Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   50€ - Virus (https://www.trojaner-board.de/107384-50-virus.html)

cosinus 06.01.2012 22:21
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

NSM 06.01.2012 22:43
Nun der TDSS-Killer:

Code:
22:33:57.0580 4452        TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
22:33:57.0798 4452        ============================================================
22:33:57.0798 4452        Current date / time: 2012/01/06 22:33:57.0798
22:33:57.0798 4452        SystemInfo:
22:33:57.0798 4452       
22:33:57.0798 4452        OS Version: 6.1.7601 ServicePack: 1.0
22:33:57.0798 4452        Product type: Workstation
22:33:57.0798 4452        ComputerName: M-HOME
22:33:57.0798 4452        UserName: Nassim
22:33:57.0798 4452        Windows directory: C:\Windows
22:33:57.0798 4452        System windows directory: C:\Windows
22:33:57.0798 4452        Running under WOW64
22:33:57.0798 4452        Processor architecture: Intel x64
22:33:57.0798 4452        Number of processors: 4
22:33:57.0798 4452        Page size: 0x1000
22:33:57.0798 4452        Boot type: Normal boot
22:33:57.0798 4452        ============================================================
22:34:00.0731 4452        Initialize success
22:34:12.0134 3380        ============================================================
22:34:12.0134 3380        Scan started
22:34:12.0134 3380        Mode: Manual; SigCheck; TDLFS;
22:34:12.0134 3380        ============================================================
22:34:12.0540 3380        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
22:34:12.0696 3380        1394ohci - ok
22:34:12.0758 3380        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
22:34:12.0790 3380        ACPI - ok
22:34:12.0805 3380        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
22:34:12.0914 3380        AcpiPmi - ok
22:34:12.0977 3380        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
22:34:13.0008 3380        adp94xx - ok
22:34:13.0039 3380        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
22:34:13.0070 3380        adpahci - ok
22:34:13.0117 3380        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
22:34:13.0133 3380        adpu320 - ok
22:34:13.0242 3380        AFD            (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
22:34:13.0351 3380        AFD - ok
22:34:13.0367 3380        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
22:34:13.0382 3380        agp440 - ok
22:34:13.0398 3380        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
22:34:13.0414 3380        aliide - ok
22:34:13.0460 3380        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
22:34:13.0476 3380        amdide - ok
22:34:13.0492 3380        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
22:34:13.0538 3380        AmdK8 - ok
22:34:13.0757 3380        amdkmdag        (f894bfb5817718d50ce0122b7806b457) C:\Windows\system32\DRIVERS\atikmdag.sys
22:34:14.0053 3380        amdkmdag - ok
22:34:14.0069 3380        amdkmdap        (b12e7be6715f3ee1a913a806f6b0ab94) C:\Windows\system32\DRIVERS\atikmpag.sys
22:34:14.0116 3380        amdkmdap - ok
22:34:14.0131 3380        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
22:34:14.0162 3380        AmdPPM - ok
22:34:14.0209 3380        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
22:34:14.0225 3380        amdsata - ok
22:34:14.0240 3380        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
22:34:14.0272 3380        amdsbs - ok
22:34:14.0303 3380        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
22:34:14.0318 3380        amdxata - ok
22:34:14.0365 3380        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
22:34:14.0568 3380        AppID - ok
22:34:14.0584 3380        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
22:34:14.0615 3380        arc - ok
22:34:14.0630 3380        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
22:34:14.0646 3380        arcsas - ok
22:34:14.0662 3380        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
22:34:14.0880 3380        AsyncMac - ok
22:34:14.0911 3380        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
22:34:14.0911 3380        atapi - ok
22:34:14.0989 3380        athr            (c8679a07267f030704168e45e27c3d43) C:\Windows\system32\DRIVERS\athrx.sys
22:34:15.0114 3380        athr - ok
22:34:15.0176 3380        AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\Windows\system32\drivers\AtihdW76.sys
22:34:15.0270 3380        AtiHDAudioService - ok
22:34:15.0332 3380        avgntflt        (b1224e6b086cd6548315b04ab575a23e) C:\Windows\system32\DRIVERS\avgntflt.sys
22:34:15.0364 3380        avgntflt - ok
22:34:15.0379 3380        avipbb          (ed45f12cfa62b83765c9c1496758cc87) C:\Windows\system32\DRIVERS\avipbb.sys
22:34:15.0395 3380        avipbb - ok
22:34:15.0457 3380        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
22:34:15.0535 3380        b06bdrv - ok
22:34:15.0566 3380        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
22:34:15.0613 3380        b57nd60a - ok
22:34:15.0769 3380        BCM43XX        (85111026f1c5a1c4cce3697f0da7bc1a) C:\Windows\system32\DRIVERS\bcmwl664.sys
22:34:15.0925 3380        BCM43XX - ok
22:34:15.0941 3380        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
22:34:15.0988 3380        Beep - ok
22:34:16.0034 3380        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys
22:34:16.0066 3380        blbdrive - ok
22:34:16.0081 3380        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
22:34:16.0128 3380        bowser - ok
22:34:16.0144 3380        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
22:34:16.0190 3380        BrFiltLo - ok
22:34:16.0206 3380        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
22:34:16.0222 3380        BrFiltUp - ok
22:34:16.0253 3380        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
22:34:16.0315 3380        Brserid - ok
22:34:16.0315 3380        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
22:34:16.0362 3380        BrSerWdm - ok
22:34:16.0362 3380        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
22:34:16.0409 3380        BrUsbMdm - ok
22:34:16.0409 3380        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
22:34:16.0440 3380        BrUsbSer - ok
22:34:16.0456 3380        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
22:34:16.0487 3380        BTHMODEM - ok
22:34:16.0502 3380        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
22:34:16.0534 3380        cdfs - ok
22:34:16.0565 3380        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
