| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Goingonearth-InfektionWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.07.2011, 20:01
| #1 |
 |  Goingonearth-Infektion Hallo liebes TB-Team, habe mir auf der Suche nach einem kostenlosen IBM SPSS-Klon leider nicht PPSS gezogen, sondern vermeintlich einen Virus, na toll ... Ich werde bei Google auf goingonearth.com/... weitergeleitet und habe inzwischen gehört, dass dieses der goingonearth-Virus ist. Nun bitte ich vielmals um eure Hilfe! Hier die Logs: hxxp://ashtrais.com/OTL.Txt hxxp://ashtrais.com/Extras.Txt oder hxxp://ashtrais.com/OTL-logs.zip |
|
31.07.2011, 15:46
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Goingonearth-Infektion Hallo und
__________________ Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ |
|
31.07.2011, 15:50
| #3 |
| | Goingonearth-Infektion Das ist der neuste Scan:
__________________Malwarebytes' Anti-Malware 1.51.1.1800 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 7326 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 30.07.2011 22:44:06 mbam-log-2011-07-30 (22-44-05).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 392600 Laufzeit: 1 Stunde(n), 12 Minute(n), 42 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
31.07.2011, 15:51
| #4 |
| | Goingonearth-Infektion Hier ein geringfügig älterer: Malwarebytes' Anti-Malware 1.51.1.1800 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 7326 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 30.07.2011 19:06:30 mbam-log-2011-07-30 (19-06-30).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 173510 Laufzeit: 6 Minute(n), 5 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 5 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 10 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XMZH42I4GI (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Nvchost (Trojan.Goldun) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\$Recycle.Bin\s-1-5-21-3420303608-675982680-1099206388-1001\$R7XN7FS.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully. c:\$Recycle.Bin\s-1-5-21-3420303608-675982680-1099206388-1001\$RGW8RDO.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully. c:\$Recycle.Bin\s-1-5-21-3420303608-675982680-1099206388-1001\$RRIINW6.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully. c:\$Recycle.Bin\s-1-5-21-3420303608-675982680-1099206388-1001\$RTJVU57.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully. c:\$Recycle.Bin\s-1-5-21-3420303608-675982680-1099206388-1001\$RTXS0N3.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully. c:\program files (x86)\arp2600 v efx.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. c:\program files (x86)\arp2600 v.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully. c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully. c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully. |
|
31.07.2011, 16:08
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Goingonearth-Infektion Führ bitte auch ESET aus, danach sehen wir weiter: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
31.07.2011, 19:30
| #6 |
| | Goingonearth-Infektion ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255) # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=9209f9eeacca7d4592fda4c0973839f2 # end=stopped # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-07-30 05:39:36 # local_time=2011-07-30 07:39:36 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7600 NT # compatibility_mode=1797 16775165 100 94 360708 48584280 418836 0 # compatibility_mode=5893 16776574 100 94 672924 63677309 0 0 # compatibility_mode=8192 67108863 100 0 128 128 0 0 # scanned=298 # found=0 # cleaned=0 # scan_time=136 ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=9209f9eeacca7d4592fda4c0973839f2 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-07-31 06:23:55 # local_time=2011-07-31 08:23:55 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=1797 16775165 100 94 438510 48662082 496638 0 # compatibility_mode=5893 16776574 100 94 750726 63755111 0 0 # compatibility_mode=8192 67108863 100 0 77930 77930 0 0 # scanned=223038 # found=0 # cleaned=0 # scan_time=11395 |
|
01.08.2011, 09:48
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Goingonearth-Infektion Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{4a5a17d1-ac97-11e0-8873-c80aa9837a6a}\Shell - "" = AutoRun
O33 - MountPoints2\{4a5a17d1-ac97-11e0-8873-c80aa9837a6a}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{f197f58b-fc8d-11df-b6fe-c80aa9837a6a}\Shell - "" = AutoRun
O33 - MountPoints2\{f197f58b-fc8d-11df-b6fe-c80aa9837a6a}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
MsConfig:64bit - StartUpReg: 8DDYX0ZBPZ - hkey= - key= - File not found
[2011.07.30 20:23:01 | 000,000,316 | -HS- | M] () -- C:\Windows\tasks\oukhqa.job
[2011.04.04 22:51:05 | 000,000,000 | -HSD | M] -- C:\Users\Thorsten\AppData\Roaming\.#
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:93DE1838
@Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:CB0AACC9
:Commands
[purity]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.08.2011, 11:58
| #8 |
| | Goingonearth-Infektion ist es richtig, dass der spaß nur ne knappe sekunde gedauert hat? ========== OTL ========== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a5a17d1-ac97-11e0-8873-c80aa9837a6a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a5a17d1-ac97-11e0-8873-c80aa9837a6a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a5a17d1-ac97-11e0-8873-c80aa9837a6a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a5a17d1-ac97-11e0-8873-c80aa9837a6a}\ not found. File D:\setup.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f197f58b-fc8d-11df-b6fe-c80aa9837a6a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f197f58b-fc8d-11df-b6fe-c80aa9837a6a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f197f58b-fc8d-11df-b6fe-c80aa9837a6a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f197f58b-fc8d-11df-b6fe-c80aa9837a6a}\ not found. File D:\LaunchU3.exe -a not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\8DDYX0ZBPZ\ not found. C:\Windows\Tasks\oukhqa.job moved successfully. C:\Users\Thorsten\AppData\Roaming\.# folder moved successfully. ADS C:\ProgramData\Temp:AB689DEA deleted successfully. ADS C:\ProgramData\Temp:93DE1838 deleted successfully. ADS C:\ProgramData\Temp:CB0AACC9 deleted successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.26.1 log created on 08012011_125717 |
|
01.08.2011, 12:26
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Goingonearth-Infektion Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.08.2011, 12:41
| #10 |
| | Goingonearth-Infektion cure bei funden oder nur durchlaufen lassen und log posten? |
|
01.08.2011, 12:44
| #11 |
