Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 04.07.2011, 17:46   #1
meyerlein
 
Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL - Standard

Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL



Hallo,

Danke ersteinmal dem- oder denjenigen die sich meinem Problem annehmen.

mein Notebook bekommt derzeit mehrfach täglich einen Bluescreen, meist mit der ersten Zeile "IRQL NOT OR LESS EQUAL". Bei googlen nach diesem Term bin ich auch auf dieses Forum gestoflen.

Der Bluescreen erscheint, wenn man Befehle gibt, während der Rechner noch hochfährt oder wenn er ¸berlastet scheint. Manchmal aber auch nur einfach so (so wie gerade, als ich diesen Text das erste mal schrieb )

Außerdem öffnen sich andere Seiten, als die die man in der Suchmaschine angeklickt hat. Zudem stürzen Opera, Firefox und auch der IE (extra getestet) ab, sobald mehrere Tabs offen sind oder je nach Webseite auch einfach so.

Habe versucht mit Spybot und Malwarebytes etwas zu ändern, aber vergeblich. Antivir von Avira findet "Bootsektorvirus BOO/TDss.", kann das Problem aber nicht lösen.

Anbei die erforderlichen Logfiles:

OTL:

OTL logfile created on: 04.07.2011 14:59:52 - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Users\dom\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1013,43 Mb Total Physical Memory | 286,71 Mb Available Physical Memory | 28,29% Memory free
2,24 Gb Paging File | 0,73 Gb Available in Paging File | 32,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 51,14 Gb Total Space | 13,96 Gb Free Space | 27,29% Space Free | Partition Type: NTFS
Drive D: | 50,89 Gb Total Space | 16,63 Gb Free Space | 32,68% Space Free | Partition Type: NTFS
Drive E: | 149,01 Gb Total Space | 56,77 Gb Free Space | 38,10% Space Free | Partition Type: FAT32

Computer Name: DOMINIC | User Name: dom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.07.04 14:58:22 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\dom\Desktop\OTL.exe
PRC - [2011.07.02 12:36:13 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Antivir\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.05.29 09:11:28 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes\mbamgui.exe
PRC - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes\mbamservice.exe
PRC - [2011.04.30 20:13:15 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Antivir\Avira\AntiVir Desktop\sched.exe
PRC - [2010.08.02 17:09:32 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Antivir\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.01.14 23:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Antivir\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.09.08 09:48:55 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe
PRC - [2009.09.08 09:47:07 | 004,513,792 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot\SDWinSec.exe
PRC - [2008.10.16 18:26:20 | 000,860,160 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe
PRC - [2008.10.16 17:54:34 | 000,466,944 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007.09.14 21:02:04 | 000,208,896 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Users\dom\AppData\Local\Temp\RtkBtMnt.exe
PRC - [2007.05.22 15:00:02 | 000,135,168 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe
PRC - [2007.05.16 22:15:22 | 000,163,840 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
PRC - [2007.05.10 14:05:36 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
PRC - [2007.04.25 16:34:30 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007.04.25 16:33:36 | 000,457,216 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
PRC - [2007.04.11 06:10:14 | 000,506,640 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\QtZgAcer.EXE
PRC - [2007.03.29 13:11:50 | 000,719,664 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2007.03.23 13:04:54 | 004,423,680 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.03.14 10:52:30 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
PRC - [2007.02.13 06:26:50 | 000,053,248 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2007.01.26 14:24:42 | 000,050,688 | ---- | M] () -- C:\Acer\ALaunch\ALaunchSvc.exe
PRC - [2006.11.24 12:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe
PRC - [2006.10.05 06:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe


========== Modules (SafeList) ==========

MOD - [2011.07.04 14:58:22 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\dom\Desktop\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2007.05.22 15:00:04 | 000,090,112 | ---- | M] (acer) -- C:\Windows\System32\eNetHook.dll


========== Win32 Services (SafeList) ==========

SRV - [2011.07.02 12:36:13 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Antivir\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes\mbamservice.exe -- (MBAMService)
SRV - [2011.04.30 20:13:15 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Antivir\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.09.08 09:48:55 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe -- (postgresql-8.4)
SRV - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008.10.16 18:26:20 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008.10.16 17:54:34 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.22 15:00:02 | 000,135,168 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2007.05.16 22:15:22 | 000,163,840 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2007.05.10 14:05:36 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007.04.25 16:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007.03.14 10:52:30 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2007.02.13 06:26:50 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2007.01.26 14:24:42 | 000,050,688 | ---- | M] () [Auto | Running] -- C:\Acer\ALaunch\ALaunchSvc.exe -- (ALaunchService)
SRV - [2006.11.24 12:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2006.10.05 06:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)


========== Driver Services (SafeList) ==========

DRV - [2011.07.02 12:36:17 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.02 12:36:17 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010.06.17 16:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.11.17 08:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2007.04.30 06:45:18 | 002,219,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007.03.09 08:56:04 | 001,163,616 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2007.02.07 18:35:10 | 001,729,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2007.01.31 11:10:14 | 000,046,592 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2007.01.31 11:10:10 | 000,061,952 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2007.01.31 11:10:06 | 000,067,584 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2006.12.07 18:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006.11.02 16:51:58 | 000,013,560 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4c74-92FE-5B863F82066B})


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.babypips.com/school/"
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2
FF - prefs.js..extensions.enabledItems: {62760FD6-B943-48C9-AB09-F99C6FE96088}:2.1.6
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.4
FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:5.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.09.02 19:45:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.01.30 19:21:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.01.30 19:21:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.27 10:17:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.26 18:36:34 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.06.24 13:39:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.04.17 10:30:48 | 000,000,000 | ---D | M]

