Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bundestrojaner win xp 32 (https://www.trojaner-board.de/103705-bundestrojaner-win-xp-32-a.html)

cbr1000 27.09.2011 13:46
Bundestrojaner win xp 32
 
Hallo liebes Kompetenzteam,

auf dem Laptop eines Bekannten befindet sich der Bundestrojaner. Ich habe srep.exe ausgeführt und wieder Zugriff auf den Laptop.

Welche Schritte brauche ich noch für ein sauberes System?

Im Voraus schon mal vielen Dank.

Nachfolgend noch die shell.txt:

WIN_XP X86

Modified HKLM shell extension. Current Shell File = C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\jashla.exe
File C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\jashla.exe moved to E:\ infected or not found
HKCU\..\Winlogon; Shell not found
No action taken


HKLM\..\Run[RTHDCPL] = RTHDCPL.EXE
HKLM\..\Run[Alcmtr] = ALCMTR.EXE
HKLM\..\Run[igfxhkcmd] = C:\WINDOWS\system32\hkcmd.exe
HKLM\..\Run[igfxpers] = C:\WINDOWS\system32\igfxpers.exe
HKLM\..\Run[LoadFUJ02E3] = C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe
HKLM\..\Run[IndicatorUtility] = C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
HKLM\..\Run[LoadFujitsuQuickTouch] = C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe
HKLM\..\Run[LoadBtnHnd] = C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe
HKLM\..\Run[AGRSMMSG] = AGRSMMSG.exe
HKLM\..\Run[F-Secure Manager] = "C:\Programme\F-Secure\Common\FSM32.EXE" /splash
HKLM\..\Run[F-Secure TNB] = "C:\Programme\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
HKLM\..\Run[StatusClient 2.6] = C:\Programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
HKLM\..\Run[TomcatStartup 2.5] = C:\Programme\Hewlett-Packard\Toolbox\hpbpsttp.exe
HKLM\..\Run[OrderReminder] = C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
HKLM\..\Run[HP Software Update] = C:\Programme\Hp\HP Software Update\HPWuSchd2.exe
HKLM\..\Run[TkBellExe] = "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
HKLM\..\Run[myLinker] = C:\PROGRA~2\myLinker\myLinker.exe /B
HKLM\..\Run[Adobe Photo Downloader] = "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
HKLM\..\Run[SunJavaUpdateSched] = "C:\Programme\Java\jre1.5.0_10\bin\jusched.exe"
HKLM\..\Run[Dr.Fasoo] = "C:\Programme\Fasoo DRM\f_drscan.exe"
HKLM\..\Run[FPH Exe] = "C:\PROGRA~1\FASOOD~1\fph.exe"
HKLM\..\Run[Adobe Reader Speed Launcher] = "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\..\Run[Adobe ARM] = "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

HKCU\..\Run[CTFMON.EXE] = C:\WINDOWS\system32\ctfmon.exe
HKCU\..\Run[MSMSGS] = "C:\Programme\Messenger\msmsgs.exe" /background
HKCU\..\Run[swg] = "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

HKU\.DEFAULT\Winlogon; Shell =
HKU\S-1-5-20\Winlogon; Shell =
HKU\S-1-5-20_Classes\Winlogon; Shell =
HKU\S-1-5-21-3333913869-70301218-1339301055-1005\Winlogon; Shell =
HKU\S-1-5-21-3333913869-70301218-1339301055-1005_Classes\Winlogon; Shell =
HKU\S-1-5-18\Winlogon; Shell =

cosinus 27.09.2011 15:20
Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!


Führe danach auch bitte ESET aus, danach sehen wir weiter.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

n.

cbr1000 27.09.2011 18:51
Hier ist der malwarebytes Bericht:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7809

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

27.09.2011 19:43:36
mbam-log-2011-09-27 (19-43-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 251469
Laufzeit: 1 Stunde(n), 10 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 9
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{4AAA2F98-2D2F-4938-AFB1-3EC1B51C41D9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{487B489F-95C2-44C1-B31F-F7FD71FFA5BE} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3474531E-CCF0-494B-8EC5-254E93EFFAF9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\F_webdc.xWebDC.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\F_webdc.xWebDC (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AAA2F98-2D2F-4938-AFB1-3EC1B51C41D9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4AAA2F98-2D2F-4938-AFB1-3EC1B51C41D9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{8E9D2F33-4585-4404-AA57-15B2B03707F4} (Rogue.VirusProtectPro) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{02910A3C-5D77-4A3E-8A13-FDF81AC7FECD} (Rogue.VirusProtectPro) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\programme\fasoo drm\f_webdc.dll (Trojan.BHO) -> Delete on reboot.
c:\dokumente und einstellungen\dr.maria-anna kim\startmenü\programme\autostart\drantispy.lnk (Rogue.DrAntispy) -> Quarantined and deleted successfully.




Der Eset Scan kommt anschließend

cbr1000 27.09.2011 20:49
Und der eset log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=ac7149b2e775214bb4901a91ba2dbc01
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-27 07:00:58
# local_time=2011-09-27 09:00:58 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2304 16777191 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 233 233 0 0
# scanned=75411
# found=4
# cleaned=0
# scan_time=2646
C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\worms.jar-77b7e1d4-20cfb462.zip Java/Agent.DJ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\myLinker\MLCaller.dll Win32/Adware.MyLinker application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\myLinker\myLinker.exe a variant of Win32/Adware.MyLinker.A application (unable to clean) 00000000000000000000000000000000 I
${Memory} a variant of Win32/Adware.MyLinker.A application 00000000000000000000000000000000 I

cosinus 27.09.2011 20:53
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

cbr1000 28.09.2011 20:03
Hallo,

folgend der otl.txt:OTL Logfile:
Code:
OTL logfile created on: 28.09.2011 20:52:13 - Run 1
OTL by OldTimer - Version 3.2.29.1    Folder = C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,86 Mb Total Physical Memory | 634,60 Mb Available Physical Memory | 62,59% Memory free
1,63 Gb Paging File | 1,34 Gb Available in Paging File | 82,26% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 61,19 Gb Free Space | 82,12% Space Free | Partition Type: NTFS
 
