| |
| |||||||
Log-Analyse und Auswertung: TR/Kazy.mekl.1 ebendfalls bei mir...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
27.04.2011, 15:43
| #1 |
| |  TR/Kazy.mekl.1 ebendfalls bei mir... Moin, habe ein Problem mit dem oben genannten "trojaner". habe bei lesen hier schon mal das anti malware programm runtergeladen und durch laufen lassen, hoffe ihr könnt mir weiterhelfen. meine daten sind alle scheinbar weg, und mein desktop ist schwarz die verknüpfungen sind aber noch da und sonst kann ich eigentlich auch alles benutzen.. denke ich, aber ich hab von sowas ehrlich gesagt kaum ahnung..^^ vielen dank im vorraus  mbam-log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6456 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 27.04.2011 15:44:53 mbam-log-2011-04-27 (15-44-53).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|) Durchsuchte Objekte: 205911 Laufzeit: 46 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 1 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: c:\programdata\vkecjcxhfiqs.exe (Trojan.FakeAlert) -> 2980 -> Unloaded process successfully. Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vKECjCxHfiQS (Trojan.FakeAlert) -> Value: vKECjCxHfiQS -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\programdata\vkecjcxhfiqs.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\Users\flo flo ramone\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\YPMHJV2R\contacts[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. OTL:OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.04.2011 16:47:47 - Run 2 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Flo Flo Ramone\Desktop Starter Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.013,00 Mb Total Physical Memory | 272,00 Mb Available Physical Memory | 27,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 50,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 187,67 Gb Total Space | 153,62 Gb Free Space | 81,86% Space Free | Partition Type: NTFS Drive D: | 30,27 Gb Total Space | 29,32 Gb Free Space | 96,86% Space Free | Partition Type: NTFS Computer Name: FLO-FLO-NETBOOK | User Name: Flo Flo Ramone | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Flo Flo Ramone\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Programme\DivX\DivX Plus Web Player\DDMService.exe (DivX, LLC) PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Lenovo\VeriFace\PManage.exe (Lenovo) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.) PRC - C:\Programme\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor) PRC - C:\Programme\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Programme\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\QSTART.SYS\config\DVMExportService.exe (DeviceVM, Inc.) PRC - C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited) PRC - C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) PRC - C:\Programme\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Programme\Lenovo\Bluetooth Software\btwdins.exe (Broadcom Corporation.) PRC - C:\Programme\Lenovo\ReadyComm\common\IGRS.exe (Lenovo Group Limited) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Windows\System32\IgrsSvcs.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.) ========== Modules (SafeList) ========== MOD - C:\Users\Flo Flo Ramone\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (mfefire) -- File not found SRV - (McProxy) -- File not found SRV - (McNaiAnn) -- File not found SRV - (McMPFSvc) -- File not found SRV - (gusvc) -- File not found SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (mfevtp) -- C:\Windows\System32\mfevtps.exe (McAfee, Inc.) SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (DvmMDES) -- C:\QSTART.SYS\config\DVMExportService.exe (DeviceVM, Inc.) SRV - (btwdins) -- C:\Programme\Lenovo\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (Lenovo ReadyComm ConnSvc) -- C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe (Lenovo Group Limited) SRV - (Lenovo ReadyComm AppSvc) -- C:\Program Files\Lenovo\ReadyComm\AppSvc.exe (Lenovo Group Limited) SRV - (IGRS) -- C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe (Lenovo Group Limited) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (ReadyComm.DirectRouter) -- C:\windows\System32\IgrsSvcs.exe (Microsoft Corporation) SRV - (PS_MDP) -- C:\windows\System32\IgrsSvcs.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (mfefirek) -- C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.) DRV - (mfewfpk) -- C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.) DRV - (mfeapfk) -- C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.) DRV - (mferkdet) -- C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.) DRV - (mfenlfk) -- C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.) DRV - (cfwids) -- C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation) DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation) DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation) DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation) DRV - (usbsmi) -- C:\Windows\System32\drivers\SMIksdrv.sys (SMI) DRV - (RSUSBSTOR) -- C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV - (Bridge0) -- C:\Windows\System32\drivers\wdbridge.sys (Lenovo) DRV - (wsvd) -- C:\Windows\System32\drivers\wsvd.sys (CyberLink) DRV - (wdmirror) -- C:\Windows\System32\drivers\WDMirror.sys (Windows (R) Codename Longhorn DDK provider) DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation) DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation) DRV - (btusbflt) -- C:\Windows\System32\drivers\btusbflt.sys (Broadcom Corporation.) DRV - (ACPIVPC) -- C:\Windows\System32\drivers\AcpiVpc.sys (Lenovo Corporation) DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ecosia.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.ecosia.de/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.02.06 17:01:08 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.02.06 17:01:10 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.22 18:05:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.22 18:05:15 | 000,000,000 | ---D | M] [2011.01.29 19:45:03 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Extensions [2011.04.07 18:14:27 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions [2011.03.23 18:52:06 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.02.20 11:32:29 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.04.02 07:09:39 | 000,000,000 | -H-D | M] (DownloadHelper) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.03.23 18:52:00 | 000,000,000 | -H-D | M] (Conduit Engine) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions\engine@conduit.com [2011.03.22 18:24:05 | 000,000,000 | -H-D | M] (startup.service) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions\startup.service@mozilla.com [2011.03.22 18:06:24 | 000,000,000 | -H-D | M] (GMX Toolbar) -- C:\Users\Flo Flo Ramone\AppData\Roaming\mozilla\Firefox\Profiles\tktia2zf.default\extensions\toolbar@gmx.net [2011.04.11 16:55:36 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.02.05 17:15:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.02.11 15:34:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.04.11 16:55:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.03.22 18:05:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions [2011.03.22 18:05:26 | 000,000,000 | ---D | M] (GMX Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@gmx.net File not found (No name found) -- [2011.02.05 17:15:34 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.02.11 15:34:01 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.04.11 16:55:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} () (No name found) -- C:\USERS\FLO FLO RAMONE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TKTIA2ZF.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011.03.18 19:56:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll [2010.10.13 23:28:54 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Programme\Mozilla Firefox\components\Scriptff.dll [2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - File not found O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - File not found O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DivX Download Manager] C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [Energy Management] C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) O4 - HKLM..