[2011.01.05 17:22:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dom\AppData\Roaming\mozilla\Extensions
[2011.01.05 17:22:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dom\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.07.03 22:16:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dom\AppData\Roaming\mozilla\Firefox\Profiles\gsmeexj1.default\extensions
[2011.01.20 18:25:21 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\dom\AppData\Roaming\mozilla\Firefox\Profiles\gsmeexj1.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2011.01.20 18:25:27 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Users\dom\AppData\Roaming\mozilla\Firefox\Profiles\gsmeexj1.default\extensions\en-US@dictionaries.addons.mozilla.org
[2011.06.22 21:15:35 | 000,002,354 | ---- | M] () -- C:\Users\dom\AppData\Roaming\Mozilla\Firefox\Profiles\gsmeexj1.default\searchplugins\aol-web-search.xml
[2011.06.27 10:17:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2007.09.18 07:49:05 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011.05.10 05:48:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.24 10:08:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.06.15 11:49:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\DOM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GSMEEXJ1.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
() (No name found) -- C:\USERS\DOM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GSMEEXJ1.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
() (No name found) -- C:\USERS\DOM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GSMEEXJ1.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2010.12.08 14:25:20 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011.06.16 06:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2007.09.22 21:55:45 | 000,183,649 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 babe.the-killer.bz
O1 - Hosts: 127.0.0.1 www.babe.the-killer.bz
O1 - Hosts: 127.0.0.1 babe.k-lined.com
O1 - Hosts: 127.0.0.1 www.babe.k-lined.com
O1 - Hosts: 127.0.0.1 did.i-used.cc
O1 - Hosts: 127.0.0.1 www.did.i-used.cc
O1 - Hosts: 127.0.0.1 coolwwwsearch.com
O1 - Hosts: 127.0.0.1 www.coolwwwsearch.com
O1 - Hosts: 127.0.0.1 coolwebsearch.com
O1 - Hosts: 127.0.0.1 www.coolwebsearch.com
O1 - Hosts: 127.0.0.1 hi.studioaperto.net
O1 - Hosts: 127.0.0.1 www.hi.studioaperto.net
O1 - Hosts: 127.0.0.1 wazzupnet.com
O1 - Hosts: 127.0.0.1 www.wazzupnet.com
O1 - Hosts: 127.0.0.1 gueb.com
O1 - Hosts: 127.0.0.1 www.gueb.com
O1 - Hosts: 127.0.0.1 kabex.com
O1 - Hosts: 127.0.0.1 www.kabex.com
O1 - Hosts: 127.0.0.1 hityou.com
O1 - Hosts: 127.0.0.1 www.hityou.com
O1 - Hosts: 127.0.0.1 miosearch.com
O1 - Hosts: 127.0.0.1 www.miosearch.com
O1 - Hosts: 127.0.0.1 blue-elefant.com
O1 - Hosts: 6527 more lines...
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - File not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Antivir\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PLFSet] C:\Windows\PLFSet.dll ( )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes\mbamgui.exe (Malwarebytes Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - File not found
O9 - Extra 'Tools' menuitem : PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - File not found
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - File not found
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - File not found
O13 - gopher Prefix: missing
O16 - DPF: {3BB4FE3B-7A37-11D3-A41E-0060080C03B3} hxxp://vblu.uni-bocconi.it/vblu/NWWClientFull.cab (Entire Screen Builder Web Viewer)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (eNetHook.dll) - C:\Windows\System32\eNetHook.dll (acer)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\bulxnpgw\jxdkxppk.exe) - File not found
O20 - Winlogon\Notify\huffodt: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{5872f4f6-3e3d-11dc-870a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5872f4f6-3e3d-11dc-870a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\{bcd9f011-77f9-11dd-8784-000000000000}\Shell\Auto\command - "" = MSOCache\doWTP_RESTORE.exe
O33 - MountPoints2\{bcd9f011-77f9-11dd-8784-000000000000}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE.exe
O33 - MountPoints2\{bcd9f017-77f9-11dd-8784-000000000000}\Shell\Auto\command - "" = MSOCache\doWTP_RESTORE.exe
O33 - MountPoints2\{bcd9f017-77f9-11dd-8784-000000000000}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE.exe
O33 - MountPoints2\{d34bcb6c-044c-11e0-99cb-000000000000}\Shell - "" = AutoRun
O33 - MountPoints2\{d34bcb6c-044c-11e0-99cb-000000000000}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2011.07.04 14:58:15 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\dom\Desktop\OTL.exe
[2011.07.04 12:26:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
[2011.06.25 13:43:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars
[2011.06.22 20:03:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
[2011.06.22 19:58:02 | 000,000,000 | ---D | C] -- C:\Program Files\Winamp Toolbar
[2011.06.22 19:54:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Software Update Utility
[2011.06.20 08:47:01 | 000,000,000 | ---D | C] -- C:\Users\dom\AppData\Roaming\HoldemManager
[2011.06.06 13:29:04 | 000,000,000 | ---D | C] -- C:\Users\dom\Desktop\geld, kapital & devisen
[2007.07.30 04:00:05 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2007.07.30 03:55:18 | 000,172,032 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2007.07.30 03:55:18 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2007.05.01 16:23:21 | 000,045,056 | ---- | C] ( ) -- C:\Windows\PLFSet.dll
[2007.05.01 08:08:13 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.07.04 14:58:22 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\dom\Desktop\OTL.exe
[2011.07.04 14:55:19 | 000,000,000 | ---- | M] () -- C:\Users\dom\defogger_reenable
[2011.07.04 14:54:41 | 000,050,477 | ---- | M] () -- C:\Users\dom\Desktop\Defogger.exe
[2011.07.04 14:19:34 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.04 14:19:34 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.04 10:59:01 | 000,000,392 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{271AFCAC-28A1-435D-B7A0-7D58B141E0EA}.job
[2011.07.04 08:19:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.03 22:59:32 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.07.02 12:36:17 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.07.02 12:36:17 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.06.30 08:39:54 | 000,401,000 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.06.27 00:01:34 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.27 00:01:34 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.27 00:01:34 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.27 00:01:34 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.22 20:32:11 | 000,025,203 | ---- | M] () -- C:\Users\dom\Documents\jo geb.m3u
[2011.06.15 12:12:31 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2011.06.15 12:12:31 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2011.06.15 12:12:13 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011.06.13 01:30:36 | 000,060,896 | ---- | M] () -- C:\Users\dom\Documents\comichighlighting1.png
[2011.06.09 05:16:44 | 000,054,430 | ---- | M] () -- C:\Users\dom\Desktop\Entwicklung Preise.jpg
[2011.06.08 11:01:44 | 000,011,353 | ---- | M] () -- C:\Users\dom\Desktop\autoh‰user 25.05.odt
[2011.06.08 09:41:51 | 000,210,464 | ---- | M] () -- C:\Users\dom\Documents\beleg.xps
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.07.04 14:55:19 | 000,000,000 | ---- | C] () -- C:\Users\dom\defogger_reenable
[2011.07.04 14:54:29 | 000,050,477 | ---- | C] () -- C:\Users\dom\Desktop\Defogger.exe
[2011.06.27 10:17:11 | 000,000,822 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.06.22 20:25:15 | 000,025,203 | ---- | C] () -- C:\Users\dom\Documents\jo geb.m3u
[2011.06.15 13:00:47 | 000,000,953 | ---- | C] () -- C:\Users\dom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.06.15 12:12:13 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.06.13 01:30:35 | 000,060,896 | ---- | C] () -- C:\Users\dom\Documents\comichighlighting1.png
[2011.06.09 05:16:44 | 000,054,430 | ---- | C] () -- C:\Users\dom\Desktop\Entwicklung Preise.jpg
[2011.06.08 09:41:35 | 000,210,464 | ---- | C] () -- C:\Users\dom\Documents\beleg.xps
[2011.03.19 03:35:03 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.01.20 15:22:03 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.01.17 14:25:39 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011.01.17 14:25:38 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.01.17 14:25:35 | 000,810,496 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.01.17 14:25:35 | 000,183,808 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.01.17 14:25:34 | 000,080,896 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.01.03 22:08:42 | 000,000,000 | ---- | C] () -- C:\Windows\HMHud.INI
[2010.12.10 23:43:57 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.12.10 23:43:56 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2008.08.06 11:06:14 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.02.11 19:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll
[2008.01.02 17:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2007.12.26 11:50:28 | 000,000,680 | ---- | C] () -- C:\Users\dom\AppData\Local\d3d9caps.dat
[2007.10.18 10:12:20 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1350.dll
[2007.09.15 20:11:08 | 000,097,280 | ---- | C] () -- C:\Users\dom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.14 21:21:16 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.08.29 16:55:38 | 000,081,920 | ---- | C] () -- C:\Windows\System32\sw2_ttls_manager.exe
[2007.08.24 19:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll
[2007.07.30 13:35:56 | 000,000,030 | ---- | C] () -- C:\Windows\SETPANEL.INI
[2007.07.30 13:35:55 | 000,000,094 | ---- | C] () -- C:\Windows\CLEANUP.INI
[2007.07.30 04:00:05 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2007.07.30 03:57:35 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007.05.01 18:13:39 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.05.01 16:23:41 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1244.dll
[2007.05.01 16:23:40 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.05.01 16:23:21 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.05.01 08:14:02 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2007.05.01 08:14:02 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2007.05.01 08:13:19 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2007.05.01 08:08:10 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.05.01 07:55:05 | 000,356,352 | ---- | C] () -- C:\Windows\EMCRI.dll
[2007.05.01 07:47:39 | 000,001,132 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007.05.01 07:47:39 | 000,000,216 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat
[2007.04.25 16:33:22 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.04.25 16:32:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.04.25 16:32:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.04.25 16:31:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.04.25 16:30:52 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.04.25 16:30:44 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2007.03.29 12:42:38 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.12.25 15:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.11.13 05:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006.11.02 17:33:31 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,126,260 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,401,000 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2011.03.10 12:25:09 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\3
[2008.01.08 13:49:34 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\BitTorrent
[2007.09.18 12:27:09 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\BitTorrent DNA
[2011.04.17 10:30:49 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Foxit
[2011.05.31 08:54:19 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\HEM Data
[2011.06.20 08:47:01 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\HoldemManager
[2011.01.30 19:21:32 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Local
[2011.03.16 19:43:40 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Mudezo
[2011.05.10 05:57:19 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\OpenOffice.org
[2010.12.13 10:43:52 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Opera
[2011.03.16 20:25:12 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Pawa
[2011.04.18 19:20:26 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Roaming
[2011.01.11 09:52:25 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Sports Interactive
[2011.01.05 17:22:37 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Thunderbird
[2011.07.04 10:59:08 | 000,032,570 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.07.04 10:59:01 | 000,000,392 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{271AFCAC-28A1-435D-B7A0-7D58B141E0EA}.job
[2011.03.15 12:28:25 | 000,000,392 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{B5DD6CC0-1BA4-474A-AE51-B6F76C72D65F}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*. >
[2007.09.14 21:01:31 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011.04.15 13:21:25 | 000,000,000 | ---D | M] -- C:\4e36c736956664754c20910a420eca
[2007.09.14 21:01:47 | 000,000,000 | ---D | M] -- C:\Acer
[2007.05.01 16:23:16 | 000,000,000 | ---D | M] -- C:\Book
[2010.12.15 09:58:13 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.09.14 20:56:26 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2007.05.01 08:44:10 | 000,000,000 | ---D | M] -- C:\DRV
[2007.10.10 06:04:58 | 000,000,000 | ---D | M] -- C:\Intel
[2008.06.20 00:22:07 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.06.27 09:25:50 | 000,000,000 | ---D | M] -- C:\Program Files
[2011.06.23 21:51:52 | 000,000,000 | ---D | M] -- C:\ProgramData
[2007.09.14 20:56:26 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.06.24 17:46:06 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.01.03 21:58:40 | 000,000,000 | R--D | M] -- C:\Users
[2011.06.27 09:25:50 | 000,000,000 | ---D | M] -- C:\Windows

