Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Schwarzer Bildschirm (https://www.trojaner-board.de/112852-schwarzer-bildschirm.html)

bl4cky 01.04.2012 13:55
Schwarzer Bildschirm
 
Hey zusammen, ich hab mir letztens n video angeguckt und plötzlich wurde mein bildschirm schwarz und internetexplorer hat sich von alleine geöffnet und wollte auf ne seite die als schädlich eingestuft wurde. erstmal pc neugestarrtet,aber hilft nix, kurz nach dem hochfahren ist nochh alles okay, 2-3 sec später wird der bildschirm komplett schwarz und ich seh nix mehr außer einem fenster indem der desktop angezeigt wird. wiederherstellung at auch nicht geklappt. Kaspersky oder taskmanager lassen sich nciht mal öffnen!
bitte um schnelle hilfe
mfg blacky

markusg 02.04.2012 09:03
hi
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

bl4cky 03.04.2012 22:52
hey, erstmal danke für die antwort, aber ich glaub ich habs wieder hinbekommen.
hab mir auf ne cd linux gepackt und dann von der cd gebootet und dann über linux nen antiviren guard laufen lassender auch erstaml das ein oder andere gefunden hat. natürlich hab ich auch alle externen festplatten (platten die zu der zeit im netzt aktiv waren) etc überprüft.
denk ihr das reicht? lg

markusg 04.04.2012 12:36
woher soll ich das ohne fundmeldungen sagen?
wo ist das log?
und, wenn man schon irgendwo nach hilfe fragt, sollte man dann auch das tun was da steht. ich hab keine lust und vor allem keine zeit anweisungen zu schreiben die nicht ausgeführt werden.

bl4cky 05.04.2012 18:33
dachte das evtl meine maßnahmen ausreichen würden und ich das evtl nicht mehr amchen müsste...
also hier die files. extra ist im anhang, otl file war zu groß daher poste ichd as hier:OTL Logfile:
Code:
OTL logfile created on: 05.04.2012 16:31:57 - Run 1
OTL by OldTimer - Version 3.2.39.2    Folder = C:\Users\David_2\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,77% Memory free
6,00 Gb Paging File | 4,54 Gb Available in Paging File | 75,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 228,82 Gb Total Space | 10,13 Gb Free Space | 4,43% Space Free | Partition Type: NTFS
Drive D: | 229,13 Gb Total Space | 12,26 Gb Free Space | 5,35% Space Free | Partition Type: NTFS
Drive E: | 79,25 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: DAVESHAVE | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\David_2\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrB.exe ()
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\qtgui4.dll ()
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\qtsql4.dll ()
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\qtscript4.dll ()
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\qtnetwork4.dll ()
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\qtcore4.dll ()
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\qtdeclarative4.dll ()
MOD - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (PnkBstrB) -- C:\Windows\SysWow64\PnkBstrB.exe ()
SRV - (PnkBstrA) -- C:\Windows\SysWow64\PnkBstrA.exe ()
SRV - (Sony Ericsson PCCompanion) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (AVP) -- C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SgtSch2Svc) -- C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe (Seagate)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Brother XP spl Service) -- C:\Windows\SysWOW64\brsvc01a.exe (brother Industries Ltd)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (seehcri) -- C:\Windows\SysNative\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tdrpman174) Acronis Try&Decide and Restore Points filter (build 174) -- C:\Windows\SysNative\drivers\tdrpm174.sys (Acronis)
DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (snapman380) Acronis Snapshots Manager (Build 380) -- C:\Windows\SysNative\drivers\snman380.sys (Acronis)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (RTL8187B) -- C:\Windows\SysNative\drivers\wg111v3.sys (NETGEAR Inc.                          )
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1018unic.sys (MCCI Corporation)
DRV:64bit: - (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1018mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1018bus) Sony Ericsson Device 1018 driver (WDM) -- C:\Windows\SysNative\drivers\s1018bus.sys (MCCI Corporation)
DRV:64bit: - (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1018nd5.sys (MCCI Corporation)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (adfs) -- C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Reg Error: Value error.
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Reg Error: Value error.
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = Reg Error: Value error.
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Reg Error: Value error.
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Reg Error: Value error.
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Reg Error: Value error.
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = Reg Error: Value error.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Reg Error: Value error.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Reg Error: Value error.
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.2
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}:6.0.27
FF - prefs.js..extensions.enabledItems: virtualKeyboard@kaspersky.ru:12.0.0.441
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:12.0.0.441
FF - prefs.js..extensions.enabledItems: KavAntiBanner@Kaspersky.ru:12.0.0.441
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Software\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Software\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Components: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{8C17574E-F5C5-41b8-8B36-333FC7E67980}: Reg Error: Value error. File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{FD9B3EC6-8265-41fb-8A2F-4C5A22A95A7B}: Reg Error: Value error. File not found
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Components: C:\Software\Mozilla Firefox\components [2012.03.16 11:18:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Plugins: C:\Software\Mozilla Firefox\plugins [2011.12.03 16:44:30 | 000,000,000 | ---D | M]
 