Computer Name: KIM-NOTEBOOK | User Name: Dr.Maria-Anna Kim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.09.27 22:22:49 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\OTL.exe
PRC - [2011.06.09 13:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.02.17 17:20:08 | 001,345,536 | ---- | M] (ILKYUNG Co.,Ltd.) -- C:\Program Files\myLinker\myLinker.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.08.09 09:27:52 | 000,073,728 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2007.07.12 21:31:07 | 000,098,304 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
PRC - [2007.01.17 16:18:55 | 000,032,807 | ---- | M] (F-Secure Automatic Update) -- C:\Programme\F-Secure\BackWeb\7681197\program\ServiceWrapper-7681197.exe
PRC - [2007.01.17 16:18:55 | 000,032,807 | ---- | M] (F-Secure Automatic Update) -- C:\Programme\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
PRC - [2006.06.23 11:24:12 | 000,343,552 | ---- | M] (AVM Berlin GmbH) -- C:\Programme\avmwlanstick\FRITZWLanMini.exe
PRC - [2006.04.20 14:08:00 | 000,073,728 | ---- | M] (FUJITSU LIMITED) -- C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe
PRC - [2005.10.31 12:01:30 | 000,208,959 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\FWES\program\fsdfwd.exe
PRC - [2005.10.26 03:55:24 | 000,110,642 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FNRB32.exe
PRC - [2005.10.26 03:55:24 | 000,057,393 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FIH32.exe
PRC - [2005.10.26 03:52:00 | 000,065,585 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FCH32.EXE
PRC - [2005.10.26 03:51:58 | 000,270,387 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FAMEH32.EXE
PRC - [2005.10.26 03:51:58 | 000,180,274 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FSMB32.EXE
PRC - [2005.10.26 03:51:58 | 000,122,929 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FSM32.EXE
PRC - [2005.10.26 03:51:58 | 000,061,490 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\common\FSMA32.EXE
PRC - [2005.10.24 17:09:08 | 000,270,428 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe
PRC - [2005.10.12 11:52:12 | 000,233,537 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\FSGUI\fsguidll.exe
PRC - [2005.10.11 18:16:02 | 000,176,128 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\FSAV32.exe
PRC - [2005.10.03 15:10:44 | 000,159,804 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\FSRW.exe
PRC - [2005.09.22 14:29:38 | 000,289,792 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\Anti-Virus\fsgk32.exe
PRC - [2005.09.09 15:30:16 | 000,247,296 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\Anti-Virus\fssm32.exe
PRC - [2005.08.09 11:53:06 | 000,081,920 | ---- | M] (FUJITSU LIMITED) -- C:\Addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
PRC - [2005.07.21 15:21:58 | 000,353,792 | ---- | M] (FUJITSU LIMITED) -- C:\Addon\Fujitsu\Application Panel\QuickTouch.exe
PRC - [2005.07.21 15:20:46 | 000,061,440 | ---- | M] (FUJITSU LIMITED) -- C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe
PRC - [2005.05.09 10:52:52 | 000,086,064 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Spyware\FSAW.exe
PRC - [2005.04.13 15:02:40 | 000,032,826 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\fsqh.exe
PRC - [2005.04.08 18:18:37 | 000,151,552 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
PRC - [2001.09.04 11:15:22 | 000,045,056 | ---- | M] (F-Secure Corp.) -- C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2007.01.17 16:18:49 | 000,151,589 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\bwfiles.dll
MOD - [2007.01.17 16:18:49 | 000,061,496 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\clntutil.dll
MOD - [2007.01.17 16:18:48 | 000,163,908 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\ServiceWrapper.dll
MOD - [2005.10.24 17:06:46 | 000,053,248 | ---- | M] () -- C:\Programme\F-Secure\BackWeb\7681197\program\fsbwres.deu
MOD - [2005.10.12 11:57:52 | 000,090,112 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\fsesres.dll
MOD - [2005.10.12 11:47:08 | 000,012,288 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\avabtres.eng
MOD - [2005.10.12 11:47:04 | 000,352,256 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\av550about.dll
MOD - [2005.10.12 11:46:10 | 000,086,016 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\fsesres.deu
MOD - [2005.10.12 11:46:10 | 000,016,384 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\guilares.deu
MOD - [2005.06.15 14:04:44 | 000,565,345 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fm4av.dll
MOD - [2005.05.24 12:13:58 | 000,053,248 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fsavhres.deu
MOD - [2005.05.12 17:20:48 | 000,081,920 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fsavures.eng
MOD - [2005.05.11 14:26:50 | 000,098,304 | ---- | M] () -- C:\Programme\F-Secure\Anti-Virus\fsavures.deu
MOD - [2002.05.03 23:40:32 | 000,094,274 | ---- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (nosGetPlusHelper) getPlus(R)
SRV - File not found [Disabled | Stopped] --  -- (HidServ)
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2007.08.09 09:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2007.01.17 16:18:55 | 000,032,807 | ---- | M] (F-Secure Automatic Update) [Auto | Running] -- C:\Programme\F-Secure\BackWeb\7681197\program\ServiceWrapper-7681197.exe -- (BackWeb Plug-in - 7681197)
SRV - [2005.10.31 12:01:30 | 000,208,959 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Programme\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD)
SRV - [2005.10.26 03:55:24 | 000,110,642 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Programme\F-Secure\Common\FNRB32.EXE -- (F-Secure Network Request Broker)
SRV - [2005.10.26 03:51:58 | 000,061,490 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Programme\F-Secure\Common\FSMA32.EXE -- (FSMA)
SRV - [2005.10.24 17:09:08 | 000,270,428 | ---- | M] (F-Secure Corp.) [Auto | Running] -- C:\Programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe -- (fsbwsys)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2001.09.04 11:15:22 | 000,045,056 | ---- | M] (F-Secure Corp.) [Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2008.04.13 20:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2006.07.06 08:56:00 | 000,248,832 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2006.06.29 12:13:08 | 001,160,320 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.04.06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2006.03.08 03:27:12 | 004,246,016 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005.10.31 12:01:44 | 000,070,896 | ---- | M] (F-Secure Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\fsdfw.sys -- (FSFW)
DRV - [2005.10.06 16:30:56 | 000,048,256 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\win2k\fsgk.sys -- (F-Secure Gatekeeper)
DRV - [2005.08.19 15:37:40 | 000,048,816 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\win2k\FSfilter.sys -- (F-Secure Filter)
DRV - [2005.08.19 15:37:40 | 000,016,720 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\F-Secure\Anti-Virus\win2k\FSrec.sys -- (F-Secure Recognizer)
DRV - [2005.07.21 15:20:46 | 000,021,120 | ---- | M] (FUJITSU LIMITED) [Kernel | Auto | Running] -- C:\Programme\Fujitsu\BtnHnd\BtnHnd.sys -- (BtnHnd)
DRV - [2005.01.26 11:10:14 | 000,004,598 | ---- | M] (Fasoo.com) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\f_kp.sys -- (f_kp)
DRV - [2004.10.18 22:08:00 | 000,005,632 | ---- | M] (Fujitsu Limited) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\FUJ02E1.sys -- (FUJ02E1)
DRV - [2004.08.04 14:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004.08.04 14:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2004.08.03 23:29:52 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB)
DRV - [2004.01.17 11:15:20 | 000,004,864 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fuj02e3.sys -- (FUJ02E3)
DRV - [2001.08.18 05:35:52 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001.08.01 19:00:22 | 000,005,248 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fuj02b1.sys -- (FUJ02B1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.t-online.de"
FF - prefs.js..network.proxy.type: 4
 
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+(R),version=1.6.2.91: C:\Programme\NOS\bin\np_gp.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2852: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2910: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1662: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2008.12.19 13:03:42 | 000,000,000 | ---D | M]
 