\Run: [EnergyUtility] C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited) O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mcui_exe] File not found O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor) O4 - HKLM..\Run: [VeriFaceManager] C:\Programme\Lenovo\VeriFace\PManage.exe (Lenovo) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Flo Flo Ramone\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites) O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites) O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.04.27 16:45:50 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Flo Flo Ramone\Desktop\OTL.exe [2011.04.27 14:55:13 | 000,000,000 | ---D | C] -- C:\Users\Flo Flo Ramone\AppData\Roaming\Malwarebytes [2011.04.27 14:55:05 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys [2011.04.27 14:55:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.04.27 14:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.04.27 14:54:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2011.04.27 14:54:55 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.04.27 14:53:59 | 007,734,208 | -H-- | C] (Malwarebytes Corporation ) -- C:\Users\Flo Flo Ramone\Desktop\mbam-setup.exe [2011.04.27 14:49:52 | 007,734,208 | -H-- | C] (Malwarebytes Corporation ) -- C:\Users\Flo Flo Ramone\Desktop\mbam-setup-1.50.1.1100.exe [2011.04.27 14:40:52 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{71C2449E-9816-43F5-86BA-DBC52B3409A8} [2011.04.26 15:29:39 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{2001464D-8DFB-49E4-B97D-4897F40A6EC7} [2011.04.25 14:39:29 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{6A8A8F46-7BF3-42A8-ADF8-8C6E98E911C4} [2011.04.22 12:36:59 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{3D625D83-CB72-446D-9A86-1BFA2E04520F} [2011.04.21 16:10:45 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{F0C2340F-A1E8-4506-9D6E-598C3694D792} [2011.04.20 16:42:52 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{2EB022ED-D4A7-4005-ACF5-16F37502B14C} [2011.04.19 17:32:58 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{2331726E-14A5-4CA3-98DD-FAE8828CBD38} [2011.04.18 15:58:43 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{97491A5C-711E-4049-9F05-6D7CEF2E3543} [2011.04.17 12:43:43 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{941B621B-2CDC-44E0-AF40-801873907EDB} [2011.04.16 15:24:14 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{8A100CB3-167F-4339-B302-F395407F7321} [2011.04.15 14:39:44 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{54074EE4-2310-4931-A4F0-68B070372C7C} [2011.04.14 16:49:40 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript.dll [2011.04.14 16:49:39 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\vbscript.dll [2011.04.14 16:49:35 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dnscacheugc.exe [2011.04.14 16:49:32 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\System32\atmfd.dll [2011.04.14 16:49:31 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\windows\System32\atmlib.dll [2011.04.14 16:49:08 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll [2011.04.14 16:49:08 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iedkcs32.dll [2011.04.14 16:49:07 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstime.dll [2011.04.14 16:49:07 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll [2011.04.14 16:49:06 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iepeers.dll [2011.04.14 16:49:06 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedsbs.dll [2011.04.14 16:49:06 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\licmgr10.dll [2011.04.14 16:49:05 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb [2011.04.14 16:49:05 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\html.iec [2011.04.14 16:49:05 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll [2011.04.14 16:49:05 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedssync.exe [2011.04.14 16:48:40 | 002,331,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys [2011.04.14 16:48:38 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\FXSCOVER.exe [2011.04.14 16:48:37 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XpsGdiConverter.dll [2011.04.14 16:48:33 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mfc42.dll [2011.04.14 16:48:32 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mfc42u.dll [2011.04.14 16:42:44 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{BAD9EFBE-CEB5-4F8F-93B6-D409F1555122} [2011.04.14 16:34:02 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{310C11CB-C956-4DC1-AECD-5DB1E1CE00AD} [2011.04.13 19:18:22 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{A3F0C56E-E584-46DC-BDEC-A3D73A76F432} [2011.04.12 16:47:51 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{8AA575C3-E49F-4C60-92D3-F18F5B3EA96F} [2011.04.11 16:55:50 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2011.04.11 16:55:31 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe [2011.04.11 16:55:31 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe [2011.04.11 16:55:31 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe [2011.04.11 16:48:55 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{27D76EBB-B3AE-4B87-B53D-C9A12A6F13B6} [2011.04.10 16:07:31 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{C7D734BB-0299-4960-A4F7-D3F32C2326B5} [2011.04.09 09:34:39 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{3D8715E9-B7CA-46E8-A573-F89A9876F849} [2011.04.08 13:49:56 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{69B68B95-B42B-4266-AC0F-6A414C512B1D} [2011.04.07 17:21:40 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{6904C9A0-3C9B-4744-A46A-B6891AAC3B55} [2011.04.06 17:32:42 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{E11EE782-7502-4AC9-B018-909ED51CF14D} [2011.04.05 17:26:47 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{18521FC1-2799-4653-B10B-6C36D1780023} [2011.04.04 20:29:20 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{7D894C0C-8514-4D48-A6D9-C53FC5AF82ED} [2011.04.03 12:30:53 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{07294B17-7FCA-4500-A1E8-1FFAFE318A09} [2011.04.02 07:09:05 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{4E4C5F9E-D1CD-4D11-8271-9F673F0D1CD1} [2011.04.01 13:45:36 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{3B140E22-4451-4825-A216-6E9556E36D17} [2011.03.31 16:07:52 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{C0D44180-C6A7-4E4F-B01F-E864C81B2C07} [2011.03.30 17:09:58 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{9BAC923E-27F0-4809-A0DD-C6D9B3F0E35A} [2011.03.29 16:58:27 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{E09E516C-67B1-4B6F-9D5C-8934E4CCDE11} [2011.03.28 16:52:26 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{561A23C6-3EAD-4A25-B281-2D34576BE90A} ========== Files - Modified Within 30 Days ========== [2011.04.27 16:45:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Flo Flo Ramone\Desktop\OTL.exe [2011.04.27 16:33:56 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx [2011.04.27 16:01:10 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.04.27 16:01:10 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.04.27 15:57:41 | 000,654,610 | ---- | M] () -- C:\windows\System32\perfh007.dat [2011.04.27 15:57:41 | 000,616,452 | ---- | M] () -- C:\windows\System32\perfh009.dat [2011.04.27 15:57:41 | 000,130,192 | ---- | M] () -- C:\windows\System32\perfc007.dat [2011.04.27 15:57:41 | 000,106,574 | ---- | M] () -- C:\windows\System32\perfc009.dat [2011.04.27 15:53:13 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2011.04.27 15:53:00 | 796,987,392 | -HS- | M] () -- C:\hiberfil.sys [2011.04.27 15:23:53 | 000,504,657 | ---- | M] () -- C:\Users\Flo Flo Ramone\Desktop\unhide.exe [2011.04.27 14:55:05 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.04.27 14:54:02 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Flo