| | Goingonearth-Infektion 2011/08/01 13:43:03.0732 2060 TDSS rootkit removing tool 2.5.13.0 Jul 29 2011 17:24:11 2011/08/01 13:43:03.0872 2060 ================================================================================ 2011/08/01 13:43:03.0872 2060 SystemInfo: 2011/08/01 13:43:03.0872 2060 2011/08/01 13:43:03.0872 2060 OS Version: 6.1.7600 ServicePack: 0.0 2011/08/01 13:43:03.0872 2060 Product type: Workstation 2011/08/01 13:43:03.0872 2060 ComputerName: THORSTEN_LAPTOP 2011/08/01 13:43:03.0872 2060 UserName: Thorsten 2011/08/01 13:43:03.0872 2060 Windows directory: C:\Windows 2011/08/01 13:43:03.0872 2060 System windows directory: C:\Windows 2011/08/01 13:43:03.0872 2060 Running under WOW64 2011/08/01 13:43:03.0872 2060 Processor architecture: Intel x64 2011/08/01 13:43:03.0872 2060 Number of processors: 4 2011/08/01 13:43:03.0872 2060 Page size: 0x1000 2011/08/01 13:43:03.0872 2060 Boot type: Normal boot 2011/08/01 13:43:03.0872 2060 ================================================================================ 2011/08/01 13:43:04.0262 2060 Initialize success 2011/08/01 13:43:07.0210 4636 ================================================================================ 2011/08/01 13:43:07.0210 4636 Scan started 2011/08/01 13:43:07.0210 4636 Mode: Manual; 2011/08/01 13:43:07.0210 4636 ================================================================================ 2011/08/01 13:43:09.0098 4636 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys 2011/08/01 13:43:09.0207 4636 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 2011/08/01 13:43:09.0316 4636 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 2011/08/01 13:43:09.0441 4636 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 2011/08/01 13:43:09.0566 4636 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 2011/08/01 13:43:09.0675 4636 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 2011/08/01 13:43:09.0816 4636 AFD (6ef20ddf3172e97d69f596fb90602f29) C:\Windows\system32\drivers\afd.sys 2011/08/01 13:43:10.0299 4636 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 2011/08/01 13:43:10.0408 4636 ak1avs_x64 (565e30a02beaa5276944faf31f268586) C:\Windows\system32\Drivers\ak1avs_x64.sys 2011/08/01 13:43:10.0549 4636 ak1usb_x64 (f2733612e6c0d04713eb0c1f43f4a453) C:\Windows\system32\Drivers\ak1usb_x64.sys 2011/08/01 13:43:10.0689 4636 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 2011/08/01 13:43:10.0798 4636 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 2011/08/01 13:43:10.0908 4636 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 2011/08/01 13:43:11.0095 4636 amdkmdag (d3e6b2e1394d93fe9db0ba24814b0d8f) C:\Windows\system32\DRIVERS\atipmdag.sys 2011/08/01 13:43:11.0407 4636 amdkmdap (cc4d915d786d3da973b2ea9b95d59a29) C:\Windows\system32\DRIVERS\atikmpag.sys 2011/08/01 13:43:11.0516 4636 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 2011/08/01 13:43:11.0625 4636 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys 2011/08/01 13:43:11.0688 4636 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 2011/08/01 13:43:11.0766 4636 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys 2011/08/01 13:43:11.0859 4636 AmUStor (391887990cdaa83de5c56c3fde966da1) C:\Windows\system32\drivers\AmUStor.SYS 2011/08/01 13:43:12.0015 4636 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 2011/08/01 13:43:12.0109 4636 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 2011/08/01 13:43:12.0171 4636 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 2011/08/01 13:43:12.0249 4636 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/08/01 13:43:12.0358 4636 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 2011/08/01 13:43:12.0468 4636 AtiHdmiService (637e0753bd6deb8ea5314a5c357ec1a0) C:\Windows\system32\drivers\AtiHdmi.sys 2011/08/01 13:43:12.0608 4636 avgntflt (b1224e6b086cd6548315b04ab575a23e) C:\Windows\system32\DRIVERS\avgntflt.sys 2011/08/01 13:43:12.0655 4636 avipbb (ed45f12cfa62b83765c9c1496758cc87) C:\Windows\system32\DRIVERS\avipbb.sys 2011/08/01 13:43:12.0780 4636 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 2011/08/01 13:43:12.0842 4636 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 2011/08/01 13:43:12.0998 4636 BCM43XX (fde8c8dc07e75347e4c6b455a0964217) C:\Windows\system32\DRIVERS\bcmwl664.sys 2011/08/01 13:43:13.0170 4636 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 2011/08/01 13:43:13.0279 4636 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 2011/08/01 13:43:13.0388 4636 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys 2011/08/01 13:43:13.0497 4636 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 2011/08/01 13:43:13.0544 4636 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 2011/08/01 13:43:13.0653 4636 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 2011/08/01 13:43:13.0731 4636 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 2011/08/01 13:43:13.0825 4636 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 2011/08/01 13:43:13.0903 4636 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 2011/08/01 13:43:14.0028 4636 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys 2011/08/01 13:43:14.0090 4636 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 2011/08/01 13:43:14.0199 4636 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys 2011/08/01 13:43:14.0324 4636 BTHPORT (21084ceb85280468c9aca3c805c0f8cf) C:\Windows\System32\Drivers\BTHport.sys 2011/08/01 13:43:14.0418 4636 BTHUSB (8504842634dd144c075b6b0c982ccec4) C:\Windows\System32\Drivers\BTHUSB.sys 2011/08/01 13:43:14.0511 4636 btwampfl (380b798d30c56ede4af58619d0e86ccb) C:\Windows\system32\drivers\btwampfl.sys 2011/08/01 13:43:14.0574 4636 btwaudio (ba5622f5544c6c445dff1a05acc8b19d) C:\Windows\system32\drivers\btwaudio.sys 2011/08/01 13:43:14.0698 4636 btwavdt (a11905d0f4bd34771f195217b6aa5ae0) C:\Windows\system32\drivers\btwavdt.sys 2011/08/01 13:43:14.0839 4636 btwl2cap (07096d2bc22ccb6cea5a532df0be8a75) C:\Windows\system32\DRIVERS\btwl2cap.sys 2011/08/01 13:43:14.0886 4636 btwrchid (bd776f32d64ec615be4563dc2747224e) C:\Windows\system32\DRIVERS\btwrchid.sys 2011/08/01 13:43:14.0995 4636 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 2011/08/01 13:43:15.0088 4636 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 2011/08/01 13:43:15.0198 4636 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 2011/08/01 13:43:15.0307 4636 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 2011/08/01 13:43:15.0447 4636 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 2011/08/01 13:43:15.0541 4636 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 2011/08/01 13:43:15.0666 4636 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys 2011/08/01 13:43:15.0728 4636 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 2011/08/01 13:43:15.0837 4636 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 2011/08/01 13:43:15.0884 4636 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 2011/08/01 13:43:16.0009 4636 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys 2011/08/01 13:43:16.0071 4636 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 2011/08/01 13:43:16.0180 4636 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 