[2007.07.12 16:07:25 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Mozilla\Firefox\Profiles\f9g9d26b.default\extensions
[2008.12.25 20:20:03 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2008.12.25 20:20:02 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2007.07.23 12:41:48 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\GOOGLE-GGIC@PARTNERS.MOZILLA.COM
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH)
O4 - HKLM..\Run: [F-Secure Manager] C:\Programme\F-Secure\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] C:\Programme\F-Secure\TNB\TNBUtil.exe (F-Secure Corporation)
O4 - HKLM..\Run: [IndicatorUtility] C:\Addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadBtnHnd] C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadFUJ02E3] C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Addon\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [myLinker] C:\Program Files\myLinker\myLinker.exe (ILKYUNG Co.,Ltd.)
O4 - HKLM..\Run: [OrderReminder] C:\Programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [StatusClient 2.6] C:\Programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure Automatic Update.lnk = C:\Programme\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe (F-Secure Automatic Update)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Block this popup - C:\Programme\F-Secure\Anti-Spyware\blockpopups.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9 - Extra Button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programme\F-Secure\Anti-Spyware\ieshield.dll (F-Secure Corporation)
O9 - Extra 'Tools' menuitem : IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programme\F-Secure\Anti-Spyware\ieshield.dll (F-Secure Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {579CC802-2AF6-436B-8B9C-10F0B6C99FFE} hxxp://sso.kisti.re.kr/auth/kisti_client.cab (egKisti Class)
O16 - DPF: {6989C944-3529-4DA8-8C60-187E95F580E2} hxxp://leeum.samsungfoundation.org/book/include/SecuiJoinsIE.cab (SecureSession Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\FJWSEL: DllName - (FJWSWNP.dll) - C:\WINDOWS\System32\FJWSWNP.dll (FUJITSU LIMITED)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O30 - LSA: Authentication Packages - (nwprovau) -C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.01.30 21:58:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^InterVideo WinCinema Manager.lnk - C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe - (InterVideo Inc.)
MsConfig - StartUpReg: Adobe Photo Downloader - hkey= - key= - C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Dr.Fasoo - hkey= - key= - C:\Programme\Fasoo DRM\f_drscan.exe (Fasoo.com)
MsConfig - StartUpReg: FPH Exe - hkey= - key= - C:\Programme\Fasoo DRM\fph.exe (Fasoo.com)
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Programme\hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: TomcatStartup 2.5 - hkey= - key= - C:\Programme\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard)
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.28 19:47:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.09.28 19:46:20 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Recent
[2011.09.28 19:44:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner
[2011.09.28 19:44:00 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2011.09.28 19:36:27 | 000,000,000 | ---D | C] -- C:\8d9f9912f9ff686dd6f0de495492
[2011.09.27 22:22:49 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\OTL.exe
[2011.09.27 22:13:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
[2011.09.27 22:13:17 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2011.09.27 20:12:59 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2011.09.27 18:05:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Malwarebytes
[2011.09.27 17:07:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.09.27 17:07:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.09.27 17:07:23 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.09.27 17:07:11 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.09.27 16:53:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FRITZ!WLAN
[2011.09.27 16:53:18 | 000,000,000 | ---D | C] -- C:\Programme\avmwlanstick
[2011.09.27 16:53:15 | 000,264,704 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\drivers\fwlanusb.sys
[2011.09.27 16:53:15 | 000,055,808 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\avmadd32.dll
[2011.09.27 16:53:15 | 000,033,792 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\avmcowlan.dll
[2011.09.27 16:53:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\AVM_Driver
[2011.09.27 16:53:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\AVM_Driver
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.28 20:47:27 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{1EBC1426-FAA4-4422-90BC-2CCB319C66D1}.job
[2011.09.28 20:44:57 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.09.28 20:44:42 | 000,001,035 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure Automatic Update.lnk
[2011.09.28 20:44:33 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.09.28 20:44:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.09.28 20:44:22 | 1063,178,240 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.28 19:46:48 | 000,123,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Eigene Dateien\cc_20110928_194643.reg
[2011.09.28 19:44:01 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2011.09.28 19:33:01 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.09.28 19:15:48 | 000,000,566 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled scanning task.job
[2011.09.27 22:22:49 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\OTL.exe
[2011.09.27 19:59:53 | 000,395,074 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.09.27 19:59:53 | 000,383,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.09.27 19:59:53 | 000,064,994 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.09.27 19:59:53 | 000,053,942 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.09.27 17:07:41 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.09.27 15:20:28 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\Microsoft Office Word 2003.lnk
[2011.09.27 14:13:54 | 000,000,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\Arbeitsplatz.lnk
[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.28 20:24:15 | 1063,178,240 | -HS- | C] () -- C:\hiberfil.sys
[2011.09.28 19:46:46 | 000,123,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Eigene Dateien\cc_20110928_194643.reg
[2011.09.28 19:44:01 | 000,000,660 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2011.09.27 19:54:00 | 000,001,035 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure Automatic Update.lnk
[2011.09.27 17:07:41 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.09.27 16:53:16 | 000,097,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin
[2011.09.27 14:13:54 | 000,000,104 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Desktop\Arbeitsplatz.lnk
[2009.10.15 17:17:20 | 000,001,553 | ---- | C] () -- C:\WINDOWS\Uninstall.ini
[2009.10.15 17:17:19 | 000,002,638 | ---- | C] () -- C:\WINDOWS\f_ProductMgr.ini
[2009.10.15 17:17:18 | 000,002,380 | ---- | C] () -- C:\WINDOWS\f_ch_tbl.ini
[2007.09.13 12:24:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2007.08.17 12:28:55 | 000,005,632 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.07.15 00:23:27 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.07.12 21:30:18 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\jst.dll
[2007.07.12 21:30:18 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\PMLJNI.dll
[2007.07.12 21:25:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\hpbprnfx.exe
[2007.07.12 21:24:50 | 000,013,451 | ---- | C] () -- C:\WINDOWS\hpbins01.dat
[2007.07.12 21:24:50 | 000,001,380 | ---- | C] () -- C:\WINDOWS\hpbmdl01.dat
[2007.07.12 21:24:45 | 000,000,750 | ---- | C] () -- C:\WINDOWS\hpbvnstp.ini
[2007.07.12 21:24:36 | 000,221,184 | R--- | C] () -- C:\WINDOWS\System32\HP3AIOZ6.dll
[2007.07.12 21:24:36 | 000,000,412 | R--- | C] () -- C:\WINDOWS\System32\HP3AIOZ6.dat
[2007.07.12 21:21:46 | 000,012,541 | ---- | C] () -- C:\WINDOWS\hplj3380.ini
[2007.07.12 17:22:36 | 000,099,970 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2007.07.12 16:07:13 | 000,003,179 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007.07.12 16:03:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007.04.17 13:52:04 | 000,239,360 | ---- | C] () -- C:\WINDOWS\System32\TrustNETTray.exe
[2007.02.09 10:27:32 | 000,000,122 | ---- | C] () -- C:\WINDOWS\KGOleSrv.INI
[2007.02.08 17:42:22 | 000,007,918 | ---- | C] () -- C:\WINDOWS\Accord50.Ini
[2007.01.18 14:50:02 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2007.01.18 14:50:02 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2007.01.18 14:50:02 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2007.01.18 14:50:02 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2007.01.18 14:50:01 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2007.01.18 14:50:01 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2007.01.17 16:27:17 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.01.17 16:18:49 | 000,118,842 | R--- | C] () -- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe
[2007.01.17 16:03:54 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007.01.09 11:22:01 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.01.30 22:20:28 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006.01.30 22:02:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006.01.30 21:55:20 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006.01.30 21:49:20 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006.01.30 21:48:22 | 000,259,048 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006.01.30 21:41:40 | 000,001,052 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006.01.30 21:41:23 | 000,395,074 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006.01.30 21:41:23 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006.01.30 21:41:23 | 000,064,994 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006.01.30 21:41:23 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006.01.30 21:41:04 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006.01.30 21:41:01 | 000,383,588 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006.01.30 21:41:01 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006.01.30 21:41:01 | 000,053,942 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006.01.30 21:41:01 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006.01.30 21:40:59 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006.01.30 21:40:59 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006.01.30 21:40:56 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2006.01.30 21:40:48 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006.01.30 21:40:48 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006.01.30 21:40:39 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006.01.30 21:40:29 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2005.01.24 19:00:50 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\egKisti.dll
[2003.09.26 14:42:46 | 000,002,421 | ---- | C] () -- C:\WINDOWS\System32\scrubber.ini
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.05.03 23:40:32 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL
 
========== LOP Check ==========
 
[2007.01.17 16:18:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\F-Secure
[2008.06.21 20:39:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Altiris
[2007.01.17 16:22:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\F-Secure
[2007.02.09 20:27:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\InterVideo
[2008.07.05 10:08:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Leadertech
[2009.01.14 13:57:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\MSNInstaller
[2009.01.13 17:00:52 | 000,000,474 | ---- | M] () -- C:\WINDOWS\Tasks\AeX Local Job 597.job
[2009.01.14 13:30:00 | 000,000,450 | ---- | M] () -- C:\WINDOWS\Tasks\AeX Local Job 598.job
[2011.09.28 19:15:48 | 000,000,566 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled scanning task.job
[2011.09.28 20:47:27 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{1EBC1426-FAA4-4422-90BC-2CCB319C66D1}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2007.01.17 16:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Adobe
[2007.01.18 14:08:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\AdobeUM
[2008.12.25 17:54:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Ahead
[2008.06.21 20:39:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Altiris
[2007.01.17 16:22:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\F-Secure
[2007.07.22 11:43:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Google
[2007.02.09 10:27:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Help
[2006.01.31 07:33:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Identities
[2007.02.09 20:27:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\InterVideo
[2007.01.17 16:15:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Lavasoft
[2008.07.05 10:08:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Leadertech
[2007.07.12 18:52:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Macromedia
[2011.09.27 18:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Malwarebytes
[2009.03.15 19:28:24 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Microsoft
[2007.07.12 16:03:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Mozilla
[2009.01.14 13:57:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\MSNInstaller
[2010.12.08 14:56:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Real
[2007.01.18 14:08:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Sun
[2007.07.12 16:07:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Talkback
 
< %APPDATA%\*.exe /s >
[2007.07.20 16:26:58 | 023,813,608 | ---- | M] (                            ) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe
[2011.01.29 12:13:26 | 000,510,120 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Real\Update\setup3.13\setup.exe
[2011.08.28 11:57:57 | 000,310,400 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Real\Update\UpgradeHelper\RealPlayer\8.00\rnupgagent.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008.12.26 20:25:05 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2005.10.12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\Drivers\iastor\iastor.sys
[2005.10.12 10:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\Drivers\Sata\iastor.sys
[2005.10.12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\drivers\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.01.30 22:47:43 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2006.01.30 22:47:43 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2006.01.30 22:47:43 | 000,409,600 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
<          >

