| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dllWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.10.2011, 12:20
| #1 |
 |  Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Hallöchen, ich habe als Titel oben genannte Datei genommen weil ich vermute damit Ärger zu haben  In chronologischer Form tauchten bei mir folgende Probleme auf [wobei ich natürlich nicht weiß ob und wo da ein Zusammenhang bestehen könnte]: Insgesamt wurde der Rechner seit einigen Wochen langsamer, ich habe öfter Netzwerkprobleme die nur mit dem Notebook auftauchen [bspw. komme ich damit nicht ins WLAN aber mit dem Handy schon] Aber mehr aus Routine als mit einem konkreten Grund habe ich vor zwei Wochen den Avira-Systemcheck gestartet. Insgesamt habe ich das drei mal versucht, immer stürzte es ab mit einer Speicherverweis-Fehlermeldung. beim zweiten Mal hat es mir einen Virus angezeigt aber ich konnte nur noch sehen dass dieser sich im Papierkorb befinden soll - bevor es erneut abstürzte. Ich habe den Papierkorb geleert, alle temporären Dateien löschen wollen was bei denen hier nicht funktionierte: C:\Users\***\AppData\Local\Temp\3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll C:\Users\***\AppData\Local\Temp\WPDNSE [das ist ein Ordner] C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt Die Google-Suche führte mich auf dieses Forum und ein weiteres Ergebnis auf www.freefixer.com [www.freefixer.com/library/file/71994/] liesen mich vermuten dass ich da Dateien habe die ich nicht haben will. Im abgesicherten Modus ließen sich die ersten beiden löschen, tauchen aber nach dem normalen Start wieder auf  Avira hab ich zwischenzeitlich mal neu gemacht, das findet aber nichts. Malwarebytes hat zwei Funde vermeldet und entfernt aber das war wohl was anderes... Ich weiß jetzt nicht was ich weiter machen soll - oder ob es überhaupt nötig ist etwas zu tun. Hier dann meine logs, ich hoffe ihr könnt mir helfen =) defogger habe ich ausgeführt, das hat mich aber nicht zum Neustart aufgefordert sondern ist einfach mit dem kleinen Fenster stehen geblieben defogger_disable by jpshortstuff (23.02.10.1) Log created at 12:08 on 10/10/2011 (***) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL Logfile: Code:
ATTFilter OTL logfile created on: 10.10.2011 12:27:46 - Run 2 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\***\Downloads 64bit- An unknown product Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 2,68 Gb Available Physical Memory | 67,51% Memory free 7,93 Gb Paging File | 6,39 Gb Available in Paging File | 80,60% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 78,02 Gb Total Space | 33,07 Gb Free Space | 42,38% Space Free | Partition Type: NTFS Drive D: | 219,97 Gb Total Space | 147,52 Gb Free Space | 67,06% Space Free | Partition Type: NTFS Computer Name: LAURELINDORENAN | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.10.10 12:02:07 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe PRC - [2011.10.05 10:18:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.05 10:17:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.10.05 10:17:50 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.08.01 05:32:20 | 000,020,880 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe PRC - [2011.08.01 05:32:10 | 003,507,088 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2009.12.18 00:32:30 | 000,497,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe PRC - [2007.05.16 03:04:42 | 001,249,280 | ---- | M] (by Joel Riley) -- C:\Program Files (x86)\hott notes 4\hottnotes.exe ========== Modules (No Company Name) ========== MOD - [2011.10.10 09:37:50 | 000,115,137 | ---- | M] () -- C:\Users\***\AppData\Local\Temp\3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll MOD - [2011.08.13 17:09:28 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\ebdaeeb5ef1a6209d67a2f70fcaf5cd5\System.Core.ni.dll MOD - [2011.08.13 17:09:13 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6e9a08576157b4aeb91a3aaa452fcb00\System.Management.ni.dll MOD - [2011.08.12 17:30:21 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7f94f6b13f92f1e093716d3e15bf86d1\PresentationFramework.Aero.ni.dll MOD - [2011.08.12 17:30:00 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e3e3b399b69c569ab1ed3b0ace2c8c20\System.Runtime.Remoting.ni.dll MOD - [2011.08.12 17:29:43 | 014,339,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\c60906a715473ceccf93f0559527e84d\PresentationFramework.ni.dll MOD - [2011.08.12 17:29:18 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0d43c5e77ee7b8466700b16d7e7d4bb7\System.Windows.Forms.ni.dll MOD - [2011.08.12 17:29:09 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\9e87dd8fe5d0f925d80a6a6eaf74fdb9\System.Drawing.ni.dll MOD - [2011.08.12 17:29:06 | 012,234,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\5566b57732d9edea236f54d06149835a\PresentationCore.ni.dll MOD - [2011.08.12 17:28:53 