22:34:16.0627 3380        cdrom - ok
22:34:16.0658 3380        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
22:34:16.0690 3380        circlass - ok
22:34:16.0736 3380        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
22:34:16.0768 3380        CLFS - ok
22:34:16.0830 3380        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
22:34:16.0877 3380        CmBatt - ok
22:34:16.0892 3380        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
22:34:16.0908 3380        cmdide - ok
22:34:16.0924 3380        CNG            (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
22:34:16.0970 3380        CNG - ok
22:34:17.0017 3380        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
22:34:17.0017 3380        Compbatt - ok
22:34:17.0048 3380        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
22:34:17.0111 3380        CompositeBus - ok
22:34:17.0126 3380        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
22:34:17.0142 3380        crcdisk - ok
22:34:17.0173 3380        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
22:34:17.0236 3380        DfsC - ok
22:34:17.0251 3380        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
22:34:17.0298 3380        discache - ok
22:34:17.0314 3380        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
22:34:17.0345 3380        Disk - ok
22:34:17.0360 3380        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
22:34:17.0407 3380        drmkaud - ok
22:34:17.0454 3380        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
22:34:17.0516 3380        DXGKrnl - ok
22:34:17.0610 3380        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
22:34:17.0719 3380        ebdrv - ok
22:34:17.0766 3380        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
22:34:17.0797 3380        elxstor - ok
22:34:17.0813 3380        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
22:34:17.0875 3380        ErrDev - ok
22:34:17.0891 3380        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
22:34:17.0969 3380        exfat - ok
22:34:17.0984 3380        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
22:34:18.0047 3380        fastfat - ok
22:34:18.0078 3380        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
22:34:18.0125 3380        fdc - ok
22:34:18.0156 3380        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
22:34:18.0172 3380        FileInfo - ok
22:34:18.0187 3380        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
22:34:18.0281 3380        Filetrace - ok
22:34:18.0312 3380        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
22:34:18.0328 3380        flpydisk - ok
22:34:18.0343 3380        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
22:34:18.0359 3380        FltMgr - ok
22:34:18.0390 3380        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
22:34:18.0406 3380        FsDepends - ok
22:34:18.0421 3380        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
22:34:18.0437 3380        Fs_Rec - ok
22:34:18.0468 3380        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
22:34:18.0515 3380        fvevol - ok
22:34:18.0530 3380        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
22:34:18.0562 3380        gagp30kx - ok
22:34:18.0593 3380        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
22:34:18.0655 3380        hcw85cir - ok
22:34:18.0686 3380        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
22:34:18.0749 3380        HdAudAddService - ok
22:34:18.0796 3380        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys
22:34:18.0842 3380        HDAudBus - ok
22:34:18.0842 3380        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
22:34:18.0889 3380        HidBatt - ok
22:34:18.0905 3380        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
22:34:18.0936 3380        HidBth - ok
22:34:18.0967 3380        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
22:34:18.0998 3380        HidIr - ok
22:34:19.0030 3380        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
22:34:19.0076 3380        HidUsb - ok
22:34:19.0092 3380        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
22:34:19.0123 3380        HpSAMD - ok
22:34:19.0139 3380        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
22:34:19.0264 3380        HTTP - ok
22:34:19.0279 3380        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
22:34:19.0295 3380        hwpolicy - ok
22:34:19.0310 3380        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
22:34:19.0342 3380        i8042prt - ok
22:34:19.0373 3380        iaStor          (d469b77687e12fe43e344806740b624d) C:\Windows\system32\drivers\iaStor.sys
22:34:19.0420 3380        iaStor - ok
22:34:19.0498 3380        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
22:34:19.0529 3380        iaStorV - ok
22:34:19.0560 3380        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
22:34:19.0576 3380        iirsp - ok
22:34:19.0669 3380        IntcAzAudAddService (b60accd29f8fafc4a6344cd2bd5ca3a5) C:\Windows\system32\drivers\RTKVHD64.sys
22:34:19.0747 3380        IntcAzAudAddService - ok
22:34:19.0747 3380        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
22:34:19.0763 3380        intelide - ok
22:34:19.0778 3380        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
22:34:19.0810 3380        intelppm - ok
22:34:19.0841 3380        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:34:19.0903 3380        IpFilterDriver - ok
22:34:19.0919 3380        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
22:34:19.0934 3380        IPMIDRV - ok
22:34:19.0934 3380        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
22:34:20.0012 3380        IPNAT - ok
22:34:20.0044 3380        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
22:34:20.0090 3380        IRENUM - ok
22:34:20.0090 3380        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
22:34:20.0106 3380        isapnp - ok
22:34:20.0137 3380        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
22:34:20.0168 3380        iScsiPrt - ok
22:34:20.0200 3380        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
22:34:20.0231 3380        kbdclass - ok
22:34:20.0231 3380        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
22:34:20.0278 3380        kbdhid - ok
22:34:20.0309 3380        KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
22:34:20.0324 3380        KSecDD - ok
22:34:20.0340 3380        KSecPkg        (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
22:34:20.0371 3380        KSecPkg - ok
22:34:20.0402 3380        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
