Trojaner-Board - Probleme nach Trojaner und Systemwiederherstellung

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Probleme nach Trojaner und Systemwiederherstellung (https://www.trojaner-board.de/96800-probleme-trojaner-systemwiederherstellung.html)

Probleme nach Trojaner und Systemwiederherstellung

Hallo,
ich habe ziemliche Probleme mit meinem Laptop. Es fing damit an, dass gestern abend, als ich im Internet gesurft habe, plötzlich Windows Recovery da war ( habe das Programm vorher noch nie auf dem Laptop gesehen) und mir 5 Probleme gemeldet hat, die sich nicht beheben ließen.( Ich weiß leider nicht mehr genau wie sie hießen, irgendwas mit "hard disc error" und "RAM Memory failure").

Nachdem also Windows Recovery zum ersten Mal erschienen ist, wurde der Laptop neu gestartet und als er wieder raufgefahren war, war das Hintergrundbild weg und so ziemlich alle Desktop Icons waren weg.
Weil das Internet aber noch ging, habe ich "Windows Recovery" gegoogelt und habe gesehen, dass es ein Trojaner ist.
Dann habe ich blöderweiße Spyhunter4 runtergeladen und habe leider zu spät gesehen, dass auch das ein Fakeprogramm ist.

Jetzt habe ich eine Systemwiederherstellung (5 Tage zurück)gemacht. Das Hintergrundbild und die Desktop Icons sind wieder da und Windows Recovery und Spyhunter werden nicht mehr angezeigt.

Jetzt habe ich folgende Probleme:

1.Die Bilderordner werden wieder angezeigt, wenn ich in den Überordner "Bilder" reingehe werden auch alle Unterordner angezeigt (auf den Unterordnern sind auch diese Vorschaubilder zu sehen, wenn ich dann aber einen Ordner anklicke steht da "Dieser Ordner ist leer"

2. Dasselbe Probleme bei den Ordnern mit den Liedern, aber wenn ich Winamp aufmache kann ich mir die Lieder von der Playlist die zuletzt draufwar anhören (eine andere Playlist lässt sich nicht laden, da auch die Dateien im Dokumente Ordner nicht mehr da sind)

3. Wenn ich versuche Pokerstars zu öffnen bekomme ich folgenede Meldung:
"Unable to get latest Software Version from the Server"

Das sind bis jetzt die 3 Probleme die mir aufgefallen sind.

Ich weiß jetzt nicht mehr weiter. Ist der Trojaner überhaupt weg? Oder ist er noch da und deswegen diese Probleme?
Kenne mich nicht so besonders gut aus, ich hoffe ich hab es verständlich geschrieben und hoffe, dass mir jemand helfen kann!

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Danke :)
Also hier die Mbam Datei:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6153

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

24.03.2011 16:50:29
mbam-log-2011-03-24 (16-50-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 267952
Laufzeit: 49 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

und die OTL:OTL Logfile:

Code:

OTL logfile created on: 24.03.2011 16:51:01 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 38,00% Memory free

5,00 Gb Paging File | 3,00 Gb Available in Paging File | 70,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 94,16 Gb Total Space | 33,10 Gb Free Space | 35,16% Space Free | Partition Type: NTFS

Drive D: | 195,14 Gb Total Space | 195,05 Gb Free Space | 99,95% Space Free | Partition Type: NTFS

 

Computer Name: *** | User Name: ***| Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()

PRC - C:\Programme\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)

PRC - C:\Programme\Winamp\winamp.exe (Nullsoft)

PRC - C:\Programme\Winamp\winampa.exe ()

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

PRC - C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)

PRC - C:\Programme\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)

PRC - C:\Programme\Launch Manager\WisKeyState.exe (Wistron Corp.)

PRC - C:\Programme\Launch Manager\OSD.exe (Wistron Corp.)

PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)

PRC - C:\Programme\Launch Manager\WisLMSvc.exe (Wistron Corp.)

PRC - C:\Programme\Launch Manager\OSDCtrl.exe ()

PRC - C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()

SRV - (TestHandler) -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (WisLMSvc) -- C:\Program Files\Launch Manager\WisLMSvc.exe (Wistron Corp.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.)

DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)

DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)

DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)

DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )

DRV - (Hotkey) -- C:\Windows\System32\drivers\HOTKEY.sys ()

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9

FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.09 09:17:21 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.09 09:17:21 | 000,000,000 | ---D | M]

 

[2009.09.12 18:45:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2009.04.22 15:46:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org

[2011.03.24 13:51:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions

[2011.03.24 13:35:47 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.03.24 13:35:47 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.03.24 13:35:47 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.03.24 13:35:47 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.03.24 13:35:47 | 000,000,000 | ---D | M] (Personas) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\personas@christopher.beard

[2011.03.23 12:26:33 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-1.xml

[2010.12.11 10:07:23 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-2.xml

[2010.12.17 13:03:21 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-3.xml

[2011.03.14 17:56:30 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-4.xml

[2010.05.12 17:40:48 | 000,001,042 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin.xml

[2010.07.17 18:00:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.07.17 18:00:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2010.10.28 21:42:09 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.10.28 21:42:09 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.10.28 21:42:09 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.10.28 21:42:09 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.10.28 21:42:09 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

O4 - HKLM..\Run: [FSCRecovery] c:\Programme\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe (Fujitsu Siemens Computers GmbH)

O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )

O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe ()

O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKLM..\Run: [WisKeyState] C:\Program Files\Launch Manager\WisKeyState.exe (Wistron Corp.)

O4 - HKCU..\Run: [EPSON SX100 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE (SEIKO EPSON CORPORATION)

O4 - HKCU..\Run: [fsc-reg] C:\fsc-reg\fscreg.exe (Fujitsu Siemens)

O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)

O4 - HKCU..\Run: [Picasa Media Detector]  File not found

O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -  File not found

O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -  File not found

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)

O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{39a6d75b-0204-11df-bde4-001f1607322f}\Shell - "" = AutoRun

O33 - MountPoints2\{39a6d75b-0204-11df-bde4-001f1607322f}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{39a6d75c-0204-11df-bde4-001f1607322f}\Shell - "" = AutoRun

O33 - MountPoints2\{39a6d75c-0204-11df-bde4-001f1607322f}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.03.24 16:01:51 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2011.03.24 15:59:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.03.24 15:59:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.03.24 15:59:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.03.24 15:59:34 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.03.24 13:09:50 | 000,000,000 | ---D | C] -- C:\Programme\Avira

[2011.03.24 13:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.03.24 03:41:29 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\bla

[2011.03.24 03:41:07 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2011.03.24 03:17:01 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2011.03.24 03:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.03.24 03:16:47 | 000,000,000 | ---D | C] -- C:\Programme\herbert

[2011.03.24 02:59:58 | 000,000,000 | -H-D | C] -- C:\ProgramData\TEMP

[2011.03.24 02:59:26 | 000,000,000 | -H-D | C] -- C:\Users\***\Documents\Simply Super Software

[2011.03.24 02:59:17 | 000,000,000 | -H-D | C] -- C:\Programme\Trojan Remover

[2011.03.24 02:59:17 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\Simply Super Software

[2011.03.24 02:59:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\Simply Super Software

[2011.03.24 02:41:40 | 000,000,000 | -H-D | C] -- C:\sh4ldr

[2011.03.24 02:41:40 | 000,000,000 | ---D | C] -- C:\Programme\Enigma Software Group

[2011.03.14 17:56:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.4

[2011.03.14 17:54:43 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\ICQ

[2011.03.14 17:54:29 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.4

[2011.03.09 15:50:46 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\AVS4YOU

[2011.03.09 15:49:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVS4YOU

[2011.03.09 15:49:37 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\AVSMedia

[2011.03.09 15:48:57 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\GdiPlus.dll

[2011.03.09 15:48:57 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3a.dll

[2011.03.09 15:48:57 | 000,000,000 | -H-D | C] -- C:\ProgramData\AVS4YOU

[2011.03.09 15:48:57 | 000,000,000 | ---D | C] -- C:\Programme\AVS4YOU

[2011.03.08 21:33:42 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll

[2011.03.08 21:33:42 | 000,323,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll

[2011.03.08 21:33:42 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax

[2011.03.08 21:33:42 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll

[2011.02.24 11:09:22 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell

[2011.02.24 11:06:08 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrsmgr.dll

[2011.02.24 11:05:51 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrshost.exe

[2011.02.24 11:05:51 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmprovhost.exe

[2011.02.24 11:05:50 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrs.exe

[2011.02.24 11:05:45 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmplpxy.dll

[2011.02.24 11:05:45 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrssrv.dll

[2011.02.24 11:05:43 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtfwd.dll

[2011.02.24 11:05:43 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecutil.exe

[2011.02.24 11:05:43 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecapi.dll

[2011.02.24 11:05:43 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmRes.dll

[2011.02.24 11:05:43 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pwrshplugin.dll

[2011.02.24 11:05:32 | 000,241,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrscmd.dll

[2011.02.24 11:05:32 | 000,214,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmWmiPl.dll

[2011.02.24 11:05:32 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmAuto.dll

[2011.02.24 11:05:31 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManMigrationPlugin.dll

[2011.02.24 11:05:31 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManHTTPConfig.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.03.24 16:01:53 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2011.03.24 16:00:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.03.24 15:59:38 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.03.24 15:37:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.03.24 15:37:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.03.24 13:37:24 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.03.24 13:37:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.03.24 13:37:03 | 2380,316,672 | -HS- | M] () -- C:\hiberfil.sys

[2011.03.24 02:26:59 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~41213704r

[2011.03.24 02:26:59 | 000,000,096 | -H-- | M] () -- C:\ProgramData\~41213704

[2011.03.24 02:20:28 | 000,000,384 | -H-- | M] () -- C:\ProgramData\41213704

[2011.03.23 15:21:50 | 000,016,478 | -H-- | M] () -- C:\Users\***\Documents\Summer.m3u

[2011.03.21 23:11:37 | 000,049,040 | -H-- | M] () -- C:\Users\***\Documents\feb11.m3u

[2011.03.17 22:32:54 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.03.17 22:32:54 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.03.17 22:32:54 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.03.17 22:32:54 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.03.14 17:56:24 | 000,001,615 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.4.lnk

[2011.03.13 12:36:01 | 000,009,241 | ---- | M] () -- C:\Users\***\Desktop\Anleitung.html

[2011.03.09 21:52:45 | 179,009,782 | ---- | M] () -- C:\Windows\MEMORY.DMP

 
 ========== Files Created - No Company Name ==========

 

[2011.03.24 15:59:38 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.03.24 02:26:59 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~41213704r

[2011.03.24 02:26:59 | 000,000,096 | -H-- | C] () -- C:\ProgramData\~41213704

[2011.03.24 02:17:56 | 000,000,384 | -H-- | C] () -- C:\ProgramData\41213704

[2011.03.14 17:56:24 | 000,001,615 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.4.lnk

[2011.03.13 12:41:20 | 000,009,241 | ---- | C] () -- C:\Users\***\Desktop\Anleitung.html

[2011.02.24 11:05:34 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs

[2011.02.24 11:05:34 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl

[2011.02.24 11:05:33 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml

[2009.09.01 12:41:39 | 000,000,680 | -H-- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2009.05.04 13:59:16 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat

[2009.05.04 13:59:16 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat

[2009.05.04 13:59:16 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat

[2009.05.04 13:59:16 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat

[2009.05.04 13:59:16 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat

[2009.05.04 13:59:16 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat

[2009.05.04 13:59:16 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat

[2009.05.04 13:59:16 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat

[2009.05.04 13:59:16 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat

[2009.05.04 13:59:16 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat

[2009.05.04 13:59:16 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat

[2009.05.04 13:59:16 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat

[2009.05.04 13:59:16 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat

[2009.05.04 13:59:16 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat

[2009.05.04 13:59:16 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat

[2009.05.04 13:59:16 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat

[2009.05.04 13:59:16 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat

[2009.05.04 13:59:16 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat

[2009.05.04 13:59:16 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini

[2009.05.04 13:56:57 | 000,000,025 | ---- | C] () -- C:\Windows\CDESX100DEFGIPS.ini

[2009.04.23 09:15:21 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.04.23 09:15:21 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2009.01.31 15:31:59 | 000,000,104 | -H-- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat

[2008.12.12 19:54:29 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.12.12 19:54:28 | 000,033,280 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.12 19:51:24 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini

[2008.09.05 05:03:01 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2008.09.05 04:44:46 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys

[2008.09.05 04:43:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2008.09.05 04:37:01 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat

[2008.09.05 04:37:01 | 000,172,033 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2008.09.05 04:37:01 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2008.09.05 04:37:01 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe

[2008.04.25 14:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll

[2008.01.21 08:15:58 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 08:15:58 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,296,064 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9
 

< End of report >

--- --- ---

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Nein das ist die Einzige. Hatte gestern schon eine gemacht, aber die hab ich nach der Systemwiederherstellung gelöscht(Papierkorb auch geleert). Aber wenn ich auf "Quarantäne" klicke steht da:

-Rogue.FakeHDD 24.03.2011 File c:\programdata\41213704.exe

-Trojan.Downloader 24.03.2011 File c:\programdata\scrrtwxnjagi.exe

-Trojan.Downloader 24.03.2011 File c:\Users\***\AppData\Local \Temp\0.2523144731193054...