2011/08/01 13:43:16.0305 4636 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 2011/08/01 13:43:16.0430 4636 DXGKrnl (24ce1ecf9d0ae0301775b07f5fea175b) C:\Windows\System32\drivers\dxgkrnl.sys 2011/08/01 13:43:16.0555 4636 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 2011/08/01 13:43:16.0726 4636 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 2011/08/01 13:43:16.0789 4636 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 2011/08/01 13:43:16.0914 4636 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 2011/08/01 13:43:16.0929 4636 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 2011/08/01 13:43:17.0054 4636 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 2011/08/01 13:43:17.0085 4636 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 2011/08/01 13:43:17.0116 4636 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 2011/08/01 13:43:17.0194 4636 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/08/01 13:43:17.0241 4636 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 2011/08/01 13:43:17.0335 4636 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 2011/08/01 13:43:17.0366 4636 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 2011/08/01 13:43:17.0460 4636 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys 2011/08/01 13:43:17.0538 4636 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 2011/08/01 13:43:17.0600 4636 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 2011/08/01 13:43:17.0694 4636 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys 2011/08/01 13:43:17.0725 4636 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 2011/08/01 13:43:17.0803 4636 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys 2011/08/01 13:43:17.0850 4636 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 2011/08/01 13:43:17.0896 4636 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 2011/08/01 13:43:17.0912 4636 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 2011/08/01 13:43:18.0037 4636 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 2011/08/01 13:43:18.0146 4636 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 2011/08/01 13:43:18.0208 4636 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 2011/08/01 13:43:18.0286 4636 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 2011/08/01 13:43:18.0349 4636 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 2011/08/01 13:43:18.0396 4636 iaStor (abbf174cb394f5c437410a788b7e404a) C:\Windows\system32\DRIVERS\iaStor.sys 2011/08/01 13:43:18.0536 4636 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys 2011/08/01 13:43:18.0614 4636 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 2011/08/01 13:43:18.0723 4636 Impcd (36fdf367a1dabff903e2214023d71368) C:\Windows\system32\DRIVERS\Impcd.sys 2011/08/01 13:43:18.0864 4636 IntcAzAudAddService (a3c9367a02b2a1fc22536add3601b64f) C:\Windows\system32\drivers\RTKVHD64.sys 2011/08/01 13:43:19.0004 4636 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 2011/08/01 13:43:19.0238 4636 intelkmd (09ce164afa8483e41808784d7fca154e) C:\Windows\system32\DRIVERS\igdpmd64.sys 2011/08/01 13:43:19.0503 4636 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 2011/08/01 13:43:19.0566 4636 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2011/08/01 13:43:19.0644 4636 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 2011/08/01 13:43:19.0722 4636 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 2011/08/01 13:43:19.0831 4636 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 2011/08/01 13:43:19.0862 4636 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 2011/08/01 13:43:19.0956 4636 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 2011/08/01 13:43:20.0049 4636 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 2011/08/01 13:43:20.0127 4636 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 2011/08/01 13:43:20.0283 4636 kore2avs (e90f8aa6dd0309b7d6458e48d2facf48) C:\Windows\system32\Drivers\kore2avs.sys 2011/08/01 13:43:20.0377 4636 kore2avs_x64 (153f4fa51a913ce0c38009c269ab06f4) C:\Windows\system32\Drivers\kore2avs_x64.sys 2011/08/01 13:43:20.0517 4636 kore2usb_svc (5c7816de46f9307a900b903b053b45b2) C:\Windows\system32\Drivers\kore2usb.sys 2011/08/01 13:43:20.0626 4636 kore2usb_x64 (6d2fa8616a57dc70273a8184f5108b56) C:\Windows\system32\Drivers\kore2usb_x64.sys 2011/08/01 13:43:20.0751 4636 KORGUMDS (73684492a5bc686ab65082053fe45ac9) C:\Windows\system32\Drivers\KORGUM64.SYS 2011/08/01 13:43:20.0798 4636 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys 2011/08/01 13:43:20.0876 4636 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys 2011/08/01 13:43:20.0970 4636 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 2011/08/01 13:43:21.0079 4636 L1C (39918db0efcf045a1ce6fabbf339f975) C:\Windows\system32\DRIVERS\L1C62x64.sys 2011/08/01 13:43:21.0188 4636 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 2011/08/01 13:43:21.0282 4636 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 2011/08/01 13:43:21.0391 4636 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 2011/08/01 13:43:21.0484 4636 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 2011/08/01 13:43:21.0594 4636 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 2011/08/01 13:43:21.0687 4636 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 2011/08/01 13:43:21.0890 4636 MAUSBFASTTRACKPRO (066991e50a5cbbeefb2ec6880069cdb5) C:\Windows\system32\DRIVERS\MAudioFastTrackPro.sys 2011/08/01 13:43:22.0015 4636 MBAMProtector (9c4fb231b6e02f84580de2f00f3c5293) C:\Windows\system32\drivers\mbam.sys 2011/08/01 13:43:22.0140 4636 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 2011/08/01 13:43:22.0249 4636 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 2011/08/01 13:43:22.0389 4636 mod7700 (74c85bbd2489949f5b325fdd886e662f) C:\Windows\system32\DRIVERS\mod7700.sys 2011/08/01 13:43:22.0530 4636 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 2011/08/01 13:43:22.0623 4636 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 2011/08/01 13:43:22.0670 4636 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 2011/08/01 13:43:22.0764 4636 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 2011/08/01 13:43:22.0810 4636 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 2011/08/01 13:43:22.0888 4636 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 2011/08/01 13:43:22.0920 4636 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 2011/08/01 13:43:23.0013 4636 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 2011/08/01 13:43:23.0076 4636 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/08/01 13:43:23.0169 4636 mrxsmb10 (a8c2d7673c8a010569390c826a0efaf4) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/08/01 13:43:23.0247 4636 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/08/01 13:43:23.0310 4636 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys 2011/08/01 13:43:23.0372 4636 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 