Flo Ramone\Desktop\mbam-setup.exe [2011.04.27 14:49:53 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Flo Flo Ramone\Desktop\mbam-setup-1.50.1.1100.exe [2011.04.15 14:37:06 | 000,280,472 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== Extras: OTL Extras logfile created on: 27.04.2011 16:47:47 - Run 2 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Flo Flo Ramone\Desktop Starter Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.013,00 Mb Total Physical Memory | 272,00 Mb Available Physical Memory | 27,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 50,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 187,67 Gb Total Space | 153,62 Gb Free Space | 81,86% Space Free | Partition Type: NTFS Drive D: | 30,27 Gb Total Space | 29,32 Gb Free Space | 96,86% Space Free | Partition Type: NTFS Computer Name: FLO-FLO-NETBOOK | User Name: Flo Flo Ramone | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources "{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion "{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5 "{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client "{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24 "{2B4E24A0-A06F-488D-87D8-16738E5E1104}" = Windows Live Family Safety "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{357B11ED-5417-4CF3-8EB2-386299BC30E0}" = Lenovo Quick Start "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant "{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later "{8991E763-21F5-4DEA-A938-5D9D77DCB488}" = Broadcom 802.11 Wireless Driver "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{90140000-006D-0407-0000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010 "{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010 "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader "{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail "{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = Lenovo Bluetooth with Enhanced Data Rate Software "{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175 "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer "{AC76BA86-7AD7-1031-7B44-A90100000001}" = Adobe Reader 9.0.1 - Deutsch "{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh "{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management "{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail "{B2164CCB-C002-4B80-8550-7535D80DF237}" = Lenovo DirectShare "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}" = Lenovo EasyCamera "755087041320E005CB1E8A67C5C55A260EB81B90" = Windows Driver Package - Broadcom Bluetooth (09/11/2009 6.2.0.9407) "A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) "DivX Setup.divx.com" = DivX-Setup "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.34.305 "HDMI" = Intel(R) Graphics Media Accelerator Driver "InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery "InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}" = Lenovo DirectShare "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "McAfee Virtual Technician" = McAfee Virtual Technician "Messenger Plus!" = Messenger Plus! 5 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de) "Office14.Click2Run" = Microsoft Office Klick-und-Los 2010 "Picasa 3" = Picasa 3 "SynTPDeinstKey" = Synaptics Pointing Device Driver "Uninstall_is1" = Uninstall 1.0.0.1 "VeriFace" = VeriFace "WinLiveSuite" = Windows Live Essentials ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 10.04.2011 15:13:27 | Computer Name = Flo-Flo-Netbook | Source = Application Hang | ID = 1002 Description = Programm msnmsgr.exe, Version 15.4.3508.1109 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 8fc Startzeit: 01cbf78878bf855e Endzeit: 250 Anwendungspfad: C:\Program Files\Windows Live\Messenger\msnmsgr.exe Berichts-ID: 99b35072-63a6-11e0-93b6-60eb694eb188 Error - 11.04.2011 12:59:25 | Computer Name = Flo-Flo-Netbook | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\silicon motion\lenovo easycamera\driverpackage\DPInst64.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 11.04.2011 12:59:40 | Computer Name = Flo-Flo-Netbook | Source = SideBySide | ID = 16842811 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll" in Zeile 2. Ungültige XML-Syntax. Error - 14.04.2011 10:20:57 | Computer Name = Flo-Flo-Netbook | Source = CVHSVC | ID = 100 Description = Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden. Error - 18.04.2011 12:33:41 | Computer Name = Flo-Flo-Netbook | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\silicon motion\lenovo easycamera\driverpackage\DPInst64.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 18.04.2011 12:33:50 | Computer Name = Flo-Flo-Netbook | Source = SideBySide | ID = 16842811 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll" in Zeile 2. Ungültige XML-Syntax. Error - 22.04.2011 07:31:36 | Computer Name = Flo-Flo-Netbook | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\silicon motion\lenovo easycamera\driverpackage\DPInst64.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 22.04.2011 07:31:52 | Computer Name = Flo-Flo-Netbook | Source = SideBySide | ID = 16842811 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll" in Zeile 2. Ungültige XML-Syntax. Error - 25.04.2011 09:23:44 | Computer Name = Flo-Flo-Netbook | Source = CVHSVC | ID = 100 Description = Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error - 25.04.2011 15:24:17 | Computer Name = Flo-Flo-Netbook | Source = CVHSVC | ID = 100 Description = Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. [ System Events ] Error - 25.04.2011 08:40:55 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7000 Description = Der Dienst "McAfee VirusScan Announcer" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 25.04.2011 09:13:13 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7003 Description = Der Dienst "McAfee Validation Trust Protection Service" ist von folgendem Dienst abhängig: mfehidk. Dieser Dienst ist eventuell nicht installiert. Error - 25.04.2011 09:13:15 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7001 Description = Der Dienst "McAfee Firewall Core Service" ist vom Dienst "McAfee Validation Trust Protection Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1075 Error - 25.04.2011 09:13:16 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7001 Description = Der Dienst "McAfee Personal Firewall-Dienst" ist vom Dienst "McAfee Firewall Core Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 25.04.2011 09:13:16 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7001 Description = Der Dienst "McAfee Proxy Service" ist vom Dienst "McAfee Firewall Core Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 25.04.2011 09:15:56 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7000 Description = Der Dienst "McAfee VirusScan Announcer" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 25.04.2011 15:11:33 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7003 Description = Der Dienst "McAfee Validation Trust Protection Service" ist von folgendem Dienst abhängig: mfehidk. Dieser Dienst ist eventuell nicht installiert. Error - 25.04.2011 15:11:36 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7001 Description = Der Dienst "McAfee Firewall Core Service" ist vom Dienst "McAfee Validation Trust Protection Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1075 Error - 25.04.2011 15:11:41 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7001 Description = Der Dienst "McAfee Personal Firewall-Dienst" ist vom Dienst "McAfee Firewall Core Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 25.04.2011 15:11:41 | Computer Name = Flo-Flo-Netbook | Source = Service Control Manager | ID = 7001 Description = Der Dienst "McAfee Proxy Service" ist vom Dienst "McAfee Firewall Core Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 < End of report > Geändert von Flo-Flo (27.04.2011 um 16:03 Uhr) |
|
28.04.2011, 16:45
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | TR/Kazy.mekl.1 ebendfalls bei mir... Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
__________________ |
|
29.04.2011, 13:38
| #3 |
| | TR/Kazy.mekl.1 ebendfalls bei mir... Hier ein aktueller log...