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %systemroot%\*. /mp /s >


< MD5 for: EXPLORER.EXE >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008.02.02 00:41:08 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008.02.02 00:41:06 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: REGEDIT.EXE >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe

< MD5 for: USERINIT.EXE >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WININIT.EXE >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

< MD5 for: WINLOGON.EXE >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-01 06:44:29

< >

========== Files - Unicode (All) ==========
[2011.03.10 12:25:07 | 000,000,000 | ---D | M](C:\Users\dom\AppData\Roaming\??????) -- C:\Users\dom\AppData\Roaming\??????
[2011.03.10 12:25:07 | 000,000,000 | ---D | M](C:\Users\dom\AppData\Roaming\??????) -- C:\Users\dom\AppData\Roaming\??????
[2011.03.10 12:25:01 | 000,000,000 | ---D | M](C:\Windows\System32\??????) -- C:\Windows\System32\??????
[2011.03.10 12:25:01 | 000,000,000 | ---D | C](C:\Windows\System32\??????) -- C:\Windows\System32\??????
(C:\Users\dom\AppData\Roaming\??????) -- C:\Users\dom\AppData\Roaming\??????

< End of report >

Extras:

OTL Extras logfile created on: 04.07.2011 14:59:53 - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Users\dom\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1013,43 Mb Total Physical Memory | 286,71 Mb Available Physical Memory | 28,29% Memory free
2,24 Gb Paging File | 0,73 Gb Available in Paging File | 32,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 51,14 Gb Total Space | 13,96 Gb Free Space | 27,29% Space Free | Partition Type: NTFS
Drive D: | 50,89 Gb Total Space | 16,63 Gb Free Space | 32,68% Space Free | Partition Type: NTFS
Drive E: | 149,01 Gb Total Space | 56,77 Gb Free Space | 38,10% Space Free | Partition Type: FAT32

Computer Name: DOMINIC | User Name: dom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Value error.
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent_DNA\bittorrent.exe" = C:\Program Files\BitTorrent_DNA\bittorrent.exe:*:Enabled:BitTorrent