22:34:20.0480 3380        ksthunk - ok
22:34:20.0512 3380        L1C            (0e154da6ca9105354a07d0c576804037) C:\Windows\system32\DRIVERS\L1C62x64.sys
22:34:20.0527 3380        L1C - ok
22:34:20.0574 3380        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
22:34:20.0636 3380        lltdio - ok
22:34:20.0652 3380        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
22:34:20.0668 3380        LSI_FC - ok
22:34:20.0668 3380        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
22:34:20.0683 3380        LSI_SAS - ok
22:34:20.0683 3380        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
22:34:20.0699 3380        LSI_SAS2 - ok
22:34:20.0714 3380        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
22:34:20.0714 3380        LSI_SCSI - ok
22:34:20.0746 3380        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
22:34:20.0824 3380        luafv - ok
22:34:20.0886 3380        MBAMProtector  (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
22:34:20.0902 3380        MBAMProtector - ok
22:34:20.0917 3380        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
22:34:20.0948 3380        megasas - ok
22:34:20.0964 3380        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
22:34:21.0011 3380        MegaSR - ok
22:34:21.0058 3380        MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\drivers\HECIx64.sys
22:34:21.0073 3380        MEIx64 - ok
22:34:21.0089 3380        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
22:34:21.0151 3380        Modem - ok
22:34:21.0182 3380        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
22:34:21.0245 3380        monitor - ok
22:34:21.0260 3380        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
22:34:21.0292 3380        mouclass - ok
22:34:21.0307 3380        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\drivers\mouhid.sys
22:34:21.0338 3380        mouhid - ok
22:34:21.0370 3380        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
22:34:21.0385 3380        mountmgr - ok
22:34:21.0416 3380        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
22:34:21.0432 3380        mpio - ok
22:34:21.0463 3380        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
22:34:21.0526 3380        mpsdrv - ok
22:34:21.0526 3380        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
22:34:21.0588 3380        MRxDAV - ok
22:34:21.0619 3380        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
22:34:21.0682 3380        mrxsmb - ok
22:34:21.0728 3380        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:34:21.0760 3380        mrxsmb10 - ok
22:34:21.0775 3380        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:34:21.0806 3380        mrxsmb20 - ok
22:34:21.0806 3380        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
22:34:21.0838 3380        msahci - ok
22:34:21.0838 3380        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
22:34:21.0869 3380        msdsm - ok
22:34:21.0900 3380        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
22:34:21.0962 3380        Msfs - ok
22:34:21.0978 3380        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
22:34:22.0025 3380        mshidkmdf - ok
22:34:22.0040 3380        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
22:34:22.0056 3380        msisadrv - ok
22:34:22.0087 3380        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
22:34:22.0134 3380        MSKSSRV - ok
22:34:22.0165 3380        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
22:34:22.0243 3380        MSPCLOCK - ok
22:34:22.0259 3380        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
22:34:22.0306 3380        MSPQM - ok
22:34:22.0337 3380        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
22:34:22.0352 3380        MsRPC - ok
22:34:22.0368 3380        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
22:34:22.0384 3380        mssmbios - ok
22:34:22.0384 3380        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
22:34:22.0430 3380        MSTEE - ok
22:34:22.0430 3380        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
22:34:22.0462 3380        MTConfig - ok
22:34:22.0477 3380        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
22:34:22.0477 3380        Mup - ok
22:34:22.0508 3380        mwlPSDFilter    (9b1eac6faf6f37305e822f5588dc8056) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
22:34:22.0524 3380        mwlPSDFilter - ok
22:34:22.0524 3380        mwlPSDNServ    (ad55c1524b296280ed9c6e0d730d35da) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
22:34:22.0540 3380        mwlPSDNServ - ok
22:34:22.0555 3380        mwlPSDVDisk    (2b599e6ec8843637bdd62e7f8f3ba201) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
22:34:22.0555 3380        mwlPSDVDisk - ok
22:34:22.0602 3380        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
22:34:22.0664 3380        NativeWifiP - ok
22:34:22.0711 3380        NDIS            (c38b8ae57f78915905064a9a24dc1586) C:\Windows\system32\drivers\ndis.sys
22:34:22.0789 3380        NDIS - ok
22:34:22.0805 3380        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
22:34:22.0867 3380        NdisCap - ok
22:34:22.0883 3380        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
22:34:22.0961 3380        NdisTapi - ok
22:34:22.0976 3380        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
22:34:23.0070 3380        Ndisuio - ok
22:34:23.0086 3380        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
22:34:23.0179 3380        NdisWan - ok
22:34:23.0210 3380        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
22:34:23.0288 3380        NDProxy - ok
22:34:23.0304 3380        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
22:34:23.0351 3380        NetBIOS - ok
22:34:23.0366 3380        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
22:34:23.0413 3380        NetBT - ok
22:34:23.0460 3380        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
22:34:23.0460 3380        nfrd960 - ok
22:34:23.0507 3380        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
22:34:23.0585 3380        Npfs - ok
22:34:23.0600 3380        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
22:34:23.0663 3380        nsiproxy - ok
22:34:23.0710 3380        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
22:34:23.0803 3380        Ntfs - ok
22:34:23.0834 3380        NTIDrvr        (ee3ba1024594d5d09e314f206b94069e) C:\Windows\system32\drivers\NTIDrvr.sys
22:34:23.0850 3380        NTIDrvr - ok
22:34:23.0866 3380        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
22:34:23.0944 3380        Null - ok