__________________mehr hab ich nicht^^ Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6470 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 29.04.2011 14:36:17 mbam-log-2011-04-29 (14-36-17).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|) Durchsuchte Objekte: 206299 Laufzeit: 52 Minute(n), 37 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) mfg |
|
29.04.2011, 20:12
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Kazy.mekl.1 ebendfalls bei mir... Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O4 - HKLM..\Run: [mcui_exe] File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
[2011.04.27 14:40:52 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{71C2449E-9816-43F5-86BA-DBC52B3409A8}
[2011.04.26 15:29:39 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{2001464D-8DFB-49E4-B97D-4897F40A6EC7}
[2011.04.25 14:39:29 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{6A8A8F46-7BF3-42A8-ADF8-8C6E98E911C4}
[2011.04.22 12:36:59 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{3D625D83-CB72-446D-9A86-1BFA2E04520F}
[2011.04.21 16:10:45 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{F0C2340F-A1E8-4506-9D6E-598C3694D792}
[2011.04.20 16:42:52 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{2EB022ED-D4A7-4005-ACF5-16F37502B14C}
[2011.04.19 17:32:58 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{2331726E-14A5-4CA3-98DD-FAE8828CBD38}
[2011.04.18 15:58:43 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{97491A5C-711E-4049-9F05-6D7CEF2E3543}
[2011.04.17 12:43:43 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{941B621B-2CDC-44E0-AF40-801873907EDB}
[2011.04.16 15:24:14 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{8A100CB3-167F-4339-B302-F395407F7321}
[2011.04.15 14:39:44 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{54074EE4-2310-4931-A4F0-68B070372C7C}
[2011.04.14 16:42:44 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{BAD9EFBE-CEB5-4F8F-93B6-D409F1555122}
[2011.04.14 16:34:02 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{310C11CB-C956-4DC1-AECD-5DB1E1CE00AD}
[2011.04.13 19:18:22 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{A3F0C56E-E584-46DC-BDEC-A3D73A76F432}
[2011.04.12 16:47:51 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{8AA575C3-E49F-4C60-92D3-F18F5B3EA96F}
[2011.04.11 16:48:55 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{27D76EBB-B3AE-4B87-B53D-C9A12A6F13B6}
[2011.04.10 16:07:31 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{C7D734BB-0299-4960-A4F7-D3F32C2326B5}
[2011.04.09 09:34:39 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{3D8715E9-B7CA-46E8-A573-F89A9876F849}
[2011.04.08 13:49:56 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{69B68B95-B42B-4266-AC0F-6A414C512B1D}
[2011.04.07 17:21:40 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{6904C9A0-3C9B-4744-A46A-B6891AAC3B55}
[2011.04.06 17:32:42 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{E11EE782-7502-4AC9-B018-909ED51CF14D}
[2011.04.05 17:26:47 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{18521FC1-2799-4653-B10B-6C36D1780023}
[2011.04.04 20:29:20 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{7D894C0C-8514-4D48-A6D9-C53FC5AF82ED}
[2011.04.03 12:30:53 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{07294B17-7FCA-4500-A1E8-1FFAFE318A09}
[2011.04.02 07:09:05 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{4E4C5F9E-D1CD-4D11-8271-9F673F0D1CD1}
[2011.04.01 13:45:36 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{3B140E22-4451-4825-A216-6E9556E36D17}
[2011.03.31 16:07:52 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{C0D44180-C6A7-4E4F-B01F-E864C81B2C07}
[2011.03.30 17:09:58 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{9BAC923E-27F0-4809-A0DD-C6D9B3F0E35A}
[2011.03.29 16:58:27 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{E09E516C-67B1-4B6F-9D5C-8934E4CCDE11}
[2011.03.28 16:52:26 | 000,000,000 | -H-D | C] -- C:\Users\Flo Flo Ramone\AppData\Local\{561A23C6-3EAD-4A25-B281-2D34576BE90A}
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.05.2011, 10:18
| #5 |
| | TR/Kazy.mekl.1 ebendfalls bei mir... okay hab ich gemacht.. All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\mcui_exe deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\autoexec.bat moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{71C2449E-9816-43F5-86BA-DBC52B3409A8} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{2001464D-8DFB-49E4-B97D-4897F40A6EC7} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{6A8A8F46-7BF3-42A8-ADF8-8C6E98E911C4} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{3D625D83-CB72-446D-9A86-1BFA2E04520F} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{F0C2340F-A1E8-4506-9D6E-598C3694D792} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{2EB022ED-D4A7-4005-ACF5-16F37502B14C} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{2331726E-14A5-4CA3-98DD-FAE8828CBD38} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{97491A5C-711E-4049-9F05-6D7CEF2E3543} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{941B621B-2CDC-44E0-AF40-801873907EDB} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{8A100CB3-167F-4339-B302-F395407F7321} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{54074EE4-2310-4931-A4F0-68B070372C7C} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{BAD9EFBE-CEB5-4F8F-93B6-D409F1555122} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{310C11CB-C956-4DC1-AECD-5DB1E1CE00AD} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{A3F0C56E-E584-46DC-BDEC-A3D73A76F432} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{8AA575C3-E49F-4C60-92D3-F18F5B3EA96F} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{27D76EBB-B3AE-4B87-B53D-C9A12A6F13B6} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{C7D734BB-0299-4960-A4F7-D3F32C2326B5} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{3D8715E9-B7CA-46E8-A573-F89A9876F849} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{69B68B95-B42B-4266-AC0F-6A414C512B1D} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{6904C9A0-3C9B-4744-A46A-B6891AAC3B55} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{E11EE782-7502-4AC9-B018-909ED51CF14D} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{18521FC1-2799-4653-B10B-6C36D1780023} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{7D894C0C-8514-4D48-A6D9-C53FC5AF82ED} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{07294B17-7FCA-4500-A1E8-1FFAFE318A09} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{4E4C5F9E-D1CD-4D11-8271-9F673F0D1CD1} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{3B140E22-4451-4825-A216-6E9556E36D17} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{C0D44180-C6A7-4E4F-B01F-E864C81B2C07} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{9BAC923E-27F0-4809-A0DD-C6D9B3F0E35A} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{E09E516C-67B1-4B6F-9D5C-8934E4CCDE11} folder moved successfully. C:\Users\Flo Flo Ramone\AppData\Local\{561A23C6-3EAD-4A25-B281-2D34576BE90A} folder moved successfully. ========== COMMANDS ========== C:\windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Flo Flo Ramone ->Temp folder emptied: 67434851 bytes ->Temporary Internet Files folder emptied: 88476066 bytes ->Java cache emptied: 204181 bytes ->FireFox cache emptied: 49743846 bytes ->Flash cache emptied: 3102 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 22179446 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 217,00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05012011_110908 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
01.05.2011, 14:25