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{4B052B4A-6944-4187-B7BA-EB9D284FED3A}" = lport=10243 | protocol=6 | dir=in | app=system |
"{536F01E3-D6AF-45B1-B61A-72E6503EDC94}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5460B6A3-081C-4E9D-8701-296A62E9D8EF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7217DFD8-29F8-446B-A346-83D3C940B735}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8C57275E-8B1E-49FE-990A-17E20744477F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A33EE1E2-B0A9-4A0E-B661-822BE3318F85}" = rport=10243 | protocol=6 | dir=out | app=system |
"{AA67081D-F2CF-49B3-A2C3-44AB45B4887D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BDCF30F8-4D2D-45B9-9A83-DE4675718B98}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E8EC45F7-C45B-4CFF-B5BE-3C32870CBC4B}" = lport=5432 | protocol=6 | dir=in | name=postgres |
"{F794D7B3-657B-43B4-B162-5C6CBFEB7A8B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{15075F0B-40CC-4EF4-8A8F-77D797EF2650}" = protocol=17 | dir=in | app=c:\program files\sports interactive\football manager 2010\fm.exe |
"{1EA04F71-1FE8-46F3-B7B5-263444F3E106}" = protocol=6 | dir=out | app=system |
"{2F042BC3-C986-4CA6-BF02-34BA5D4422FA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{41124CB3-27CC-43F4-B5D8-E29F5DC8D2C6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4C454EF4-162B-469F-8820-F916F1DA4960}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{7530F0EE-5938-42B6-BFFA-53D33705C7FA}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{7998B954-F5F2-402C-B730-9BC1488F1822}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{7C659DF1-D3D4-4DFB-A91A-31FECE8C10B6}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{854AF788-359E-4675-9EF4-921C72051DA2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8831D5D2-A3E2-4712-A04C-ECAB112DFC8B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{89BEA3B7-10A6-4042-90A2-C7E4C0A3A306}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9B84C918-1740-4586-926F-EF0A1B19D232}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A87E8D8E-BFAD-450C-AA40-F4591A124440}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{B7360545-54F3-433E-B99E-8434BF63775E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B98080A1-8676-4326-8C12-AB8B7F28050D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B9B6D85E-8EA9-4762-83D7-62B1D78AD470}" = protocol=6 | dir=in | app=c:\program files\sports interactive\football manager 2010\fm.exe |
"{BD289B34-DF30-437A-A650-B75EF139C7D1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C1AD2C55-15C5-4D16-ACB4-9C783A799237}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{D0FE849D-26AB-4014-AD6D-2B66DF61BD45}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EF2BA8F2-16D0-4950-9CEB-51703095AF0E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F1F40A3A-D402-431D-901B-2BEB27A53E35}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{3D923782-D919-4D1E-8D40-45F9282A836C}C:\program files\zattoo\zattoo.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattoo.exe |
"TCP Query User{68379244-42FF-4A1A-A29B-6BF0ED4EF2A6}C:\program files\zattoo\zattoo.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattoo.exe |
"TCP Query User{6E04C4FD-71C0-425B-A4DD-ECA983C5BC53}C:\program files\steam\steamapps\dionysos13\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\dionysos13\team fortress 2\hl2.exe |
"TCP Query User{9B59BC88-15E1-4C36-B071-A32ED20B76FD}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{9D11D79C-8942-4B11-99C6-48B443E25E9D}C:\program files\steam\steamapps\csgod494\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\csgod494\team fortress 2\hl2.exe |
"TCP Query User{A13937C5-E785-4593-8888-ABEB395383FE}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{B233AF06-C9C8-4679-BB2E-B1E3D0EF7623}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{B2662E8E-80E3-4F34-9EAF-E9DC36F5BC16}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{CE2E6AB2-7E55-4AE1-AB8E-9A214AEF6923}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{ECA44183-A7CF-44F9-AF2D-1068499A8D7B}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{F56047A2-E124-41F0-A3D0-E8490048AFC2}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{3143CD7D-63BF-4505-82BE-F338F627C142}C:\program files\zattoo\zattoo.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattoo.exe |
"UDP Query User{5368EC90-978A-46A0-91A5-AF195ED53E40}C:\program files\zattoo\zattoo.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattoo.exe |
"UDP Query User{5993106E-E12F-494B-A456-CC4E9B31316D}C:\program files\steam\steamapps\csgod494\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\csgod494\team fortress 2\hl2.exe |
"UDP Query User{5AAA6C6F-346A-452D-BC7D-DF95FC214041}C:\program files\steam\steamapps\dionysos13\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\dionysos13\team fortress 2\hl2.exe |
"UDP Query User{8F993012-2831-4375-84D0-18B6625863D1}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{9119A1F1-2533-4963-B801-84A9DF4D0D51}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{B5A52058-A0E9-4427-93A4-FB7DE3935A68}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{B6EEDBB3-CAC3-4F97-9575-2D14A45EF8E8}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{B9358F73-1FCC-494E-9BAC-7541517A2AC6}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{C7EC594A-51D8-4183-B388-14BDCFBAC66C}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{D3A745B0-8A04-4B28-8363-343EBA2F122F}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.4900
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 26
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{35C0A1E4-D02A-412C-841F-266DBB116ABB}" = Intel(R) PROSet/Wireless WiFi-Software
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye webcam
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skypeô 5.3
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AA047D7C-5E7C-4878-B75C-77589151B563}" = Acer Crystal Eye webcam
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}" = Broadcom Gigabit Integrated Controller
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"FLV Player" = FLV Player 2.0, build 24
"Foxit Reader" = Foxit Reader
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HoldemManager" = Holdem Manager
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.8.0 (Full)
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 5.0 (x86 de)" = Mozilla Firefox 5.0 (x86 de)
"Mozilla Thunderbird (3.1.11)" = Mozilla Thunderbird (3.1.11)
"Opera 11.11.2109" = Opera 11.11
"PokerStars" = PokerStars
"PostgreSQL 8.4" = PostgreSQL 8.4
"ProInst" = Intel PROSet Wireless
"SecureW2 TTLS Client" = SecureW2 TTLS Client 3.3.3 for Windows
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"VLC media player" = VideoLAN VLC media player 0.8.6c
"Winamp" = Winamp
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
"Zattoo" = Zattoo 3.3.0 Beta

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 04.07.2011 04:54:38 | Computer Name = *** | Source = PostgreSQL | ID = 0
Description =

Error - 04.07.2011 04:55:10 | Computer Name = *** | Source = PostgreSQL | ID = 0
Description =

Error - 04.07.2011 04:55:42 | Computer Name = *** | Source = PostgreSQL | ID = 0
Description =

Error - 04.07.2011 04:58:50 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
Ausnahmecode 0xc000071b, Fehleroffset 0x00088d15, Prozess-ID 0x71c, Anwendungsstartzeit
01cc3a25bcb938b0.

Error - 04.07.2011 07:03:08 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131077
Description =

Error - 04.07.2011 07:03:09 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131077
Description =

Error - 04.07.2011 07:03:09 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131077
Description =

Error - 04.07.2011 07:03:10 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131077
Description =

Error - 04.07.2011 09:02:03 | Computer Name = *** | Source = SPP | ID = 16387
Description =

Error - 04.07.2011 09:02:03 | Computer Name = *** | Source = System Restore | ID = 8193
Description =

[ System Events ]
Error - 03.07.2011 16:59:14 | Computer Name = *** | Source = DCOM | ID = 10010
Description =

Error - 03.07.2011 18:43:54 | Computer Name = *** | Source = Service Control Manager | ID = 7026
Description =

Error - 03.07.2011 18:47:47 | Computer Name = *** | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 04.07.2011 um 00:46:20 unerwartet heruntergefahren.

Error - 03.07.2011 18:49:14 | Computer Name = *** | Source = Service Control Manager | ID = 7026
Description =

Error - 04.07.2011 02:28:22 | Computer Name = *** | Source = Service Control Manager | ID = 7032
Description =

Error - 04.07.2011 02:28:23 | Computer Name = *** | Source = Service Control Manager | ID = 7032
Description =

Error - 04.07.2011 04:39:46 | Computer Name = *** | Source = Service Control Manager | ID = 7032
Description =

Error - 04.07.2011 04:39:46 | Computer Name = *** | Source = Service Control Manager | ID = 7032
Description =

Error - 04.07.2011 04:42:45 | Computer Name = *** | Source = Service Control Manager | ID = 7032
Description =

Error - 04.07.2011 05:01:09 | Computer Name = *** | Source = Service Control Manager | ID = 7032
Description =


< End of report >


und Gmer:

GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-07-04 16:32:43
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\iaStor0 TOSHIBA_ rev.DL15
Running: 7iq456ud.exe; Driver: C:\Users\dom\AppData\Local\Temp\pwldapod.sys


---- System - GMER 1.0.15 ----

SSDT 8D5DD4D6 ZwCreateSection
SSDT 8D5DD4DB ZwSetContextThread
SSDT 8D5DD477 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 215 820B3998 4 Bytes [D6, D4, 5D, 8D]
.text ntkrnlpa.exe!KeSetEvent + 56D 820B3CF0 4 Bytes [DB, D4, 5D, 8D]
.text ntkrnlpa.exe!KeSetEvent + 621 820B3DA4 4 Bytes [77, D4, 5D, 8D]

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\Explorer.EXE[208] ntdll.dll!NtProtectVirtualMemory 775C4B84 5 Bytes JMP 0090000A
.text C:\Windows\Explorer.EXE[208] ntdll.dll!NtWriteVirtualMemory 775C54C4 5 Bytes JMP 0096000A
.text C:\Windows\Explorer.EXE[208] ntdll.dll!KiUserExceptionDispatcher 775C5BF8 5 Bytes JMP 008F000A
.text C:\Windows\system32\svchost.exe[1148] ntdll.dll!NtProtectVirtualMemory 775C4B84 5 Bytes JMP 0022000A
.text C:\Windows\system32\svchost.exe[1148] ntdll.dll!NtWriteVirtualMemory 775C54C4 5 Bytes JMP 0023000A
.text C:\Windows\system32\svchost.exe[1148] ntdll.dll!KiUserExceptionDispatcher 775C5BF8 5 Bytes JMP 0021000A
.text C:\Windows\system32\svchost.exe[1148] ole32.dll!CoCreateInstance 76F79F3E 5 Bytes JMP 01EE000A
.text C:\Windows\system32\svchost.exe[1148] USER32.dll!WindowFromPoint 771C884F 5 Bytes JMP 01F4000A
.text C:\Windows\system32\svchost.exe[1148] USER32.dll!GetForegroundWindow 771D32C4 5 Bytes JMP 01F5000A
.text C:\Windows\system32\svchost.exe[1148] USER32.dll!GetCursorPos 771E0B88 5 Bytes JMP 01EF000A

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

Device \Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskTOSHIBA_MK1237GSX_______________________DL150J__#4&12a7e20a&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00197efc305b
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00197efc305b@0016b825dfcd 0x6C 0xBB 0xB5 0x84 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00197efc305b@c42c03b8ccd6 0x6C 0xA6 0x07 0x4F ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00197efc305b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00197efc305b@0016b825dfcd 0x6C 0xBB 0xB5 0x84 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00197efc305b@c42c03b8ccd6 0x6C 0xA6 0x07 0x4F ...