< End of report >
--- --- ---

cosinus 28.09.2011 20:24
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
PRC - [2009.02.17 17:20:08 | 001,345,536 | ---- | M] (ILKYUNG Co.,Ltd.) -- C:\Program Files\myLinker\myLinker.exe
O4 - HKLM..\Run: [myLinker] C:\Program Files\myLinker\myLinker.exe (ILKYUNG Co.,Ltd.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.01.30 21:58:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
:Files
C:\Program Files\myLinker
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

cbr1000 28.09.2011 22:05
Der Fix ist durch

All processes killed
========== OTL ==========
No active process named myLinker.exe was found!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\myLinker deleted successfully.
C:\Program Files\myLinker\myLinker.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
========== FILES ==========
C:\Program Files\myLinker\8DOTDTSF\925 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\923 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\922 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\921 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\905 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\904 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\903 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\901 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\861 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\741 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\726 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\724 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\721 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\708 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\704 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\703 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\666 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\664 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\663 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\661 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\642 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\624 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\623 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\615 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\614 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\610 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\608 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\606 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\604 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\561 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\541 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\502 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\486 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\484 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\422 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\41 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\401 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\382 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\381 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\371 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\369 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\366 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\365 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\364 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\363 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\362 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\349 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\342 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\322 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\321 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\301 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\241 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\23 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\22 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\161 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15766 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15726 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15706 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15687 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15686 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15666 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15646 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15628 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15627 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15626 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15606 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15589 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15588 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15587 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15571 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15568 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15567 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15551 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15550 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15549 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15547 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15546 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15526 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15510 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15508 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15507 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15506 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15488 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15486 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15468 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15467 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15429 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15407 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15387 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15386 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15326 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15306 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15226 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15086 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15066 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15046 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\15026 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14986 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14966 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14946 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14928 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14927 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14926 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14906 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14886 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14866 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14826 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14806 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14769 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14768 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14767 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14766 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14746 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14706 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14686 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14666 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14647 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14626 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14606 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14587 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14566 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14526 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14507 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14486 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14466 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14427 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14426 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14406 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14328 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14327 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14326 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14266 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14249 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14248 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14247 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14246 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14228 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14227 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14226 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14186 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14166 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14106 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14066 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14026 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\14006 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13986 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13946 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13906 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13888 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13887 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13886 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13867 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13866 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13846 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13826 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13806 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13786 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13766 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13746 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13706 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13686 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13646 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13626 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13606 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13566 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13546 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13507 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13486 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13446 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13427 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13327 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13326 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13287 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13266 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13187 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13186 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13166 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13146 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13126 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13106 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13066 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13026 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13009 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\13007 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12986 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12906 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12826 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12806 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12786 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12726 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12606 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12586 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12526 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12466 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12448 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12446 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12429 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12427 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12426 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12386 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12370 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12367 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12351 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12345 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12344 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12323 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12322 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12319 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12318 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12295 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12275 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12258 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12256 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12254 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12251 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12250 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12249 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12248 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12247 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12246 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12244 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12243 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12242 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12203 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12201 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12182 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12181 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12161 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12142 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12141 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12123 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12121 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\121 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12084 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12082 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12081 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12051 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12049 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12046 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12045 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12043 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12042 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12041 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12022 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12021 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12008 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12004 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12003 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF\12001 folder moved successfully.
C:\Program Files\myLinker\8DOTDTSF folder moved successfully.
C:\Program Files\myLinker folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
->Flash cache emptied: 83 bytes

User: Dr.Maria-Anna Kim
->Temp folder emptied: 115209632 bytes
->Temporary Internet Files folder emptied: 15658498 bytes
->Java cache emptied: 6861487 bytes
->FireFox cache emptied: 3093487 bytes
->Flash cache emptied: 470 bytes

User: DR015A~1~MAR

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 14471998 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 3244423 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 290169324 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 428,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.29.1 log created on 09282011_225927

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 28.09.2011 22:34
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

cbr1000 29.09.2011 12:38
Hi,

TDSS Killer ist fertig, Log läßt sich aber nicht posten, 6 Bedrohungen wurden in Quarantäne verschoben