-Trojan.FakeAlert.Gen 24.03.2011 File c:\Users\***\AppData\Local\Temp\internetexplorerupdate...

-Trojan.Downloader 24.03.2011 registry value HKEY_CURRENT_USER\Software\Microsoft\window....

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9

[2011.03.24 02:26:59 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~41213704r

[2011.03.24 02:26:59 | 000,000,096 | -H-- | C] () -- C:\ProgramData\~41213704

[2011.03.24 02:17:56 | 000,000,384 | -H-- | C] () -- C:\ProgramData\41213704

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{39a6d75b-0204-11df-bde4-001f1607322f}\Shell - "" = AutoRun

O33 - MountPoints2\{39a6d75b-0204-11df-bde4-001f1607322f}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{39a6d75c-0204-11df-bde4-001f1607322f}\Shell - "" = AutoRun

O33 - MountPoints2\{39a6d75c-0204-11df-bde4-001f1607322f}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

So:

All processes killed
========== OTL ==========
Unable to delete ADS C:\ProgramData\TEMP:CB0AACC9 .
File C:\ProgramData\~41213704r not found.
File C:\ProgramData\~41213704 not found.
File C:\ProgramData\41213704 not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File C:\autoexec.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39a6d75b-0204-11df-bde4-001f1607322f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39a6d75b-0204-11df-bde4-001f1607322f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39a6d75b-0204-11df-bde4-001f1607322f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39a6d75b-0204-11df-bde4-001f1607322f}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39a6d75c-0204-11df-bde4-001f1607322f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39a6d75c-0204-11df-bde4-001f1607322f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39a6d75c-0204-11df-bde4-001f1607322f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39a6d75c-0204-11df-bde4-001f1607322f}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: ***
->Temp folder emptied: 65076 bytes
->Temporary Internet Files folder emptied: 35720 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 19984546 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 19,00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 03242011_192048

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

übrigens hab ich jetzt noch was und zwar kommt ständig diese Fehlermeldung auf den Bildschirm:

Catalyst Control Centre: Host application funktioniert nicht mehr
Das Programm wird aufgrund eines Problems nicht richtig ausgeführt. Das Programm wird geschlossen und Sie werden benachrichtigt, wenn eine Lösung verfügbar ist.

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Habe ausversehn ComboFix gleich laufen lassen :-/ ist das schlimm oder soll ich den CCleaner jetzt noch laufen lassen? Ich glaub, ich habe irgendwas falsch gemacht...wenn ich jetzt Mozilla oder IExplorer öffnen will kommt die Fehlermeldung:

C:\Program Files\Mozilla Firefox\firefox.exe
Es wurde versucht, einen Registrierungsschlüssel einem unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

Kam jetzt nur ins Mozilla als ich auf das Icon rechtsklick gemacht habe und auf "als Administrator ausführen" angeklickt habe.

Hier die Logdatei vom Combofix

([Strg]a, [Strg]c)Combofix Logfile:

Code:

ComboFix 11-03-24.01 - *** 24.03.2011  19:49:13.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2269.1471 [GMT 1:00]

ausgeführt von:: c:\users\***\Desktop\Cofi.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-02-24 bis 2011-03-24  ))))))))))))))))))))))))))))))

.

.

2011-03-24 18:54 . 2011-03-24 18:54        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-03-24 18:14 . 2011-03-18 17:56        142296        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-03-24 18:14 . 2011-03-18 17:56        781272        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-03-24 18:14 . 2011-03-18 17:56        728024        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2011-03-24 18:14 . 2011-03-18 17:56        719832        ----a-w-        c:\program files\Mozilla Firefox\mozcpp19.dll

2011-03-24 18:14 . 2011-03-18 17:56        1975768        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll

2011-03-24 18:14 . 2011-03-18 17:56        1893336        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-03-24 18:14 . 2011-03-18 17:56        1874904        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2011-03-24 18:14 . 2011-03-18 17:56        16856        ----a-w-        c:\program files\Mozilla Firefox\plugin-container.exe

2011-03-24 18:14 . 2011-03-18 17:56        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2011-03-24 18:14 . 2011-03-18 17:56        142296        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2011-03-24 18:08 . 2011-03-24 18:08        --------        d-----w-        C:\_OTL

2011-03-24 14:59 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-24 14:59 . 2011-03-24 14:59        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-03-24 14:59 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-03-24 12:45 . 2011-02-11 06:54        5943120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{57CE643F-DE9D-4B7B-9E7D-13597408A3F1}\mpengine.dll

2011-03-24 12:09 . 2011-03-24 12:09        --------        d-----w-        c:\programdata\Avira

2011-03-24 12:09 . 2011-03-24 12:09        --------        d-----w-        c:\program files\Avira

2011-03-24 02:41 . 2011-03-24 11:15        --------        d-----w-        c:\program files\ERUNT

2011-03-24 02:17 . 2011-03-24 02:17        --------        d-----w-        c:\users\Ani\AppData\Roaming\Malwarebytes

2011-03-24 02:16 . 2011-03-24 02:16        --------        d-----w-        c:\programdata\Malwarebytes

2011-03-24 02:16 . 2011-03-24 02:16        --------        d-----w-        c:\program files\herbert

2011-03-24 01:59 . 2011-03-24 02:01        --------        d--h--w-        c:\program files\Trojan Remover

2011-03-24 01:59 . 2011-03-24 01:59        --------        d--h--w-        c:\users\Ani\AppData\Roaming\Simply Super Software

2011-03-24 01:59 . 2011-03-24 01:59        --------        d--h--w-        c:\programdata\Simply Super Software

2011-03-24 01:41 . 2011-03-24 01:41        --------        d-----w-        C:\sh4ldr

2011-03-24 01:41 . 2011-03-24 01:41        --------        d-----w-        c:\program files\Enigma Software Group

2011-03-14 16:54 . 2011-03-15 17:46        --------        d--h--w-        c:\users\Ani\AppData\Roaming\ICQ

2011-03-14 16:54 . 2011-03-24 12:35        --------        d-----w-        c:\program files\ICQ7.4

2011-03-09 14:50 . 2011-03-09 14:50        --------        d--h--w-        c:\users\Ani\AppData\Roaming\AVS4YOU

2011-03-09 14:49 . 2011-03-09 14:54        --------        d-----w-        c:\program files\Common Files\AVSMedia

2011-03-09 14:48 . 2011-03-09 14:54        --------        d-----w-        c:\program files\AVS4YOU

2011-03-09 14:48 . 2011-03-09 14:50        --------        d--h--w-        c:\programdata\AVS4YOU

2011-03-09 14:48 . 2010-12-02 09:12        24576        ----a-w-        c:\windows\system32\msxml3a.dll

2011-03-09 14:48 . 2010-12-02 09:12        1700352        ----a-w-        c:\windows\system32\GdiPlus.dll

2011-03-08 20:33 . 2010-12-29 17:41        323072        ----a-w-        c:\windows\system32\sbe.dll

2011-03-08 20:33 . 2010-12-29 17:41        153088        ----a-w-        c:\windows\system32\sbeio.dll

2011-03-08 20:33 . 2010-12-29 17:41        429056        ----a-w-        c:\windows\system32\EncDec.dll

2011-03-08 20:33 . 2010-12-29 17:39        177664        ----a-w-        c:\windows\system32\mpg2splt.ax

2011-03-08 20:33 . 2010-12-17 16:43        2067456        ----a-w-        c:\windows\system32\mstscax.dll

2011-03-08 20:33 . 2010-12-17 15:06        677888        ----a-w-        c:\windows\system32\mstsc.exe

2011-02-24 10:06 . 2009-10-09 21:56        2048        ----a-w-        c:\windows\system32\winrsmgr.dll

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-02 16:11 . 2009-10-03 10:26        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-01-08 07:50 . 2011-02-09 09:13        34304        ----a-w-        c:\windows\system32\atmlib.dll

2011-01-08 05:57 . 2011-02-09 09:13        292352        ----a-w-        c:\windows\system32\atmfd.dll

2010-12-31 13:25 . 2011-02-09 09:13        2038784        ----a-w-        c:\windows\system32\win32k.sys

2010-12-28 14:57 . 2011-01-12 09:48        409600        ----a-w-        c:\windows\system32\odbc32.dll

2009-09-25 16:41 . 2009-09-25 16:41        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll

2009-09-25 16:41 . 2009-09-25 16:41        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll

2011-03-18 17:56 . 2011-03-24 18:14        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

2010-08-05 10:19 . 2009-11-16 18:34        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472]

"fsc-reg"="c:\fsc-reg\fscreg.exe" [2008-08-01 380688]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-30 39408]

"ICQ"="c:\program files\ICQ7.4\ICQ.exe" [2011-03-14 119608]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2008-05-23 192512]

"WisKeyState"="c:\program files\Launch Manager\WisKeyState.exe" [2008-03-07 208896]

"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2008-03-03 258048]

"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2007-12-25 241664]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-05 30192]

"FSCRecovery"="c:\program files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe" [2008-06-18 268096]

"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-22 136600]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"fsc-reg"="c:\fsc-reg\fscreg.exe" [2008-08-01 380688]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate1ca605e1da063c1;Google Update Service (gupdate1ca605e1da063c1);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 133104]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-05 30192]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R3 XDva375;XDva375;c:\windows\system32\XDva375.sys [x]

S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-11 84240]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2008-01-15 118784]

.

.

Inhalt des "geplante Tasks" Ordners

.

2011-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 10:27]

.

2011-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 10:27]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://start.icq.com/

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube to MP3 Converter - c:\users\Ani\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe

FF - ProfilePath - c:\users\Ani\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe

AddRemove-Poker Skins - c:\users\Ani\Desktop\Poker Skins\uninstall.exe

AddRemove-{7585478E9D9B42108671C12F8714CEFE} - c:\program files\DivX\DivXConverterUninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-03-24 19:55

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-03-24  19:56:28

ComboFix-quarantined-files.txt  2011-03-24 18:56

.

Vor Suchlauf: 17 Verzeichnis(se), 35.776.696.320 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 35.504.635.904 Bytes frei

.

- - End Of File - - 3C58B99E16514D5DE933380E7CC0D053

--- --- ---
([Strg]v)

Lass den CCleaner weg.
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Ich kann die Datei nicht öffnen, da erscheint die gleiche Fehlermeldung wie wenn ich versuche Mozilla zu öffnen:

C:\Users\***\Desktop\TDSSKiller.exe
Es wurde versucht, einen Registrierungsschlüssel einem unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

Wenn ich rechtsklick mache und "als Administrator ausführen" anklicke kommt diese:

C:\Users\***\Desktop\TDSSKiller.exe
Der Verzeichnisname ist ungültig

Virenscanner deaktiviert? :confused:
Manchmal stören die.
Außerdem musst du nach CF den Rechner neu starten, wenn CF das nicht selbst getan hat, funktionieren viele Sachen nicht so wie sie sollen.

Okay sorry, hatte den PC nicht neugestartet...