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6124dbbfd45927c4a6226d6e6bca6253\WindowsBase.ni.dll MOD - [2011.08.12 17:28:46 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\16d2854bf69d59d94e64a918365705f1\System.Xml.ni.dll MOD - [2011.08.12 17:28:36 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\3da7c6c1a0f26ae91883fd8b03ec192d\System.ni.dll MOD - [2011.08.01 05:32:20 | 000,020,880 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe MOD - [2011.07.26 10:27:06 | 000,617,384 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\CommonModule.dll MOD - [2011.07.26 10:27:06 | 000,424,872 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\FirmwareUpdateAgent.Common.dll MOD - [2011.07.26 10:27:06 | 000,007,168 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\IPCServer.dll MOD - [2011.07.26 10:27:06 | 000,003,584 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\ISharedIPCInterface.dll MOD - [2011.06.28 20:20:28 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\16b68fcaff063835ae0ee348a1201f2a\mscorlib.ni.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.01.21 04:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\stacsv64.exe -- (STacSV) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2009.06.25 18:48:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.03.03 02:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters) SRV - [2011.10.05 10:18:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.05 10:17:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2009.12.18 00:32:30 | 000,497,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.09.18 08:39:27 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.09.15 23:55:03 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.09.15 23:55:03 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm) DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2010.01.21 04:10:00 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA) DRV:64bit: - [2010.01.13 18:37:16 | 007,675,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R) DRV:64bit: - [2009.12.18 00:18:51 | 000,024,248 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva) DRV:64bit: - [2009.08.24 11:20:22 | 000,285,744 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.25 19:24:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R) DRV:64bit: - [2009.06.10 22:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.05 05:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F9 8D 0D 0D 6B 7B CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google.de" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.09.12 15:31:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.26 16:02:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.08.19 23:55:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 1.1.17\Extensions\\Components: C:\Program Files (x86)\mozilla.org\SeaMonkey\Components [2010.05.29 21:27:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 1.1.17\Extensions\\Plugins: C:\Program Files (x86)\mozilla.org\SeaMonkey\Plugins [2011.09.26 16:02:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.4.1\extensions\\Components: C:\Program Files (x86)\SeaMonkey\components [2011.10.01 17:54:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.4.1\extensions\\Plugins: C:\Program Files (x86)\SeaMonkey\plugins FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey 1.1.17\Extensions\\Components: C:\Program Files (x86)\mozilla.org\SeaMonkey\Components [2010.05.29 21:27:36 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey 1.1.17\Extensions\\Plugins: C:\Program Files (x86)\mozilla.org\SeaMonkey\Plugins [2011.09.26 16:02:54 | 000,000,000 | ---D | M] [2010.08.12 12:53:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions [2010.08.12 12:53:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.10.04 20:58:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\iil4pl46.default\extensions [2011.09.03 15:12:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\SeaMonkey\Profiles\md76uvnb.default\extensions [2011.09.28 10:58:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\SeaMonkey\Profiles\vr08bhas.mails\extensions [2011.05.24 16:34:42 | 000,002,101 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\iil4pl46.default\searchplugins\googlede.xml [2009.11.18 18:16:52 | 000,004,153 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\iil4pl46.default\searchplugins\youtube.xml [2011.06.26 12:07:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2010.06.06 20:04:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.12.01 17:33:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.12.18 12:08:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.15 14:56:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.06.26 12:07:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} () (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IIL4PL46.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IIL4PL46.