cosinus 29.09.2011 13:13
Log zippen und hier anhängen

cbr1000 29.09.2011 14:29
Sorry, hier kommt der log



13:18:31.0703 3260 TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
13:18:31.0718 3260 ============================================================
13:18:31.0718 3260 Current date / time: 2011/09/29 13:18:31.0718
13:18:31.0718 3260 SystemInfo:
13:18:31.0718 3260
13:18:31.0718 3260 OS Version: 5.1.2600 ServicePack: 3.0
13:18:31.0718 3260 Product type: Workstation
13:18:31.0718 3260 ComputerName: KIM-NOTEBOOK
13:18:31.0718 3260 UserName: Dr.Maria-Anna Kim
13:18:31.0718 3260 Windows directory: C:\WINDOWS
13:18:31.0718 3260 System windows directory: C:\WINDOWS
13:18:31.0718 3260 Processor architecture: Intel x86
13:18:31.0718 3260 Number of processors: 2
13:18:31.0718 3260 Page size: 0x1000
13:18:31.0718 3260 Boot type: Normal boot
13:18:31.0718 3260 ============================================================
13:18:32.0062 3260 Initialize success
13:22:15.0093 1660 ============================================================
13:22:15.0093 1660 Scan started
13:22:15.0093 1660 Mode: Manual; SigCheck; TDLFS;
13:22:15.0093 1660 ============================================================
13:22:15.0312 1660 Abiosdsk - ok
13:22:15.0328 1660 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
13:22:18.0078 1660 abp480n5 - ok
13:22:18.0203 1660 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
13:22:18.0359 1660 ACPI - ok
13:22:18.0406 1660 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
13:22:18.0546 1660 ACPIEC - ok
13:22:18.0578 1660 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
13:22:18.0750 1660 adpu160m - ok
13:22:18.0812 1660 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
13:22:19.0015 1660 aec - ok
13:22:19.0125 1660 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
13:22:19.0187 1660 AFD - ok
13:22:19.0281 1660 AgereSoftModem (90456051c422e09bc36e6340dd891f0c) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
13:22:19.0468 1660 AgereSoftModem - ok
13:22:19.0562 1660 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
13:22:19.0765 1660 agp440 - ok
13:22:19.0859 1660 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
13:22:20.0062 1660 agpCPQ - ok
13:22:20.0156 1660 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
13:22:20.0265 1660 Aha154x - ok
13:22:20.0328 1660 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
13:22:20.0484 1660 aic78u2 - ok
13:22:20.0546 1660 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
13:22:20.0703 1660 aic78xx - ok
13:22:20.0796 1660 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
13:22:20.0953 1660 AliIde - ok
13:22:21.0046 1660 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
13:22:21.0234 1660 alim1541 - ok
13:22:21.0343 1660 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
13:22:21.0546 1660 amdagp - ok
13:22:21.0656 1660 AmdK7 (3a0dafac778236559c14c7203fb550eb) C:\WINDOWS\system32\DRIVERS\amdk7.sys
13:22:21.0843 1660 AmdK7 - ok
13:22:21.0953 1660 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
13:22:22.0062 1660 amsint - ok
13:22:22.0156 1660 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
13:22:22.0328 1660 Arp1394 - ok
13:22:22.0437 1660 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
13:22:22.0609 1660 asc - ok
13:22:22.0671 1660 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
13:22:22.0781 1660 asc3350p - ok
13:22:22.0859 1660 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
13:22:23.0015 1660 asc3550 - ok
13:22:23.0109 1660 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
13:22:23.0296 1660 AsyncMac - ok
13:22:23.0390 1660 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
13:22:23.0500 1660 atapi - ok
13:22:23.0515 1660 Atdisk - ok
13:22:23.0546 1660 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
13:22:23.0750 1660 Atmarpc - ok
13:22:23.0843 1660 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
13:22:24.0000 1660 audstub - ok
13:22:24.0078 1660 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
13:22:24.0234 1660 Beep - ok
13:22:24.0296 1660 BtnHnd (c84e0365e1b1d1f96ebdf3b403de5feb) C:\Programme\Fujitsu\BtnHnd\BtnHnd.sys
13:22:24.0343 1660 BtnHnd ( UnsignedFile.Multi.Generic ) - warning
13:22:24.0343 1660 BtnHnd - detected UnsignedFile.Multi.Generic (1)
13:22:24.0437 1660 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
13:22:24.0609 1660 cbidf - ok
13:22:24.0640 1660 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
13:22:24.0765 1660 cbidf2k - ok
13:22:24.0812 1660 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
13:22:24.0921 1660 cd20xrnt - ok
13:22:24.0984 1660 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
13:22:25.0156 1660 Cdaudio - ok
13:22:25.0218 1660 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
13:22:25.0328 1660 Cdfs - ok
13:22:25.0437 1660 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
13:22:25.0625 1660 Cdrom - ok
13:22:25.0718 1660 Changer - ok
13:22:25.0750 1660 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
13:22:25.0937 1660 CmBatt - ok
13:22:26.0031 1660 CmdIde (c687f81290303d90099b027a6474f99f) C:\WINDOWS\system32\DRIVERS\cmdide.sys
13:22:26.0187 1660 CmdIde - ok
13:22:26.0218 1660 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
13:22:26.0343 1660 Compbatt - ok
13:22:26.0406 1660 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
13:22:26.0562 1660 Cpqarray - ok
13:22:26.0671 1660 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
13:22:26.0843 1660 dac2w2k - ok
13:22:26.0921 1660 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
13:22:27.0093 1660 dac960nt - ok
13:22:27.0187 1660 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
13:22:27.0296 1660 Disk - ok
13:22:27.0390 1660 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
13:22:27.0671 1660 dmboot - ok
13:22:27.0765 1660 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
13:22:27.0875 1660 dmio - ok
13:22:27.0968 1660 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
13:22:28.0078 1660 dmload - ok
13:22:28.0171 1660 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
13:22:28.0359 1660 DMusic - ok
13:22:28.0468 1660 Dot4 (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys
13:22:28.0671 1660 Dot4 - ok
13:22:28.0781 1660 Dot4Print (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
13:22:28.0937 1660 Dot4Print - ok
13:22:29.0031 1660 Dot4Scan (bd05306428da63369692477ddc0f6f5f) C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys
13:22:29.0187 1660 Dot4Scan - ok
13:22:29.0296 1660 dot4usb (29e86af2f3457d0441348020fe3cfbd0) C:\WINDOWS\system32\DRIVERS\dot4usb.sys
13:22:29.0453 1660 dot4usb - ok
13:22:29.0562 1660 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
13:22:29.0718 1660 dpti2o - ok
13:22:29.0796 1660 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
13:22:29.0968 1660 drmkaud - ok
13:22:30.0078 1660 F-Secure Filter (13eb491eec0f95ac76f7af26b7e14984) C:\Programme\F-Secure\Anti-Virus\Win2K\FSfilter.sys
13:22:30.0140 1660 F-Secure Filter ( UnsignedFile.Multi.Generic ) - warning
13:22:30.0140 1660 F-Secure Filter - detected UnsignedFile.Multi.Generic (1)
13:22:30.0156 1660 F-Secure Gatekeeper (f80fa8d1a625b037b3d3f9a61ece685e) C:\Programme\F-Secure\Anti-Virus\Win2K\FSgk.sys
13:22:30.0250 1660 F-Secure Gatekeeper ( UnsignedFile.Multi.Generic ) - warning
13:22:30.0250 1660 F-Secure Gatekeeper - detected UnsignedFile.Multi.Generic (1)
13:22:30.0359 1660 F-Secure Recognizer (9a92de4b13378f99b09a6bf8713a2829) C:\Programme\F-Secure\Anti-Virus\Win2K\FSrec.sys
13:22:30.0406 1660 F-Secure Recognizer ( UnsignedFile.Multi.Generic ) - warning
13:22:30.0406 1660 F-Secure Recognizer - detected UnsignedFile.Multi.Generic (1)
13:22:30.0500 1660 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
13:22:30.0671 1660 Fastfat - ok
13:22:30.0718 1660 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
13:22:30.0906 1660 Fdc - ok
13:22:31.0000 1660 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
13:22:31.0156 1660 FETNDIS - ok
13:22:31.0250 1660 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
13:22:31.0437 1660 Fips - ok
13:22:31.0531 1660 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
13:22:31.0734 1660 Flpydisk - ok
13:22:31.0828 1660 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
13:22:31.0953 1660 FltMgr - ok
13:22:32.0031 1660 FSFW (997719d16d6d60c4d4e5bd1afde5ddbb) C:\WINDOWS\system32\drivers\fsdfw.sys