2011/03/24 22:20:32.0791 2264 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/24 22:20:33.0103 2264 ================================================================================
2011/03/24 22:20:33.0103 2264 SystemInfo:
2011/03/24 22:20:33.0103 2264
2011/03/24 22:20:33.0103 2264 OS Version: 6.0.6001 ServicePack: 1.0
2011/03/24 22:20:33.0103 2264 Product type: Workstation
2011/03/24 22:20:33.0103 2264 ComputerName: ***-PC
2011/03/24 22:20:33.0103 2264 UserName: ***
2011/03/24 22:20:33.0103 2264 Windows directory: C:\Windows
2011/03/24 22:20:33.0103 2264 System windows directory: C:\Windows
2011/03/24 22:20:33.0103 2264 Processor architecture: Intel x86
2011/03/24 22:20:33.0103 2264 Number of processors: 2
2011/03/24 22:20:33.0103 2264 Page size: 0x1000
2011/03/24 22:20:33.0103 2264 Boot type: Normal boot
2011/03/24 22:20:33.0103 2264 ================================================================================
2011/03/24 22:20:33.0509 2264 Initialize success
2011/03/24 22:20:54.0616 3584 ================================================================================
2011/03/24 22:20:54.0616 3584 Scan started
2011/03/24 22:20:54.0616 3584 Mode: Manual;
2011/03/24 22:20:54.0616 3584 ================================================================================
2011/03/24 22:20:55.0474 3584 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/03/24 22:20:55.0599 3584 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/03/24 22:20:55.0801 3584 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/03/24 22:20:55.0942 3584 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/03/24 22:20:56.0020 3584 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/03/24 22:20:56.0223 3584 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/03/24 22:20:56.0425 3584 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/03/24 22:20:56.0597 3584 ahcix86s (fbe4016f9ef3ab3db547e40a936b6cd9) C:\Windows\system32\drivers\ahcix86s.sys
2011/03/24 22:20:56.0800 3584 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/24 22:20:57.0112 3584 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/03/24 22:20:57.0190 3584 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/03/24 22:20:57.0393 3584 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/03/24 22:20:57.0471 3584 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/03/24 22:20:57.0751 3584 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/03/24 22:20:57.0923 3584 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/03/24 22:20:58.0017 3584 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/03/24 22:20:58.0110 3584 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/24 22:20:58.0219 3584 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/03/24 22:20:58.0547 3584 athr (24b4375abbc587bdc99e231383c16b8f) C:\Windows\system32\DRIVERS\athr.sys
2011/03/24 22:20:58.0999 3584 atikmdag (5a1e51ff7ba5f23aa4585b25ac0e484d) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/03/24 22:20:59.0436 3584 AtiPcie (5a1465ad2e7c1bc39cda12a355329096) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/03/24 22:20:59.0670 3584 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/24 22:20:59.0842 3584 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/03/24 22:20:59.0951 3584 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/24 22:21:00.0123 3584 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/24 22:21:00.0185 3584 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/24 22:21:00.0279 3584 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/24 22:21:00.0341 3584 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/24 22:21:00.0466 3584 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/24 22:21:00.0544 3584 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/24 22:21:00.0622 3584 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/24 22:21:00.0887 3584 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/24 22:21:01.0059 3584 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/24 22:21:01.0308 3584 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/03/24 22:21:01.0417 3584 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/03/24 22:21:01.0823 3584 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/03/24 22:21:01.0963 3584 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/03/24 22:21:02.0166 3584 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/03/24 22:21:02.0572 3584 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/03/24 22:21:02.0899 3584 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/03/24 22:21:03.0180 3584 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/03/24 22:21:03.0352 3584 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/03/24 22:21:03.0586 3584 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/24 22:21:03.0898 3584 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/24 22:21:04.0194 3584 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/24 22:21:04.0381 3584 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/03/24 22:21:04.0569 3584 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/03/24 22:21:04.0693 3584 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/03/24 22:21:04.0927 3584 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/03/24 22:21:05.0021 3584 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/03/24 22:21:05.0161 3584 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/24 22:21:05.0380 3584 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/24 22:21:05.0692 3584 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/24 22:21:05.0941 3584 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/24 22:21:06.0253 3584 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/03/24 22:21:06.0565 3584 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/24 22:21:06.0831 3584 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/24 22:21:07.0392 3584 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/03/24 22:21:07.0798 3584 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/24 22:21:07.0891 3584 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/24 22:21:08.0110 3584 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/03/24 22:21:08.0266 3584 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/24 22:21:08.0422 3584 Hotkey (8b566ea71d5b76157a9cdb78f25a5731) C:\Windows\system32\drivers\Hotkey.sys
2011/03/24 22:21:08.0515 3584 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/03/24 22:21:08.0656 3584 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/03/24 22:21:08.0905 3584 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/03/24 22:21:09.0217 3584 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/24 22:21:09.0483 3584 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:\Windows\system32\drivers\iastor.sys
2011/03/24 22:21:09.0841 3584 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/03/24 22:21:10.0356 3584 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/24 22:21:11.0370 3584 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys
2011/03/24 22:21:12.0088 3584 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/24 22:21:12.0837 3584 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/24 22:21:13.0336 3584 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/24 22:21:13.0788 3584 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/24 22:21:14.0022 3584 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/24 22:21:14.0256 3584 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/24 22:21:14.0350 3584 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/03/24 22:21:14.0443 3584 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/24 22:21:14.0615 3584 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/24 22:21:14.0677 3584 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/24 22:21:14.0755 3584 JMCR (dedb6cc1b166928a8f3f68def1766db0) C:\Windows\system32\DRIVERS\jmcr.sys
2011/03/24 22:21:14.0849 3584 JRAID (c36f3a1a4e8416ef43f30deab7701730) C:\Windows\system32\drivers\jraid.sys
2011/03/24 22:21:14.0943 3584 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/24 22:21:15.0067 3584 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/24 22:21:15.0145 3584 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/24 22:21:15.0442 3584 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/24 22:21:15.0676 3584 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/24 22:21:15.0785 3584 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/24 22:21:16.0003 3584 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/24 22:21:16.0097 3584 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/24 22:21:16.0315 3584 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/03/24 22:21:16.0690 3584 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/03/24 22:21:16.0955 3584 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/24 22:21:17.0298 3584 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/24 22:21:17.0485 3584 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/24 22:21:17.0704 3584 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/24 22:21:17.0969 3584 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/24 22:21:18.0437 3584 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/03/24 22:21:18.0671 3584 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/24 22:21:18.0874 3584 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/24 22:21:19.0139 3584 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/03/24 22:21:19.0326 3584 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/24 22:21:19.0638 3584 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/24 22:21:19.0950 3584 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/24 22:21:20.0200 3584 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/03/24 22:21:20.0465 3584 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/03/24 22:21:20.0824 3584 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/24 22:21:21.0027 3584 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/24 22:21:21.0323 3584 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/24 22:21:21.0526 3584 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/24 22:21:21.0791 3584 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/24 22:21:22.0025 3584 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/03/24 22:21:22.0337 3584 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/24 22:21:22.0509 3584 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/24 22:21:22.0649 3584 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/03/24 22:21:22.0930 3584 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/24 22:21:23.0523 3584 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/03/24 22:21:23.0803 3584 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/24 22:21:23.0881 3584 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/24 22:21:24.0006 3584 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/24 22:21:24.0100 3584 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/24 22:21:24.0287 3584 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/24 22:21:24.0459 3584 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/03/24 22:21:24.0661 3584 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/24 22:21:24.0864 3584 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/03/24 22:21:24.0989 3584 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/24 22:21:25.0270 3584 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/03/24 22:21:25.0519 3584 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/24 22:21:25.0722 3584 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/24 22:21:25.0831 3584 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/03/24 22:21:25.0972 3584 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/03/24 22:21:26.0065 3584 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/03/24 22:21:26.0892 3584 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/03/24 22:21:27.0235 3584 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/03/24 22:21:27.0641 3584 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/03/24 22:21:27.0859 3584 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/03/24 22:21:28.0093 3584 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/03/24 22:21:28.0405 3584 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/03/24 22:21:28.0561 3584 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/03/24 22:21:29.0061 3584 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/24 22:21:29.0404 3584 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/24 22:21:29.0544 3584 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\DRIVERS\processr.sys
2011/03/24 22:21:29.0934 3584 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/24 22:21:30.0262 3584 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\Windows\system32\Drivers\PxHelp20.sys
2011/03/24 22:21:30.0667 3584 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/03/24 22:21:30.0964 3584 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/24 22:21:31.0151 3584 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/24 22:21:31.0213 3584 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/24 22:21:31.0494 3584 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/24 22:21:31.0775 3584 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/24 22:21:31.0931 3584 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/24 22:21:32.0321 3584 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/24 22:21:32.0851 3584 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/24 22:21:33.0117 3584 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/03/24 22:21:33.0569 3584 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/24 22:21:33.0834 3584 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/03/24 22:21:34.0552 3584 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/24 22:21:34.0848 3584 RTL8169 (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/03/24 22:21:35.0051 3584 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/24 22:21:35.0550 3584 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
2011/03/24 22:21:35.0815 3584 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/24 22:21:36.0034 3584 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/03/24 22:21:36.0221 3584 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/03/24 22:21:36.0517 3584 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/24 22:21:36.0861 3584 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/03/24 22:21:37.0095 3584 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/24 22:21:37.0547 3584 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/24 22:21:37.0750 3584 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/24 22:21:38.0202 3584 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/03/24 22:21:38.0514 3584 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/03/24 22:21:38.0842 3584 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/03/24 22:21:39.0013 3584 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/03/24 22:21:39.0294 3584 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/24 22:21:39.0793 3584 srv (5754e8bae40943871d0ab9becbf335e8) C:\Windows\system32\DRIVERS\srv.sys
2011/03/24 22:21:40.0074 3584 srv2 (d47b09ff7d28ee44d728f57c2d1fab86) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/24 22:21:40.0293 3584 srvnet (32d52290341a740881521e118106acd6) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/24 22:21:40.0636 3584 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/24 22:21:40.0885 3584 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/24 22:21:41.0119 3584 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/24 22:21:41.0431 3584 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/24 22:21:41.0603 3584 SynTP (db835c324cd488a86e9bfc2c3fd29cd8) C:\Windows\system32\DRIVERS\SynTP.sys
2011/03/24 22:21:42.0773 3584 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/03/24 22:21:43.0335 3584 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/24 22:21:43.0818 3584 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/24 22:21:44.0052 3584 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/24 22:21:44.0224 3584 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/24 22:21:44.0598 3584 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/24 22:21:44.0817 3584 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/24 22:21:45.0222 3584 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/24 22:21:45.0347 3584 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/24 22:21:45.0503 3584 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/24 22:21:45.0565 3584 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/03/24 22:21:45.0940 3584 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/24 22:21:46.0314 3584 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/24 22:21:46.0439 3584 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/03/24 22:21:46.0595 3584 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/24 22:21:46.0720 3584 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/24 22:21:46.0782 3584 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/24 22:21:46.0907 3584 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/24 22:21:47.0001 3584 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/03/24 22:21:47.0079 3584 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/24 22:21:47.0172 3584 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/24 22:21:47.0406 3584 usbohci (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2011/03/24 22:21:47.0578 3584 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/24 22:21:47.0687 3584 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/03/24 22:21:47.0765 3584 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/24 22:21:47.0905 3584 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/24 22:21:47.0999 3584 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/03/24 22:21:48.0061 3584 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/24 22:21:48.0139 3584 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/24 22:21:48.0202 3584 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/03/24 22:21:48.0264 3584 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/03/24 22:21:48.0358 3584 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/03/24 22:21:48.0420 3584 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/24 22:21:48.0483 3584 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/03/24 22:21:48.0529 3584 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/03/24 22:21:48.0639 3584 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/03/24 22:21:48.0701 3584 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/24 22:21:48.0795 3584 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/24 22:21:48.0826 3584 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/24 22:21:48.0904 3584 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/03/24 22:21:48.0966 3584 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/24 22:21:49.0138 3584 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/03/24 22:21:49.0247 3584 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/03/24 22:21:49.0309 3584 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/24 22:21:49.0403 3584 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/24 22:21:49.0668 3584 ================================================================================