2011/08/01 13:43:23.0450 4636 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 2011/08/01 13:43:23.0544 4636 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 2011/08/01 13:43:23.0575 4636 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 2011/08/01 13:43:23.0684 4636 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 2011/08/01 13:43:23.0778 4636 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/08/01 13:43:23.0871 4636 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 2011/08/01 13:43:23.0934 4636 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 2011/08/01 13:43:23.0996 4636 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 2011/08/01 13:43:24.0105 4636 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 2011/08/01 13:43:24.0168 4636 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 2011/08/01 13:43:24.0230 4636 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 2011/08/01 13:43:24.0339 4636 mwlPSDFilter (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys 2011/08/01 13:43:24.0433 4636 mwlPSDNServ (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys 2011/08/01 13:43:24.0480 4636 mwlPSDVDisk (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys 2011/08/01 13:43:24.0604 4636 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 2011/08/01 13:43:24.0714 4636 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 2011/08/01 13:43:24.0838 4636 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 2011/08/01 13:43:24.0916 4636 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/08/01 13:43:24.0979 4636 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/08/01 13:43:25.0057 4636 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/08/01 13:43:25.0104 4636 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 2011/08/01 13:43:25.0197 4636 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 2011/08/01 13:43:25.0244 4636 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 2011/08/01 13:43:25.0572 4636 NETw5s64 (24f64343f14a119308456e1ca7507b26) C:\Windows\system32\DRIVERS\NETw5s64.sys 2011/08/01 13:43:25.0899 4636 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 2011/08/01 13:43:26.0024 4636 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 2011/08/01 13:43:26.0071 4636 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 2011/08/01 13:43:26.0196 4636 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys 2011/08/01 13:43:26.0352 4636 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys 2011/08/01 13:43:26.0398 4636 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 2011/08/01 13:43:26.0508 4636 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys 2011/08/01 13:43:26.0617 4636 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys 2011/08/01 13:43:26.0710 4636 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 2011/08/01 13:43:26.0757 4636 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 2011/08/01 13:43:26.0835 4636 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 2011/08/01 13:43:26.0866 4636 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys 2011/08/01 13:43:26.0960 4636 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 2011/08/01 13:43:27.0038 4636 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 2011/08/01 13:43:27.0085 4636 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 2011/08/01 13:43:27.0132 4636 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 2011/08/01 13:43:27.0241 4636 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 2011/08/01 13:43:27.0428 4636 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 2011/08/01 13:43:27.0475 4636 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 2011/08/01 13:43:27.0615 4636 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 2011/08/01 13:43:27.0709 4636 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 2011/08/01 13:43:27.0849 4636 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 2011/08/01 13:43:27.0896 4636 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 2011/08/01 13:43:27.0958 4636 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 2011/08/01 13:43:28.0052 4636 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 2011/08/01 13:43:28.0146 4636 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/08/01 13:43:28.0239 4636 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/08/01 13:43:28.0286 4636 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 2011/08/01 13:43:28.0364 4636 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 2011/08/01 13:43:28.0489 4636 RDID1009 (7a32254ea22f47c679309c7d1d2085b3) C:\Windows\system32\Drivers\rdwm1009.sys 2011/08/01 13:43:28.0582 4636 RDID1027 (7b345fa8191172fb719c82417154058d) C:\Windows\system32\Drivers\rdwm1027.sys 2011/08/01 13:43:28.0629 4636 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 2011/08/01 13:43:28.0660 4636 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/08/01 13:43:28.0754 4636 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 2011/08/01 13:43:28.0816 4636 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 2011/08/01 13:43:28.0863 4636 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys 2011/08/01 13:43:28.0941 4636 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 2011/08/01 13:43:29.0004 4636 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys 2011/08/01 13:43:29.0113 4636 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 2011/08/01 13:43:29.0160 4636 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 2011/08/01 13:43:29.0222 4636 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 2011/08/01 13:43:29.0316 4636 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 2011/08/01 13:43:29.0409 4636 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 2011/08/01 13:43:29.0456 4636 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 2011/08/01 13:43:29.0534 4636 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 2011/08/01 13:43:29.0565 4636 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 2011/08/01 13:43:29.0659 4636 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys 2011/08/01 13:43:29.0721 4636 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 2011/08/01 13:43:29.0846 4636 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 2011/08/01 13:43:29.0893 4636 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 2011/08/01 13:43:29.0971 4636 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 2011/08/01 13:43:30.0080 4636 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 2011/08/01 13:43:30.0205 4636 sptd (51de15ca5c05bca46d8b110cd00a02fb) C:\Windows\system32\drivers\sptd.sys 2011/08/01 13:43:30.0205 4636 Suspicious file (NoAccess): C:\Windows\system32\drivers\sptd.sys. md5: 51de15ca5c05bca46d8b110cd00a02fb 2011/08/01 13:43:30.0205 4636 sptd - detected LockedFile.Multi.Generic (1) 2011/08/01 13:43:30.0267 4636 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys 2011/08/01 13:43:30.0376 4636 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys 2011/08/01 13:43:30.0454 4636 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys 2011/08/01 13:43:30.0595 4636 SSPORT (0211ab46b73a2623b86c1cfcb30579ab) C:\Windows\system32\Drivers\SSPORT.sys 2011/08/01 13:43:30.0626 4636 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 2011/08/01 13:43:30.0720 4636 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 2011/08/01 13:43:30.0829 4636 SynTP (ed6d1424e5b0c21a57b28dd8508d6843) C:\Windows\system32\DRIVERS\SynTP.sys 2011/08/01 13:43:30.0938 4636 SynUSB64 (7c24fa401c5bbfea8553abc4db983e83) C:\Windows\system32\DRIVERS\SynUSB64.sys 2011/08/01 13:43:31.0078 4636 Tcpip (61dc720bb065d607d5823f13d2a64321) C:\Windows\system32\drivers\tcpip.sys 2011/08/01 13:43:31.0234 4636 TCPIP6 (61dc720bb065d607d5823f13d2a64321) C:\Windows\system32\DRIVERS\tcpip.sys 2011/08/01 13:43:31.0297 4636 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 2011/08/01 13:43:31.0344 4636 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 2011/08/01 13:43:31.0422 4636 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 2011/08/01 13:43:31.0515 4636 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 2011/08/01 13:43:31.0671 4636 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 2011/08/01 13:43:31.0796 4636 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/08/01 13:43:31.0874 4636 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 2011/08/01 13:43:31.0952 4636 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 2011/08/01 13:43:32.0046 4636 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys 2011/08/01 13:43:32.0108 4636 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys 2011/08/01 13:43:32.0217 4636 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 2011/08/01 13:43:32.0264 4636 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 2011/08/01 13:43:32.0358 4636 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 2011/08/01 13:43:32.0436 4636 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys 2011/08/01 13:43:32.0498 4636 usbccgp (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\Windows\system32\DRIVERS\usbccgp.sys 2011/08/01 13:43:32.0592 4636 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 2011/08/01 13:43:32.0670 4636 usbehci (fbb21ebe49f6d560db37ac25fbc68e66) C:\Windows\system32\drivers\usbehci.sys 2011/08/01 13:43:32.0716 4636 usbhub (6b7a8a99c4a459e73c286a6763ea24cc) C:\Windows\system32\DRIVERS\usbhub.sys 2011/08/01 13:43:32.0794 4636 usbohci (8c88aa7617b4cbc2e4bed61d26b33a27) C:\Windows\system32\drivers\usbohci.sys 2011/08/01 13:43:32.0904 4636 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 2011/08/01 13:43:33.0013 4636 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 2011/08/01 13:43:33.0060 4636 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2011/08/01 13:43:33.0153 4636 usbuhci (0b5b3b2df3fd1709618acfa50b8392b0) C:\Windows\system32\drivers\usbuhci.sys 2011/08/01 13:43:33.0262 4636 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys 2011/08/01 13:43:33.0372 4636 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 2011/08/01 13:43:33.0403 4636 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/08/01 13:43:33.0496 4636 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 2011/08/01 13:43:33.0512 4636 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 2011/08/01 13:43:33.0590 4636 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 2011/08/01 13:43:33.0621 4636 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 2011/08/01 13:43:33.0652 4636 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 2011/08/01 13:43:33.0730 4636 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 2011/08/01 13:43:33.0840 4636 vpnva (e526a69d932538ae8bc96b3f4a5a90b1) C:\Windows\system32\DRIVERS\vpnva64.sys 2011/08/01 13:43:33.0964 4636 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 2011/08/01 13:43:34.0011 4636 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 2011/08/01 13:43:34.0105 4636 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 2011/08/01 13:43:34.0214 4636 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys 2011/08/01 13:43:34.0261 4636 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 2011/08/01 13:43:34.0323 4636 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 2011/08/01 13:43:34.0339 4636 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 2011/08/01 13:43:34.0432 4636 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 2011/08/01 13:43:34.0495 4636 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 2011/08/01 13:43:34.0604 4636 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 2011/08/01 13:43:34.0666 4636 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 2011/08/01 13:43:34.0822 4636 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys 2011/08/01 13:43:34.0932 4636 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 2011/08/01 13:43:35.0041 4636 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 2011/08/01 13:43:35.0088 4636 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys 2011/08/01 13:43:35.0181 4636 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys 2011/08/01 13:43:35.0384 4636 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 2011/08/01 13:43:35.0400 4636 Boot (0x1200) (646e6ff6504912709d83f70775d9a9ef) \Device\Harddisk0\DR0\Partition0 2011/08/01 13:43:35.0415 4636 Boot (0x1200) (6488cb304737456d63b8c610bd81057a) \Device\Harddisk0\DR0\Partition1 2011/08/01 13:43:35.0415 4636 ================================================================================ 2011/08/01 13:43:35.0415 4636 Scan finished 2011/08/01 13:43:35.0415 4636 ================================================================================ 2011/08/01 13:43:35.0431 2388 Detected object count: 1 2011/08/01 13:43:35.0431 2388 Actual detected object count: 1 2011/08/01 13:43:41.0125 2388 LockedFile.Multi.Generic(sptd) - User select action: Skip |
|
01.08.2011, 13:05
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Goingonearth-Infektion Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.08.2011, 13:29
| #13 |
| | Goingonearth-Infektion Combofix ist durch. Habe Avira vorher deaktiviert, trotzdem kam die Meldung, dass es noch laufen würde, ich solle es nun abstellen, dann auf OK klicken. Habe dann Avira kurzerhand deinstalliert, ist aus der Prozessliste auch verschwunden. Nach Combofix startet das Sicherheitscenter wieder! Auch die Weiterleitungen in Google sind so weit ich das sehen konnte weg. Wollte jetzt nichts falsch machen, solange Avira runter ist. Hier ist der LOG: Combofix Logfile: Code:
ATTFilter ComboFix 11-07-31.04 - Thorsten 01.08.2011 14:12:44.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3767.2432 [GMT 2:00]
ausgeführt von:: c:\users\Thorsten\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\programdata\FullRemove.exe
c:\windows\SysWow64\lsprst7.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-07-01 bis 2011-08-01 ))))))))))))))))))))))))))))))
.