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----

Alt 04.07.2011, 21:37   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL - Standard

Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL



Hallo und

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________

__________________

Alt 05.07.2011, 08:43   #3
meyerlein
 
Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL - Standard

Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL



Guten Morgen.

Habe über Nacht mal nen Vollscan laufen lassen, der war aber wie am Nachmittag erfolglos:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 7019

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

05.07.2011 03:13:39
mbam-log-2011-07-05 (03-13-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 323017
Laufzeit: 1 Stunde(n), 40 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

und am selben Nachmittag:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 7017

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

04.07.2011 14:21:56
mbam-log-2011-07-04 (14-21-55).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 322215
Laufzeit: 1 Stunde(n), 52 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Dazu die alten (Quick-)Scans mit und ohne Funde:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6605

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

18.05.2011 11:53:31
mbam-log-2011-05-18 (11-53-31).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 36456
Laufzeit: 3 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6605

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

18.05.2011 08:54:42
mbam-log-2011-05-18 (08-54-42).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 152456
Laufzeit: 7 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6599

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

18.05.2011 08:36:50
mbam-log-2011-05-18 (08-36-50).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 152323
Laufzeit: 8 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6599

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

18.05.2011 07:56:34
mbam-log-2011-05-18 (07-56-34).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 152258
Laufzeit: 10 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\youmeetwewo (Trojan.SpyEyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\youmeetwewo\config.bin (Trojan.SpyEyes) -> Quarantined and deleted successfully.



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6363

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

14.04.2011 18:03:35
mbam-log-2011-04-14 (18-03-35).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 164425
Laufzeit: 27 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Windows\Temp\0.7533198462859988.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
__________________

Alt 05.07.2011, 08:51   #4
meyerlein
 
Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL - Standard

Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL



Dazu noch etwas für mich sehr erschreckendes:

Habe seit gestern die Trialversion von Malwarebytes. Diese stoppt den Zugriff aufs Internet von einem mir nicht bekannten Programm fast im Minutentakt.

Anbei auch dieses Logfile:

12:28:57 dom MESSAGE Protection started successfully
12:29:04 dom MESSAGE IP Protection started successfully
12:29:18 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 57856, Process: svchost.exe)
12:30:40 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 57932, Process: svchost.exe)
12:33:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58185, Process: svchost.exe)
12:36:43 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58212, Process: svchost.exe)
12:39:40 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58218, Process: svchost.exe)
12:41:17 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 58221, Process: svchost.exe)
12:42:46 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58248, Process: svchost.exe)
12:45:44 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58420, Process: svchost.exe)
12:48:50 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58472, Process: svchost.exe)
12:51:48 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58477, Process: svchost.exe)
12:54:46 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58479, Process: svchost.exe)
12:57:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58481, Process: svchost.exe)
12:58:10 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 58483, Process: svchost.exe)
12:58:10 dom IP-BLOCK 208.73.210.48 (Type: outgoing, Port: 58485, Process: svchost.exe)
12:58:10 dom IP-BLOCK 208.73.210.48 (Type: outgoing, Port: 58486, Process: svchost.exe)
12:58:34 dom MESSAGE Added 208.73.210.48 to ignore list
12:58:39 dom MESSAGE IP Protection stopped
12:58:41 dom MESSAGE IP Protection started successfully
13:00:50 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58545, Process: svchost.exe)
13:01:46 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 58570, Process: svchost.exe)
13:01:46 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 58571, Process: svchost.exe)
13:02:28 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 58618, Process: svchost.exe)
13:02:28 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 58619, Process: svchost.exe)
13:03:00 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 58639, Process: svchost.exe)
13:03:00 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 58640, Process: svchost.exe)
13:03:57 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 58793, Process: svchost.exe)
13:06:56 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59010, Process: svchost.exe)
13:09:53 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59050, Process: svchost.exe)
13:11:31 dom IP-BLOCK 64.111.196.117 (Type: outgoing, Port: 59083, Process: svchost.exe)
13:13:01 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59103, Process: svchost.exe)
13:15:59 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59163, Process: svchost.exe)
13:19:05 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59253, Process: svchost.exe)
13:22:03 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59262, Process: svchost.exe)
13:25:01 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59265, Process: svchost.exe)
13:26:21 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59266, Process: svchost.exe)
13:26:29 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59268, Process: svchost.exe)
13:28:07 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59298, Process: svchost.exe)
13:30:08 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 59320, Process: svchost.exe)
13:30:08 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 59321, Process: svchost.exe)
13:30:57 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 59338, Process: svchost.exe)
13:30:57 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 59339, Process: svchost.exe)
13:31:05 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59342, Process: svchost.exe)
13:31:29 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 59353, Process: svchost.exe)
13:31:29 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 59354, Process: svchost.exe)
13:34:03 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59395, Process: svchost.exe)
13:37:10 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59401, Process: svchost.exe)
13:38:23 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59402, Process: svchost.exe)
13:38:31 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59404, Process: svchost.exe)
13:40:09 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59599, Process: svchost.exe)
14:55:21 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59713, Process: svchost.exe)
14:58:19 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59717, Process: svchost.exe)
14:58:52 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 59718, Process: svchost.exe)
15:00:12 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59728, Process: svchost.exe)
15:01:25 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59734, Process: svchost.exe)
15:04:23 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59736, Process: svchost.exe)
15:08:09 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59740, Process: svchost.exe)
15:09:14 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 59745, Process: svchost.exe)
15:10:27 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59747, Process: svchost.exe)
15:13:24 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59749, Process: svchost.exe)
15:16:00 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59767, Process: svchost.exe)
15:16:33 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59773, Process: svchost.exe)
15:19:14 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 59796, Process: svchost.exe)
15:19:30 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59798, Process: svchost.exe)
15:22:36 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59803, Process: svchost.exe)
15:23:16 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59805, Process: svchost.exe)
15:25:33 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59811, Process: svchost.exe)
15:28:31 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59813, Process: svchost.exe)
15:31:20 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59815, Process: svchost.exe)
15:31:36 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59818, Process: svchost.exe)
15:34:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59826, Process: svchost.exe)
15:37:39 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59828, Process: svchost.exe)
15:39:40 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 59830, Process: svchost.exe)
15:40:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 59835, Process: svchost.exe)
15:40:45 dom IP-BLOCK 91.213.29.63 (Type: outgoing, Port: 59838, Process: svchost.exe)
15:46:36 dom MESSAGE Protection started successfully
15:46:42 dom MESSAGE IP Protection started successfully
15:47:05 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49165, Process: svchost.exe)
15:47:23 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 49166, Process: svchost.exe)
15:50:05 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49169, Process: svchost.exe)
15:53:12 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49171, Process: svchost.exe)
15:53:24 dom MESSAGE IP Protection stopped
16:34:07 dom MESSAGE IP Protection started successfully
16:34:14 dom MESSAGE IP Protection stopped
16:34:16 dom MESSAGE IP Protection started successfully
16:35:12 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49173, Process: svchost.exe)
16:38:17 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49182, Process: svchost.exe)
16:39:22 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 49185, Process: svchost.exe)
16:41:15 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49205, Process: svchost.exe)
16:44:21 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49207, Process: svchost.exe)
16:47:12 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 49210, Process: svchost.exe)
16:47:20 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49213, Process: svchost.exe)
16:47:36 dom IP-BLOCK 91.213.29.63 (Type: outgoing, Port: 49215, Process: svchost.exe)
16:47:52 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 49216, Process: svchost.exe)
16:48:00 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 49222, Process: svchost.exe)
16:48:32 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49269, Process: svchost.exe)
16:48:32 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49270, Process: svchost.exe)
16:49:21 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49316, Process: svchost.exe)
16:49:21 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49317, Process: svchost.exe)
16:49:21 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 49318, Process: svchost.exe)
16:49:45 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 49350, Process: svchost.exe)
16:49:45 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49352, Process: svchost.exe)
16:49:45 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49353, Process: svchost.exe)
16:50:17 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49390, Process: svchost.exe)
16:51:14 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49490, Process: svchost.exe)
16:51:14 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49491, Process: svchost.exe)
16:51:30 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49496, Process: svchost.exe)
16:51:30 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49497, Process: svchost.exe)
16:51:55 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49528, Process: svchost.exe)
16:51:55 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49529, Process: svchost.exe)
16:52:27 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49574, Process: svchost.exe)
16:52:27 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49575, Process: svchost.exe)
16:52:27 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49578, Process: svchost.exe)
16:52:27 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49579, Process: svchost.exe)
16:52:43 dom IP-BLOCK 208.91.207.91 (Type: outgoing, Port: 49590, Process: svchost.exe)
16:53:08 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49631, Process: svchost.exe)
16:53:08 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49635, Process: svchost.exe)
16:53:24 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49709, Process: svchost.exe)
16:53:40 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49721, Process: svchost.exe)
16:53:40 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49722, Process: svchost.exe)
16:56:23 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49825, Process: svchost.exe)
16:57:25 dom MESSAGE IP Protection stopped
17:03:25 dom MESSAGE Protection started successfully
17:03:29 dom MESSAGE IP Protection started successfully
17:04:24 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 49172, Process: svchost.exe)
17:06:01 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49179, Process: svchost.exe)
17:08:58 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49181, Process: svchost.exe)
17:10:12 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 49185, Process: svchost.exe)
17:11:50 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49352, Process: svchost.exe)
17:11:50 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49353, Process: svchost.exe)
17:12:06 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49391, Process: svchost.exe)
17:12:32 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 49431, Process: svchost.exe)
17:12:40 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49438, Process: svchost.exe)
17:12:40 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49439, Process: svchost.exe)
17:12:48 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49471, Process: svchost.exe)
17:12:48 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49472, Process: svchost.exe)
17:13:13 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49529, Process: svchost.exe)
17:13:13 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49530, Process: svchost.exe)
17:13:22 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49548, Process: svchost.exe)
17:13:22 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49549, Process: svchost.exe)
17:14:10 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 49806, Process: svchost.exe)
17:14:10 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49809, Process: svchost.exe)
17:14:10 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49810, Process: svchost.exe)
17:14:27 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49899, Process: svchost.exe)
17:14:27 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49900, Process: svchost.exe)
17:14:27 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49944, Process: svchost.exe)
17:14:27 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49948, Process: svchost.exe)
17:15:07 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50028, Process: svchost.exe)
17:18:04 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50172, Process: svchost.exe)
17:21:09 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50201, Process: svchost.exe)
17:23:18 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 50245, Process: svchost.exe)
17:24:07 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50275, Process: svchost.exe)
17:24:31 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 50395, Process: svchost.exe)
17:24:47 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50399, Process: svchost.exe)
17:24:47 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50400, Process: svchost.exe)
17:25:19 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50472, Process: svchost.exe)
17:25:19 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50473, Process: svchost.exe)
17:25:35 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50530, Process: svchost.exe)
17:25:35 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50531, Process: svchost.exe)
17:27:12 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50701, Process: svchost.exe)
17:28:56 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 50772, Process: svchost.exe)
17:28:56 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 50773, Process: svchost.exe)
17:29:29 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 50780, Process: svchost.exe)
17:29:29 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 50781, Process: svchost.exe)
17:29:53 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 50790, Process: svchost.exe)
17:29:53 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 50791, Process: svchost.exe)
17:30:09 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50796, Process: svchost.exe)
17:33:14 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50818, Process: svchost.exe)
17:36:11 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50860, Process: svchost.exe)
17:39:16 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50872, Process: svchost.exe)
17:41:20 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50945, Process: svchost.exe)
17:41:20 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50947, Process: svchost.exe)
17:41:20 dom IP-BLOCK 208.91.207.91 (Type: outgoing, Port: 50962, Process: svchost.exe)
17:41:20 dom IP-BLOCK 208.91.207.91 (Type: outgoing, Port: 50964, Process: svchost.exe)
17:42:17 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51004, Process: svchost.exe)
17:42:25 dom IP-BLOCK 67.29.139.153 (Type: outgoing, Port: 51012, Process: svchost.exe)
17:44:42 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51211, Process: svchost.exe)
17:44:42 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51212, Process: svchost.exe)
17:45:15 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51229, Process: svchost.exe)
17:45:23 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51255, Process: svchost.exe)
17:45:23 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51256, Process: svchost.exe)
17:45:55 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51264, Process: svchost.exe)
17:45:55 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51265, Process: svchost.exe)
17:48:20 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51268, Process: svchost.exe)
17:51:17 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51272, Process: svchost.exe)
17:54:22 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51277, Process: svchost.exe)
17:56:47 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51382, Process: svchost.exe)
17:56:47 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51383, Process: svchost.exe)
17:57:11 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51391, Process: svchost.exe)
17:57:11 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51392, Process: svchost.exe)
17:57:19 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51408, Process: svchost.exe)
17:57:45 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51448, Process: svchost.exe)
17:57:45 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51449, Process: svchost.exe)
18:00:18 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51654, Process: svchost.exe)
18:03:26 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51926, Process: svchost.exe)
18:06:23 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51934, Process: svchost.exe)
18:09:28 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51936, Process: svchost.exe)
18:12:25 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51939, Process: svchost.exe)
18:15:30 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51941, Process: svchost.exe)
18:17:23 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 51945, Process: svchost.exe)
18:17:31 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51947, Process: svchost.exe)
18:17:31 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51948, Process: svchost.exe)
18:18:03 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51965, Process: svchost.exe)
18:18:03 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51966, Process: svchost.exe)
18:18:19 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51996, Process: svchost.exe)
18:18:19 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 51997, Process: svchost.exe)
18:18:27 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52001, Process: svchost.exe)
18:28:02 dom MESSAGE Protection started successfully
18:28:09 dom MESSAGE IP Protection started successfully