[2010.03.20 14:44:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Extensions
[2010.03.20 14:44:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.02.05 15:16:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\aivyvp0o.default\extensions
[2012.02.05 15:16:03 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\aivyvp0o.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.04.03 01:25:26 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\aivyvp0o.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011.04.03 01:25:26 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\aivyvp0o.default\extensions\engine@conduit.com
 
O1 HOSTS File: ([2012.02.13 23:16:29 | 000,000,852 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 74.208.10.249 gs.apple.com
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\Direct3DVideoOutput.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\Direct3DVideoOutput.dll (DivX, Inc.)
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\DivXDeinterlaceFilter.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\DivXDeinterlaceFilter.dll (DivX, Inc.)
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\DivXPlaybackModule.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\DivXPlaybackModule.dll (DivX, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Software\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - ftp Prefix: missing
O1364bit: - gopher Prefix: missing
O1364bit: - home Prefix: missing
O1364bit: - mosaic Prefix: missing
O1364bit: - www Prefix: missing
O13 - ftp Prefix: missing
O13 - gopher Prefix: missing
O13 - home Prefix: missing
O13 - mosaic Prefix: missing
O13 - www Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F854221-51A3-4516-8274-DBB3AD0A00E7}: NameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL ()
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL ()
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.03.20 17:42:25 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{f24ec682-31f7-11df-a962-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f24ec682-31f7-11df-a962-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRun.exe --autorun
O33 - MountPoints2\{f24ec682-31f7-11df-a962-806e6f6e6963}\Shell\autorun_0\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{f24ec682-31f7-11df-a962-806e6f6e6963}\Shell\autorun_1\command - "" = E:\Gothic2-Setup.exe
O33 - MountPoints2\{f24ec682-31f7-11df-a962-806e6f6e6963}\Shell\autorun_2\command - "" = notepad ReadMe.txt
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.05 14:38:23 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.05 14:38:23 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.05 14:35:08 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.04.05 14:35:08 | 000,656,044 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.04.05 14:35:08 | 000,616,590 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.04.05 14:35:08 | 000,130,676 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.04.05 14:35:08 | 000,106,970 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.04.05 14:30:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.05 14:30:41 | 2415,517,696 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.03 23:43:19 | 005,006,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2011.08.28 17:18:45 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2011.05.25 11:49:57 | 000,007,653 | ---- | C] () -- C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2011.01.22 18:30:05 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.01.22 18:20:52 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.10.12 05:40:10 | 000,107,832 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.05.29 18:41:13 | 000,682,280 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.05.29 18:41:13 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010.05.03 17:56:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2010.03.26 20:11:57 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\InterTrust
[2010.03.17 23:25:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\JavaEditor
[2010.08.02 16:34:43 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\MyPhoneExplorer
[2011.05.28 14:37:53 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PyScripter
[2010.03.17 23:16:53 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Scooter Software
[2010.03.20 14:44:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Thunderbird
[2011.02.20 14:42:25 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TuneUp Software
[2011.12.23 15:02:16 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2011.02.20 14:48:38 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.06.25 23:56:14 | 000,000,000 | ---D | M] -- C:\0acaea9987d8f1ab869489
[2011.08.11 04:28:21 | 000,000,000 | ---D | M] -- C:\Call of Duty 4 - Modern Warfare
[2012.03.29 16:15:27 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2012.03.30 18:20:42 | 000,000,000 | ---D | M] -- C:\dll music