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Kazy.mekl.1 ebendfalls bei mir... Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ --> TR/Kazy.mekl.1 ebendfalls bei mir... |
|
01.05.2011, 17:40
| #7 |
| | TR/Kazy.mekl.1 ebendfalls bei mir... ist es richtig das man das durchlaufen lassen muss und dann nochmal das anti malware prog. durchlaufen lassen muss? so hab ich das jetzt verstanden...^^ Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6472 Windows 6.1.7600 Internet Explorer 9.0.8112.16421 01.05.2011 18:36:03 mbam-log-2011-05-01 (18-36-03).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|) Durchsuchte Objekte: 203504 Laufzeit: 51 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) mfg |
|
02.05.2011, 09:31
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Kazy.mekl.1 ebendfalls bei mir... Wo ist das Log vom tdsskiller?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.05.2011, 16:41
| #9 |
| | TR/Kazy.mekl.1 ebendfalls bei mir... oh..sorry hatte den report button wohl nicht gesehn..:S ich mache nochmal einen aktuellen malware scan.. hier nun der tdss killer log: 2011/05/02 17:34:41.0681 2244 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28 2011/05/02 17:34:41.0853 2244 ================================================================================ 2011/05/02 17:34:41.0853 2244 SystemInfo: 2011/05/02 17:34:41.0853 2244 2011/05/02 17:34:41.0853 2244 OS Version: 6.1.7600 ServicePack: 0.0 2011/05/02 17:34:41.0853 2244 Product type: Workstation 2011/05/02 17:34:41.0853 2244 ComputerName: FLO-FLO-NETBOOK 2011/05/02 17:34:41.0853 2244 UserName: Flo Flo Ramone 2011/05/02 17:34:41.0853 2244 Windows directory: C:\windows 2011/05/02 17:34:41.0853 2244 System windows directory: C:\windows 2011/05/02 17:34:41.0853 2244 Processor architecture: Intel x86 2011/05/02 17:34:41.0853 2244 Number of processors: 2 2011/05/02 17:34:41.0853 2244 Page size: 0x1000 2011/05/02 17:34:41.0853 2244 Boot type: Normal boot 2011/05/02 17:34:41.0853 2244 ================================================================================ 2011/05/02 17:34:42.0820 2244 Initialize success 2011/05/02 17:37:57.0522 4068 ================================================================================ 2011/05/02 17:37:57.0522 4068 Scan started 2011/05/02 17:37:57.0522 4068 Mode: Manual; 2011/05/02 17:37:57.0522 4068 ================================================================================ 2011/05/02 17:37:59.0300 4068 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\windows\system32\DRIVERS\1394ohci.sys 2011/05/02 17:37:59.0425 4068 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\windows\system32\DRIVERS\ACPI.sys 2011/05/02 17:37:59.0503 4068 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\windows\system32\DRIVERS\acpipmi.sys 2011/05/02 17:37:59.0597 4068 ACPIVPC (87114efedeb94af49323ca61f344716d) C:\windows\system32\DRIVERS\AcpiVpc.sys 2011/05/02 17:37:59.0768 4068 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys 2011/05/02 17:37:59.0971 4068 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys 2011/05/02 17:38:00.0080 4068 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys 2011/05/02 17:38:00.0236 4068 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\windows\system32\drivers\afd.sys 2011/05/02 17:38:00.0330 4068 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\DRIVERS\agp440.sys 2011/05/02 17:38:00.0455 4068 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys 2011/05/02 17:38:00.0611 4068 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\DRIVERS\aliide.sys 2011/05/02 17:38:00.0704 4068 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\DRIVERS\amdagp.sys 2011/05/02 17:38:00.0798 4068 amdide (cd5914170297126b6266860198d1d4f0) C:\windows\system32\DRIVERS\amdide.sys 2011/05/02 17:38:00.0923 4068 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys 2011/05/02 17:38:01.0079 4068 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys 2011/05/02 17:38:01.0172 4068 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\windows\system32\drivers\amdsata.sys 2011/05/02 17:38:01.0281 4068 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys 2011/05/02 17:38:01.0359 4068 amdxata (869e67d66be326a5a9159fba8746fa70) C:\windows\system32\drivers\amdxata.sys 2011/05/02 17:38:01.0562 4068 AppID (feb834c02ce1e84b6a38f953ca067706) C:\windows\system32\drivers\appid.sys 2011/05/02 17:38:01.0734 4068 arc (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys 2011/05/02 17:38:01.0827 4068 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys 2011/05/02 17:38:01.0999 4068 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys 2011/05/02 17:38:02.0077 4068 atapi (338c86357871c167a96ab976519bf59e) C:\windows\system32\DRIVERS\atapi.sys 2011/05/02 17:38:02.0280 4068 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\windows\system32\DRIVERS\avgntflt.sys 2011/05/02 17:38:02.0389 4068 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\windows\system32\DRIVERS\avipbb.sys 2011/05/02 17:38:02.0498 4068 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys 2011/05/02 17:38:02.0592 4068 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\windows\system32\DRIVERS\b57nd60x.sys 2011/05/02 17:38:02.0951 4068 BCM43XX (61351a6aac26257f333d77ef738f3f3e) C:\windows\system32\DRIVERS\bcmwl6.sys 2011/05/02 17:38:03.0263 4068 Beep (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys 2011/05/02 17:38:03.0403 4068 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys 2011/05/02 17:38:03.0590 4068 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\windows\system32\DRIVERS\bowser.sys 2011/05/02 17:38:03.0715 4068 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys 2011/05/02 17:38:03.0809 4068 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys 2011/05/02 17:38:03.0902 4068 Bridge0 (b35bb97b6dd9913093579f5c83962636) C:\windows\system32\drivers\WDBridge.sys 2011/05/02 17:38:04.0043 4068 Brserid (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys 2011/05/02 17:38:04.0152 4068 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys 2011/05/02 17:38:04.0214 4068 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys 2011/05/02 17:38:04.0292 4068 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys 2011/05/02 17:38:04.0370 4068 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\DRIVERS\BthEnum.sys 2011/05/02 17:38:04.0448 4068 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys 2011/05/02 17:38:04.0542 4068 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys 2011/05/02 17:38:04.0620 4068 BTHPORT (4a34888e13224678dd062466afec4240) C:\windows\system32\Drivers\BTHport.sys 2011/05/02 17:38:04.0745 4068 BTHUSB (fa04c63916fa221dbb91fce153d07a55) C:\windows\system32\Drivers\BTHUSB.sys 2011/05/02 17:38:04.0854 4068 btusbflt (92c5b845803f3662637eb691ac0b250f) C:\windows\system32\drivers\btusbflt.sys 2011/05/02 17:38:04.0947 4068 btwaudio (ce5833c144ca6623bcbde93b188aa850) C:\windows\system32\drivers\btwaudio.sys 2011/05/02 17:38:05.0057 4068 btwavdt (af9148c3e844131ac954cb53ff43d971) C:\windows\system32\drivers\btwavdt.sys 2011/05/02 17:38:05.0244 4068 btwl2cap (aafd7cb76ba61fbb08e302da208c974a) C:\windows\system32\DRIVERS\btwl2cap.sys 2011/05/02 17:38:05.0353 4068 btwrchid (480b3d195854b2e55299cddddc50bcf9) C:\windows\system32\DRIVERS\btwrchid.sys 2011/05/02 17:38:05.0478 4068 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys 2011/05/02 17:38:05.0618 4068 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\windows\system32\DRIVERS\cdrom.sys 2011/05/02 17:38:05.0790 4068 cfwids (7e6f7da1c4de5680820f964562548949) C:\windows\system32\drivers\cfwids.sys 2011/05/02 17:38:05.0899 4068 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys 2011/05/02 17:38:06.0024 4068 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys 2011/05/02 17:38:06.0149 4068 CmBatt (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys 2011/05/02 17:38:06.0227 4068 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\DRIVERS\cmdide.sys 2011/05/02 17:38:06.0305 4068 CNG (1b675691ed940766149c93e8f4488d68) C:\windows\system32\Drivers\cng.sys 2011/05/02 17:38:06.0476 4068 Compbatt (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys 2011/05/02 17:38:06.0585 4068 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\windows\system32\DRIVERS\CompositeBus.sys 2011/05/02 17:38:06.0679 4068 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys 2011/05/02 17:38:06.0913 4068 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\windows\system32\Drivers\dfsc.sys 2011/05/02 17:38:07.0007 4068 discache (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys 2011/05/02 17:38:07.0069 4068 Disk (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys 2011/05/02 17:38:07.0256 4068 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys 2011/05/02 17:38:07.0397 4068 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\windows\System32\drivers\dxgkrnl.sys 2011/05/02 17:38:07.0677 4068 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys 2011/05/02 17:38:07.0974 4068 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys 2011/05/02 17:38:08.0099 4068 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\DRIVERS\errdev.sys 2011/05/02 17:38:08.0270 4068 exfat (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys 2011/05/02 17:38:08.0348 4068 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys 2011/05/02 17:38:08.0504 4068 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys 2011/05/02 17:38:08.0645 4068 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys 2011/05/02 17:38:08.0738 4068 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys 2011/05/02 17:38:08.0816 4068 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys 2011/05/02 17:38:08.0957 4068 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys 2011/05/02 17:38:09.0113 4068 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys 2011/05/02 17:38:09.0269 4068 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\windows\system32\DRIVERS\fssfltr.sys 2011/05/02 17:38:09.0393 4068 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\windows\system32\drivers\Fs_Rec.sys 2011/05/02 17:38:09.0518 4068 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\windows\system32\DRIVERS\fvevol.sys 2011/05/02 17:38:09.0581 4068 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys 2011/05/02 17:38:09.0752 4068 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys 2011/05/02 17:38:09.0861 4068 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\windows\system32\drivers\HdAudio.sys 2011/05/02 17:38:09.0971 4068 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\windows\system32\DRIVERS\HDAudBus.sys 2011/05/02 17:38:10.0017 4068 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys 2011/05/02 17:38:10.0095 4068 HidBth (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys 2011/05/02 17:38:10.0189 4068 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys 2011/05/02 17:38:10.0345 4068 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\windows\system32\DRIVERS\hidusb.sys 2011/05/02 17:38:10.0470 4068 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\DRIVERS\HpSAMD.sys 2011/05/02 17:38:10.0579 4068 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\windows\system32\drivers\HTTP.sys 2011/05/02 17:38:10.0657 4068 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\windows\system32\drivers\hwpolicy.sys 2011/05/02 17:38:10.0719 4068 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\DRIVERS\i8042prt.sys 2011/05/02 17:38:10.0860 4068 iaStor (26541a068572f650a2fa490726fe81be) C:\windows\system32\DRIVERS\iaStor.sys 2011/05/02 17:38:10.0985 4068 iaStorV (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\windows\system32\drivers\iaStorV.sys 2011/05/02 17:38:11.0219 4068 igfx (d0074897c6bc132f3980ea4654bf7fb9) C:\windows\system32\DRIVERS\igdkmd32.sys 2011/05/02 17:38:11.0546 4068 iirsp (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys 2011/05/02 17:38:11.0843 4068 IntcAzAudAddService (0d8c36a8020898bea12ad3087c22ff7f) C:\windows\system32\drivers\RTKVHDA.sys 2011/05/02 17:38:12.0092 4068 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\DRIVERS\intelide.sys 2011/05/02 17:38:12.0217 4068 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys 2011/05/02 17:38:12.0295 4068 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys 2011/05/02 17:38:12.0467 4068 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\windows\system32\DRIVERS\IPMIDrv.sys 2011/05/02 17:38:12.0576 4068 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys 2011/05/02 17:38:12.0685 4068 IRENUM (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys 2011/05/02 17:38:12.0763 4068 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\DRIVERS\isapnp.sys 2011/05/02 17:38:12.0857 4068 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\windows\system32\DRIVERS\msiscsi.sys 2011/05/02 17:38:12.0950 4068 k57nd60x (c4c95805b85bce1eb9d20f4a02fc5f9b) C:\windows\system32\DRIVERS\k57nd60x.sys 2011/05/02 17:38:13.0044 4068 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\DRIVERS\kbdclass.sys 2011/05/02 17:38:13.0122 4068 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\windows\system32\DRIVERS\kbdhid.sys 2011/05/02 17:38:13.0215 4068 KSecDD (e36a061ec11b373826905b21be10948f) C:\windows\system32\Drivers\ksecdd.sys 2011/05/02 17:38:13.0309 4068 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\windows\system32\Drivers\ksecpkg.sys 2011/05/02 17:38:13.0574 4068 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys 2011/05/02 17:38:13.0730 4068 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys 2011/05/02 17:38:13.0808 4068 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys 2011/05/02 17:38:13.0917 4068 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys 2011/05/02 17:38:13.0995 4068 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys 2011/05/02 17:38:14.0089 4068 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys 2011/05/02 17:38:14.0292 4068 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys 2011/05/02 17:38:14.0401 4068 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys 2011/05/02 17:38:14.0510 4068 mfeapfk (84d59a3eddfb9438fb94f7f80d37859d) C:\windows\system32\drivers\mfeapfk.sys 2011/05/02 17:38:14.0619 4068 mfefirek (d5f89b4934960c70882924d992c6abfc) C:\windows\system32\drivers\mfefirek.sys 2011/05/02 17:38:14.0713 4068 mfenlfk (b4022e16569bbd1a85e68e7e78e68880) C:\windows\system32\DRIVERS\mfenlfk.sys 2011/05/02 17:38:14.0822 4068 mferkdet (c9eda1eada2ab6e34cd1a10c3a24ab25) C:\windows\system32\drivers\mferkdet.sys 2011/05/02 17:38:14.0994 4068 mfewfpk (183f32c79d1693170df3baecec611125) C:\windows\system32\drivers\mfewfpk.sys 2011/05/02 17:38:15.0103 4068 Modem (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys 2011/05/02 17:38:15.0181 4068 monitor (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys 2011/05/02 17:38:15.0228 4068 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\DRIVERS\mouclass.sys 2011/05/02 17:38:15.0337 4068 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys 2011/05/02 17:38:15.0415 4068 mountmgr (921c18727c5920d6c0300736646931c2) C:\windows\system32\drivers\mountmgr.sys 2011/05/02 17:38:15.0509 4068 mpio (2af5997438c55fb79d33d015c30e1974) C:\windows\system32\DRIVERS\mpio.sys 2011/05/02 17:38:15.0618 4068 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys 2011/05/02 17:38:15.0711 4068 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\windows\system32\drivers\mrxdav.sys 2011/05/02 