22:34:23.0990 3380        nusb3hub        (786db821bfd57c0551dbbe4f75384a7d) C:\Windows\system32\DRIVERS\nusb3hub.sys
22:34:24.0037 3380        nusb3hub - ok
22:34:24.0068 3380        nusb3xhc        (daa8005caf745042bb427a1ed7433354) C:\Windows\system32\DRIVERS\nusb3xhc.sys
22:34:24.0100 3380        nusb3xhc - ok
22:34:24.0146 3380        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
22:34:24.0178 3380        nvraid - ok
22:34:24.0193 3380        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
22:34:24.0224 3380        nvstor - ok
22:34:24.0256 3380        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
22:34:24.0271 3380        nv_agp - ok
22:34:24.0287 3380        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
22:34:24.0334 3380        ohci1394 - ok
22:34:24.0349 3380        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
22:34:24.0380 3380        Parport - ok
22:34:24.0396 3380        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
22:34:24.0412 3380        partmgr - ok
22:34:24.0427 3380        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
22:34:24.0458 3380        pci - ok
22:34:24.0474 3380        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
22:34:24.0490 3380        pciide - ok
22:34:24.0505 3380        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
22:34:24.0536 3380        pcmcia - ok
22:34:24.0568 3380        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
22:34:24.0583 3380        pcw - ok
22:34:24.0599 3380        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
22:34:24.0692 3380        PEAUTH - ok
22:34:24.0770 3380        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
22:34:24.0817 3380        PptpMiniport - ok
22:34:24.0833 3380        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
22:34:24.0848 3380        Processor - ok
22:34:24.0880 3380        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
22:34:24.0973 3380        Psched - ok
22:34:25.0036 3380        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
22:34:25.0114 3380        ql2300 - ok
22:34:25.0129 3380        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
22:34:25.0145 3380        ql40xx - ok
22:34:25.0176 3380        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
22:34:25.0192 3380        QWAVEdrv - ok
22:34:25.0207 3380        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
22:34:25.0254 3380        RasAcd - ok
22:34:25.0285 3380        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
22:34:25.0316 3380        RasAgileVpn - ok
22:34:25.0332 3380        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
22:34:25.0379 3380        Rasl2tp - ok
22:34:25.0394 3380        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
22:34:25.0457 3380        RasPppoe - ok
22:34:25.0488 3380        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
22:34:25.0535 3380        RasSstp - ok
22:34:25.0550 3380        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
22:34:25.0597 3380        rdbss - ok
22:34:25.0613 3380        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys
22:34:25.0628 3380        rdpbus - ok
22:34:25.0660 3380        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
22:34:25.0706 3380        RDPCDD - ok
22:34:25.0738 3380        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
22:34:25.0800 3380        RDPENCDD - ok
22:34:25.0831 3380        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
22:34:25.0862 3380        RDPREFMP - ok
22:34:25.0878 3380        RDPWD          (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
22:34:25.0925 3380        RDPWD - ok
22:34:25.0925 3380        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
22:34:25.0940 3380        rdyboost - ok
22:34:25.0972 3380        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
22:34:26.0018 3380        rspndr - ok
22:34:26.0065 3380        RSUSBSTOR      (9beb5f18a418ff70659ce2e356829568) C:\Windows\System32\Drivers\RtsUStor.sys
22:34:26.0081 3380        RSUSBSTOR - ok
22:34:26.0112 3380        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
22:34:26.0128 3380        sbp2port - ok
22:34:26.0159 3380        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
22:34:26.0252 3380        scfilter - ok
22:34:26.0299 3380        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
22:34:26.0393 3380        secdrv - ok
22:34:26.0408 3380        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
22:34:26.0440 3380        Serenum - ok
22:34:26.0455 3380        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
22:34:26.0502 3380        Serial - ok
22:34:26.0502 3380        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
22:34:26.0533 3380        sermouse - ok
22:34:26.0549 3380        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
22:34:26.0580 3380        sffdisk - ok
22:34:26.0580 3380        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
22:34:26.0611 3380        sffp_mmc - ok
22:34:26.0611 3380        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
22:34:26.0642 3380        sffp_sd - ok
22:34:26.0642 3380        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
22:34:26.0658 3380        sfloppy - ok
22:34:26.0689 3380        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
22:34:26.0705 3380        SiSRaid2 - ok
22:34:26.0705 3380        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
22:34:26.0720 3380        SiSRaid4 - ok
22:34:26.0752 3380        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
22:34:26.0798 3380        Smb - ok
22:34:26.0845 3380        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
22:34:26.0861 3380        spldr - ok
22:34:26.0908 3380        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
22:34:26.0970 3380        srv - ok
22:34:27.0001 3380        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
22:34:27.0048 3380        srv2 - ok
22:34:27.0079 3380        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
22:34:27.0095 3380        srvnet - ok
22:34:27.0126 3380        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
22:34:27.0142 3380        stexstor - ok
22:34:27.0173 3380        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
22:34:27.0188 3380        swenum - ok
22:34:27.0282 3380        SynTP          (ef51b22706db03f0857fade127c804ec) C:\Windows\system32\DRIVERS\SynTP.sys
22:34:27.0329 3380        SynTP - ok
22:34:27.0407 3380        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
22:34:27.0500 3380        Tcpip - ok
22:34:27.0547 3380        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
22:34:27.0578 3380        TCPIP6 - ok