2011/03/24 22:21:49.0668 3584 Scan finished
2011/03/24 22:21:49.0668 3584 ================================================================================
2011/03/24 22:24:07.0041 3512 ================================================================================
2011/03/24 22:24:07.0041 3512 Scan started
2011/03/24 22:24:07.0041 3512 Mode: Manual;
2011/03/24 22:24:07.0041 3512 ================================================================================
2011/03/24 22:24:08.0040 3512 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/03/24 22:24:08.0149 3512 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/03/24 22:24:08.0274 3512 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/03/24 22:24:08.0430 3512 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/03/24 22:24:08.0555 3512 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/03/24 22:24:08.0711 3512 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/03/24 22:24:08.0851 3512 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/03/24 22:24:08.0960 3512 ahcix86s (fbe4016f9ef3ab3db547e40a936b6cd9) C:\Windows\system32\drivers\ahcix86s.sys
2011/03/24 22:24:09.0116 3512 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/24 22:24:09.0366 3512 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/03/24 22:24:09.0491 3512 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/03/24 22:24:09.0647 3512 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/03/24 22:24:09.0803 3512 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/03/24 22:24:09.0943 3512 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/03/24 22:24:10.0083 3512 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/03/24 22:24:10.0271 3512 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/03/24 22:24:10.0411 3512 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/24 22:24:10.0489 3512 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/03/24 22:24:10.0739 3512 athr (24b4375abbc587bdc99e231383c16b8f) C:\Windows\system32\DRIVERS\athr.sys
2011/03/24 22:24:11.0347 3512 atikmdag (5a1e51ff7ba5f23aa4585b25ac0e484d) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/03/24 22:24:11.0659 3512 AtiPcie (5a1465ad2e7c1bc39cda12a355329096) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/03/24 22:24:11.0768 3512 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/24 22:24:11.0862 3512 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/03/24 22:24:12.0002 3512 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/24 22:24:12.0143 3512 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/24 22:24:12.0252 3512 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/24 22:24:12.0377 3512 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/24 22:24:12.0548 3512 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/24 22:24:12.0673 3512 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/24 22:24:12.0767 3512 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/24 22:24:12.0907 3512 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/24 22:24:13.0219 3512 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/24 22:24:13.0375 3512 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/24 22:24:13.0578 3512 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/03/24 22:24:13.0734 3512 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/03/24 22:24:13.0905 3512 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/03/24 22:24:14.0046 3512 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/03/24 22:24:14.0249 3512 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/03/24 22:24:14.0514 3512 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/03/24 22:24:14.0685 3512 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/03/24 22:24:14.0857 3512 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/03/24 22:24:14.0997 3512 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/03/24 22:24:15.0107 3512 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/24 22:24:15.0247 3512 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/24 22:24:15.0434 3512 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/24 22:24:15.0793 3512 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/03/24 22:24:15.0965 3512 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/03/24 22:24:16.0167 3512 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/03/24 22:24:16.0339 3512 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/03/24 22:24:16.0495 3512 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/03/24 22:24:16.0573 3512 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/24 22:24:16.0713 3512 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/24 22:24:16.0838 3512 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/24 22:24:17.0010 3512 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/24 22:24:17.0181 3512 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/03/24 22:24:17.0415 3512 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/24 22:24:17.0525 3512 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/24 22:24:17.0743 3512 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/03/24 22:24:17.0821 3512 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/24 22:24:17.0915 3512 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/24 22:24:18.0008 3512 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/03/24 22:24:18.0242 3512 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/24 22:24:18.0320 3512 Hotkey (8b566ea71d5b76157a9cdb78f25a5731) C:\Windows\system32\drivers\Hotkey.sys
2011/03/24 22:24:18.0445 3512 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/03/24 22:24:18.0617 3512 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/03/24 22:24:18.0726 3512 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/03/24 22:24:18.0851 3512 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/24 22:24:18.0960 3512 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:\Windows\system32\drivers\iastor.sys
2011/03/24 22:24:19.0085 3512 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/03/24 22:24:19.0303 3512 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/24 22:24:19.0740 3512 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys
2011/03/24 22:24:19.0927 3512 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/24 22:24:20.0036 3512 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/24 22:24:20.0145 3512 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/24 22:24:20.0426 3512 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/24 22:24:20.0535 3512 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/24 22:24:20.0754 3512 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/24 22:24:20.0879 3512 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/03/24 22:24:21.0035 3512 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/24 22:24:21.0206 3512 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/24 22:24:21.0409 3512 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/24 22:24:21.0549 3512 JMCR (dedb6cc1b166928a8f3f68def1766db0) C:\Windows\system32\DRIVERS\jmcr.sys
2011/03/24 22:24:21.0768 3512 JRAID (c36f3a1a4e8416ef43f30deab7701730) C:\Windows\system32\drivers\jraid.sys
2011/03/24 22:24:21.0893 3512 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/24 22:24:22.0033 3512 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/24 22:24:22.0173 3512 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/24 22:24:22.0407 3512 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/24 22:24:22.0610 3512 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/24 22:24:22.0735 3512 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/24 22:24:22.0860 3512 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/24 22:24:23.0031 3512 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/24 22:24:23.0203 3512 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/03/24 22:24:23.0359 3512 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/03/24 22:24:23.0453 3512 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/24 22:24:23.0624 3512 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/24 22:24:23.0796 3512 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/24 22:24:23.0936 3512 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/24 22:24:24.0092 3512 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/24 22:24:24.0248 3512 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/03/24 22:24:24.0389 3512 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/24 22:24:24.0576 3512 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/24 22:24:24.0716 3512 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/03/24 22:24:24.0935 3512 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/24 22:24:25.0075 3512 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/24 22:24:25.0169 3512 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/24 22:24:25.0231 3512 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/03/24 22:24:25.0371 3512 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/03/24 22:24:25.0512 3512 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/24 22:24:25.0543 3512 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/24 22:24:25.0668 3512 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/24 22:24:25.0824 3512 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/24 22:24:25.0933 3512 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/24 22:24:26.0058 3512 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/03/24 22:24:26.0214 3512 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/24 22:24:26.0307 3512 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/24 22:24:26.0432 3512 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/03/24 22:24:26.0541 3512 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/24 22:24:26.0635 3512 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/03/24 22:24:26.0713 3512 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/24 22:24:26.0838 3512 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/24 22:24:26.0885 3512 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/24 22:24:26.0947 3512 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/24 22:24:27.0025 3512 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/24 22:24:27.0197 3512 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/03/24 22:24:27.0399 3512 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/24 22:24:27.0587 3512 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/03/24 22:24:27.0727 3512 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/24 22:24:27.0977 3512 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/03/24 22:24:28.0117 3512 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/24 22:24:28.0304 3512 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/24 22:24:28.0460 3512 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/03/24 22:24:28.0554 3512 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/03/24 22:24:28.0757 3512 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/03/24 22:24:29.0147 3512 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/03/24 22:24:29.0349 3512 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/03/24 22:24:29.0505 3512 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/03/24 22:24:29.0615 3512 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/03/24 22:24:29.0708 3512 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/03/24 22:24:29.0911 3512 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/03/24 22:24:30.0020 3512 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/03/24 22:24:30.0114 3512 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/24 22:24:30.0317 3512 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/24 22:24:30.0426 3512 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\DRIVERS\processr.sys
2011/03/24 22:24:30.0519 3512 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/24 22:24:30.0597 3512 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\Windows\system32\Drivers\PxHelp20.sys
2011/03/24 22:24:30.0707 3512 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/03/24 22:24:30.0831 3512 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/24 22:24:30.0909 3512 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/24 22:24:31.0003 3512 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/24 22:24:31.0097 3512 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/24 22:24:31.0315 3512 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/24 22:24:31.0424 3512 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/24 22:24:31.0502 3512 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/24 22:24:31.0549 3512 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/24 22:24:31.0643 3512 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/03/24 22:24:32.0438 3512 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/24 22:24:32.0547 3512 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/03/24 22:24:32.0657 3512 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/24 22:24:32.0735 3512 RTL8169 (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/03/24 22:24:32.0813 3512 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/24 22:24:32.0891 3512 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
2011/03/24 22:24:32.0969 3512 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/24 22:24:33.0031 3512 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/03/24 22:24:33.0078 3512 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/03/24 22:24:33.0125 3512 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/24 22:24:33.0203 3512 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/03/24 22:24:33.0265 3512 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/24 22:24:33.0312 3512 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/24 22:24:33.0343 3512 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/24 22:24:33.0405 3512 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/03/24 22:24:33.0452 3512 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/03/24 22:24:33.0515 3512 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/03/24 22:24:33.0608 3512 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/03/24 22:24:33.0686 3512 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/24 22:24:33.0780 3512 srv (5754e8bae40943871d0ab9becbf335e8) C:\Windows\system32\DRIVERS\srv.sys
2011/03/24 22:24:33.0811 3512 srv2 (d47b09ff7d28ee44d728f57c2d1fab86) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/24 22:24:33.0873 3512 srvnet (32d52290341a740881521e118106acd6) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/24 22:24:33.0998 3512 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/24 22:24:34.0139 3512 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/24 22:24:34.0201 3512 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/24 22:24:34.0279 3512 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/24 22:24:34.0404 3512 SynTP (db835c324cd488a86e9bfc2c3fd29cd8) C:\Windows\system32\DRIVERS\SynTP.sys
2011/03/24 22:24:34.0575 3512 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/03/24 22:24:34.0685 3512 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/24 22:24:34.0747 3512 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/24 22:24:34.0825 3512 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/24 22:24:34.0903 3512 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/24 22:24:34.0965 3512 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/24 22:24:35.0168 3512 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/24 22:24:35.0309 3512 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/24 22:24:35.0355 3512 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/24 22:24:35.0449 3512 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/24 22:24:35.0480 3512 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/03/24 22:24:35.0543 3512 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/24 22:24:35.0621 3512 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/24 22:24:35.0667 3512 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/03/24 22:24:35.0745 3512 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/24 22:24:35.0823 3512 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/24 22:24:35.0855 3512 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/24 22:24:35.0948 3512 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/24 22:24:36.0026 3512 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/03/24 22:24:36.0104 3512 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/24 22:24:36.0151 3512 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/24 22:24:36.0182 3512 usbohci (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2011/03/24 22:24:36.0229 3512 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/24 22:24:36.0291 3512 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/03/24 22:24:36.0354 3512 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/24 22:24:36.0447 3512 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/24 22:24:36.0525 3512 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/03/24 22:24:36.0603 3512 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/24 22:24:36.0650 3512 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/24 22:24:36.0713 3512 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/03/24 22:24:36.0775 3512 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/03/24 22:24:36.0884 3512 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/03/24 22:24:36.0947 3512 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/24 22:24:36.0993 3512 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/03/24 22:24:37.0040 3512 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/03/24 22:24:37.0103 3512 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/03/24 22:24:37.0196 3512 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/24 22:24:37.0290 3512 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/24 22:24:37.0321 3512 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/24 22:24:37.0383 3512 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/03/24 22:24:37.0446 3512 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/24 22:24:37.0680 3512 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/03/24 22:24:37.0789 3512 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/03/24 22:24:37.0820 3512 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/24 22:24:37.0898 3512 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/24 22:24:38.0007 3512 ================================================================================
2011/03/24 22:24:38.0007 3512 Scan finished
2011/03/24 22:24:38.0007 3512 ================================================================================