17:38:15.0836 4068 mrxsmb (b4c76ef46322a9711c7b0f4e21ef6ea5) C:\windows\system32\DRIVERS\mrxsmb.sys 2011/05/02 17:38:15.0945 4068 mrxsmb10 (e593d45024a3fdd11e93cc4a6ca91101) C:\windows\system32\DRIVERS\mrxsmb10.sys 2011/05/02 17:38:16.0039 4068 mrxsmb20 (a9f86c82c9cc3b679cc3957e1183a30f) C:\windows\system32\DRIVERS\mrxsmb20.sys 2011/05/02 17:38:16.0133 4068 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\windows\system32\DRIVERS\msahci.sys 2011/05/02 17:38:16.0211 4068 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\windows\system32\DRIVERS\msdsm.sys 2011/05/02 17:38:16.0351 4068 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys 2011/05/02 17:38:16.0429 4068 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys 2011/05/02 17:38:16.0491 4068 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\DRIVERS\msisadrv.sys 2011/05/02 17:38:16.0585 4068 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys 2011/05/02 17:38:16.0663 4068 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys 2011/05/02 17:38:16.0741 4068 MSPQM (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys 2011/05/02 17:38:16.0819 4068 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys 2011/05/02 17:38:16.0913 4068 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\DRIVERS\mssmbios.sys 2011/05/02 17:38:16.0975 4068 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys 2011/05/02 17:38:17.0053 4068 MTConfig (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys 2011/05/02 17:38:17.0100 4068 Mup (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys 2011/05/02 17:38:17.0225 4068 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys 2011/05/02 17:38:17.0412 4068 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\windows\system32\drivers\ndis.sys 2011/05/02 17:38:17.0490 4068 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys 2011/05/02 17:38:17.0583 4068 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys 2011/05/02 17:38:17.0693 4068 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\windows\system32\DRIVERS\ndisuio.sys 2011/05/02 17:38:17.0771 4068 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\windows\system32\DRIVERS\ndiswan.sys 2011/05/02 17:38:17.0880 4068 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\windows\system32\drivers\NDProxy.sys 2011/05/02 17:38:17.0973 4068 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys 2011/05/02 17:38:18.0051 4068 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\windows\system32\DRIVERS\netbt.sys 2011/05/02 17:38:18.0301 4068 netw5v32 (58218ec6b61b1169cf54aab0d00f5fe2) C:\windows\system32\DRIVERS\netw5v32.sys 2011/05/02 17:38:18.0629 4068 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys 2011/05/02 17:38:18.0738 4068 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys 2011/05/02 17:38:18.0878 4068 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys 2011/05/02 17:38:19.0019 4068 Ntfs (187002ce05693c306f43c873f821381f) C:\windows\system32\drivers\Ntfs.sys 2011/05/02 17:38:19.0206 4068 Null (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys 2011/05/02 17:38:19.0299 4068 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\windows\system32\drivers\nvraid.sys 2011/05/02 17:38:19.0424 4068 nvstor (4520b63899e867f354ee012d34e11536) C:\windows\system32\drivers\nvstor.sys 2011/05/02 17:38:19.0533 4068 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\DRIVERS\nv_agp.sys 2011/05/02 17:38:19.0643 4068 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\DRIVERS\ohci1394.sys 2011/05/02 17:38:19.0845 4068 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys 2011/05/02 17:38:19.0923 4068 partmgr (ff4218952b51de44fe910953a3e686b9) C:\windows\system32\drivers\partmgr.sys 2011/05/02 17:38:20.0001 4068 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys 2011/05/02 17:38:20.0079 4068 pci (c858cb77c577780ecc456a892e7e7d0f) C:\windows\system32\DRIVERS\pci.sys 2011/05/02 17:38:20.0189 4068 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\DRIVERS\pciide.sys 2011/05/02 17:38:20.0267 4068 pcmcia (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys 2011/05/02 17:38:20.0345 4068 pcw (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys 2011/05/02 17:38:20.0454 4068 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys 2011/05/02 17:38:20.0813 4068 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys 2011/05/02 17:38:20.0922 4068 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys 2011/05/02 17:38:21.0125 4068 Psched (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys 2011/05/02 17:38:21.0249 4068 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys 2011/05/02 17:38:21.0452 4068 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys 2011/05/02 17:38:21.0546 4068 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys 2011/05/02 17:38:21.0608 4068 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys 2011/05/02 17:38:21.0717 4068 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys 2011/05/02 17:38:21.0827 4068 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys 2011/05/02 17:38:21.0936 4068 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys 2011/05/02 17:38:22.0092 4068 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys 2011/05/02 17:38:22.0170 4068 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\windows\system32\DRIVERS\rdbss.sys 2011/05/02 17:38:22.0295 4068 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys 2011/05/02 17:38:22.0388 4068 RDPCDD (1e016846895b15a99f9a176a05029075) C:\windows\system32\DRIVERS\RDPCDD.sys 2011/05/02 17:38:22.0497 4068 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys 2011/05/02 17:38:22.0575 4068 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys 2011/05/02 17:38:22.0638 4068 RDPWD (801371ba9782282892d00aadb08ee367) C:\windows\system32\drivers\RDPWD.sys 2011/05/02 17:38:22.0809 4068 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\windows\system32\drivers\rdyboost.sys 2011/05/02 17:38:23.0012 4068 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys 2011/05/02 17:38:23.0153 4068 rspndr (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys 2011/05/02 17:38:23.0293 4068 RSUSBSTOR (7cc293d2f95f8d0a5a4883e21b303d89) C:\windows\system32\Drivers\RtsUStor.sys 2011/05/02 17:38:23.0449 4068 RTL8167 (05c2613f661584190c752f6184d1c8ef) C:\windows\system32\DRIVERS\Rt86win7.sys 2011/05/02 17:38:23.0589 4068 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\windows\system32\DRIVERS\sbp2port.sys 2011/05/02 17:38:23.0699 4068 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\windows\system32\DRIVERS\scfilter.sys 2011/05/02 17:38:23.0870 4068 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys 2011/05/02 17:38:24.0011 4068 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys 2011/05/02 17:38:24.0120 4068 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys 2011/05/02 17:38:24.0229 4068 sermouse (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys 2011/05/02 17:38:24.0385 4068 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\DRIVERS\sffdisk.sys 2011/05/02 17:38:24.0432 4068 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\DRIVERS\sffp_mmc.sys 2011/05/02 17:38:24.0494 4068 sffp_sd (a0708bbd07d245c06ff9de549ca47185) C:\windows\system32\DRIVERS\sffp_sd.sys 2011/05/02 17:38:24.0557 4068 sfloppy (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys 2011/05/02 17:38:24.0635 4068 Sftfs (cc895997c0995a07b6b2779a3b21918b) C:\windows\system32\DRIVERS\Sftfslh.sys 2011/05/02 17:38:24.0775 4068 Sftplay (cf5e9798637795db59697f5e40fca993) C:\windows\system32\DRIVERS\Sftplaylh.sys 2011/05/02 17:38:24.0869 4068 Sftredir (4c8076ff8938b365eeec9123969e0350) C:\windows\system32\DRIVERS\Sftredirlh.sys 