18:30:25 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49179, Process: svchost.exe)
18:33:24 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49182, Process: svchost.exe)
18:36:21 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49239, Process: svchost.exe)
18:36:21 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49240, Process: svchost.exe)
18:36:29 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49243, Process: svchost.exe)
18:36:46 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49245, Process: svchost.exe)
18:36:46 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49246, Process: svchost.exe)
18:37:02 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49248, Process: svchost.exe)
18:37:02 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49249, Process: svchost.exe)
18:37:34 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49267, Process: svchost.exe)
18:37:34 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49268, Process: svchost.exe)
18:37:34 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49269, Process: svchost.exe)
18:37:34 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49270, Process: svchost.exe)
18:37:58 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49289, Process: svchost.exe)
18:37:58 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49290, Process: svchost.exe)
18:37:58 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49292, Process: svchost.exe)
18:37:58 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49293, Process: svchost.exe)
18:38:40 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49395, Process: svchost.exe)
18:38:40 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49394, Process: svchost.exe)
18:39:12 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49427, Process: svchost.exe)
18:39:12 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 49428, Process: svchost.exe)
18:39:28 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49446, Process: svchost.exe)
18:42:26 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49477, Process: svchost.exe)
18:47:32 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49482, Process: svchost.exe)
18:50:29 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49484, Process: svchost.exe)
18:53:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49486, Process: svchost.exe)
18:56:32 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49492, Process: svchost.exe)
18:59:31 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49722, Process: svchost.exe)
18:59:47 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49729, Process: svchost.exe)
18:59:47 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49730, Process: svchost.exe)
19:00:28 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49759, Process: svchost.exe)
19:00:28 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49760, Process: svchost.exe)
19:00:52 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49776, Process: svchost.exe)
19:00:52 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 49777, Process: svchost.exe)
19:02:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49847, Process: svchost.exe)
19:05:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 49874, Process: svchost.exe)
19:11:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50054, Process: svchost.exe)
19:14:18 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50090, Process: svchost.exe)
19:14:18 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50091, Process: svchost.exe)
19:14:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50093, Process: svchost.exe)
19:14:59 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50120, Process: svchost.exe)
19:14:59 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50121, Process: svchost.exe)
19:15:31 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50146, Process: svchost.exe)
19:15:31 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 50147, Process: svchost.exe)
19:17:49 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50257, Process: svchost.exe)
19:20:55 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50426, Process: svchost.exe)
19:23:52 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50506, Process: svchost.exe)
19:24:44 dom MESSAGE Scheduled update executed successfully
19:24:47 dom MESSAGE IP Protection stopped
19:25:10 dom MESSAGE Database updated successfully
19:25:15 dom MESSAGE IP Protection started successfully
19:26:56 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50558, Process: svchost.exe)
19:29:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50813, Process: svchost.exe)
19:33:41 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50917, Process: svchost.exe)
19:36:39 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50920, Process: svchost.exe)
19:39:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50922, Process: svchost.exe)
19:42:42 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50925, Process: svchost.exe)
19:45:39 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 50968, Process: svchost.exe)
19:48:44 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51208, Process: svchost.exe)
19:51:41 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51373, Process: svchost.exe)
19:54:23 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51380, Process: svchost.exe)
19:57:20 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51382, Process: svchost.exe)
20:00:25 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51384, Process: svchost.exe)
20:03:22 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51386, Process: svchost.exe)
20:04:35 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 51390, Process: svchost.exe)
20:06:27 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51441, Process: svchost.exe)
20:09:28 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51776, Process: svchost.exe)
20:12:26 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51941, Process: svchost.exe)
20:15:31 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 51974, Process: svchost.exe)
20:17:40 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 51997, Process: svchost.exe)
20:18:28 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52027, Process: svchost.exe)
20:19:09 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 52039, Process: svchost.exe)
20:19:09 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 52040, Process: svchost.exe)
20:19:49 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 52056, Process: svchost.exe)
20:19:49 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 52057, Process: svchost.exe)
20:20:13 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 52083, Process: svchost.exe)
20:20:13 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 52084, Process: svchost.exe)
20:21:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52145, Process: svchost.exe)
20:24:31 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52299, Process: svchost.exe)
20:27:36 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52327, Process: svchost.exe)
20:30:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52439, Process: svchost.exe)
20:33:39 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52655, Process: svchost.exe)
20:36:36 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52732, Process: svchost.exe)
20:39:42 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52761, Process: svchost.exe)
20:42:39 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52811, Process: svchost.exe)
20:45:44 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 52927, Process: svchost.exe)
20:48:42 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53032, Process: svchost.exe)
20:51:49 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53119, Process: svchost.exe)
20:54:46 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53132, Process: svchost.exe)
20:57:52 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53136, Process: svchost.exe)
21:00:49 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53203, Process: svchost.exe)
21:03:46 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 53308, Process: svchost.exe)
21:03:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53321, Process: svchost.exe)
21:06:51 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53477, Process: svchost.exe)
21:09:57 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53483, Process: svchost.exe)
21:12:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53495, Process: svchost.exe)
21:14:07 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 53497, Process: svchost.exe)
21:15:52 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 53501, Process: svchost.exe)
21:15:52 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 53503, Process: svchost.exe)
21:15:52 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 53504, Process: svchost.exe)
21:15:52 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53506, Process: svchost.exe)
21:16:32 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 53513, Process: svchost.exe)
21:16:32 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 53514, Process: svchost.exe)
21:17:04 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 53532, Process: svchost.exe)
21:17:04 dom IP-BLOCK 208.87.32.75 (Type: outgoing, Port: 53533, Process: svchost.exe)
21:18:57 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53584, Process: svchost.exe)
21:21:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53702, Process: svchost.exe)
21:24:28 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 53759, Process: svchost.exe)
21:25:00 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53787, Process: svchost.exe)
21:27:57 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53803, Process: svchost.exe)
21:31:03 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53864, Process: svchost.exe)
21:34:00 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 53991, Process: svchost.exe)
21:34:24 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 53994, Process: svchost.exe)
21:37:06 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54100, Process: svchost.exe)
21:40:03 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54112, Process: svchost.exe)
21:40:03 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 54113, Process: svchost.exe)
21:43:01 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54166, Process: svchost.exe)
21:44:29 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 54231, Process: svchost.exe)
21:46:06 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54253, Process: svchost.exe)
21:49:04 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54299, Process: svchost.exe)
21:52:09 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54305, Process: svchost.exe)
21:53:06 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 54309, Process: svchost.exe)
21:55:07 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54382, Process: svchost.exe)
21:57:24 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 54451, Process: svchost.exe)
21:57:24 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 54452, Process: svchost.exe)
21:58:12 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 54487, Process: svchost.exe)
21:58:12 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 54488, Process: svchost.exe)
21:58:12 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54490, Process: svchost.exe)
21:58:37 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 54497, Process: svchost.exe)
21:58:37 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 54498, Process: svchost.exe)
22:01:10 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54523, Process: svchost.exe)
22:04:15 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54557, Process: svchost.exe)
22:04:32 dom IP-BLOCK 91.213.29.63 (Type: outgoing, Port: 54558, Process: svchost.exe)
22:07:13 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54632, Process: svchost.exe)
22:10:18 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54751, Process: svchost.exe)
22:13:16 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54798, Process: svchost.exe)
22:14:28 dom IP-BLOCK 188.95.52.161 (Type: outgoing, Port: 54807, Process: svchost.exe)
22:14:28 dom IP-BLOCK 91.213.29.63 (Type: outgoing, Port: 54808, Process: svchost.exe)
22:16:21 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54816, Process: svchost.exe)
22:19:18 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54871, Process: svchost.exe)
22:22:08 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 54875, Process: svchost.exe)
22:22:16 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54895, Process: svchost.exe)
22:24:33 dom IP-BLOCK 188.95.52.162 (Type: outgoing, Port: 54942, Process: svchost.exe)
22:25:23 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 54970, Process: svchost.exe)
22:28:25 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55082, Process: svchost.exe)
22:31:30 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55113, Process: svchost.exe)
22:34:27 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55116, Process: svchost.exe)
22:34:27 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 55117, Process: svchost.exe)
22:34:27 dom IP-BLOCK 188.229.90.136 (Type: outgoing, Port: 55118, Process: svchost.exe)
22:37:33 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55183, Process: svchost.exe)
22:40:31 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55364, Process: svchost.exe)
22:43:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55386, Process: svchost.exe)
22:44:33 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 55389, Process: svchost.exe)
22:44:33 dom IP-BLOCK 188.229.90.137 (Type: outgoing, Port: 55390, Process: svchost.exe)
22:46:34 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55451, Process: svchost.exe)
22:49:39 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55454, Process: svchost.exe)
22:50:20 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 55456, Process: svchost.exe)
22:52:37 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55517, Process: svchost.exe)
22:55:42 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55609, Process: svchost.exe)
22:58:40 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55691, Process: svchost.exe)
23:01:45 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55742, Process: svchost.exe)
23:03:54 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 55752, Process: svchost.exe)
23:04:42 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55754, Process: svchost.exe)
23:07:31 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 55757, Process: svchost.exe)
23:07:48 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55766, Process: svchost.exe)
23:10:46 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 55918, Process: svchost.exe)
23:13:43 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56025, Process: svchost.exe)
23:14:16 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 56033, Process: svchost.exe)
23:16:49 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56055, Process: svchost.exe)
23:19:46 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56063, Process: svchost.exe)
23:20:58 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 56067, Process: svchost.exe)
23:22:43 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56111, Process: svchost.exe)
23:22:43 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56112, Process: svchost.exe)
23:22:51 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56114, Process: svchost.exe)
23:23:23 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56123, Process: svchost.exe)
23:23:23 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56124, Process: svchost.exe)
23:23:55 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56173, Process: svchost.exe)
23:23:55 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56174, Process: svchost.exe)
23:24:36 dom IP-BLOCK 89.208.149.204 (Type: outgoing, Port: 56212, Process: svchost.exe)
23:25:00 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56286, Process: svchost.exe)
23:25:00 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56287, Process: svchost.exe)
23:25:49 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56310, Process: svchost.exe)
23:25:57 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56312, Process: svchost.exe)
23:25:57 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56313, Process: svchost.exe)
23:26:21 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56327, Process: svchost.exe)
23:26:21 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56328, Process: svchost.exe)
23:28:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56466, Process: svchost.exe)
23:31:51 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56492, Process: svchost.exe)
23:34:32 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 56526, Process: svchost.exe)
23:34:57 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56528, Process: svchost.exe)
23:37:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56594, Process: svchost.exe)
23:40:59 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56632, Process: svchost.exe)
23:43:56 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56685, Process: svchost.exe)
23:44:37 dom IP-BLOCK 193.218.156.42 (Type: outgoing, Port: 56686, Process: svchost.exe)
23:45:49 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56690, Process: svchost.exe)
23:45:49 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56691, Process: svchost.exe)
23:46:38 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56712, Process: svchost.exe)
23:46:38 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56713, Process: svchost.exe)
23:46:54 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56715, Process: svchost.exe)
23:47:10 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56722, Process: svchost.exe)
23:47:10 dom IP-BLOCK 208.73.210.29 (Type: outgoing, Port: 56723, Process: svchost.exe)
23:50:00 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56829, Process: svchost.exe)
23:52:58 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56866, Process: svchost.exe)
23:56:03 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56890, Process: svchost.exe)
23:58:20 dom IP-BLOCK 83.133.119.176 (Type: outgoing, Port: 56901, Process: svchost.exe)
23:59:00 dom IP-BLOCK 91.193.194.175 (Type: outgoing, Port: 56922, Process: svchost.exe)