22:34:27.0610 3380        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
22:34:27.0688 3380        tcpipreg - ok
22:34:27.0719 3380        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
22:34:27.0766 3380        TDPIPE - ok
22:34:27.0766 3380        TDTCP          (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
22:34:27.0797 3380        TDTCP - ok
22:34:27.0812 3380        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
22:34:27.0844 3380        tdx - ok
22:34:27.0859 3380        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
22:34:27.0859 3380        TermDD - ok
22:34:27.0890 3380        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
22:34:27.0922 3380        tssecsrv - ok
22:34:27.0937 3380        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
22:34:27.0968 3380        TsUsbFlt - ok
22:34:27.0984 3380        TsUsbGD        (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
22:34:28.0000 3380        TsUsbGD - ok
22:34:28.0046 3380        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
22:34:28.0125 3380        tunnel - ok
22:34:28.0156 3380        TurboB          (fd24f98d2898be093fe926604be7db99) C:\Windows\system32\DRIVERS\TurboB.sys
22:34:28.0187 3380        TurboB - ok
22:34:28.0218 3380        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
22:34:28.0234 3380        uagp35 - ok
22:34:28.0265 3380        UBHelper        (a17d5e1a6df4eab0a480f2c490de4c9d) C:\Windows\system32\drivers\UBHelper.sys
22:34:28.0281 3380        UBHelper - ok
22:34:28.0296 3380        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
22:34:28.0374 3380        udfs - ok
22:34:28.0405 3380        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
22:34:28.0421 3380        uliagpkx - ok
22:34:28.0437 3380        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
22:34:28.0468 3380        umbus - ok
22:34:28.0468 3380        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
22:34:28.0515 3380        UmPass - ok
22:34:28.0561 3380        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
22:34:28.0608 3380        usbccgp - ok
22:34:28.0624 3380        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
22:34:28.0655 3380        usbcir - ok
22:34:28.0686 3380        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
22:34:28.0733 3380        usbehci - ok
22:34:28.0764 3380        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
22:34:28.0811 3380        usbhub - ok
22:34:28.0827 3380        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
22:34:28.0858 3380        usbohci - ok
22:34:28.0873 3380        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys
22:34:28.0905 3380        usbprint - ok
22:34:28.0920 3380        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:34:28.0983 3380        USBSTOR - ok
22:34:28.0998 3380        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
22:34:29.0045 3380        usbuhci - ok
22:34:29.0076 3380        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys
22:34:29.0139 3380        usbvideo - ok
22:34:29.0185 3380        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
22:34:29.0217 3380        vdrvroot - ok
22:34:29.0232 3380        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
22:34:29.0263 3380        vga - ok
22:34:29.0295 3380        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
22:34:29.0373 3380        VgaSave - ok
22:34:29.0388 3380        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
22:34:29.0404 3380        vhdmp - ok
22:34:29.0419 3380        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
22:34:29.0435 3380        viaide - ok
22:34:29.0451 3380        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
22:34:29.0466 3380        volmgr - ok
22:34:29.0482 3380        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
22:34:29.0513 3380        volmgrx - ok
22:34:29.0513 3380        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
22:34:29.0544 3380        volsnap - ok
22:34:29.0575 3380        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
22:34:29.0591 3380        vsmraid - ok
22:34:29.0622 3380        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
22:34:29.0669 3380        vwifibus - ok
22:34:29.0685 3380        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
22:34:29.0731 3380        vwififlt - ok
22:34:29.0747 3380        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
22:34:29.0778 3380        WacomPen - ok
22:34:29.0794 3380        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
22:34:29.0872 3380        WANARP - ok
22:34:29.0872 3380        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
22:34:29.0903 3380        Wanarpv6 - ok
22:34:29.0919 3380        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
22:34:29.0934 3380        Wd - ok
22:34:29.0950 3380        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
22:34:29.0997 3380        Wdf01000 - ok
22:34:30.0043 3380        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
22:34:30.0090 3380        WfpLwf - ok
22:34:30.0090 3380        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
22:34:30.0106 3380        WIMMount - ok
22:34:30.0153 3380        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
22:34:30.0215 3380        WinUsb - ok
22:34:30.0262 3380        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
22:34:30.0277 3380        WmiAcpi - ok
22:34:30.0340 3380        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
22:34:30.0402 3380        ws2ifsl - ok
22:34:30.0480 3380        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
22:34:30.0574 3380        WudfPf - ok
22:34:30.0605 3380        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
22:34:30.0699 3380        WUDFRd - ok
22:34:30.0730 3380        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
22:34:30.0948 3380        \Device\Harddisk0\DR0 - ok
22:34:30.0948 3380        Boot (0x1200)  (0708f77c7277b5f2cc3f177be5a9ca98) \Device\Harddisk0\DR0\Partition0
22:34:30.0964 3380        \Device\Harddisk0\DR0\Partition0 - ok
22:34:30.0995 3380        Boot (0x1200)  (4dfbffb56f153758a5bbdd68296037ed) \Device\Harddisk0\DR0\Partition1
22:34:30.0995 3380        \Device\Harddisk0\DR0\Partition1 - ok
22:34:30.0995 3380        ============================================================
22:34:30.0995 3380        Scan finished
22:34:30.0995 3380        ============================================================
22:34:31.0011 3460        Detected object count: 0
22:34:31.0011 3460        Actual detected object count: 0
22:37:42.0766 0732        Deinitialize success