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Also 2 Probleme:

-bei gmer ist der PC abgestürzt

und OSAM lässt sich nur mit Winamp öffen?!

Nimm zum Entpacken von OSAM bitte WinRAR oder 7ZIP => http://filepony.de/download-7-zip/

okay danke, hat geklappt :) hoffe, dass ist das richtige

MBRCheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: FUJITSU SIEMENS
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: FUJITSU SIEMENS
System Product Name: AMILO Notebook Pa 3553
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 138):
0x82047000 \SystemRoot\system32\ntkrnlpa.exe
0x82014000 \SystemRoot\system32\hal.dll
0x8040B000 \SystemRoot\system32\kdcom.dll
0x80413000 \SystemRoot\system32\PSHED.dll
0x80424000 \SystemRoot\system32\BOOTVID.dll
0x8042C000 \SystemRoot\system32\CLFS.SYS
0x8046D000 \SystemRoot\system32\CI.dll
0x8054D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C9000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80609000 \SystemRoot\system32\drivers\acpi.sys
0x8064F000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80658000 \SystemRoot\system32\drivers\msisadrv.sys
0x80660000 \SystemRoot\system32\drivers\pci.sys
0x80687000 \SystemRoot\System32\drivers\partmgr.sys
0x80696000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80699000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x806A3000 \SystemRoot\system32\drivers\volmgr.sys
0x806B2000 \SystemRoot\System32\drivers\volmgrx.sys
0x806FC000 \SystemRoot\System32\drivers\mountmgr.sys
0x8070C000 \SystemRoot\system32\drivers\fltmgr.sys
0x8073E000 \SystemRoot\system32\drivers\fileinfo.sys
0x8074E000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x80757000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82609000 \SystemRoot\system32\drivers\ndis.sys
0x82714000 \SystemRoot\system32\drivers\msrpc.sys
0x8273F000 \SystemRoot\system32\drivers\NETIO.SYS
0x88409000 \SystemRoot\System32\drivers\tcpip.sys
0x884F2000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88603000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88712000 \SystemRoot\system32\drivers\volsnap.sys
0x8874B000 \SystemRoot\System32\Drivers\spldr.sys
0x88753000 \SystemRoot\System32\Drivers\mup.sys
0x88762000 \SystemRoot\System32\drivers\ecache.sys
0x88789000 \SystemRoot\system32\drivers\disk.sys
0x8879A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x887BB000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x887C3000 \SystemRoot\system32\drivers\crcdisk.sys
0x8850D000 \SystemRoot\system32\drivers\ahcix86s.sys
0x8854D000 \SystemRoot\system32\drivers\storport.sys
0x887E3000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x887EE000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x885CE000 \SystemRoot\system32\DRIVERS\processr.sys
0x887F7000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C40B000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8C91E000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C9BD000 \SystemRoot\System32\drivers\watchdog.sys
0x8C9CA000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8CA01000 \SystemRoot\system32\DRIVERS\athr.sys
0x8CAE3000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8CB04000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8CB14000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8CB22000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x8CB37000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x8CB5D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CB75000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8CB7F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8CBBD000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8CBCC000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8CBD0000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8CBE3000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x82779000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8CBEE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CBF0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x827A6000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C9DC000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C9E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C400000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x885DD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x827D4000 \SystemRoot\system32\DRIVERS\raspppoe.sys

OSAM:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 23:25:12 on 24.03.2011
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 4.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl

"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\Users\Ani\AppData\Local\Temp\catchme.sys  (File not found)

"EagleNT" (EagleNT) - ? - C:\Windows\system32\drivers\EagleNT.sys  (File not found)

"Hotkey" (Hotkey) - ? - C:\Windows\system32\drivers\Hotkey.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

"XDva375" (XDva375) - ? - C:\Windows\system32\XDva375.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_11.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10c.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

"ICQ7.4" - "ICQ, LLC." - C:\Program Files\ICQ7.4\ICQ.exe

"PartyPoker.com" - ? - C:\Programs\PartyGaming\PartyPoker\RunApp.exe  (File not found)

"PokerStars" - "PokerStars" - C:\Program Files\PokerStars\PokerStarsUpdate.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Ani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"fsc-reg" - "Fujitsu Siemens" - C:\fsc-reg\fscreg.exe 20110313

"ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4

"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"FSCRecovery" - "Fujitsu Siemens Computers GmbH" - c:\Program Files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe

"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

"Google EULA Launcher" - " " - c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA

"HotkeyApp" - "Wistron" - "C:\Program Files\Launch Manager\HotkeyApp.exe"

"LMgrOSD" - ? - "C:\Program Files\Launch Manager\OSDCtrl.exe"

"LMgrVolOSD" - "Wistron Corp." - "C:\Program Files\Launch Manager\OSD.exe"

"NeroFilterCheck" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

"StartCCC" - "Advanced Micro Devices, Inc." - "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe"

"WinampAgent" - ? - "C:\Program Files\Winamp\winampa.exe"  (File found, but it contains no detailed information)

"WisKeyState" - "Wistron Corp." - "C:\Program Files\Launch Manager\WisKeyState.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Fujitsu Siemens Computers Diagnostic Testhandler" (TestHandler) - "Fujitsu Siemens Computers" - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe

"Google Desktop Manager 5.9.1005.12335" (GoogleDesktopManager-051210-111108) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate1ca605e1da063c1)" (gupdate1ca605e1da063c1) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Log von mbrcheck ist unvollständig

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: FUJITSU SIEMENS
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: FUJITSU SIEMENS
System Product Name: AMILO Notebook Pa 3553
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 138):
0x82047000 \SystemRoot\system32\ntkrnlpa.exe
0x82014000 \SystemRoot\system32\hal.dll
0x8040B000 \SystemRoot\system32\kdcom.dll
0x80413000 \SystemRoot\system32\PSHED.dll
0x80424000 \SystemRoot\system32\BOOTVID.dll
0x8042C000 \SystemRoot\system32\CLFS.SYS
0x8046D000 \SystemRoot\system32\CI.dll
0x8054D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C9000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80609000 \SystemRoot\system32\drivers\acpi.sys
0x8064F000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80658000 \SystemRoot\system32\drivers\msisadrv.sys
0x80660000 \SystemRoot\system32\drivers\pci.sys
0x80687000 \SystemRoot\System32\drivers\partmgr.sys
0x80696000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80699000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x806A3000 \SystemRoot\system32\drivers\volmgr.sys
0x806B2000 \SystemRoot\System32\drivers\volmgrx.sys
0x806FC000 \SystemRoot\System32\drivers\mountmgr.sys
0x8070C000 \SystemRoot\system32\drivers\fltmgr.sys
0x8073E000 \SystemRoot\system32\drivers\fileinfo.sys
0x8074E000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x80757000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82609000 \SystemRoot\system32\drivers\ndis.sys
0x82714000 \SystemRoot\system32\drivers\msrpc.sys
0x8273F000 \SystemRoot\system32\drivers\NETIO.SYS
0x88409000 \SystemRoot\System32\drivers\tcpip.sys
0x884F2000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88603000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88712000 \SystemRoot\system32\drivers\volsnap.sys
0x8874B000 \SystemRoot\System32\Drivers\spldr.sys
0x88753000 \SystemRoot\System32\Drivers\mup.sys
0x88762000 \SystemRoot\System32\drivers\ecache.sys
0x88789000 \SystemRoot\system32\drivers\disk.sys
0x8879A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x887BB000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x887C3000 \SystemRoot\system32\drivers\crcdisk.sys
0x8850D000 \SystemRoot\system32\drivers\ahcix86s.sys
0x8854D000 \SystemRoot\system32\drivers\storport.sys
0x887E3000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x887EE000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x885CE000 \SystemRoot\system32\DRIVERS\processr.sys
0x887F7000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C40B000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8C91E000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C9BD000 \SystemRoot\System32\drivers\watchdog.sys
0x8C9CA000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8CA01000 \SystemRoot\system32\DRIVERS\athr.sys
0x8CAE3000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8CB04000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8CB14000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8CB22000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x8CB37000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x8CB5D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CB75000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8CB7F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8CBBD000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8CBCC000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8CBD0000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8CBE3000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x82779000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8CBEE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CBF0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x827A6000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C9DC000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C9E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C400000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x885DD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x827D4000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x827E3000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x807C8000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x807DD000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8CBFB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x805D6000 \SystemRoot\system32\DRIVERS\ks.sys
0x807ED000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8CE0F000 \SystemRoot\system32\DRIVERS\umbus.sys

Leider immer noch unvollständig. Lass es doch mal etwas länger durchlaufen!

Sorry...diesmal aber:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: FUJITSU SIEMENS
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: FUJITSU SIEMENS
System Product Name: AMILO Notebook Pa 3553
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 138):
0x8203D000 \SystemRoot\system32\ntkrnlpa.exe
0x8200A000 \SystemRoot\system32\hal.dll
0x8040B000 \SystemRoot\system32\kdcom.dll
0x80413000 \SystemRoot\system32\PSHED.dll
0x80424000 \SystemRoot\system32\BOOTVID.dll
0x8042C000 \SystemRoot\system32\CLFS.SYS
0x8046D000 \SystemRoot\system32\CI.dll
0x8054D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C9000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8060D000 \SystemRoot\system32\drivers\acpi.sys
0x80653000 \SystemRoot\system32\drivers\WMILIB.SYS
0x8065C000 \SystemRoot\system32\drivers\msisadrv.sys
0x80664000 \SystemRoot\system32\drivers\pci.sys
0x8068B000 \SystemRoot\System32\drivers\partmgr.sys
0x8069A000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8069D000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x806A7000 \SystemRoot\system32\drivers\volmgr.sys
0x806B6000 \SystemRoot\System32\drivers\volmgrx.sys
0x80700000 \SystemRoot\System32\drivers\mountmgr.sys
0x80710000 \SystemRoot\system32\drivers\fltmgr.sys
0x80742000 \SystemRoot\system32\drivers\fileinfo.sys
0x80752000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8075B000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8260B000 \SystemRoot\system32\drivers\ndis.sys
0x82716000 \SystemRoot\system32\drivers\msrpc.sys
0x82741000 \SystemRoot\system32\drivers\NETIO.SYS
0x88403000 \SystemRoot\System32\drivers\tcpip.sys
0x884EC000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88603000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88712000 \SystemRoot\system32\drivers\volsnap.sys
0x8874B000 \SystemRoot\System32\Drivers\spldr.sys
0x88753000 \SystemRoot\System32\Drivers\mup.sys
0x88762000 \SystemRoot\System32\drivers\ecache.sys
0x88789000 \SystemRoot\system32\drivers\disk.sys
0x8879A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x887BB000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x887C3000 \SystemRoot\system32\drivers\crcdisk.sys
0x88507000 \SystemRoot\system32\drivers\ahcix86s.sys
0x88547000 \SystemRoot\system32\drivers\storport.sys
0x887E3000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x887EE000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x885C8000 \SystemRoot\system32\DRIVERS\processr.sys
0x887F7000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C209000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8C71C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C7BB000 \SystemRoot\System32\drivers\watchdog.sys
0x8C7C8000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8CA00000 \SystemRoot\system32\DRIVERS\athr.sys
0x8CAE2000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8CB03000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8CB13000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8CB21000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x8CB36000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x8CB5C000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CB74000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8CB7E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8CBBC000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8CBCB000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8CBCF000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8CBE2000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8277B000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8CBED000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CBEF000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x827A8000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C7DA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C7E5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x885D7000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x827D6000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x885E2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x807CC000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x807E0000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x805D6000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8CBFA000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8CC00000 \SystemRoot\system32\DRIVERS\ks.sys
0x8CC2A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8CC34000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8CC41000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8CC75000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8CC86000 \SystemRoot\system32\drivers\HdAudio.sys
0x8CCC5000 \SystemRoot\system32\drivers\portcls.sys
0x8CCF2000 \SystemRoot\system32\drivers\drmk.sys
0x8CE08000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8D015000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8D01E000 \SystemRoot\System32\Drivers\Null.SYS
0x8D025000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D035000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8D03C000 \SystemRoot\System32\drivers\vga.sys
0x8D048000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D069000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D071000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D079000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D084000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D092000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D09B000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D0B1000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D0C5000 \SystemRoot\system32\drivers\afd.sys
0x8D10D000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D13F000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D155000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D163000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D176000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D1B2000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D1BC000 \SystemRoot\System32\Drivers\Hotkey.SYS
0x8D1BF000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D1D6000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8D1DF000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8D1EF000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8CD17000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8CD2E000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8CD4F000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8CD5C000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x8CD66000 \SystemRoot\System32\Drivers\dump_ahcix86s.sys
0x95040000 \SystemRoot\System32\win32k.sys
0x8CDA6000 \SystemRoot\System32\drivers\Dxapi.sys
0x8CDB0000 \SystemRoot\system32\DRIVERS\monitor.sys
0x95260000 \SystemRoot\System32\TSDDD.dll
0x95280000 \SystemRoot\System32\cdd.dll
0x8CDBF000 \SystemRoot\system32\drivers\luafv.sys
0x98206000 \SystemRoot\system32\drivers\spsys.sys
0x982B5000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x982C5000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x982EF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x982F9000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9830C000 \SystemRoot\system32\drivers\HTTP.sys
0x98379000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x98396000 \SystemRoot\system32\DRIVERS\bowser.sys
0x983AF000 \SystemRoot\System32\drivers\mpsdrv.sys
0x983C4000 \SystemRoot\system32\drivers\mrxdav.sys
0x8CDDA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x88588000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x983E4000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x98C02000 \SystemRoot\System32\DRIVERS\srv2.sys
0x98C2A000 \SystemRoot\System32\DRIVERS\srv.sys
0x98C78000 \SystemRoot\system32\drivers\peauth.sys
0x98D56000 \SystemRoot\System32\Drivers\secdrv.SYS
0x98D60000 \SystemRoot\System32\drivers\tcpipreg.sys
0x98D6C000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77240000 \Windows\System32\ntdll.dll