2011/05/02 17:38:24.0962 4068 Sftvol (6095a5f221eca9dada2c9ee80ec0d92d) C:\windows\system32\DRIVERS\Sftvollh.sys 2011/05/02 17:38:25.0149 4068 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\DRIVERS\sisagp.sys 2011/05/02 17:38:25.0259 4068 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys 2011/05/02 17:38:25.0383 4068 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys 2011/05/02 17:38:25.0508 4068 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys 2011/05/02 17:38:25.0695 4068 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys 2011/05/02 17:38:25.0867 4068 srv (4a9b0f215de2519e2363f91df25c1e97) C:\windows\system32\DRIVERS\srv.sys 2011/05/02 17:38:25.0992 4068 srv2 (14c44875518ae1c982e54ea8c5f7fe28) C:\windows\system32\DRIVERS\srv2.sys 2011/05/02 17:38:26.0070 4068 srvnet (07a14223b0a50e76ade003fdf95d4fec) C:\windows\system32\DRIVERS\srvnet.sys 2011/05/02 17:38:26.0179 4068 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\windows\system32\DRIVERS\ssmdrv.sys 2011/05/02 17:38:26.0304 4068 stexstor (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys 2011/05/02 17:38:26.0397 4068 swenum (e58c78a848add9610a4db6d214af5224) C:\windows\system32\DRIVERS\swenum.sys 2011/05/02 17:38:26.0538 4068 SynTP (53d429d38e8fb5e0cd9225353006af0f) C:\windows\system32\DRIVERS\SynTP.sys 2011/05/02 17:38:26.0772 4068 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\windows\system32\drivers\tcpip.sys 2011/05/02 17:38:27.0037 4068 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\windows\system32\DRIVERS\tcpip.sys 2011/05/02 17:38:27.0146 4068 tcpipreg (e64444523add154f86567c469bc0b17f) C:\windows\system32\drivers\tcpipreg.sys 2011/05/02 17:38:27.0240 4068 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\windows\system32\drivers\tdpipe.sys 2011/05/02 17:38:27.0318 4068 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\windows\system32\drivers\tdtcp.sys 2011/05/02 17:38:27.0380 4068 tdx (cb39e896a2a83702d1737bfd402b3542) C:\windows\system32\DRIVERS\tdx.sys 2011/05/02 17:38:27.0458 4068 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\windows\system32\DRIVERS\termdd.sys 2011/05/02 17:38:27.0661 4068 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\windows\system32\DRIVERS\tssecsrv.sys 2011/05/02 17:38:27.0770 4068 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\windows\system32\DRIVERS\tunnel.sys 2011/05/02 17:38:27.0864 4068 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys 2011/05/02 17:38:27.0957 4068 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\windows\system32\DRIVERS\udfs.sys 2011/05/02 17:38:28.0145 4068 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\DRIVERS\uliagpkx.sys 2011/05/02 17:38:28.0254 4068 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\windows\system32\DRIVERS\umbus.sys 2011/05/02 17:38:28.0347 4068 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys 2011/05/02 17:38:28.0410 4068 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\windows\system32\DRIVERS\usbccgp.sys 2011/05/02 17:38:28.0519 4068 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\DRIVERS\usbcir.sys 2011/05/02 17:38:28.0628 4068 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\windows\system32\DRIVERS\usbehci.sys 2011/05/02 17:38:28.0706 4068 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\windows\system32\DRIVERS\usbhub.sys 2011/05/02 17:38:28.0847 4068 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\windows\system32\DRIVERS\usbohci.sys 2011/05/02 17:38:28.0925 4068 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys 2011/05/02 17:38:29.0096 4068 usbsmi (ff04ee7750229600a59b900d663164b1) C:\windows\system32\DRIVERS\SMIksdrv.sys 2011/05/02 17:38:29.0221 4068 USBSTOR (1c4287739a93594e57e2a9e6a3ed7353) C:\windows\system32\drivers\USBSTOR.SYS 2011/05/02 17:38:29.0299 4068 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\windows\system32\DRIVERS\usbuhci.sys 2011/05/02 17:38:29.0439 4068 usbvideo (b5f6a992d996282b7fae7048e50af83a) C:\windows\System32\Drivers\usbvideo.sys 2011/05/02 17:38:29.0611 4068 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\DRIVERS\vdrvroot.sys 2011/05/02 17:38:29.0705 4068 vga (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys 2011/05/02 17:38:29.0767 4068 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys 2011/05/02 17:38:29.0845 4068 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\windows\system32\DRIVERS\vhdmp.sys 2011/05/02 17:38:29.0970 4068 viaagp (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\DRIVERS\viaagp.sys 2011/05/02 17:38:30.0095 4068 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys 2011/05/02 17:38:30.0157 4068 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\DRIVERS\viaide.sys 2011/05/02 17:38:30.0251 4068 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\windows\system32\DRIVERS\volmgr.sys 2011/05/02 17:38:30.0329 4068 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys 2011/05/02 17:38:30.0407 4068 volsnap (58df9d2481a56edde167e51b334d44fd) C:\windows\system32\DRIVERS\volsnap.sys 2011/05/02 17:38:30.0531 4068 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys 2011/05/02 17:38:30.0641 4068 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys 2011/05/02 17:38:30.0750 4068 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys 2011/05/02 17:38:30.0875 4068 WacomPen (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys 2011/05/02 17:38:30.0984 4068 WANARP (692a712062146e96d28ba0b7d75de31b) C:\windows\system32\DRIVERS\wanarp.sys 2011/05/02 17:38:31.0031 4068 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\windows\system32\DRIVERS\wanarp.sys 2011/05/02 17:38:31.0202 4068 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys 2011/05/02 17:38:31.0296 4068 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys 2011/05/02 17:38:31.0483 4068 wdmirror (ea4e9dd00e69b35f9bd3d39acb113e3f) C:\windows\system32\DRIVERS\WDMirror.sys 2011/05/02 17:38:31.0670 4068 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys 2011/05/02 17:38:31.0748 4068 WimFltr (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\windows\system32\DRIVERS\wimfltr.sys 2011/05/02 17:38:31.0826 4068 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys 2011/05/02 17:38:32.0045 4068 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\DRIVERS\wmiacpi.sys 2011/05/02 17:38:32.0185 4068 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys 2011/05/02 17:38:32.0310 4068 wsvd (baedc491374defd5e76336901d6d397d) C:\windows\system32\DRIVERS\wsvd.sys 2011/05/02 17:38:32.0419 4068 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\windows\system32\drivers\WudfPf.sys 2011/05/02 17:38:32.0591 4068 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\windows\system32\DRIVERS\WUDFRd.sys 2011/05/02 17:38:32.0778 4068 ================================================================================ 2011/05/02 17:38:32.0778 4068 Scan finished 2011/05/02 17:38:32.0778 4068 ================================================================================ |
|
02.05.2011, 19:01
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Kazy.mekl.1 ebendfalls bei mir... Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu TR/Kazy.mekl.1 ebendfalls bei mir... |
| anti, anti-malware, appdata, avgntflt.sys, bösartige, conduit, dateien, daten, desktop, explorer, files, install.exe, laufen, lenovo, location, malware, mcafee firewall, microsoft, microsoft office starter 2010, minute, nicht gefunden, oldtimer, picasa, plug-in, problem, process, programm, richtlinie, saver, sched.exe, schei, schwarz, searchplugins, shell32.dll, software, start menu, taskhost.exe, temporary, tr/kazy, trojan.fakealert, trojaner, usb 2.0, value, verknüpfungen, version, webcheck |