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI [2011.09.12 15:31:07 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files (x86)\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files (x86)\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files (x86)\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.) O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O4 - HKCU..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hott notes 4.lnk = C:\Program Files (x86)\hott notes 4\hottnotes.exe (by Joel Riley) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} hxxp://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab (IGDTester Class) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7B40B834-234A-4F4F-BCBD-C2C9B53C88E6}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A2201BBD-B27A-4566-A092-531104827C41}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.10.10 11:43:07 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes [2011.10.10 11:42:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.10.10 11:42:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.10.10 11:42:55 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.10.10 11:42:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.10.09 21:45:26 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira [2011.10.09 21:45:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.10.09 21:45:01 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.10.09 21:45:01 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.10.09 21:45:01 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2011.10.09 21:45:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.10.09 21:45:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2011.09.28 11:37:07 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Canneverbe Limited [2011.09.28 11:37:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2011.09.28 11:36:59 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP [2011.09.25 13:44:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\FRITZ! [2011.09.25 13:44:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\FRITZ! [2011.09.25 13:41:19 | 000,047,616 | ---- | C] (TODO: <Company name>) -- C:\Windows\SysNative\AvmColorFax.dll [2011.09.25 13:41:19 | 000,043,520 | ---- | C] (TODO: <Company name>) -- C:\Windows\SysNative\AvmFax.dll [2011.09.25 13:41:19 | 000,027,136 | ---- | C] (AVM Berlin GmbH) -- C:\Windows\SysNative\FriDru64.dll [2011.09.25 13:41:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ! [2011.09.25 13:39:48 | 000,000,000 | ---D | C] -- C:\ProgramData\ISDNWatch [2011.09.25 13:39:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\FRITZ!fax für FRITZ!Box [2011.09.25 13:39:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ! [2011.09.12 10:29:46 | 000,000,000 | ---D | C] -- C:\Temp [2011.09.12 10:18:00 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\System32 [2011.09.12 10:02:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Samsung [2011.09.12 10:02:47 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\samsung [2011.09.12 10:02:04 | 000,161,280 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscemdm.sys [2011.09.12 10:02:04 | 000,018,944 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscemdfl.sys [2011.09.12 10:02:04 | 000,015,872 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscewhnt.sys [2011.09.12 10:02:04 | 000,015,872 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscewh.sys [2011.09.12 10:02:04 | 000,015,360 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscecmnt.sys [2011.09.12 10:02:04 | 000,015,360 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscecm.sys [2011.09.12 10:02:03 | 000,127,488 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscebus.sys [2011.09.12 10:01:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung [2011.09.12 10:01:16 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll [2011.09.12 10:01:11 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll [2011.09.12 10:01:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MarkAny [2011.09.12 10:00:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Samsung [2011.09.12 10:00:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung [2011.09.12 10:00:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung [2011.09.12 09:57:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Downloaded Installations [2004.07.22 16:33:22 | 000,545,792 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\sbox.dll [2004.07.16 21:59:22 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\stv.dll [2004.07.16 21:59:18 | 000,109,568 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\gtv.dll [2004.07.16 21:59:18 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\cpitv.dll [2004.06.12 11:41:08 | 001,014,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\PodMain.dll [2004.06.12 11:41:08 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\PodData.dll [2004.06.12 11:41:08 | 000,727,552 