cosinus 06.01.2012 23:03
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

NSM 07.01.2012 00:19
Jetzt nun auch die Ergebnisse von ComboFix:

Combofix Logfile:
Code:
ComboFix 12-01-06.03 - Nassim 06.01.2012  23:56:26.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4078.2675 [GMT 1:00]
ausgeführt von:: c:\users\Nassim\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\Nassim\4.0
c:\users\Nassim\AppData\Roaming\AcroIEHelpe.txt
c:\users\Nassim\AppData\Roaming\srvblck2.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-06 bis 2012-01-06  ))))))))))))))))))))))))))))))
.
.
2012-01-06 22:59 . 2012-01-06 22:59        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-06 21:12 . 2011-11-21 11:40        8822856        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{79F39460-387C-4421-89D0-367911E319AD}\mpengine.dll
2012-01-06 21:06 . 2012-01-06 21:06        --------        d-----w-        C:\_OTL
2012-01-05 22:14 . 2012-01-05 22:14        --------        d-----w-        c:\program files (x86)\ESET
2012-01-03 19:58 . 2012-01-03 19:58        --------        d-----w-        c:\users\Nassim\AppData\Roaming\Malwarebytes
2012-01-03 19:58 . 2012-01-03 19:58        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-03 19:58 . 2012-01-03 19:58        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-03 19:58 . 2011-12-10 14:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-12-15 13:14 . 2011-11-04 01:34        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-12-14 14:07 . 2011-11-24 04:52        3145216        ----a-w-        c:\windows\system32\win32k.sys
2011-12-14 14:07 . 2011-10-26 05:21        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2011-12-14 14:07 . 2011-10-15 06:31        723456        ----a-w-        c:\windows\system32\EncDec.dll
2011-12-14 14:07 . 2011-10-15 05:38        534528        ----a-w-        c:\windows\SysWow64\EncDec.dll
2011-12-14 14:07 . 2011-11-05 05:32        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-12-14 14:07 . 2011-11-05 04:26        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-09-28 340336]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-09-17 407920]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-09-17 201584]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-03-09 297280]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-02-08 336384]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-02-03 506712]
"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-02-18 177448]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
c:\users\Nassim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-02-22 873064]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-13 13336]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-01-31 244624]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-03-09 257344]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-10 11785832]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-09 2189416]
"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-02-22 1796200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mStart Page =
mLocal Page =
IE: Free YouTube to MP3 Converter - c:\users\Nassim\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Nassim\AppData\Roaming\Mozilla\Firefox\Profiles\yp0jxmbh.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
c:\program files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-07  00:04:06 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-06 23:04
.
Vor Suchlauf: 10 Verzeichnis(se), 690.752.757.760 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 690.579.378.176 Bytes frei
.
- - End Of File - - 97E85A9080D5B9CB0E4BDAB92BFAF470
--- --- ---

cosinus 07.01.2012 00:22
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

NSM 07.01.2012 00:39
Hier ist der Log von aswMBR:

Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-07 00:29:18
-----------------------------
00:29:18.586    OS Version: Windows x64 6.1.7601 Service Pack 1
00:29:18.586    Number of processors: 4 586 0x2A07
00:29:18.587    ComputerName: M-HOME  UserName: Nassim
00:29:20.010    Initialize success
00:30:40.995    AVAST engine defs: 12010601
00:31:16.095    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
00:31:16.095    Disk 0 Vendor: WDC_WD75 01.0 Size: 715404MB BusType: 3
00:31:16.110    Disk 0 MBR read successfully
00:31:16.110    Disk 0 MBR scan
00:31:16.110    Disk 0 Windows 7 default MBR code
00:31:16.110    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        16384 MB offset 2048
00:31:16.126    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 33556480
00:31:16.142    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      698918 MB offset 33761280
00:31:16.157    Service scanning
00:31:17.156    Modules scanning
00:31:17.156    Disk 0 trace - called modules:
00:31:17.171   
00:31:18.856    AVAST engine scan C:\Windows
00:31:21.914    AVAST engine scan C:\Windows\system32
00:32:18.651    AVAST engine scan C:\Windows\system32\drivers
00:32:25.999    AVAST engine scan C:\Users\Nassim
00:33:01.239    AVAST engine scan C:\ProgramData
00:33:34.015    Scan finished successfully
00:35:36.334    Disk 0 MBR has been saved successfully to "C:\Users\Nassim\Desktop\MBR.dat"
00:35:36.350    The log file has been saved successfully to "C:\Users\Nassim\Desktop\aswMBR.txt"

cosinus 07.01.2012 00:57
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


NSM 07.01.2012 01:53
Zunächst einmal der Log von Malwarebytes:

Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.06.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Nassim :: M-HOME [Administrator]

Schutz: Aktiviert

07.01.2012 01:13:07
mbam-log-2012-01-07 (01-13-07).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 277321
Laufzeit: 26 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 37
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5049\components\AcroFF0498.dll (Trojan.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5050\components\AcroFF0507.dll (Trojan.Passwords) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5051\components\AcroFF0510.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5051\components\AcroFF0515.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5051\components\AcroFF0516.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5051\components\AcroFF0517.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5051\components\AcroFF0518.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5053\components\AcroFF0535.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5053\components\AcroFF0536.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5053\components\AcroFF0537.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5053\components\AcroFF0538.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5054\components\AcroFF0540.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5054\components\AcroFF0545.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5054\components\AcroFF0546.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5054\components\AcroFF0547.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5054\components\AcroFF0548.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5055\components\AcroFF0550.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5055\components\AcroFF0555.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5055\components\AcroFF0556.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5055\components\AcroFF0557.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5055\components\AcroFF0558.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5056\components\AcroFF0560.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5056\components\AcroFF0565.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5056\components\AcroFF0566.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5056\components\AcroFF0567.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5056\components\AcroFF0568.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5058\components\AcroFF0580.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5058\components\AcroFF0585.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5058\components\AcroFF0586.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5058\components\AcroFF0587.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5058\components\AcroFF0588.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5059\components\AcroFF0590.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5059\components\AcroFF0596.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5059\components\AcroFF0597.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5059\components\AcroFF0598.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5060\components\AcroFF0607.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5060\components\AcroFF0608.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

NSM 07.01.2012 02:44
Nun der Log von SuperAntiSpyware:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/07/2012 at 02:36 AM

Application Version : 5.0.1142

Core Rules Database Version : 8112
Trace Rules Database Version: 5924

Scan type      : Complete Scan
Total Scan Time : 00:31:24

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 785
Memory threats detected  : 0
Registry items scanned    : 69813
Registry threats detected : 0
File items scanned        : 166239
File threats detected    : 62