13:22:32.0046 1660 FSFW ( UnsignedFile.Multi.Generic ) - warning
13:22:32.0046 1660 FSFW - detected UnsignedFile.Multi.Generic (1)
13:22:32.0109 1660 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
13:22:32.0265 1660 Fs_Rec - ok
13:22:32.0312 1660 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
13:22:32.0453 1660 Ftdisk - ok
13:22:32.0546 1660 FUJ02B1 (00845dcd64fe6348ddf7890c310c17b9) C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys
13:22:32.0625 1660 FUJ02B1 - ok
13:22:32.0656 1660 FUJ02E1 (c4942669fde5abd7bbe70027c9de1247) C:\WINDOWS\system32\Drivers\FUJ02E1.sys
13:22:32.0734 1660 FUJ02E1 - ok
13:22:32.0781 1660 FUJ02E3 (ef9f310f86fd504afcdcedf8280091fb) C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys
13:22:32.0843 1660 FUJ02E3 - ok
13:22:32.0906 1660 FWLANUSB (b45f1df1cce34e2af422f0ed78cd70ef) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys
13:22:33.0000 1660 FWLANUSB - ok
13:22:33.0078 1660 f_kp (fc34a7da8335a3c8e21366f0289722a1) C:\WINDOWS\system32\drivers\f_kp.sys
13:22:33.0125 1660 f_kp ( UnsignedFile.Multi.Generic ) - warning
13:22:33.0125 1660 f_kp - detected UnsignedFile.Multi.Generic (1)
13:22:33.0187 1660 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
13:22:33.0375 1660 Gpc - ok
13:22:33.0531 1660 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
13:22:33.0656 1660 HDAudBus - ok
13:22:33.0750 1660 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
13:22:33.0921 1660 HidUsb - ok
13:22:34.0031 1660 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
13:22:34.0171 1660 hpn - ok
13:22:34.0250 1660 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
13:22:34.0296 1660 HTTP - ok
13:22:34.0328 1660 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
13:22:34.0515 1660 i2omgmt - ok
13:22:34.0625 1660 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
13:22:34.0812 1660 i2omp - ok
13:22:34.0921 1660 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
13:22:35.0062 1660 i8042prt - ok
13:22:35.0203 1660 ialm (81efe1c5542afb2570758f39ae3b1151) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
13:22:35.0406 1660 ialm - ok
13:22:35.0500 1660 iaStor (309c4d86d989fb1fcf64bd30dc81c51b) C:\WINDOWS\system32\DRIVERS\iaStor.sys
13:22:35.0578 1660 iaStor - ok
13:22:35.0640 1660 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
13:22:35.0828 1660 Imapi - ok
13:22:36.0140 1660 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
13:22:36.0312 1660 ini910u - ok
13:22:37.0265 1660 IntcAzAudAddService (64be56b8858ca0153c725c720ffd194f) C:\WINDOWS\system32\drivers\RtkHDAud.sys
13:22:37.0718 1660 IntcAzAudAddService - ok
13:22:37.0921 1660 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
13:22:38.0125 1660 IntelIde - ok
13:22:38.0156 1660 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
13:22:38.0281 1660 intelppm - ok
13:22:38.0375 1660 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
13:22:38.0562 1660 Ip6Fw - ok
13:22:38.0609 1660 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
13:22:38.0765 1660 IpFilterDriver - ok
13:22:38.0843 1660 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
13:22:39.0015 1660 IpInIp - ok
13:22:39.0156 1660 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
13:22:39.0281 1660 IpNat - ok
13:22:39.0359 1660 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
13:22:39.0515 1660 IPSec - ok
13:22:39.0625 1660 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
13:22:39.0812 1660 irda - ok
13:22:39.0921 1660 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
13:22:40.0093 1660 IRENUM - ok
13:22:40.0218 1660 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
13:22:40.0343 1660 isapnp - ok
13:22:40.0406 1660 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
13:22:40.0593 1660 Kbdclass - ok
13:22:40.0671 1660 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
13:22:40.0875 1660 kmixer - ok
13:22:40.0968 1660 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
13:22:41.0031 1660 KSecDD - ok
13:22:41.0046 1660 lbrtfdc - ok
13:22:41.0109 1660 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys
13:22:41.0140 1660 MBAMProtector - ok
13:22:41.0171 1660 MBAMSwissArmy - ok
13:22:41.0218 1660 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
13:22:41.0375 1660 mnmdd - ok
13:22:41.0468 1660 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
13:22:41.0593 1660 Modem - ok
13:22:41.0609 1660 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
13:22:41.0796 1660 Mouclass - ok
13:22:41.0937 1660 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
13:22:42.0093 1660 mouhid - ok
13:22:42.0234 1660 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
13:22:42.0328 1660 MountMgr - ok
13:22:42.0437 1660 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
13:22:42.0593 1660 mraid35x - ok
13:22:42.0687 1660 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
13:22:42.0812 1660 MRxDAV - ok
13:22:42.0937 1660 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
13:22:43.0031 1660 MRxSmb - ok
13:22:43.0093 1660 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
13:22:43.0203 1660 Msfs - ok
13:22:43.0296 1660 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
13:22:43.0500 1660 MSKSSRV - ok
13:22:43.0593 1660 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
13:22:43.0765 1660 MSPCLOCK - ok
13:22:43.0906 1660 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
13:22:44.0093 1660 MSPQM - ok
13:22:44.0187 1660 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
13:22:44.0296 1660 mssmbios - ok
13:22:44.0375 1660 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
13:22:44.0437 1660 Mup - ok
13:22:44.0468 1660 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
13:22:44.0593 1660 NDIS - ok
13:22:44.0687 1660 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
13:22:44.0734 1660 NdisTapi - ok
13:22:44.0781 1660 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
13:22:44.0968 1660 Ndisuio - ok
13:22:45.0078 1660 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
13:22:45.0234 1660 NdisWan - ok
13:22:45.0343 1660 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
13:22:45.0421 1660 NDProxy - ok
13:22:45.0468 1660 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
13:22:45.0593 1660 NetBIOS - ok
13:22:45.0609 1660 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
13:22:45.0781 1660 NetBT - ok
13:22:45.0937 1660 NETw3x32 (e2f396f71a793a04839dbb6af304a026) C:\WINDOWS\system32\DRIVERS\NETw3x32.sys
13:22:46.0015 1660 NETw3x32 - ok
13:22:46.0093 1660 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
13:22:46.0203 1660 NIC1394 - ok
13:22:46.0250 1660 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
13:22:46.0375 1660 Npfs - ok
13:22:46.0453 1660 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
13:22:46.0593 1660 Ntfs - ok
13:22:46.0703 1660 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
13:22:46.0859 1660 Null - ok
13:22:46.0953 1660 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
13:22:47.0109 1660 NwlnkFlt - ok
13:22:47.0187 1660 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
13:22:47.0343 1660 NwlnkFwd - ok
13:22:47.0453 1660 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
13:22:47.0640 1660 NwlnkIpx - ok
13:22:47.0734 1660 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
13:22:47.0906 1660 NwlnkNb - ok
13:22:47.0968 1660 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
13:22:48.0125 1660 NwlnkSpx - ok
13:22:48.0234 1660 NWRDR (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys
13:22:48.0343 1660 NWRDR - ok
13:22:48.0390 1660 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
13:22:48.0500 1660 ohci1394 - ok
13:22:48.0562 1660 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
13:22:48.0750 1660 Parport - ok
13:22:48.0859 1660 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
13:22:48.0968 1660 PartMgr - ok
13:22:49.0046 1660 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
13:22:49.0203 1660 ParVdm - ok
13:22:49.0296 1660 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
13:22:49.0406 1660 PCI - ok
13:22:49.0421 1660 PCIDump - ok
13:22:49.0468 1660 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
13:22:49.0593 1660 PCIIde - ok
13:22:49.0671 1660 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
13:22:49.0796 1660 Pcmcia - ok
13:22:49.0859 1660 PDCOMP - ok
13:22:49.0875 1660 PDFRAME - ok
13:22:49.0906 1660 PDRELI - ok
13:22:49.0906 1660 PDRFRAME - ok
13:22:49.0953 1660 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