Processes (total 65):
0 System Idle Process
4 System
508 C:\Windows\System32\smss.exe
580 csrss.exe
652 C:\Windows\System32\wininit.exe
660 csrss.exe
696 C:\Windows\System32\services.exe
716 C:\Windows\System32\lsass.exe
724 C:\Windows\System32\lsm.exe
856 C:\Windows\System32\svchost.exe
920 C:\Windows\System32\svchost.exe
956 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\Ati2evxx.exe
1044 C:\Windows\System32\svchost.exe
1056 C:\Windows\System32\winlogon.exe
1148 C:\Windows\System32\svchost.exe
1168 C:\Windows\System32\svchost.exe
1284 C:\Windows\System32\audiodg.exe
1348 C:\Windows\System32\SLsvc.exe
1396 C:\Windows\System32\svchost.exe
1516 C:\Windows\System32\svchost.exe
1552 C:\Windows\System32\Ati2evxx.exe
1776 C:\Windows\System32\spoolsv.exe
1832 C:\Windows\System32\svchost.exe
560 C:\Program Files\ICQ6Toolbar\ICQ Service.exe
644 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
1864 C:\Windows\System32\svchost.exe
1996 C:\Windows\System32\svchost.exe
1772 C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
2140 C:\Windows\System32\svchost.exe
2200 C:\Windows\System32\SearchIndexer.exe
2668 C:\Windows\System32\taskeng.exe
2704 C:\Windows\System32\dwm.exe
2756 C:\Windows\System32\taskeng.exe
2784 C:\Windows\explorer.exe
2984 C:\Windows\RtHDVCpl.exe
3008 C:\Program Files\Synaptics\SynTP\SynTPStart.exe
3020 C:\Program Files\Launch Manager\HotkeyApp.exe
3028 C:\Program Files\Launch Manager\WisKeyState.exe
3036 C:\Program Files\Launch Manager\OSD.exe
3052 C:\Program Files\Launch Manager\OSDCtrl.exe
3220 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
3276 C:\Program Files\Java\jre6\bin\jusched.exe
3284 C:\Program Files\Launch Manager\WisLMSvc.exe
3308 C:\Program Files\Winamp\winampa.exe
3324 C:\Program Files\Windows Sidebar\sidebar.exe
3404 WmiPrvSE.exe
3580 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
3588 C:\Program Files\ICQ7.4\ICQ.exe
3604 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3628 C:\Program Files\Mozilla Firefox\firefox.exe
3968 C:\Program Files\Mozilla Firefox\plugin-container.exe
2844 C:\Windows\servicing\TrustedInstaller.exe
3500 C:\Windows\System32\VSSVC.exe
1944 C:\Program Files\Internet Explorer\ieuser.exe
3544 C:\Program Files\Internet Explorer\iexplore.exe
2420 C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
3624 C:\Windows\System32\svchost.exe
3388 C:\ProgramData\Google\Google Toolbar\Update\GoogleToolbarInstaller_updater_signed.exe
3964 C:\Windows\System32\conime.exe
3676 C:\Program Files\Java\jre6\bin\jucheck.exe
156 C:\Windows\System32\SearchProtocolHost.exe
844 C:\Windows\System32\SearchFilterHost.exe
3072 C:\Windows\System32\wuauclt.exe
3116 C:\Users\Ani\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`32900000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000019`bcc00000 (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHZ2320BH G2, Rev:

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 RE: Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Ok.

Zitat:

"EagleNT" (EagleNT) - ? - C:\Windows\system32\drivers\EagleNT.sys (File not found)
"XDva375" (XDva375) - ? - C:\Windows\system32\XDva375.sys (File not found)

Bitte mit OSAM deaktivieren und löschen (delete from storage)

"delete from storage" lässt sich nicht anklicken...

Bitte die Anleitung zuz OSAM bachten

Habe ausversehen den 1. Report weggeklickt, hier ist das Endergebnis:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 15:43:33 on 25.03.2011
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 4.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl

"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\Users\Ani\AppData\Local\Temp\catchme.sys  (File not found)

"Hotkey" (Hotkey) - ? - C:\Windows\system32\drivers\Hotkey.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

(Disabled) "EagleNT" (EagleNT) - ? - C:\Windows\system32\drivers\EagleNT.sys  (File not found)

(Disabled) "XDva375" (XDva375) - ? - C:\Windows\system32\XDva375.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_11.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10c.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

"ICQ7.4" - "ICQ, LLC." - C:\Program Files\ICQ7.4\ICQ.exe

"PartyPoker.com" - ? - C:\Programs\PartyGaming\PartyPoker\RunApp.exe  (File not found)

"PokerStars" - "PokerStars" - C:\Program Files\PokerStars\PokerStarsUpdate.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Ani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"fsc-reg" - "Fujitsu Siemens" - C:\fsc-reg\fscreg.exe 20110313

"ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4

"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"FSCRecovery" - "Fujitsu Siemens Computers GmbH" - c:\Program Files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe

"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

"Google EULA Launcher" - " " - c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA

"HotkeyApp" - "Wistron" - "C:\Program Files\Launch Manager\HotkeyApp.exe"

"LMgrOSD" - ? - "C:\Program Files\Launch Manager\OSDCtrl.exe"

"LMgrVolOSD" - "Wistron Corp." - "C:\Program Files\Launch Manager\OSD.exe"

"NeroFilterCheck" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

"StartCCC" - "Advanced Micro Devices, Inc." - "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe"

"WinampAgent" - ? - "C:\Program Files\Winamp\winampa.exe"  (File found, but it contains no detailed information)

"WisKeyState" - "Wistron Corp." - "C:\Program Files\Launch Manager\WisKeyState.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Fujitsu Siemens Computers Diagnostic Testhandler" (TestHandler) - "Fujitsu Siemens Computers" - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe

"Google Desktop Manager 5.9.1005.12335" (GoogleDesktopManager-051210-111108) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate1ca605e1da063c1)" (gupdate1ca605e1da063c1) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Nagut, deaktivieren geht auch.

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/25/2011 at 06:59 PM

Application Version : 4.50.1002

Core Rules Database Version : 6673
Trace Rules Database Version: 4485

Scan type : Complete Scan
Total Scan Time : 01:45:28

Memory items scanned : 643
Memory threats detected : 0
Registry items scanned : 8932
Registry threats detected : 0
File items scanned : 125266
File threats detected : 23

Adware.Tracking Cookie
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ar.atwola[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@advertising[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@content.yieldmanager[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@cdn.at.atwola[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@zedo[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@atdmt[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@partypoker[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad.yieldmanager[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@tacoda[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@atwola[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adtech[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@doubleclick[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@earlyexperience.partyaccount[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@de.partypoker[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@at.atwola[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@bs.serving-sys[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adcentriconline[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adfarm1.adition[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@serving-sys[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@content.yieldmanager[3].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@tradedoubler[2].txt
C:\Users\***\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XT3VABRU ]

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6169

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

25.03.2011 16:55:16
mbam-log-2011-03-25 (16-55-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 270621
Laufzeit: 46 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Okay, hört sich schonmal gut an :) aber habe noch das Probleme:

-Lieder und Bilder werden nicht angezeigt(wie am Anfang), habe aber bei einem Scan gesehen, dass die Bilder durchsucht worden sind, also müssten sie doch noch da sein?Warum kann ich sie nicht sehen?

Geht das auch genauer?
Kann kein Lies mehr abgespielt werden? Auch über Youtube etc. nicht?

Es ist noch genauso, wie ich es im 1. Beitrag beschrieben habe... wenn ich einen Ordner auf dem Desktop oder bei den eigenen Dateien anklicke steht da " dieser Ordner ist leer". Habe aber wie gesagt bei einem von den Scans die ich gemacht habe gesehen, dass genau die Ordner durchsucht worden sind und auch die einzelnen Lieder/Bilder die in dem Ordner vorher( vor dem Trojaner) drin waren...deshalb meinte ich, dass die Bilder/Lieder doch eigentlich auch da sein müssten.
Wenn ich jetzt den Ordner "Bilder anklicke, werden mir die ganzen Unterordner angezeigt, sogar mit den Vorschaubildern (hoffe du weißt was ich meine...), wenn ich dann aber einen von den Ordnern anklicke steht da "der Ordner ist leer").
Oder bei Winamp lassen sich auch die Lieder abspielen, die in der Playlist waren, die ich vor dem Trojaner zuletzt geladen hatte (ich kann aber keine andere Playlist laden, weil ich die unter "Dokumente" gespeichert hatte und auch da keine Dateien mehr sind/bzw nicht angezeigt werden).
Youtube und alles andere geht.
Deshalb frag ich mich jetzt, ob die Dateien gelöscht worden sind oder noch da sind, nur nicht sichtbar.Mit der Systemwiederherstellung kann es ja nichts zu tun haben, weil an dem Datum auf das ich wiederhergestellt habe waren die Dateien alle schon drauf.

Vllt hab ich was übersehen. Mach mal frische Logs mit OTL.exe und poste sie.

1.OTL Logfile:

Code:

OTL Extras logfile created on: 27.03.2011 22:05:35 - Run 2

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 47,00% Memory free

5,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 94,16 Gb Total Space | 30,99 Gb Free Space | 32,91% Space Free | Partition Type: NTFS

Drive D: | 195,14 Gb Total Space | 195,05 Gb Free Space | 99,95% Space Free | Partition Type: NTFS

 

Computer Name: ***C | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"oobe_av" = 1

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0AC4EAF2-D30E-46B3-8E9C-8B6DC0230082}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{0ACDB04C-BF68-4789-B6BC-6A9100684758}" = lport=137 | protocol=17 | dir=in | app=system | 

"{10CEA79A-F75A-4118-9FCC-24FB14888D9F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{12C40389-F4AA-4B07-B02C-71B26DA9AC75}" = rport=137 | protocol=17 | dir=out | app=system | 

"{1EB00D77-B053-4357-8433-40421ACCE722}" = rport=445 | protocol=6 | dir=out | app=system | 

"{4208AA20-C8AA-4D7A-9D80-A746C7CAEBC7}" = lport=138 | protocol=17 | dir=in | app=system | 

"{4AA1CB05-B3CA-4BD9-A523-977889C41162}" = rport=138 | protocol=17 | dir=out | app=system | 

"{4C7DCADF-E56F-4865-A504-9B28B1BEA969}" = lport=445 | protocol=6 | dir=in | app=system | 

"{616923DC-AE32-4305-8385-CECF20AF4A79}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{7A0932FA-6D5B-4E68-8384-2FF0E0ED3E97}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{BFD31C53-47F3-4387-B7CB-9AB5A8617A0C}" = lport=139 | protocol=6 | dir=in | app=system | 

"{E20C5825-4B77-420B-942D-61F61F56DB6F}" = rport=139 | protocol=6 | dir=out | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{163157D8-8E3D-40CB-B4F7-AE93D618FD2F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{1CBB2CED-69B0-493A-BD7D-920648EF69B3}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{2A3EF047-B65D-4728-82B9-57C3261BC8AE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{3F61C227-593F-4A0F-ADC9-1EED02710DC0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{4534C903-2B06-40C7-9964-893C99854CCB}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe | 