.
2011-08-01 12:18 . 2011-08-01 12:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-01 10:57 . 2011-08-01 10:57 -------- d-----w- C:\_OTL
2011-07-31 14:31 . 2011-07-31 14:31 -------- d-----w- c:\program files\CCleaner
2011-07-31 14:22 . 2011-07-31 14:22 -------- d-----w- C:\TDSSKiller_Quarantine
2011-07-30 17:35 . 2011-07-30 17:35 -------- d-----w- c:\program files (x86)\ESET
2011-07-30 16:57 . 2011-07-30 16:57 -------- d-----w- c:\users\Thorsten\AppData\Roaming\Malwarebytes
2011-07-30 16:57 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-30 16:57 . 2011-07-30 16:57 -------- d-----w- c:\programdata\Malwarebytes
2011-07-30 16:57 . 2011-07-30 16:57 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-30 16:57 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-30 16:03 . 2011-07-30 16:04 -------- d-----w- c:\program files (x86)\eLicenser
2011-07-30 16:03 . 2011-07-30 16:03 -------- d-----w- c:\program files (x86)\Syncrosoft
2011-07-25 18:35 . 2011-07-25 18:35 66048 --sha-r- c:\windows\SysWow64\winver8.dll
2011-07-25 16:54 . 2011-07-25 16:54 -------- d-----w- c:\users\Thorsten\.spss
2011-07-25 16:54 . 2011-07-25 16:54 -------- d-----w- c:\users\Thorsten\AppData\Local\javasharedresources
2011-07-25 16:52 . 2011-07-25 16:52 -------- d-----w- c:\programdata\SafeNet Sentinel
2011-07-25 16:52 . 2011-07-25 16:52 -------- d-----w- c:\program files\Common Files\IBM
2011-07-25 16:51 . 2011-07-25 16:52 -------- d--h--w- c:\program files (x86)\Zero G Registry
2011-07-25 16:51 . 2011-07-25 16:51 -------- d--h--w- c:\users\Thorsten\InstallAnywhere
2011-07-25 16:51 . 2011-07-25 16:51 -------- d-----w- c:\programdata\SPSS
2011-07-25 16:50 . 2011-07-25 16:50 -------- d-----w- c:\program files (x86)\Common Files\IBM
2011-07-25 16:49 . 2011-07-25 16:49 -------- d-----w- c:\program files (x86)\IBM
2011-07-25 16:49 . 2011-07-25 16:49 1025 ----a-w- c:\windows\SysWow64\sysprs7.dll
2011-07-25 16:46 . 2011-07-25 16:46 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-07-22 22:42 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{551BA3F4-5733-4C1B-BC4D-FB6BE3F91D31}\mpengine.dll
2011-07-12 15:03 . 2011-07-12 15:03 -------- dc----w- c:\programdata\{E63F6C18-0762-46E9-8101-206AFAF0E93A}
2011-07-12 14:44 . 2011-07-12 14:44 828912 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-07-10 11:44 . 2011-07-10 11:44 -------- d-----w- c:\users\Thorsten\AppData\Roaming\inkscape
2011-07-10 11:40 . 2011-07-10 11:44 -------- d-----w- c:\program files (x86)\Inkscape
2011-07-07 12:31 . 2011-07-07 12:31 -------- dc-h--w- c:\programdata\{CDE68D04-1148-4534-8B2F-E34CC9B53027}
2011-07-07 12:31 . 2011-07-07 12:31 -------- dc-h--w- c:\programdata\{DCC412E7-393B-4016-91FB-9307F059AFB6}
2011-07-05 11:02 . 2011-07-05 11:02 -------- d-----w- c:\program files (x86)\EMI
2011-07-02 20:00 . 2011-07-02 20:00 -------- dc-h--w- c:\programdata\{2CD82595-0327-40C7-ADBC-62745295C2B1}
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-26 17:06 . 2010-06-15 15:43 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-07-26 17:05 . 2010-06-15 15:43 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-07-26 17:05 . 2010-06-20 08:22 1166144 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-07-25 16:45 . 2010-11-29 18:07 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-06-16 09:32 . 2011-06-16 09:44 2601816 ----a-w- c:\windows\system32\WavesGUILib.dll
2011-06-16 09:32 . 2011-06-16 09:44 518896 ----a-w- c:\windows\system32\SRSTSX64.dll
2011-06-16 09:32 . 2011-06-16 09:44 211184 ----a-w- c:\windows\system32\SRSTSH64.dll
2011-06-16 09:32 . 2011-06-16 09:44 198896 ----a-w- c:\windows\system32\SRSHP64.dll
2011-06-16 09:32 . 2011-06-16 09:44 155888 ----a-w- c:\windows\system32\SRSWOW64.dll
2011-06-16 09:32 . 2011-06-16 09:44 2405992 ----a-w- c:\windows\system32\RtPgEx64.dll
2011-06-16 09:32 . 2011-06-16 09:44 1559656 ----a-w- c:\windows\system32\RTSnMg64.cpl
2011-06-16 09:32 . 2011-06-16 09:44 332392 ----a-w- c:\windows\system32\RtlCPAPI64.dll
2011-06-16 09:32 . 2011-06-16 09:44 2886888 ----a-w- c:\windows\system32\drivers\RTKVHD64.sys
2011-06-16 09:32 . 2011-06-16 09:44 149608 ----a-w- c:\windows\system32\RtkCfg64.dll
2011-06-16 09:32 . 2011-06-16 09:44 3114088 ----a-w- c:\windows\system32\RtkAPO64.dll
2011-06-16 09:32 . 2011-06-16 09:44 78680 ----a-w- c:\windows\system32\RTEEG64A.dll
2011-06-16 09:32 . 2011-06-16 09:44 648808 ----a-w- c:\windows\system32\RtkApi64.dll