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.03.17 21:39:52 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.10.28 15:12:49 | 000,000,000 | -HSD | M] -- C:\found.000
[2010.10.12 03:30:47 | 000,000,000 | ---D | M] -- C:\Fruity_Loops_setup
[2010.12.18 15:20:17 | 000,000,000 | ---D | M] -- C:\handy karte
[2012.01.12 21:06:56 | 000,000,000 | ---D | M] -- C:\jonas
[2012.02.05 15:19:00 | 000,000,000 | ---D | M] -- C:\Macromedia
[2011.02.12 19:35:52 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2010.03.17 21:44:54 | 000,000,000 | ---D | M] -- C:\OEMSettings
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.01.20 16:23:26 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.08 17:48:46 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.01.20 16:10:23 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.03.17 21:39:52 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.04.03 03:05:11 | 000,000,000 | ---D | M] -- C:\Recover4all Pro 2.53
[2010.03.17 21:39:52 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.03.07 19:33:19 | 000,000,000 | ---D | M] -- C:\Software
[2011.03.16 16:37:48 | 000,000,000 | ---D | M] -- C:\Spiele
[2012.04.05 15:49:10 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.04.26 23:04:24 | 000,000,000 | R--D | M] -- C:\Users
[2012.04.02 14:30:50 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2009.12.20 00:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Software\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.04.05 15:44:00 | 002,621,440 | -HS- | M] () -- C:\Users\David\ntuser.dat
[2012.04.05 15:44:00 | 000,262,144 | -HS- | M] () -- C:\Users\David\ntuser.dat.LOG1
[2010.03.17 21:40:00 | 000,000,000 | -HS- | M] () -- C:\Users\David\ntuser.dat.LOG2
[2011.02.21 16:47:22 | 000,000,000 | -HS- | M] () -- C:\Users\David\NTUSER.DAT_tureg_new.LOG1
[2011.02.21 16:47:22 | 000,000,000 | -HS- | M] () -- C:\Users\David\NTUSER.DAT_tureg_new.LOG2
[2011.02.21 16:47:26 | 002,621,440 | -HS- | M] () -- C:\Users\David\NTUSER.DAT_tureg_old
[2010.03.17 21:56:30 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.03.17 21:56:30 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.03.17 21:56:30 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011.02.21 17:24:59 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{0666402c-3dc9-11e0-ba52-806e6f6e6963}.TM.blf
[2011.02.21 17:24:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{0666402c-3dc9-11e0-ba52-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2011.02.21 17:24:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{0666402c-3dc9-11e0-ba52-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2010.09.22 16:30:59 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1841c7a1-c655-11df-b07c-001c25321542}.TM.blf
[2010.09.22 16:30:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1841c7a1-c655-11df-b07c-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.09.22 16:30:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1841c7a1-c655-11df-b07c-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.11.16 17:17:34 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{18b7f98d-1044-11e1-ac6f-001c25321542}.TM.blf
[2011.11.16 17:17:34 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{18b7f98d-1044-11e1-ac6f-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.11.16 17:17:34 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{18b7f98d-1044-11e1-ac6f-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.05.28 14:37:39 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1bde67ff-891d-11e0-8244-001c25321542}.TM.blf
[2011.05.28 14:37:38 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1bde67ff-891d-11e0-8244-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.05.28 14:37:39 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1bde67ff-891d-11e0-8244-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.07.10 21:11:26 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1de177ac-8c53-11df-9e6f-001c25321542}.TM.blf
[2010.07.10 21:11:26 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1de177ac-8c53-11df-9e6f-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.07.10 21:11:26 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{1de177ac-8c53-11df-9e6f-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2012.04.05 15:43:19 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{243aef58-7f1b-11e1-b637-001c25321542}.TM.blf
[2012.04.05 15:43:19 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{243aef58-7f1b-11e1-b637-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2012.04.05 15:43:19 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{243aef58-7f1b-11e1-b637-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.10.12 15:14:29 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{257027b4-d5ff-11df-9af0-001c25321542}.TM.blf