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piutil.dll [2004.06.12 11:41:08 | 000,295,424 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piview.dll [2004.06.12 11:41:08 | 000,111,104 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piwa.dll [2004.06.12 11:41:06 | 002,758,656 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pitask.dll [2004.06.12 11:41:06 | 002,596,864 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\picore.dll [2004.06.12 11:41:06 | 000,625,152 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piedit.dll [2004.06.12 11:41:06 | 000,562,688 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pical.dll [2004.06.12 11:41:06 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piproj.dll [2004.06.12 11:41:06 | 000,146,944 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piphp.dll [2004.06.12 11:41:06 | 000,119,296 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pisctv.dll [2004.06.12 11:41:06 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pimix.dll [2004.06.12 11:41:06 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pibase.dll [2004.06.12 11:41:02 | 000,284,672 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\ImprtWiz.exe [2004.06.12 11:40:16 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pi.exe [2004.06.12 11:39:42 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\pip.exe [2004.06.12 11:35:16 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\Pod.exe [2004.06.10 11:01:54 | 001,645,320 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\gdiplus.dll [2004.05.19 16:34:50 | 000,008,704 | ---- | C] (Microsoft® Corporation) -- C:\Program Files (x86)\workssvc.dll [2004.05.19 16:28:04 | 000,344,064 | R--- | C] (Microsoft Corporation) -- C:\Program Files (x86)\msvcr70.dll [2004.05.19 16:27:30 | 000,487,424 | R--- | C] (Microsoft Corporation) -- C:\Program Files (x86)\msvcp70.dll [2004.05.19 16:25:20 | 001,060,864 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\MFC71.dll [2004.05.19 12:31:04 | 000,299,008 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\cutout.dll [2004.05.19 11:03:46 | 004,112,451 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\piservr5.dll [2004.05.19 11:02:32 | 000,186,952 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\dw15.exe [2004.05.19 11:00:24 | 000,868,352 | ---- | C] (Microsoft® Corporation) -- C:\Program Files (x86)\MiniQD6.dll [2004.05.19 11:00:10 | 000,127,033 | ---- | C] (Microsoft® Corporation) -- C:\Program Files (x86)\cpiqrtf5.dll [2004.05.19 09:59:40 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\msvcr71.dll [2004.05.19 09:59:34 | 000,401,462 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\msvcp60.dll [2004.05.19 09:58:36 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\SQLSE20.dll [2004.05.19 09:57:26 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\SQLDB20.dll [1 C:\Users\***\AppData\Local\*.tmp files -> C:\Users\***\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.10.10 12:07:08 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable [2011.10.10 12:05:59 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.10.10 12:05:59 | 000,643,866 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.10.10 12:05:59 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.10.10 12:05:59 | 000,126,394 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.10.10 12:05:59 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.10.10 11:57:28 | 000,016,384 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.10.10 11:57:28 | 000,016,384 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.10.10 11:51:09 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.10.10 11:50:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.10.10 11:49:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.10.10 11:49:48 | 3193,585,664 | -HS- | M] () -- C:\hiberfil.sys [2011.10.10 11:42:59 | 000,001,118 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.10.10 11:21:19 | 000,865,742 | ---- | M] () -- C:\Users\***\AppData\Local\census.cache [2011.10.10 11:20:23 | 000,104,109 | ---- | M] () -- C:\Users\***\AppData\Local\ars.cache [2011.10.10 11:00:37 | 000,000,036 | ---- | M] () -- C:\Users\***\AppData\Local\housecall.guid.cache [2011.10.09 22:55:21 | 000,002,101 | ---- | M] () -- C:\Users\***\Desktop\Avira Free Antivirus Profil Suche nach Rootkits und aktiver Malware.LNK [2011.10.09 21:45:11 | 000,002,075 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2011.10.09 21:23:30 | 000,430,744 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.10.06 11:02:38 | 001,667,588 | ---- | M] () -- C:\Users\***\Desktop\Cantuccini.jpg [2011.09.28 16:20:52 | 000,002,018 | -H-- | M] () -- C:\Users\***\Documents\Default.rdp [2011.09.25 13:41:18 | 000,001,000 | ---- | M] () -- C:\Users\Public\Desktop\FRITZ!fax.lnk [2011.09.18 08:39:27 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.09.15 23:55:03 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.09.15 23:55:03 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2011.09.12 10:03:41 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_wpdcomp_01_09_00.Wdf [2011.09.12 10:03:30 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [1 C:\Users\***\AppData\Local\*.tmp files -> C:\Users\***\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.10.10 12:07:08 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable [2011.10.10 11:42:59 | 000,001,118 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.10.10 11:21:19 | 000,865,742 | ---- | C] () -- C:\Users\***\AppData\Local\census.cache [2011.10.10 11:20:23 | 000,104,109 | ---- | C] () -- C:\Users\***\AppData\Local\ars.cache [2011.10.10 11:00:37 | 000,000,036 | ---- | C] () -- C:\Users\***\AppData\Local\housecall.guid.cache [2011.10.09 22:55:21 | 000,002,101 | ---- | C] () -- C:\Users\***\Desktop\Avira Free Antivirus Profil Suche nach Rootkits und aktiver Malware.LNK [2011.10.09 21:45:11 | 000,002,075 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2011.09.28 11:37:02 | 000,001,701 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk [2011.09.26 16:31:48 | 000,002,018 | -H-- | C] () -- C:\Users\***\Documents\Default.rdp [2011.09.25 13:41:19 | 000,020,480 | ---- | C] () -- C:\Windows\SysNative\FritzPort64.dll [2011.09.25 13:41:19 | 000,020,480 | ---- | C] () -- C:\Windows\SysNative\FritzColorPort64.dll [2011.09.25 13:41:18 | 000,001,000 | ---- | C] () -- C:\Users\Public\Desktop\FRITZ!fax.lnk [2011.09.12 10:03:41 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_wpdcomp_01_09_00.Wdf [2011.09.12 10:03:30 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2011.07.12 21:39:14 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Local\{14192335-FF7A-4F32-88D6-F72826DB3E3A} [2011.01.29 17:00:24 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.01.29 17:00:22 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.01.29 17:00:22 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.01.29 17:00:22 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.01.29 17:00:22 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2010.07.20 13:07:56 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2010.07.20 13:07:56 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2010.07.20 13:07:56 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2010.07.20 13:07:56 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2010.07.20 13:07:56 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2010.07.20 13:07:56 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2010.07.20 13:07:56 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2010.07.20 13:07:56 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2010.07.20 13:07:56 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2010.07.20 13:07:56 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2010.07.20 13:07:56 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2010.07.20 13:07:56 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2010.07.20 13:07:56 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2010.07.20 13:07:56 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2010.07.20 13:07:56 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2010.07.20 13:07:56 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2010.07.20 13:07:56 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2010.07.20 13:07:56 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2010.07.20 13:07:56 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2010.07.20 13:05:43 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX5000EFDG.ini [2010.07.11 11:00:09 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\ztvunrar36.dll [2010.07.11 11:00:09 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\ztvunace26.dll [2010.05.31 21:04:56 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.05.29 21:27:36 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat [2010.05.29 21:27:34 | 000,118,784 | ---- | C] () -- C:\Windows\SeaMonkeyUninstall.exe [2010.05.29 21:27:32 | 000,118,784 | ---- | C] () -- C:\Windows\GREUninstall.exe [2010.05.29 21:27:31 | 000,008,839 | ---- | C] () -- C:\Windows\mozver.dat [2010.05.29 12:10:03 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll [2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll [2004.07.20 16:27:47 | 002,527,232 | R--- | C] () -- C:\Program Files (x86)\PIP.GDB [2004.07.20 15:42:49 | 002,174,976 | ---- | C] () -- C:\Program Files (x86)\pi.sbc [2004.07.02 11:30:06 | 000,013,361 | ---- | C] () -- C:\Program Files (x86)\pipcust.dic [2004.06.18 13:59:32 | 000,084,382 | ---- | C] () -- C:\Program Files (x86)\2p.its [2004.06.18 13:59:32 | 000,042,414 | ---- | C] () -- C:\Program Files (x86)\2t.its [2004.06.12 11:39:18 | 000,544,647 | ---- | C] () -- C:\Program Files (x86)\piproj.its [2004.05.19 14:00:58 | 000,066,468 | ---- | C] () -- C:\Program Files (x86)\startupl.png [2004.05.19 11:36:18 | 000,458,752 | ---- | C] () -- C:\Program Files (x86)\blank.sbc [2004.05.19 11:07:44 | 000,094,208 | ---- | C] () -- C:\Program Files (x86)\firstpg.qtd [2004.05.19 11:07:44 | 000,011,264 | ---- | C] () -- C:\Program Files (x86)\secondpg.qtd [2004.05.19 11:02:44 | 000,593,920 | ---- | C] () -- C:\Program Files (x86)\Homepub.ibd [2004.05.19 10:49:32 | 000,010,350 | ---- | C] () -- C:\Program Files (x86)\poddlb.dat [2004.05.19 10:49:30 | 000,005,663 | ---- | C] () -- C:\Program Files (x86)\pihtss.dat [2004.05.19 10:49:30 | 000,000,318 | ---- | C] () -- C:\Program Files (x86)\dipunsb.001 [2004.05.19 10:00:56 | 000,000,404 | ---- | C] () -- C:\Program Files (x86)\cdlayout.dat [2004.05.19 10:00:38 | 000,275,793 | ---- | C] () -- C:\Program Files (x86)\FlyOuts.png ========== LOP Check ========== [2011.04.03 10:41:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon [2011.09.28 11:37:07 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited [2010.07.20 13:21:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EPSON [2011.09.25 13:55:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ! [2011.09.25 13:39:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ!fax für FRITZ!Box [2010.08.31 22:11:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0 [2010.06.10 13:20:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\hott notes 4 [2010.06.18 13:42:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\inkscape [2010.06.11 18:36:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PhotoScape [2011.09.12 10:00:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung [2011.09.03 17:31:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Stellarium [2010.08.12 12:52:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird [2010.05.29 21:26:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Trillian [2011.08.15 10:07:16 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.10.09 22:18:01 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2010.08.01 19:40:50 | 000,000,000 | ---D | M] -- C:\BlueByte [2010.05.30 12:38:32 | 000,000,000 | ---D | M] -- C:\dell [2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2010.05.29 12:15:12 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2010.05.30 12:47:03 | 000,000,000 | ---D | M] -- C:\Intel [2010.05.29 22:15:32 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011.03.13 19:26:39 | 000,000,000 | ---D | M] -- C:\No23Recorder [2011.07.09 19:53:16 | 000,000,000 | ---D | M] -- C:\output [2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.09.28 11:36:59 | 000,000,000 | R--D | M] -- C:\Program Files [2011.10.10 11:48:23 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.10.10 11:42:58 | 000,000,000 | -H-D | M] -- C:\ProgramData [2010.05.29 12:15:12 | 000,000,000 | -HSD | M] -- C:\Programme [2010.05.29 12:15:12 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.10.10 12:29:17 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.09.12 10:29:46 | 000,000,000 | ---D | M] -- C:\Temp [2010.05.29 12:15:22 | 000,000,000 | R--D | M] -- C:\Users [2011.10.09 23:01:29 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > [2004.05.19 11:02:32 | 000,186,952 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\dw15.exe [2004.06.12 11:41:02 | 000,284,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\ImprtWiz.exe [2004.06.12 11:40:16 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\pi.exe [2004.06.12 11:39:42 | 000,007,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\pip.exe [2004.06.12 11:35:16 | 000,035,328 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Pod.exe < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: EXPLORER.EXE > [2009.10.06 08:06:36 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SysWOW64\explorer.exe [2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2009.10.06 08:35:29 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe [2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\explorer.exe [2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2009.10.06 08:31:09 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe [2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe [2009.10.06 07:53:03 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > www.malwarebytes.org Datenbank Version: 7914 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 10.10.2011 11:48:23 mbam-log-2011-10-10 (11-48-23).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 177311 Laufzeit: 2 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES (X86)\MIXFIX.DLL (Spyware.OnlineGames) -> Value: MIXFIX.DLL -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\program files (x86)\mixfix.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. Vielen lieben Dank schon mal! Liebe Grüße Nel Geändert von Neld0reth (10.10.2011 um 12:29 Uhr) |
|
10.10.2011, 14:11
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
__________________ |
|
10.10.2011, 14:21
| #3 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll es gibt den Protection log