"{49D107F6-C253-4C94-8CA3-B46DB33F0FF8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{61774FA6-5012-4679-A245-12F9F08DDB82}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 

"{7C354DA8-6EEA-44B4-8507-DDDA9F934635}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe | 

"{8916AF0B-8B31-461B-8399-700EC4F0EE3F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{918CAF29-587F-4087-A64B-FA1D9280566C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{9910490A-4947-41C7-B5F8-E9288C828A34}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 

"{A18683AC-84A4-49E9-8A8B-817917FD78FE}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | 

"{AA0F234E-020C-41D4-854A-61357E2EF01F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{B3683B96-E77F-4B5F-8C4E-0D23C07F9B52}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{B643CB92-F220-4325-A4DE-8AF1FEDCC623}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{BE5B488D-DEFB-42DA-ADB0-AD0D02913811}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 

"{BFF05BA1-8F5D-450C-A12C-08B1A997C8F8}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{C7C4D1D0-6209-4CFC-A2BD-90BB1E4D90EE}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 

"{CB7CF885-7A90-432F-931D-2DF301EEF76C}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 

"{D2BE524F-3073-41E0-A2C6-81C5AC271662}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{D475EA96-6740-42EE-9FF5-DA0329CC7358}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 

"{DF946051-375D-489A-B1D1-D8548A68A569}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe | 

"{E134DA2D-24CC-4DA2-820D-3A2F9142AA45}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe | 

"{E5A728EA-7959-4B66-82B1-96E7192B6D20}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{E931E7F7-B149-4384-8A93-D714C5A72BB9}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | 

"{EC4C3FFB-D19A-468D-AA38-E006DC883327}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 

"TCP Query User{3C897222-2206-4562-ABB3-759E51823ECB}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{6DE602EA-0164-4373-90E2-B44F50B511E3}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | 

"TCP Query User{975A88E2-B638-4283-8837-FEB6CC48806A}C:\program files\frostwire\frostwire.exe" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe | 

"TCP Query User{B6AA7CA9-CDCC-43D0-B547-42BE95A75287}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"TCP Query User{B8113162-5CFD-4869-A6F9-B1CFE5D8C8AC}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"TCP Query User{CBE3F5DA-8755-468D-8ABD-65463EAC1537}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 

"TCP Query User{EA52A18E-C3CA-43ED-AD6D-A3F013D08A0A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{6BB43954-7165-480E-8DA2-32E8ADEFFCF0}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | 

"UDP Query User{7946DD39-0D0D-4561-AB70-BA96422B1567}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 

"UDP Query User{9C7ADB27-4DD1-4515-B8F8-3DE63E7CD578}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{B25D2DA6-9A0A-4160-8493-B3AA7E320D13}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{DD68C35D-D5D5-4843-BC3B-883DAC10D9F9}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{DF1684F1-BFE9-4455-9619-3F2AD0379F29}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{F057C794-5510-4600-8386-B0693D45B8FB}C:\program files\frostwire\frostwire.exe" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{016F5FA1-FD85-FA69-885F-96A03EEEF9C1}" = CCC Help Dutch

"{017C6E75-766C-DE1C-1B48-D0230CB155BC}" = Catalyst Control Center Localization Korean

"{021C8270-F2A6-C941-3A19-EBE139C966E7}" = Catalyst Control Center Graphics Full Existing

"{04FC3DE9-BC19-E2A2-2FB9-24684DA82A36}" = CCC Help Spanish

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{05DD3745-0898-FCA7-0A52-689F128B84F9}" = CCC Help French

"{0739951F-27F4-F7FF-C26D-3C44A681933F}" = ccc-utility

"{099F2D26-B862-F04A-FC7B-E7B0B6196CA7}" = CCC Help Chinese Standard

"{0C58BA84-88A3-39FD-61DB-4DF780D1E0B9}" = CCC Help Polish

"{0C8DFC9B-FB65-1444-3E12-9DF64270347A}" = CCC Help Korean

"{139B7164-4C7B-BF85-4CA6-0DD5C611179B}" = Catalyst Control Center Localization Turkish

"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter

"{14D68B6D-4C3E-6771-1C77-4384BB653B9E}" = Catalyst Control Center Localization Chinese Traditional

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{22E719FE-F76D-0BF3-229D-7A9337458CD0}" = CCC Help German

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller

"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11

"{26D421BE-752E-1070-0C26-2DE993ED00B0}" = CCC Help Portuguese

"{2A63E819-5359-62CF-FCDB-3707391A08A0}" = CCC Help Chinese Traditional

"{2F926AE7-9FB7-4B34-906F-9C29A6D146A7}" = SystemDiagnostics

"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform

"{31F2D65F-84A8-D3AD-E3AF-DF127860E39E}" = CCC Help Turkish

"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3F026B88-D153-93DB-A99B-2A78AFEFF813}" = Catalyst Control Center Localization Polish

"{3F03121C-CA62-D0E1-7957-5C82A4CF3C69}" = Catalyst Control Center Localization Norwegian

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{45A34A3F-3597-AA37-E44B-9B95852055A9}" = CCC Help Swedish

"{4811A487-6830-E60D-CD37-816E46C8988D}" = Catalyst Control Center Localization Portuguese

"{49083280-8601-EF0D-EC78-6A8FD9C54172}" = CCC Help Thai

"{4A5DC837-AD1B-D80E-FDE5-4793DC47F695}" = CCC Help Finnish

"{4AAF1376-9CB5-B232-22EE-D0EE53ED9148}" = Catalyst Control Center Localization Danish

"{4EBE8518-B14F-B69E-082B-E6FB85F6B52E}" = CCC Help Italian

"{4F2E897D-39A4-73B7-6614-F1EC2B43A1B5}" = CCC Help Czech

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{5413DF9C-4FCC-39A1-FB67-6945428DA718}" = Catalyst Control Center Localization Russian

"{55035C7B-61D2-1DC1-EC53-CFD01C3F82F9}" = CCC Help Hungarian

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{5B5A6B3A-9DF7-4B81-9F29-5CC668406904}" = Pixia

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{60DCEC40-8854-B0B5-7828-A6E14DBE71EC}" = Catalyst Control Center Graphics Previews Vista

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6DC0B476-B032-83DE-9637-3F6809A344C1}" = Skins

"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4

"{766FF098-68AB-48BE-BF41-05708D178198}" = Wer wird Millionär

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{774715EC-6B2F-092E-0221-B464A80F565A}" = Catalyst Control Center Localization Italian

"{78B1919F-EFDD-5A23-7393-7887C53BE013}" = CCC Help Danish

"{7E1043B7-AA4D-A877-9A26-D1B3E78DF051}" = CCC Help Norwegian

"{81758E18-D5EA-4049-844A-E2DDDDDA9798}" = CCC Help English

"{81794E08-21DA-189A-1DD5-AEDBBE0BE37B}" = CCC Help Russian

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{95104E32-1B84-0E33-14BE-BA115643629C}" = Catalyst Control Center Graphics Light

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9687697B-1055-E1E5-2D31-061CC502AB31}" = ATI Catalyst Install Manager

"{96AFCF8B-3C53-49A2-8456-E637021B1031}" = Nero 8 Essentials

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{98383302-798D-2089-9143-D64E35D666BD}" = Catalyst Control Center Localization Greek

"{9860F761-0ADB-1149-1A0D-1CBBFD693A3D}" = Catalyst Control Center Localization Finnish

"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge

"{9D26F264-EFA2-31BB-D49F-380FD60207FA}" = Catalyst Control Center Core Implementation

"{A777FF2A-942F-CBB0-C36B-F9B72E95B7D9}" = Catalyst Control Center Localization Czech

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder

"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter

"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch

"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint

"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger

"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder

"{AFC454ED-A26F-4816-826B-C35129D82E1F}" = Fujitsu Siemens Computers Recovery

"{B1EEB795-48EE-AA3B-7CF9-5CE4B7883792}" = Catalyst Control Center Localization German

"{B3905755-64EC-422E-A4D9-644D6D8FDE5E}" = ccc-core-static

"{B3D068F7-34DD-2BB7-6F2F-D67274819ACC}" = Catalyst Control Center Localization Swedish

"{C698749A-7BB4-BE2A-9551-EC85C8A65E2F}" = CCC Help Greek

"{CA45B622-88F9-4836-A529-DBF14698498D}" = Catalyst Control Center - Branding

"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CF06DB43-2F14-EA98-AB1B-124FD65A8AEE}" = Catalyst Control Center InstallProxy

"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.5.4

"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call

"{D21E879C-8400-BEE3-23AB-9399DEF9F7D1}" = Catalyst Control Center Localization Hungarian

"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser

"{DCA2E1BC-7FB4-217C-54C6-B99D4EA7FFCF}" = Catalyst Control Center Localization Dutch

"{DEDB47A3-C988-4A43-A645-E2CEA571E680}" = Epson Easy Photo Print 2

"{E7B4D6A2-D6B1-29A3-7720-C35599A8718B}" = Catalyst Control Center Localization Thai

"{EBFD0EFA-9AEF-D432-9330-717FE34FB717}" = Catalyst Control Center Localization French

"{ED3B736A-7C2E-35DB-0F33-E8C9CF101662}" = Catalyst Control Center Localization Chinese Standard

"{EECA2BE9-BB32-8E29-3293-536B600B04B4}" = Catalyst Control Center Localization Spanish

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F2E272DA-CB23-936D-268E-030DE425AD11}" = Catalyst Control Center Graphics Full New

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{F87C6FBE-FBD2-CC11-FF28-AC687D08EDF0}" = CCC Help Japanese

"{FD65BBF8-5EEB-BE96-44E8-5887B035E0F6}" = Catalyst Control Center Localization Japanese

"7-Zip" = 7-Zip 9.20

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Audacity_is1" = Audacity 1.2.6

"Blue Byte Game Channel" = Blue Byte Game Channel

"EPSON Scanner" = EPSON Scan

"EPSON Stylus SX100_TX100 Benutzerhandbuch" = EPSON Stylus SX100_TX100 Handbuch

"EPSON SX100 Series" = EPSON SX100 Series Printer Uninstall

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.30

"Google Chrome" = Google Chrome

"Google Desktop" = Google Desktop

"HOMESTUDENTR" = Microsoft Office Home and Student 2007

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de)

"Picasa 3" = Picasa 3

"PokerStars" = PokerStars

"Skinamp" = Skinamp for Winamp 2.x (remove only)

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Uninstall_is1" = Uninstall 1.0.0.1

"Winamp" = Winamp

"WinLiveSuite_Wave3" = Windows Live Essentials

 
 ========== Last 10 Event Log Errors ==========

 

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

 

< End of report >

--- --- ---

2.OTL Logfile:

Code:

OTL logfile created on: 27.03.2011 22:05:35 - Run 2

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 47,00% Memory free

5,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 94,16 Gb Total Space | 30,99 Gb Free Space | 32,91% Space Free | Partition Type: NTFS

Drive D: | 195,14 Gb Total Space | 195,05 Gb Free Space | 99,95% Space Free | Partition Type: NTFS

 

Computer Name: *** | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

PRC - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

PRC - C:\Programme\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)

PRC - C:\Programme\Winamp\winamp.exe (Nullsoft)

PRC - C:\Programme\Winamp\winampa.exe ()

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

PRC - C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)

PRC - C:\Programme\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)

PRC - C:\Programme\Launch Manager\WisKeyState.exe (Wistron Corp.)

PRC - C:\Programme\Launch Manager\OSD.exe (Wistron Corp.)

PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)

PRC - C:\Programme\Launch Manager\WisLMSvc.exe (Wistron Corp.)

PRC - C:\Programme\Launch Manager\OSDCtrl.exe ()

PRC - C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (TestHandler) -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (WisLMSvc) -- C:\Program Files\Launch Manager\WisLMSvc.exe (Wistron Corp.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.)

DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)

DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)

DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)

DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )

DRV - (Hotkey) -- C:\Windows\System32\drivers\HOTKEY.sys ()

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9

FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

 

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.24 20:15:27 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.24 20:15:27 | 000,000,000 | ---D | M]

 

[2009.09.12 19:45:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2009.04.22 16:46:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org

[2011.03.24 20:41:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions

[2011.03.24 14:35:47 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.03.24 14:35:47 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.03.24 14:35:47 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\zf8kf1a0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.03.24 20:12:42 | 000,002,349 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icq-search.xml

[2011.03.23 13:26:33 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-1.xml

[2010.12.11 11:07:23 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-2.xml

[2010.12.17 14:03:21 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-3.xml

[2011.03.14 18:56:30 | 000,000,961 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-4.xml

[2011.03.24 20:17:26 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-5.xml

[2011.03.24 20:23:11 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin-6.xml

[2010.05.12 18:40:48 | 000,001,042 | -H-- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\zf8kf1a0.default\searchplugins\icqplugin.xml

[2011.03.24 20:14:15 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.07.17 19:00:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

File not found (No name found) -- 

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZF8KF1A0.DEFAULT\EXTENSIONS\{B9DB16A4-6EDC-47EC-A1F4-B86292ED211D}.XPI

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZF8KF1A0.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI

[2011.03.18 19:56:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.03.24 20:20:50 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

O4 - HKLM..\Run: [FSCRecovery] c:\Programme\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe (Fujitsu Siemens Computers GmbH)

O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )

O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe ()

O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()

O4 - HKLM..\Run: [WisKeyState] C:\Program Files\Launch Manager\WisKeyState.exe (Wistron Corp.)

O4 - HKCU..\Run: [fsc-reg] C:\fsc-reg\fscreg.exe (Fujitsu Siemens)

O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -  File not found

O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -  File not found

O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)

O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.03.27 13:05:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars

[2011.03.27 13:05:29 | 000,000,000 | ---D | C] -- C:\Programme\PokerStars

[2011.03.26 13:17:24 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PokerStars.NET

[2011.03.25 17:59:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\SUPERAntiSpyware.com

[2011.03.25 17:59:06 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2011.03.25 17:59:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2011.03.25 17:58:55 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware

[2011.03.25 17:58:29 | 010,687,672 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\***\Desktop\SUPERAntiSpyware.exe

[2011.03.25 16:22:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Online Solutions

[2011.03.25 00:22:55 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\osam_autorun_manager_5_0_portable

[2011.03.25 00:22:32 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2011.03.25 00:22:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2011.03.24 23:18:04 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2011.03.24 22:20:18 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\tdsskiller

[2011.03.24 20:55:55 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2011.03.24 20:48:25 | 000,000,000 | ---D | C] -- C:\Cofi

[2011.03.24 20:48:06 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe

[2011.03.24 20:40:31 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2011.03.24 20:40:31 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2011.03.24 20:40:31 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2011.03.24 20:40:26 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2011.03.24 20:36:30 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011.03.24 20:08:56 | 000,000,000 | ---D | C] -- C:\_OTL

[2011.03.24 17:01:51 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2011.03.24 16:59:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.03.24 16:59:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.03.24 16:59:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.03.24 16:59:34 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.03.24 14:09:50 | 000,000,000 | ---D | C] -- C:\Programme\Avira

[2011.03.24 14:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.03.24 04:41:07 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2011.03.24 04:17:01 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2011.03.24 04:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.03.24 04:16:47 | 000,000,000 | ---D | C] -- C:\Programme\herbert

[2011.03.24 03:59:58 | 000,000,000 | -H-D | C] -- C:\ProgramData\TEMP

[2011.03.24 03:59:26 | 000,000,000 | -H-D | C] -- C:\Users\***\Documents\Simply Super Software

[2011.03.24 03:59:17 | 000,000,000 | -H-D | C] -- C:\Programme\Trojan Remover

[2011.03.24 03:59:17 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\Simply Super Software

[2011.03.24 03:59:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\Simply Super Software

[2011.03.24 03:41:40 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2011.03.24 03:41:40 | 000,000,000 | ---D | C] -- C:\Programme\Enigma Software Group

[2011.03.14 18:56:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.4

[2011.03.14 18:54:43 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\ICQ

[2011.03.14 18:54:29 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.4

[2011.03.10 13:27:50 | 001,377,112 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\***\Desktop\TDSSKiller.exe

[2011.03.09 16:50:46 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData\Roaming\AVS4YOU

[2011.03.09 16:49:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVS4YOU

[2011.03.09 16:49:37 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\AVSMedia

[2011.03.09 16:48:57 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\GdiPlus.dll

[2011.03.09 16:48:57 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3a.dll

[2011.03.09 16:48:57 | 000,000,000 | -H-D | C] -- C:\ProgramData\AVS4YOU

[2011.03.09 16:48:57 | 000,000,000 | ---D | C] -- C:\Programme\AVS4YOU

[2011.03.08 22:33:42 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll

[2011.03.08 22:33:42 | 000,323,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll

[2011.03.08 22:33:42 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax

[2011.03.08 22:33:42 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.03.27 22:00:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.03.27 20:34:30 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.03.27 20:34:30 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.03.27 13:05:37 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\PokerStars.lnk

[2011.03.27 12:40:37 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.03.27 12:40:37 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.03.27 12:40:37 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.03.27 12:40:37 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.03.27 12:36:30 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.03.27 12:34:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.03.27 12:34:25 | 2380,316,672 | -HS- | M] () -- C:\hiberfil.sys

[2011.03.25 17:59:01 | 000,001,806 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2011.03.25 17:58:41 | 010,687,672 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Ani\Desktop\SUPERAntiSpyware.exe

[2011.03.25 16:29:56 | 000,311,296 | ---- | M] () -- C:\Windows\System32\drivers\ohekbae.sys

[2011.03.25 00:26:28 | 000,080,384 | ---- | M] () -- C:\Users\***\Desktop\MBRCheck.exe

[2011.03.25 00:09:55 | 004,272,474 | ---- | M] () -- C:\Users\***\Desktop\osam_autorun_manager_5_0_portable.rar

[2011.03.25 00:03:29 | 276,551,926 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2011.03.24 23:44:55 | 000,301,568 | ---- | M] () -- C:\Users\***\Desktop\qygfgi4t.exe

[2011.03.24 20:48:01 | 004,301,567 | R--- | M] () -- C:\Users\***\Desktop\Cofi.exe

[2011.03.24 20:20:50 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2011.03.24 20:14:15 | 000,000,852 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2011.03.24 17:01:53 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2011.03.24 16:59:38 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.03.23 16:21:50 | 000,016,478 | -H-- | M] () -- C:\Users\***\Documents\Summer.m3u

[2011.03.22 00:11:37 | 000,049,040 | -H-- | M] () -- C:\Users\***\Documents\feb11.m3u

[2011.03.14 18:56:24 | 000,001,615 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.4.lnk

[2011.03.13 13:36:01 | 000,009,241 | ---- | M] () -- C:\Users\***\Desktop\Anleitung.html

[2011.03.10 13:27:50 | 001,377,112 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\***\Desktop\TDSSKiller.exe

 
 ========== Files Created - No Company Name ==========

 

[2011.03.27 13:05:37 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\PokerStars.lnk

[2011.03.25 17:59:01 | 000,001,806 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2011.03.25 16:29:56 | 000,311,296 | ---- | C] () -- C:\Windows\System32\drivers\ohekbae.sys

[2011.03.25 00:26:09 | 000,080,384 | ---- | C] () -- C:\Users\***\Desktop\MBRCheck.exe

[2011.03.25 00:07:35 | 004,272,474 | ---- | C] () -- C:\Users\***i\Desktop\osam_autorun_manager_5_0_portable.rar

[2011.03.24 23:44:50 | 000,301,568 | ---- | C] () -- C:\Users\***\Desktop\qygfgi4t.exe

[2011.03.24 20:47:30 | 004,301,567 | R--- | C] () -- C:\Users\***\Desktop\Cofi.exe

[2011.03.24 20:40:31 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe

[2011.03.24 20:40:31 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2011.03.24 20:40:31 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe

[2011.03.24 20:40:31 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2011.03.24 20:40:31 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2011.03.24 20:14:15 | 000,000,864 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.03.24 20:14:15 | 000,000,852 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2011.03.24 16:59:38 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.03.14 18:56:24 | 000,001,615 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.4.lnk

[2011.03.13 13:41:20 | 000,009,241 | ---- | C] () -- C:\Users\***\Desktop\Anleitung.html

[2009.09.01 13:41:39 | 000,000,680 | -H-- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2009.05.04 14:59:16 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat

[2009.05.04 14:59:16 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat

[2009.05.04 14:59:16 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat

[2009.05.04 14:59:16 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat

[2009.05.04 14:59:16 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat

[2009.05.04 14:59:16 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat

[2009.05.04 14:59:16 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat

[2009.05.04 14:59:16 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat

[2009.05.04 14:59:16 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat

[2009.05.04 14:59:16 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat

[2009.05.04 14:59:16 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat

[2009.05.04 14:59:16 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat

[2009.05.04 14:59:16 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat

[2009.05.04 14:59:16 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat

[2009.05.04 14:59:16 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat

[2009.05.04 14:59:16 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat

[2009.05.04 14:59:16 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat

[2009.05.04 14:59:16 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat

[2009.05.04 14:59:16 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini

[2009.05.04 14:56:57 | 000,000,025 | ---- | C] () -- C:\Windows\CDESX100DEFGIPS.ini

[2009.04.23 10:15:21 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.04.23 10:15:21 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2009.01.31 16:31:59 | 000,000,104 | -H-- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat

[2008.12.12 20:54:29 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.12.12 20:54:28 | 000,033,280 | ---- | C] () -- C:\Users\Ani\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.12 20:51:24 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini

[2008.09.05 06:03:01 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2008.09.05 05:44:46 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys

[2008.09.05 05:43:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2008.09.05 05:37:01 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat

[2008.09.05 05:37:01 | 000,172,033 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2008.09.05 05:37:01 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2008.09.05 05:37:01 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe

[2008.04.25 15:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll

[2008.01.21 09:15:58 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 09:15:58 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:37 | 000,296,064 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

 
 ========== LOP Check ==========

 

[2011.03.24 14:35:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Azureus

[2010.12.03 16:54:54 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers

[2009.08.05 14:17:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EPSON

[2011.03.24 14:35:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GetRightToGo

[2011.03.15 19:46:21 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\ICQ

[2011.03.25 16:32:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Online Solutions

[2011.03.24 03:59:17 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Simply Super Software

[2010.10.04 15:49:42 | 000,000,000 | -H-D | M] -- C:\Users\***\AppData\Roaming\Template

[2011.03.27 02:46:33 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

Code:

:OTL

[2011.03.25 16:29:56 | 000,311,296 | ---- | C] () -- C:\Windows\System32\drivers\ohekbae.sys

[2011.03.24 03:41:40 | 000,000,000 | ---D | C] -- C:\sh4ldr

FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

:Commands

[purity]

[resethosts]

[emptytemp]

All processes killed
========== OTL ==========
C:\Windows\System32\drivers\ohekbae.sys moved successfully.
C:\sh4ldr folder moved successfully.
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=" removed from keyword.URL
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "ICQ Search" removed from browser.search.selectedEngine
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: ***
->Temp folder emptied: 20179401 bytes
->Temporary Internet Files folder emptied: 34734931 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 389992247 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2978 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 31201 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 424,00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 03282011_123602

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.

Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Super,hat geklappt :) Muss ich jetzt noch irgendwas machen?

Kannst zur nochmaligen Kontrolle Malwarebytes ausführen, ist aber nicht unbedingt nötig. Eigentlich wäre wir durch - ist denn jetzt alles paletti bei deinem Rechner?

Okay, habe nochmal einen Quickscan gemacht- wurde nichts gefunden! Ja ist alles wieder in Ordnung, Programme laufen wieder und die Dateien sind auch alle wieder sichtbar...Soll ich die Programme (OTL usw) mal drauflassen oder muss ich was löschen?

Kann wieder alles runter. Malwarebytes kann hin und wieder aber sinnvoll sein.
Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Alles klar, hab alle Updates installiert!
Vielen, vielen Dank für die Hilfe, ohne dich wär ich wohl verloren gewesen :dankeschoen: