windows\System32\conhost.exe
6940 C:\Windows\System32\dllhost.exe
6968 dllhost.exe
6652 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c800000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000047`55000000 (NTFS)

PhysicalDrive0 Model Number: WDCWD3200BEVT-60ZCT1, Rev: 13.01A13

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!
GMER:
GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-12 00:30:15
Windows 6.1.7601 Service Pack 1
Running: 1208ky31.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  1
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Program Files (x86)\DAEMON Tools Pro\
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0x00 0x00 0x00 0x00 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x4D 0x54 0x5E 0x06 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0x17 0xC2 0x0F 0x9E ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x61 0x65 0x23 0xC5 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0xDA 0x0A 0x48 0xAC ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                0x79 0x7D 0x0A 0x41 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                0x57 0x56 0x05 0x6A ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files (x86)\DAEMON Tools Pro\
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x00 0x00 0x00 0x00 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x4D 0x54 0x5E 0x06 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0x17 0xC2 0x0F 0x9E ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x61 0x65 0x23 0xC5 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0xDA 0x0A 0x48 0xAC ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                    0x79 0x7D 0x0A 0x41 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                    0x57 0x56 0x05 0x6A ...

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 13.06.2011 18:35
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


megalomon 14.06.2011 14:43
Die Explorer.exe stürzt leider immernoch von Zeit zu Zeit ab.


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:02 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131