Alt 05.07.2011, 09:56   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL - Standard

Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL



Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.




Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL
32-bit, antivir, autorun, bho, bluescreen, boo/tdss, bootsektorvirus, c:\windows\system32\rundll32.exe, equal, erste mal, firefox, geld, google, install.exe, launch, mozilla thunderbird, ntdll.dll, popup, problem, registry, rundll, safer networking, shell32.dll, software, spyware.passwords.xgen, start menu, svchost.exe, torrent.exe, trojan.spyeyes, usb, vista, ändern



Ähnliche Themen: Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL


  1. Blauer Bildschirm, wenn ich im Internet bin, mit Fehlercode DRIVER-IRQL-NOT-LESS-OR-EQUAL
    Plagegeister aller Art und deren Bekämpfung - 09.02.2015 (5)
  2. Windows 8.1 Fehlermeldung IRQL not less or equal
    Log-Analyse und Auswertung - 03.02.2015 (23)
  3. Bluescreen "IRQL not less or equal" auf zwei PCs (Win Vista, 8.1)
    Alles rund um Windows - 10.08.2014 (4)
  4. Bootsektorvirus BOO/TDss.o
    Plagegeister aller Art und deren Bekämpfung - 17.11.2013 (9)
  5. b00/tdss.0 Bootsektorvirus in MBR und in den Bootsektoren der USB-Sticks entdeckt
    Plagegeister aller Art und deren Bekämpfung - 11.11.2012 (5)
  6. Bootsektorvirus BOO/TDss.M zeigt Antivir
    Log-Analyse und Auswertung - 14.12.2011 (3)
  7. Bootsektorvirus BOO/TDss.M
    Log-Analyse und Auswertung - 06.12.2011 (7)
  8. Bootsektorvirus BOO/TDss.D mehrmals im System
    Log-Analyse und Auswertung - 10.10.2011 (11)
  9. Komplette Festplatte nach Fund von Bootsektorvirus BOO/TDss.C verschwunden
    Log-Analyse und Auswertung - 30.09.2011 (30)
  10. wie entferne ich den bootsektorvirus BOO/TDss.M
    Log-Analyse und Auswertung - 11.09.2011 (1)
  11. Bootsektorvirus BOO/TDss.D 3 mal im system
    Log-Analyse und Auswertung - 06.09.2011 (12)
  12. Bootsektorvirus BOO/TDss.M
    Plagegeister aller Art und deren Bekämpfung - 15.08.2011 (13)
  13. Bootsektorvirus BOO/TDss.M in beiden Laufwerken und TR/Trash.Gen nach Wiederherst. von Netbook
    Plagegeister aller Art und deren Bekämpfung - 23.06.2011 (28)
  14. Irql Not less or equal
    Alles rund um Windows - 23.10.2009 (13)
  15. Meldung: IRQL Not less or equal
    Netzwerk und Hardware - 22.10.2009 (3)
  16. Driver Irql Not less or equal
    Plagegeister aller Art und deren Bekämpfung - 09.04.2009 (15)
  17. "IRQL not less or equal" nach Speichererweiterung
    Netzwerk und Hardware - 03.01.2007 (1)

Zum Thema Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL - Hallo, Danke ersteinmal dem- oder denjenigen die sich meinem Problem annehmen. mein Notebook bekommt derzeit mehrfach täglich einen Bluescreen, meist mit der ersten Zeile "IRQL NOT OR LESS EQUAL". Bei - Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL...
Archiv
Du betrachtest: Bootsektorvirus BOO/TDss / Bluescreen IRQL NOT OR LESS EQUAL auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.