2011-06-16 09:32 . 2011-06-16 09:44 375128 ----a-w- c:\windows\system32\RTEEP64A.dll
2011-06-16 09:32 . 2011-06-16 09:44 204120 ----a-w- c:\windows\system32\RTEED64A.dll
2011-06-16 09:32 . 2011-06-16 09:44 101208 ----a-w- c:\windows\system32\RTEEL64A.dll
2011-06-16 09:32 . 2011-06-16 09:44 310104 ----a-w- c:\windows\system32\RP3DHT64.dll
2011-06-16 09:32 . 2011-06-16 09:44 1245288 ----a-w- c:\windows\system32\RTCOM64.dll
2011-06-16 09:32 . 2011-06-16 09:44 91240 ----a-w- c:\windows\system32\RCoInst64.dll
2011-06-16 09:32 . 2011-06-16 09:44 310104 ----a-w- c:\windows\system32\RP3DAA64.dll
2011-06-16 09:32 . 2011-06-16 09:44 1404928 ----a-w- c:\windows\system32\RCoRes64.dat
2011-06-16 09:32 . 2011-06-16 09:44 334680 ----a-w- c:\windows\system32\MaxxVolumeSDAPO.dll
2011-06-16 09:32 . 2011-06-16 09:44 2238296 ----a-w- c:\windows\system32\MaxxAudioRealtek.dll
2011-06-16 09:32 . 2011-06-16 09:44 2197264 ----a-w- c:\windows\system32\MaxxAudioEQ.dll
2011-06-16 09:32 . 2011-06-16 09:44 341336 ----a-w- c:\windows\system32\MaxxAudioAPO30.dll
2011-06-16 09:32 . 2011-06-16 09:44 318808 ----a-w- c:\windows\system32\MaxxAudioAPO20.dll
2011-06-16 09:32 . 2011-06-16 09:44 2085440 ----a-w- c:\windows\system32\FMAPO64.dll
2011-06-16 09:32 . 2011-06-16 09:44 200800 ----a-w- c:\windows\system32\AERTAC64.dll
2011-06-16 09:32 . 2011-06-16 09:44 108960 ----a-w- c:\windows\system32\AERTAR64.dll
2011-06-16 09:32 . 2010-05-13 10:42 1284712 ----a-w- c:\windows\RtlExUpd.dll
2011-06-02 05:56 . 2011-07-13 08:29 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-05-28 03:25 . 2011-06-20 00:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-05-28 03:00 . 2011-06-20 00:38 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-05-24 17:14 . 2010-06-09 21:00 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-24 11:21 . 2011-06-29 12:33 404992 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-05-24 10:34 . 2011-06-29 12:33 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-05-24 10:34 . 2011-06-29 12:33 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-05-24 10:34 . 2011-06-29 12:33 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:32 . 2011-06-29 12:33 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-05-04 05:30 . 2011-06-29 12:33 2326016 ----a-w- c:\windows\system32\tquery.dll
2011-05-04 05:28 . 2011-06-29 12:33 2228224 ----a-w- c:\windows\system32\mssrch.dll
2011-05-04 05:28 . 2011-06-29 12:33 779264 ----a-w- c:\windows\system32\mssvp.dll
2011-05-04 05:28 . 2011-06-29 12:33 491520 ----a-w- c:\windows\system32\mssph.dll
2011-05-04 05:28 . 2011-06-29 12:33 75264 ----a-w- c:\windows\system32\msscntrs.dll
2011-05-04 05:28 . 2011-06-29 12:33 288256 ----a-w- c:\windows\system32\mssphtb.dll
2011-05-04 05:24 . 2011-06-29 12:33 593408 ----a-w- c:\windows\system32\SearchIndexer.exe
2011-05-04 05:24 . 2011-06-29 12:33 249856 ----a-w- c:\windows\system32\SearchProtocolHost.exe
2011-05-04 05:24 . 2011-06-29 12:33 113664 ----a-w- c:\windows\system32\SearchFilterHost.exe
2011-05-04 04:53 . 2011-06-29 12:33 1553920 ----a-w- c:\windows\SysWow64\tquery.dll
2011-05-04 04:52 . 2011-06-29 12:33 1401856 ----a-w- c:\windows\SysWow64\mssrch.dll
2011-05-04 04:52 . 2011-06-29 12:33 666624 ----a-w- c:\windows\SysWow64\mssvp.dll
2011-05-04 04:52 . 2011-06-29 12:33 59392 ----a-w- c:\windows\SysWow64\msscntrs.dll
2011-05-04 04:52 . 2011-06-29 12:33 337408 ----a-w- c:\windows\SysWow64\mssph.dll
2011-05-04 04:52 . 2011-06-29 12:33 197120 ----a-w- c:\windows\SysWow64\mssphtb.dll
2011-05-04 04:52 . 2011-06-29 12:33 428032 ----a-w- c:\windows\SysWow64\SearchIndexer.exe
2011-05-04 04:52 . 2011-06-29 12:33 86528 ----a-w- c:\windows\SysWow64\SearchFilterHost.exe
2011-05-04 04:52 . 2011-06-29 12:33 164352 ----a-w- c:\windows\SysWow64\SearchProtocolHost.exe
2011-05-04 02:51 . 2011-06-20 00:38 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-05-04 02:51 . 2011-06-20 00:38 157696 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-05-04 02:51 . 2011-06-20 00:38 126464 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-04-17 05:55 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-03-03 1300560]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi6"=KORGUM64.DRV
"midi7"=KORGUM64.DRV
"midi3"=KORGUM64.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 kore2avs;Kore 2 Midi;c:\windows\system32\Drivers\kore2avs.sys [2011-04-11 358480]