Adware.Tracking Cookie
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\HZJHQ7XP.txt [ /mediaplex.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\835U7ZN0.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\R267N17U.txt [ /doubleclick.net ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\S0WC967Z.txt [ /adfarm1.adition.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\IP5OZ41D.txt [ /imrworldwide.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\Y0SXFMVK.txt [ /questionmarket.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\EBGBR0JK.txt [ /apmebf.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\23T3BGU9.txt [ /bs.serving-sys.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\W7DC20T6.txt [ /serving-sys.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\XJ25QO9G.txt [ /atdmt.com ]
        C:\Users\Nassim\AppData\Roaming\Microsoft\Windows\Cookies\3J1S6J09.txt [ /c.atdmt.com ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\WMM6I93M.txt [ Cookie:nassim@mediaplex.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\L3L3E68L.txt [ Cookie:nassim@content.yieldmanager.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\MLR41OL1.txt [ Cookie:nassim@doubleclick.net/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\MP4IVKO7.txt [ Cookie:nassim@apmebf.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\JC51B7CA.txt [ Cookie:nassim@bs.serving-sys.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\UPLJ3AIV.txt [ Cookie:nassim@serving-sys.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\L69RW15D.txt [ Cookie:nassim@atdmt.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\K1CABP3X.txt [ Cookie:nassim@ad.yieldmanager.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\TO552GWW.txt [ Cookie:nassim@azjmp.com/ ]
        C:\USERS\NASSIM\AppData\Roaming\Microsoft\Windows\Cookies\Low\0WE3DW0Q.txt [ Cookie:nassim@c.atdmt.com/ ]
        C:\USERS\NASSIM\Cookies\HZJHQ7XP.txt [ Cookie:nassim@mediaplex.com/ ]
        C:\USERS\NASSIM\Cookies\835U7ZN0.txt [ Cookie:nassim@ad2.adfarm1.adition.com/ ]
        C:\USERS\NASSIM\Cookies\R267N17U.txt [ Cookie:nassim@doubleclick.net/ ]
        C:\USERS\NASSIM\Cookies\S0WC967Z.txt [ Cookie:nassim@adfarm1.adition.com/ ]
        C:\USERS\NASSIM\Cookies\IP5OZ41D.txt [ Cookie:nassim@imrworldwide.com/cgi-bin ]
        C:\USERS\NASSIM\Cookies\Y0SXFMVK.txt [ Cookie:nassim@questionmarket.com/ ]
        C:\USERS\NASSIM\Cookies\EBGBR0JK.txt [ Cookie:nassim@apmebf.com/ ]
        C:\USERS\NASSIM\Cookies\23T3BGU9.txt [ Cookie:nassim@bs.serving-sys.com/ ]
        C:\USERS\NASSIM\Cookies\W7DC20T6.txt [ Cookie:nassim@serving-sys.com/ ]
        C:\USERS\NASSIM\Cookies\XJ25QO9G.txt [ Cookie:nassim@atdmt.com/ ]
        C:\USERS\NASSIM\Cookies\3J1S6J09.txt [ Cookie:nassim@c.atdmt.com/ ]
        .doubleclick.net [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\NASSIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YP0JXMBH.DEFAULT\COOKIES.SQLITE ]