13:22:50.0109 1660 perc2 - ok
13:22:50.0218 1660 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
13:22:50.0359 1660 perc2hib - ok
13:22:50.0484 1660 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
13:22:50.0640 1660 PptpMiniport - ok
13:22:50.0687 1660 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
13:22:50.0890 1660 PSched - ok
13:22:50.0984 1660 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
13:22:51.0140 1660 Ptilink - ok
13:22:51.0203 1660 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
13:22:51.0218 1660 PxHelp20 - ok
13:22:51.0250 1660 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
13:22:51.0406 1660 ql1080 - ok
13:22:51.0500 1660 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
13:22:51.0656 1660 Ql10wnt - ok
13:22:51.0718 1660 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
13:22:51.0875 1660 ql12160 - ok
13:22:51.0937 1660 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
13:22:52.0078 1660 ql1240 - ok
13:22:52.0187 1660 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
13:22:52.0343 1660 ql1280 - ok
13:22:52.0406 1660 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
13:22:52.0562 1660 RasAcd - ok
13:22:52.0687 1660 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
13:22:52.0796 1660 Rasirda - ok
13:22:52.0875 1660 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
13:22:53.0031 1660 Rasl2tp - ok
13:22:53.0140 1660 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
13:22:53.0312 1660 RasPppoe - ok
13:22:53.0406 1660 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
13:22:53.0578 1660 Raspti - ok
13:22:53.0671 1660 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
13:22:53.0796 1660 Rdbss - ok
13:22:53.0890 1660 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
13:22:54.0031 1660 RDPCDD - ok
13:22:54.0125 1660 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
13:22:54.0328 1660 rdpdr - ok
13:22:54.0437 1660 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
13:22:54.0484 1660 RDPWD - ok
13:22:54.0546 1660 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
13:22:54.0734 1660 redbook - ok
13:22:54.0859 1660 S3SavageNB (0dbcc071a268e0340a2ba6bdd98bace4) C:\WINDOWS\system32\DRIVERS\s3gnbm.sys
13:22:55.0015 1660 S3SavageNB - ok
13:22:55.0125 1660 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
13:22:55.0312 1660 Secdrv - ok
13:22:55.0421 1660 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
13:22:55.0593 1660 Serenum - ok
13:22:55.0703 1660 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
13:22:55.0843 1660 Serial - ok
13:22:55.0953 1660 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
13:22:56.0140 1660 Sfloppy - ok
13:22:56.0203 1660 Simbad - ok
13:22:56.0265 1660 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
13:22:56.0453 1660 sisagp - ok
13:22:56.0546 1660 SMCIRDA (d03a4cdb1b089e3f6c23501339506e5e) C:\WINDOWS\system32\DRIVERS\smcirda.sys
13:22:56.0656 1660 SMCIRDA - ok
13:22:56.0734 1660 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
13:22:56.0875 1660 Sparrow - ok
13:22:56.0968 1660 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
13:22:57.0156 1660 splitter - ok
13:22:57.0265 1660 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
13:22:57.0375 1660 sr - ok
13:22:57.0500 1660 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
13:22:57.0562 1660 Srv - ok
13:22:57.0625 1660 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
13:22:57.0828 1660 swenum - ok
13:22:57.0890 1660 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
13:22:58.0078 1660 swmidi - ok
13:22:58.0171 1660 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
13:22:58.0312 1660 symc810 - ok
13:22:58.0390 1660 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
13:22:58.0546 1660 symc8xx - ok
13:22:58.0609 1660 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
13:22:58.0750 1660 sym_hi - ok
13:22:58.0828 1660 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
13:22:58.0968 1660 sym_u3 - ok
13:22:59.0046 1660 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
13:22:59.0203 1660 sysaudio - ok
13:22:59.0312 1660 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
13:22:59.0406 1660 Tcpip - ok
13:22:59.0453 1660 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
13:22:59.0656 1660 TDPIPE - ok
13:22:59.0687 1660 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
13:22:59.0875 1660 TDTCP - ok
13:22:59.0984 1660 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
13:23:00.0171 1660 TermDD - ok
13:23:00.0281 1660 TosIde (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\system32\DRIVERS\toside.sys
13:23:00.0421 1660 TosIde - ok
13:23:00.0562 1660 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
13:23:00.0750 1660 Udfs - ok
13:23:00.0859 1660 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
13:23:00.0968 1660 ultra - ok
13:23:01.0062 1660 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
13:23:01.0281 1660 Update - ok
13:23:01.0390 1660 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
13:23:01.0593 1660 usbehci - ok
13:23:01.0671 1660 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
13:23:01.0859 1660 usbhub - ok
13:23:01.0953 1660 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
13:23:02.0062 1660 USBSTOR - ok
13:23:02.0171 1660 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
13:23:02.0359 1660 usbuhci - ok
13:23:02.0453 1660 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
13:23:02.0656 1660 VgaSave - ok
13:23:02.0687 1660 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
13:23:02.0859 1660 viaagp - ok
13:23:02.0937 1660 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
13:23:03.0125 1660 ViaIde - ok
13:23:03.0234 1660 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
13:23:03.0359 1660 VolSnap - ok
13:23:03.0390 1660 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
13:23:03.0578 1660 Wanarp - ok
13:23:03.0656 1660 WDICA - ok
13:23:03.0703 1660 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
13:23:03.0859 1660 wdmaud - ok
13:23:03.0984 1660 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
13:23:04.0125 1660 WS2IFSL - ok
13:23:04.0234 1660 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
13:23:04.0343 1660 WudfPf - ok
13:23:04.0437 1660 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
13:23:04.0531 1660 WudfRd - ok
13:23:04.0625 1660 yukonwxp (05d48e56ea2612d39a4e7f0ecc17b917) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
13:23:04.0656 1660 yukonwxp - ok
13:23:04.0687 1660 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
13:23:04.0890 1660 \Device\Harddisk0\DR0 - ok
13:23:04.0890 1660 MBR (0x1B8) (ddae9d649db12f6aff24483f2c298989) \Device\Harddisk1\DR2
13:23:04.0984 1660 \Device\Harddisk1\DR2 - ok
13:23:04.0984 1660 Boot (0x1200) (e1659763cfcf661227304dae08fd6bee) \Device\Harddisk0\DR0\Partition0
13:23:04.0984 1660 \Device\Harddisk0\DR0\Partition0 - ok
13:23:05.0000 1660 Boot (0x1200) (ff6211bdb425d5b4507320645a2d295e) \Device\Harddisk1\DR2\Partition0
13:23:05.0000 1660 \Device\Harddisk1\DR2\Partition0 - ok
13:23:05.0000 1660 ============================================================
13:23:05.0000 1660 Scan finished
13:23:05.0000 1660 ============================================================
13:23:05.0109 3460 Detected object count: 6
13:23:05.0109 3460 Actual detected object count: 6
13:23:50.0750 3460 C:\Programme\Fujitsu\BtnHnd\BtnHnd.sys - copied to quarantine
13:23:50.0781 3460 BtnHnd ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
13:23:50.0859 3460 C:\Programme\F-Secure\Anti-Virus\Win2K\FSfilter.sys - copied to quarantine
13:23:50.0890 3460 F-Secure Filter ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
13:23:50.0937 3460 C:\Programme\F-Secure\Anti-Virus\Win2K\FSgk.sys - copied to quarantine
13:23:50.0968 3460 F-Secure Gatekeeper ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
13:23:51.0000 3460 C:\Programme\F-Secure\Anti-Virus\Win2K\FSrec.sys - copied to quarantine
13:23:51.0046 3460 F-Secure Recognizer ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
13:23:51.0156 3460 C:\WINDOWS\system32\drivers\fsdfw.sys - copied to quarantine
13:23:51.0187 3460 FSFW ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
13:23:51.0234 3460 C:\WINDOWS\system32\drivers\f_kp.sys - copied to quarantine
13:23:51.0265 3460 f_kp ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
15:24:29.0109 3256 Deinitialize success