[2010.10.12 15:14:29 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{257027b4-d5ff-11df-9af0-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.10.12 15:14:29 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{257027b4-d5ff-11df-9af0-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.04.21 22:47:02 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{2a3c3e03-4d46-11df-a4ea-001c25321542}.TM.blf
[2010.04.21 22:47:02 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{2a3c3e03-4d46-11df-a4ea-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.04.21 22:47:02 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{2a3c3e03-4d46-11df-a4ea-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.09.17 14:57:24 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{2f9ca404-c25a-11df-aab3-001c25321542}.TM.blf
[2010.09.17 14:57:24 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{2f9ca404-c25a-11df-aab3-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.09.17 14:57:24 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{2f9ca404-c25a-11df-aab3-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.04.01 14:22:21 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{3fa56a39-5c5a-11e0-8e31-001c25321542}.TM.blf
[2011.04.01 14:22:21 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{3fa56a39-5c5a-11e0-8e31-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.04.01 14:22:21 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{3fa56a39-5c5a-11e0-8e31-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.08.04 04:07:36 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{44f0bbf4-9f66-11df-9575-001c25321542}.TM.blf
[2010.08.04 04:07:35 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{44f0bbf4-9f66-11df-9575-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.08.04 04:07:35 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{44f0bbf4-9f66-11df-9575-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.12.01 16:13:51 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{4541bb86-fd54-11df-8b84-001c25321542}.TM.blf
[2010.12.01 16:13:51 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{4541bb86-fd54-11df-8b84-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.12.01 16:13:51 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{4541bb86-fd54-11df-8b84-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.04.14 18:19:46 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{4b3f581e-47d6-11df-9799-001c25321542}.TM.blf
[2010.04.14 18:19:46 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{4b3f581e-47d6-11df-9799-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.04.14 18:19:46 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{4b3f581e-47d6-11df-9799-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.07.31 16:32:21 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{52ba6427-9ca5-11df-b9cf-001c25321542}.TM.blf
[2010.07.31 16:32:21 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{52ba6427-9ca5-11df-b9cf-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.07.31 16:32:21 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{52ba6427-9ca5-11df-b9cf-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2012.03.25 01:09:30 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{5ec4bb60-75bf-11e1-9582-001c25321542}.TM.blf
[2012.03.25 01:09:30 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{5ec4bb60-75bf-11e1-9582-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2012.03.25 01:09:30 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{5ec4bb60-75bf-11e1-9582-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2012.01.15 15:09:38 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{7432d1f8-3f70-11e1-bf0e-001c25321542}.TM.blf
[2012.01.15 15:09:38 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{7432d1f8-3f70-11e1-bf0e-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2012.01.15 15:09:38 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{7432d1f8-3f70-11e1-bf0e-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2012.02.04 00:59:36 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{754cabd1-4eba-11e1-8f92-001c25321542}.TM.blf
[2012.02.04 00:59:36 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{754cabd1-4eba-11e1-8f92-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2012.02.04 00:59:36 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{754cabd1-4eba-11e1-8f92-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2012.03.09 18:10:13 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{7add300d-69f7-11e1-b1f4-001c25321542}.TM.blf
[2012.03.09 18:10:13 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{7add300d-69f7-11e1-b1f4-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2012.03.09 18:10:13 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{7add300d-69f7-11e1-b1f4-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2012.01.20 16:23:19 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{7fba3a74-436e-11e1-b85a-001c25321542}.TM.blf