NSM 07.01.2012 03:51
Hier jetzt noch ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f189c2963f8c044281d9c955d83e7964
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-05 10:21:53
# local_time=2012-01-05 11:21:53 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775166 100 94 825344 62333831 902488 0
# compatibility_mode=5893 16776573 100 94 4780 77431818 0 0
# compatibility_mode=8192 67108863 100 0 3891 3891 0 0
# scanned=586
# found=0
# cleaned=0
# scan_time=146
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f189c2963f8c044281d9c955d83e7964
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-06 04:39:23
# local_time=2012-01-06 05:39:23 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775166 100 94 891270 62399757 968414 0
# compatibility_mode=5893 16776573 100 94 4005 77497744 0 0
# compatibility_mode=8192 67108863 100 0 69817 69817 0 0
# scanned=423
# found=0
# cleaned=0
# scan_time=90
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f189c2963f8c044281d9c955d83e7964
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-06 04:51:23
# local_time=2012-01-06 05:51:23 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=freeze
# scanned=130
# found=0
# cleaned=0
# scan_time=2
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f189c2963f8c044281d9c955d83e7964
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-06 06:42:14
# local_time=2012-01-06 07:42:14 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775166 100 94 893459 62401946 970603 0
# compatibility_mode=5893 16776574 100 94 6194 77499933 0 0
# compatibility_mode=8192 67108863 100 0 72006 72006 0 0
# scanned=254769
# found=87
# cleaned=0
# scan_time=5271
C:\Users\Nassim\AppData\Local\Temp\321.exe        a variant of Win32/Kryptik.YLQ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\fe48b4f-184cd3d9        a variant of Java/Exploit.CVE-2010-4452.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\fe48b4f-24642f4d        a variant of Java/Exploit.CVE-2010-4452.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\fe48b4f-50e871e3        a variant of Java/Exploit.CVE-2010-4452.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\fe48b4f-525151c9        a variant of Java/Exploit.CVE-2010-4452.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\fe48b4f-61bfeafc        a variant of Java/Exploit.CVE-2010-4452.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\fe48b4f-6bb2a5ee        a variant of Java/Exploit.CVE-2010-4452.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\478c76e3-12b9371e        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\3060a771-443cd5a5        a variant of Java/Exploit.CVE-2011-3544.Q trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5049\components\AcroFF0498.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5050\components\AcroFF0507.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5051\components\AcroFF0510.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5051\components\AcroFF0515.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5051\components\AcroFF0516.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5051\components\AcroFF0517.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5051\components\AcroFF0518.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5052\components\AcroFF0520.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5052\components\AcroFF0525.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5052\components\AcroFF0526.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5052\components\AcroFF0527.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5052\components\AcroFF0528.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5053\components\AcroFF0530.dll        Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5053\components\AcroFF0535.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5053\components\AcroFF0536.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5053\components\AcroFF0537.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5053\components\AcroFF0538.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5054\components\AcroFF0540.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5054\components\AcroFF0545.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5054\components\AcroFF0546.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5054\components\AcroFF0547.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5054\components\AcroFF0548.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5055\components\AcroFF0550.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5055\components\AcroFF0555.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5055\components\AcroFF0556.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5055\components\AcroFF0557.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5055\components\AcroFF0558.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5056\components\AcroFF0560.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5056\components\AcroFF0565.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5056\components\AcroFF0566.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5056\components\AcroFF0567.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5056\components\AcroFF0568.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5058\components\AcroFF0580.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5058\components\AcroFF0585.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5058\components\AcroFF0586.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5058\components\AcroFF0587.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5058\components\AcroFF0588.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5059\components\AcroFF0590.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5059\components\AcroFF0596.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5059\components\AcroFF0597.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5059\components\AcroFF0598.dll        Win32/Spy.Banker.XAW trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5060\components\AcroFF0600.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5060\components\AcroFF0605.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5060\components\AcroFF0606.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5060\components\AcroFF0607.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5060\components\AcroFF0608.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5061\components\AcroFF0610.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5061\components\AcroFF0615.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5061\components\AcroFF0616.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5061\components\AcroFF0617.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5061\components\AcroFF0618.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5062\components\AcroFF0620.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5062\components\AcroFF0625.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5062\components\AcroFF0626.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5062\components\AcroFF0627.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5062\components\AcroFF0628.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5063\components\AcroFF0630.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5063\components\AcroFF0635.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5063\components\AcroFF0636.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5063\components\AcroFF0637.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5064\components\AcroFF0640.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5064\components\AcroFF0645.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5064\components\AcroFF0646.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5064\components\AcroFF0647.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Nassim\AppData\Roaming\5064\components\AcroFF0649.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Setup_01c2.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Setup_1d07.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Setup_cb3d.exe        a variant of Win32/MessengerPlus application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Setup_d89b.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_08b6.exe        a variant of Win32/MessengerPlus application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_133a.exe        a variant of Win32/MessengerPlus application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_155d.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_179d.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_33b4.exe        a variant of Win32/MessengerPlus application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_57a3.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_ad5d.exe        a variant of Win32/MessengerPlus application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_be46.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I
E:\sicherung\c\Users\Nassim\AppData\Local\Temp\Update_c6b1.exe        a variant of Win32/MessengerPlus application (unable to clean)        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f189c2963f8c044281d9c955d83e7964
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-07 02:38:11
# local_time=2012-01-07 03:38:11 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775166 100 94 14812 62432696 10756 0
# compatibility_mode=5893 16776573 100 94 0 77530683 0 0
# compatibility_mode=8192 67108863 100 0 102756 102756 0 0
# scanned=108666
# found=28
# cleaned=0
# scan_time=3078
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5052\components\AcroFF0520.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5052\components\AcroFF0525.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5052\components\AcroFF0526.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5052\components\AcroFF0527.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5052\components\AcroFF0528.dll        a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5053\components\AcroFF0530.dll        Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5060\components\AcroFF0600.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5060\components\AcroFF0605.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5060\components\AcroFF0606.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5061\components\AcroFF0610.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5061\components\AcroFF0615.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5061\components\AcroFF0616.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5061\components\AcroFF0617.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5061\components\AcroFF0618.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5062\components\AcroFF0620.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5062\components\AcroFF0625.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5062\components\AcroFF0626.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5062\components\AcroFF0627.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5062\components\AcroFF0628.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5063\components\AcroFF0630.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5063\components\AcroFF0635.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5063\components\AcroFF0636.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5063\components\AcroFF0637.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5064\components\AcroFF0640.dll        probably a variant of Win32/Spy.Banker.WZJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5064\components\AcroFF0645.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5064\components\AcroFF0646.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5064\components\AcroFF0647.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01062012_220621\C_Users\Nassim\AppData\Roaming\5064\components\AcroFF0649.dll        a variant of Win32/Spy.Banker.XBB trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 07.01.2012 04:22
Nur Cookies und isolierte Schädlinge in der Q von OTL.
Kann alles weg.
Rechner soweit wieder im Lot?

NSM 07.01.2012 14:20
Wofür steht das Q und wie mache ich alles weg?
Doch ansonsten läuft mein Laptop wieder und der Virus erscheint nicht. Doch die Funde gestern bzw. heute Nacht haben mich nochmal verunsichert. Sind diese Schädlich?

Außerdem habe ich im allerersten Schritt Emulatoren gewisser Treiber durch defogger deaktiviert. Soll ich diese wieder aktivieren und wenn ja wie, oder sind sie wieder aktiviert?


Wie kann ich mich zukünftig von Viren schützen (Programme, Empfehlungen, ...)?

Ansonsten vielen vielen Dank für deine Hilfe :D

mfG NSM

cosinus 07.01.2012 16:04
Q steht für Quarantäne. Du kannst den gesamten Ordner c:\_OTL löschen

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

NSM 10.01.2012 15:23
Hallo,
komischerweise habe ich einige Tage bevor der Virus erschien vom Flash Player und von Java Updates angezeigt bekommen. Da muss ich wohl in Zukunft auf "OK" drücken ;)

ansonsten habe ich erneut einen Scan mit Malwarebytes sowie mit Avira durchgeführt und "0 Funde" angezeigt bekommen.

Danke nocheinmal für die tolle Hilfe! ;)
mfG NSM


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:17 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27