cosinus 29.09.2011 14:41
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

cbr1000 29.09.2011 16:13
Und nun das log von Combofix:

Combofix Logfile:
Code:
ComboFix 11-09-29.02 - Dr.Maria-Anna Kim 29.09.2011  16:44:18.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1014.512 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Desktop\ComboFix.exe
AV: F-Secure Anti-Virus Client Security 6.01 *Disabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Anti-Virus Client Security 6.01 *Disabled* {D4747503-0346-49EB-9262-997542F79BF4}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokume~1\DR015A~1.MAR\LOKALE~1\Temp\IadHide5.dll
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\ngen.exe.2c05686e.ini
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL141.tmp.c0063f75.ini
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL2E8.tmp.b026640c.ini
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL87.tmp.e5b93eca.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\ngen.exe.2c05686e.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL141.tmp.c0063f75.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL2E8.tmp.b026640c.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Anwendungsdaten\ApplicationHistory\SL87.tmp.e5b93eca.ini
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Lokale Einstellungen\Temp\IadHide5.dll
c:\dokumente und einstellungen\Dr.Maria-Anna Kim\WINDOWS
c:\progra~1\FASOOD~1\f_SPs.dll
c:\progra~1\FASOOD~1\fpH.exe
c:\programme\Fasoo DRM
c:\programme\Fasoo DRM\f_blksc.dll
c:\programme\Fasoo DRM\f_cm.dll
c:\programme\Fasoo DRM\f_diag.exe
c:\programme\Fasoo DRM\f_drscan.exe
c:\programme\Fasoo DRM\f_sps.dll
c:\programme\Fasoo DRM\f_swv.dll
c:\programme\Fasoo DRM\f_WEbdm.dll
c:\programme\Fasoo DRM\f_websn.dll
c:\programme\Fasoo DRM\fph.exe
c:\programme\Fasoo DRM\Log\21.log
c:\programme\Fasoo DRM\Log\70.log
c:\programme\google\common\google updater\googleupdaterservice.exe
c:\windows\bwUnin-6.3.2.116-7681197L.exe
c:\windows\ehome\medctrro.exe
c:\windows\f_ProductMgr.exe
c:\windows\f_ProductMgr.ini
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\f_kp.sys
c:\windows\system32\drivers\FSC__PI__LIFEBOOK S7110__FUJITSU_FJNB1B5__Default System BIOS_FUJ - 1210000_Version 1.21 .MRK
c:\windows\system32\f_crypto.dll
c:\windows\system32\f_iurc09.dll
c:\windows\system32\f_iurc12.dll
c:\windows\system32\f_kpi.dll
c:\windows\system32\f_pbrc09.dll
c:\windows\system32\f_pbrc12.dll
c:\windows\system32\f_swrc09.dll
c:\windows\system32\f_swrc12.dll
c:\windows\TEMP\IadHide5.dll
c:\windows\Uninstall.ini
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_f_kp
-------\Service_f_kp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-28 bis 2011-09-29  ))))))))))))))))))))))))))))))
.
.
2011-09-29 13:21 . 2011-09-29 13:21        --------        d-----w-        c:\programme\7-Zip
2011-09-29 12:47 . 2011-09-29 12:47        --------        d-----w-        c:\programme\Microsoft CAPICOM 2.1.0.2
2011-09-29 11:23 . 2011-09-29 11:23        --------        d-----w-        C:\TDSSKiller_Quarantine
2011-09-28 21:34 . 2011-09-28 21:34        --------        d-sh--w-        c:\dokumente und einstellungen\Administrator\IETldCache
2011-09-28 21:23 . 2011-09-28 21:23        --------        d--h--w-        c:\windows\system32\GroupPolicy
2011-09-28 20:59 . 2011-09-28 20:59        --------        d-----w-        C:\_OTL
2011-09-28 17:44 . 2011-09-28 17:44        --------        d-----w-        c:\programme\CCleaner
2011-09-28 17:36 . 2011-09-28 17:36        --------        d-----w-        C:\8d9f9912f9ff686dd6f0de495492
2011-09-27 20:13 . 2011-09-27 20:13        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java
2011-09-27 20:12 . 2011-09-27 20:12        73728        ----a-w-        c:\windows\system32\javacpl.cpl
2011-09-27 20:12 . 2011-09-27 20:12        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-09-27 18:12 . 2011-09-27 18:12        --------        d-----w-        c:\programme\ESET
2011-09-27 17:59 . 2011-09-27 17:59        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-27 16:05 . 2011-09-27 16:05        --------        d-----w-        c:\dokumente und einstellungen\Dr.Maria-Anna Kim\Anwendungsdaten\Malwarebytes
2011-09-27 15:07 . 2011-09-27 15:07        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-09-27 15:07 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-09-27 15:07 . 2011-09-27 15:07        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2011-09-27 14:54 . 2011-09-27 14:54        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\IETldCache
2011-09-27 14:53 . 2011-09-27 14:53        --------        d-----w-        c:\programme\avmwlanstick
2011-09-27 14:53 . 2006-04-05 23:00        97312        ----a-w-        c:\windows\system32\drivers\Fwusb1b.bin
2011-09-27 14:53 . 2011-09-27 14:53        --------        d-----w-        c:\windows\AVM_Driver
2011-09-27 14:53 . 2006-04-05 23:00        55808        ----a-w-        c:\windows\system32\avmadd32.dll
2011-09-27 14:53 . 2006-04-05 23:00        33792        ----a-w-        c:\windows\system32\avmcowlan.dll
2011-09-27 14:53 . 2006-04-05 23:00        264704        ----a-w-        c:\windows\system32\drivers\fwlanusb.sys
2011-09-27 14:53 . 2011-09-27 14:53        --------        d-----w-        c:\dokumente und einstellungen\Dr.Maria-Anna Kim\AVM_Driver
2011-09-09 09:11 . 2011-09-09 09:11        604160        ------w-        c:\windows\system32\dllcache\crypt32.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-09 09:11 . 2006-01-30 19:40        604160        ----a-w-        c:\windows\system32\crypt32.dll
2011-07-15 13:29 . 2006-01-30 19:40        456320        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2006-01-30 19:40        10496        ----a-w-        c:\windows\system32\drivers\ndistapi.sys
2008-04-24 14:26 . 2007-07-22 09:40        122880        ----a-w-        c:\programme\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-15 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-07 16010240]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-03 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-03 118784]
"LoadFUJ02E3"="c:\programme\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-04-20 73728]
"IndicatorUtility"="c:\addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-08-09 81920]
"LoadFujitsuQuickTouch"="c:\addon\Fujitsu\Application Panel\QuickTouch.exe" [2005-07-21 353792]
"LoadBtnHnd"="c:\programme\Fujitsu\BtnHnd\BtnHnd.exe" [2005-07-21 61440]
"AGRSMMSG"="AGRSMMSG.exe" [2006-06-29 89541]
"F-Secure Manager"="c:\programme\F-Secure\Common\FSM32.EXE" [2005-10-26 122929]
"F-Secure TNB"="c:\programme\F-Secure\TNB\TNBUtil.exe" [2004-05-27 684032]
"StatusClient 2.6"="c:\programme\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2005-04-08 151552]
"OrderReminder"="c:\programme\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe" [2007-07-12 98304]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"AVMWlanClient"="c:\programme\avmwlanstick\FRITZWLANMini.exe" [2006-06-23 343552]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
F-Secure Automatic Update.lnk - c:\programme\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-1-17 32807]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\FJWSEL]
2006-06-29 12:45        32768        ----a-w-        c:\windows\system32\FJWSWNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          \0
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^InterVideo WinCinema Manager.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-16 10:45        63712        ----a-w-        c:\programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-16 21:11        49152        ----a-w-        c:\programme\hp\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2007-09-14 09:43        185632        ----a-w-        c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5]
2004-05-20 16:37        188416        ----a-w-        c:\programme\Hewlett-Packard\Toolbox\hpbpsttp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"c:\\Programme\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"=
.
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [17.01.2007 16:18 70896]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [17.01.2007 16:18 32807]
R2 F-Secure Filter;F-Secure File System Filter;c:\programme\F-Secure\Anti-Virus\win2k\FSfilter.sys [17.01.2007 16:18 48816]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\programme\F-Secure\Anti-Virus\win2k\fsgk.sys [17.01.2007 16:18 48256]
R2 F-Secure Recognizer;F-Secure File System Recognizer;c:\programme\F-Secure\Anti-Virus\win2k\FSrec.sys [17.01.2007 16:18 16720]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [27.09.2011 17:07 366152]
R3 FUJ02E1;%FUJ02E1.DeviceDesc%;c:\windows\system32\drivers\FUJ02E1.sys [09.01.2007 11:21 5632]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\drivers\fuj02e3.sys [09.01.2007 11:21 4864]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [27.09.2011 16:53 264704]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27.09.2011 17:07 22216]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [01.02.2010 13:45 135664]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [01.02.2010 13:45 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [30.01.2006 21:41 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper        REG_MULTI_SZ          nosGetPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-01 11:45]
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-01 11:45]
.
2011-09-29 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2007-01-17 14:42]
.
2011-09-29 c:\windows\Tasks\User_Feed_Synchronization-{1EBC1426-FAA4-4422-90BC-2CCB319C66D1}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
IE: &Block this popup - c:\programme\F-Secure\Anti-Spyware\blockpopups.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
DPF: {579CC802-2AF6-436B-8B9C-10F0B6C99FFE} - hxxp://sso.kisti.re.kr/auth/kisti_client.cab
DPF: {6989C944-3529-4DA8-8C60-187E95F580E2} - hxxp://leeum.samsungfoundation.org/book/include/SecuiJoinsIE.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Dr - c:\programme\Fasoo DRM\f_drscan.exe
MSConfigStartUp-FPH Exe - c:\progra~1\FASOOD~1\fph.exe
AddRemove-BackWeb-7681197 Uninstaller - c:\windows\BWUnin-6.3.2.116-7681197L.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-09-29 17:08
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1124)
c:\windows\system32\FJWSWNP.dll
.
- - - - - - - > 'explorer.exe'(3700)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\F-Secure\Anti-Virus\fsgk32st.exe
c:\programme\F-Secure\Anti-Virus\FSGK32.EXE
c:\programme\F-Secure\BackWeb\7681197\program\fsbwsys.exe
c:\programme\F-Secure\Anti-Virus\fssm32.exe
c:\programme\F-Secure\Common\FSMA32.EXE
c:\programme\F-Secure\Common\FSMB32.EXE
c:\programme\Java\jre6\bin\jqs.exe
c:\windows\system32\hpzipm12.exe
c:\programme\F-Secure\Common\FCH32.EXE
c:\programme\F-Secure\Common\FAMEH32.EXE
c:\programme\F-Secure\Common\FNRB32.EXE
c:\programme\F-Secure\Anti-Virus\fsqh.exe
c:\programme\F-Secure\Anti-Virus\fsrw.exe
c:\programme\F-Secure\Common\FIH32.EXE
c:\programme\F-Secure\FWES\Program\fsdfwd.exe
c:\programme\F-Secure\Anti-Virus\fsav32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\AGRSMMSG.exe
c:\progra~1\F-Secure\ANTI-S~1\fsaw.exe
c:\programme\F-Secure\FSGUI\fsguidll.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-29  17:11:28 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-09-29 15:11
.
Vor Suchlauf: 20 Verzeichnis(se), 65.231.802.368 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 65.117.253.632 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 1B5584666CF4BEE1C5B106297DEB4389
--- --- ---

cosinus 29.09.2011 18:51
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:11 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131