[2012.01.20 16:23:19 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{7fba3a74-436e-11e1-b85a-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2012.01.20 16:23:19 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{7fba3a74-436e-11e1-b85a-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.09.21 14:54:41 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{806f48bd-c57e-11df-bc10-001c25321542}.TM.blf
[2010.09.21 14:54:41 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{806f48bd-c57e-11df-bc10-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.09.21 14:54:41 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{806f48bd-c57e-11df-bc10-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.10.21 18:28:29 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{8583fb1b-fbf1-11e0-929c-001c25321542}.TM.blf
[2011.10.21 18:28:29 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{8583fb1b-fbf1-11e0-929c-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.10.21 18:28:29 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{8583fb1b-fbf1-11e0-929c-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.02.24 05:07:05 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{8b6f0113-3fbc-11e0-9730-001c25321542}.TM.blf
[2011.02.24 05:07:05 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{8b6f0113-3fbc-11e0-9730-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.02.24 05:07:05 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{8b6f0113-3fbc-11e0-9730-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.12.30 08:11:59 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{92cd3894-32ac-11e1-8590-001c25321542}.TM.blf
[2011.12.30 08:11:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{92cd3894-32ac-11e1-8590-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.12.30 08:11:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{92cd3894-32ac-11e1-8590-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.12.29 17:12:30 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{94de939d-3218-11e1-af48-001c25321542}.TM.blf
[2011.12.29 17:12:30 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{94de939d-3218-11e1-af48-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.12.29 17:12:30 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{94de939d-3218-11e1-af48-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.09.02 17:27:38 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{a6c917fc-d577-11e0-987b-001c25321542}.TM.blf
[2011.09.02 17:27:38 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{a6c917fc-d577-11e0-987b-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.09.02 17:27:38 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{a6c917fc-d577-11e0-987b-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.09.20 15:33:15 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{acc3f2a2-c4ba-11df-bb3e-001c25321542}.TM.blf
[2010.09.20 15:33:15 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{acc3f2a2-c4ba-11df-bb3e-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.09.20 15:33:15 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{acc3f2a2-c4ba-11df-bb3e-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.07.21 15:28:59 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{af344838-b39c-11e0-bd4c-001b2f32e49f}.TM.blf
[2011.07.21 15:28:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{af344838-b39c-11e0-bd4c-001b2f32e49f}.TMContainer00000000000000000001.regtrans-ms
[2011.07.21 15:28:59 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{af344838-b39c-11e0-bd4c-001b2f32e49f}.TMContainer00000000000000000002.regtrans-ms
[2011.07.31 15:49:37 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{af3448bc-b39c-11e0-bd4c-001b2f32e49f}.TM.blf
[2011.07.31 15:49:37 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{af3448bc-b39c-11e0-bd4c-001b2f32e49f}.TMContainer00000000000000000001.regtrans-ms
[2011.07.31 15:49:37 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{af3448bc-b39c-11e0-bd4c-001b2f32e49f}.TMContainer00000000000000000002.regtrans-ms
[2011.09.01 13:03:22 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{c7edc460-d482-11e0-a3c8-001c25321542}.TM.blf
[2011.09.01 13:03:22 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{c7edc460-d482-11e0-a3c8-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.09.01 13:03:22 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{c7edc460-d482-11e0-a3c8-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.04.27 21:48:14 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{ca5fff1d-70e1-11e0-a16f-001c25321542}.TM.blf
[2011.04.27 21:48:14 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{ca5fff1d-70e1-11e0-a16f-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.04.27 21:48:14 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{ca5fff1d-70e1-11e0-a16f-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.09.25 00:52:12 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{cf19831e-c7d6-11df-95d2-001c25321542}.TM.blf