R3 kore2avs_x64;kore2avs_x64;c:\windows\system32\Drivers\kore2avs_x64.sys [x]
R3 kore2usb_svc;Kore 2 Controller;c:\windows\system32\Drivers\kore2usb.sys [2011-04-11 89168]
R3 kore2usb_x64;kore2usb_x64;c:\windows\system32\Drivers\kore2usb_x64.sys [x]
R3 KORGUMDS;KORG USB-MIDI Driver for Windows x64 Edition;c:\windows\system32\Drivers\KORGUM64.SYS [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MAUSBFASTTRACKPRO;Service for M-Audio FastTrack Pro;c:\windows\system32\DRIVERS\MAudioFastTrackPro.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-04-17 305520]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
R3 RDID1009;UM-1;c:\windows\system32\Drivers\rdwm1009.sys [x]
R3 SynUSB64;SynUSB64;c:\windows\system32\DRIVERS\SynUSB64.sys [x]
S0 sptd;sptd; [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-03-03 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-04-23 820768]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [2010-04-22 171040]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-05-27 2337144]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2010-08-24 592120]
S3 ak1avs_x64;ak1avs_x64;c:\windows\system32\Drivers\ak1avs_x64.sys [x]
S3 ak1usb_x64;ak1usb_x64;c:\windows\system32\Drivers\ak1usb_x64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 78183397
*NewlyCreated* - 81604361
*Deregistered* - 78183397
*Deregistered* - 81604361
*Deregistered* - avipbb
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\Thorsten\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-04-17 05:58 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-04-09 320000]
"ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2010-04-22 223264]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-20 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-20 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-20 413720]
"PLFSetI"="c:\windows\PLFSetI.exe" [2010-01-13 206208]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-04-23 496160]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-16 11855976]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-16 2226280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\Drivers32]
"midi3"=KORGUM64.DRV
"midi6"=KORGUM64.DRV
"midi7"=KORGUM64.DRV
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t56k1j130
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\Thorsten\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\Thorsten\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
FF - ProfilePath - c:\users\Thorsten\AppData\Roaming\Mozilla\Firefox\Profiles\5bgl7ta2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Native Instruments Kore 2 Controller Driver - c:\programdata\{F94F0CF6-942F-4A5D-BDAE-824B2EB35AD7}\Kore 2 Controller Driver Setup.exe
AddRemove-{371B17C3-9624-4583-A497-DF980313D851} - c:\programdata\{9D92E4DF-0CEE-44D4-A4FE-2B4A438E1607}\Absynth 5 Setup PC.exe
AddRemove-{491DF203-7B61-4F0E-BDCB-A1218C4DAFE9} - c:\programdata\{13A9B825-42CB-4973-913D-2194B5A4CF94}\Massive Setup PC.exe
AddRemove-{65B7E38D-10F8-4B1A-8EE3-BF2362CF12AE} - c:\programdata\{E7D4E1BB-A8A8-4E3B-BEA6-38DD8E4522DF}\Kontakt 4 Factory Content Setup PC.exe
AddRemove-{B2552FA6-86E3-410D-84AD-265C2242D410} - c:\programdata\{3EE98DDF-8EFF-4760-88EB-D666A839217F}\FM8 Setup PC.exe
AddRemove-{C7FAFC98-5ECC-40FC-B440-A5D5FE3A6A6E} - c:\programdata\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe
AddRemove-{EC015649-3B3C-4611-9C66-453F8011E944} - c:\programdata\{349235F3-1FB1-49C2-A9BE-9594B228EA54}\Kontakt 4 Setup PC.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-08-01 14:21:22
ComboFix-quarantined-files.txt 2011-08-01 12:21
.
Vor Suchlauf: 12 Verzeichnis(se), 536.746.422.272 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 536.651.169.792 Bytes frei
.
- - End Of File - - A39FA25E4F0E2CE180512C33F0C0D518
|
|
01.08.2011, 13:34
| #14 |
| | Goingonearth-Infektion edit: auch Malwarebytes blockt nun keine Websites mehr (sonst erschienen im Minutentakt Tooltips dieser Art) |
|
01.08.2011, 13:49
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Goingonearth-Infektion Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Goingonearth-Infektion |
| google, hijack.zones, kostenlose, kostenlosen, spyware.onlinegames, suche, trojan.downloader, trojan.fakealert, trojan.fakealert.sa, trojan.fraudpack, trojan.fraudpack.gen, trojan.goldun, virus, weitergeleitet, zwischen |
Linear-Darstellung