[2010.09.25 00:52:12 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{cf19831e-c7d6-11df-95d2-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.09.25 00:52:12 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{cf19831e-c7d6-11df-95d2-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.11.01 18:16:57 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{d748e020-048b-11e1-8eb9-001c25321542}.TM.blf
[2011.11.01 18:16:57 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{d748e020-048b-11e1-8eb9-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.11.01 18:16:57 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{d748e020-048b-11e1-8eb9-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.10.14 13:33:13 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{d94c8e74-d784-11df-974b-001c25321542}.TM.blf
[2010.10.14 13:33:13 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{d94c8e74-d784-11df-974b-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.10.14 13:33:13 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{d94c8e74-d784-11df-974b-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.11.27 20:13:56 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{da77a67d-fa20-11df-8570-001c25321542}.TM.blf
[2010.11.27 20:13:55 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{da77a67d-fa20-11df-8570-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.11.27 20:13:55 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{da77a67d-fa20-11df-8570-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.10.20 19:14:18 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{dbcb3b17-dc6c-11df-9036-001c25321542}.TM.blf
[2010.10.20 19:14:18 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{dbcb3b17-dc6c-11df-9036-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.10.20 19:14:18 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{dbcb3b17-dc6c-11df-9036-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.03.13 21:46:05 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{e89b2cd0-4d62-11e0-84a2-001c25321542}.TM.blf
[2011.03.13 21:46:05 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{e89b2cd0-4d62-11e0-84a2-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.03.13 21:46:05 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{e89b2cd0-4d62-11e0-84a2-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.08.22 00:29:04 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{f1873005-cbe6-11e0-8993-001c25321542}.TM.blf
[2011.08.22 00:29:04 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{f1873005-cbe6-11e0-8993-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2011.08.22 00:29:04 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{f1873005-cbe6-11e0-8993-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2010.09.01 18:01:52 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{f494dfc6-b5c8-11df-8c54-001c25321542}.TM.blf
[2010.09.01 18:01:51 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{f494dfc6-b5c8-11df-8c54-001c25321542}.TMContainer00000000000000000001.regtrans-ms
[2010.09.01 18:01:52 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{f494dfc6-b5c8-11df-8c54-001c25321542}.TMContainer00000000000000000002.regtrans-ms
[2011.03.21 17:29:00 | 000,065,536 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{f76faf65-53c1-11e0-9bdb-001b2f32e49f}.TM.blf
[2011.03.21 17:29:00 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{f76faf65-53c1-11e0-9bdb-001b2f32e49f}.TMContainer00000000000000000001.regtrans-ms
[2011.03.21 17:29:00 | 000,524,288 | -HS- | M] () -- C:\Users\David\NTUSER.DAT{f76faf65-53c1-11e0-9bdb-001b2f32e49f}.TMContainer00000000000000000002.regtrans-ms
[2010.03.17 21:40:00 | 000,000,020 | -HS- | M] () -- C:\Users\David\ntuser.ini
[2012.02.13 22:15:31 | 000,000,287 | ---- | M] () -- C:\Users\David\umbrella0.log
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<          >

< End of report >
--- --- ---

markusg 06.04.2012 16:19
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

bl4cky 07.04.2012 19:04
hey,also ich hab das gemacht wie du gesagt hast und combofix hat auch was gefunden nur als ich dann den pc wieder hochgefahren hat hat combofix verrücktgespielt und immer weiter fenster geöffnet! ne combofix.txt datei ahb ich auch nciht gefunden. was ist da falsch gelaufen? soll ichs einfach nochmal komplett von vorn machen?

bl4cky 09.04.2012 17:30
hier ist das file

markusg 11.04.2012 17:14
öffne mal computer, c: qoobox.
packe den ordner quarantain, lade ihn im upload channel hoch und sage mir, wenn dies erledigt ist, danke
Trojaner-Board Upload Channel

bl4cky 12.04.2012 23:33
hab ich gemacht

markusg 13.04.2012 16:26
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

bl4cky 14.04.2012 15:26
hier ist das log

markusg 14.04.2012 16:12
ok passt.
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

bl4cky 21.04.2012 20:41
lässt sich nicht installieren =/
"Interner Fehler: Failed to expand shell folder constant 'userappdata' "

und nun?

markusg 22.04.2012 19:41
wie sihets im abgesicherten modus mit netzwerk aus?


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:35 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131