__________________11:44:09 *** MESSAGE Protection started successfully 11:44:16 *** MESSAGE IP Protection started successfully 11:51:20 *** MESSAGE Protection started successfully 11:51:25 *** MESSAGE IP Protection started successfully dann hab ich den log vom ersten scan Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 7914 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 10.10.2011 11:48:07 mbam-log-2011-10-10 (11-47-57).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 177311 Laufzeit: 2 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES (X86)\MIXFIX.DLL (Spyware.OnlineGames) -> Value: MIXFIX.DLL -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\program files (x86)\mixfix.dll (Spyware.OnlineGames) -> No action taken. und vom zweiten Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 7914 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 10.10.2011 11:48:23 mbam-log-2011-10-10 (11-48-23).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 177311 Laufzeit: 2 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES (X86)\MIXFIX.DLL (Spyware.OnlineGames) -> Value: MIXFIX.DLL -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\program files (x86)\mixfix.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. Mehr hab ich nicht... |
|
10.10.2011, 14:37
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
10.10.2011, 16:51
| #5 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll edit: Bevor Du Dir jetzt unnötig Arbeit machst - ich hab meine externe Platte vergessen. Ich benutze die eigentlich kaum, aber ich machs dann noch mal und poste das ESET log später nochmal... Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 7915 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 10.10.2011 16:20:50 mbam-log-2011-10-10 (16-20-50).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 372369 Laufzeit: 40 Minute(n), 27 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=cd1743ce83f3bb488bb7c73ecb850eef # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-10-10 03:45:00 # local_time=2011-10-10 05:45:00 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 67571 67571 0 0 # compatibility_mode=5893 16776574 100 94 19681498 69886921 0 0 # compatibility_mode=8192 67108863 100 0 305 305 0 0 # scanned=205529 # found=0 # cleaned=0 # scan_time=4429 |
|
10.10.2011, 17:32
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Kommen jetzt noch die Logs mit den ext. Platten oder waren die das? 
__________________ --> Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll |
|
10.10.2011, 18:27
| #7 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll sorry hat ein bisschen gedauert... dabei ist es doch gar nicht so viel?! ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=cd1743ce83f3bb488bb7c73ecb850eef # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-10-10 03:45:00 # local_time=2011-10-10 05:45:00 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 67571 67571 0 0 # compatibility_mode=5893 16776574 100 94 19681498 69886921 0 0 # compatibility_mode=8192 67108863 100 0 305 305 0 0 # scanned=205529 # found=0 # cleaned=0 # scan_time=4429 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=cd1743ce83f3bb488bb7c73ecb850eef # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-10-10 05:24:15 # local_time=2011-10-10 07:24:15 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 72784 72784 0 0 # compatibility_mode=5893 16776574 100 94 19686711 69892134 0 0 # compatibility_mode=8192 67108863 100 0 5518 5518 0 0 # scanned=205775 # found=1 # cleaned=0 # scan_time=5171 F:\Installationsdateien\MyPhoneExplorer_Setup_1.7.2.exe a variant of Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I |
|
10.10.2011, 18:36
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Malwarebytes hat die externe Platte aber noch nicht untersucht?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.10.2011, 18:42
| #9 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll ähm... sorry  ist in Arbeit  |
|
10.10.2011, 18:55
| #10 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Hier noch mal der scan der externen Platte. Die eine Datei (myphoneexplorer) hatte ich schon gelöscht. Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 7917 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 10.10.2011 19:53:38 mbam-log-2011-10-10 (19-53-38).txt Art des Suchlaufs: Vollständiger Suchlauf (F:\|) Durchsuchte Objekte: 214767 Laufzeit: 9 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
10.10.2011, 19:04
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.10.2011, 19:16
| #12 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll nix gefunden... ist doch eigentlich ein gutes Zeichen oder? 20:13:45.0087 4532 TDSS rootkit removing tool 2.6.7.0 Oct 10 2011 09:40:06 20:13:45.0274 4532 ============================================================ 20:13:45.0274 4532 Current date / time: 2011/10/10 20:13:45.0274 20:13:45.0274 4532 SystemInfo: 20:13:45.0274 4532 20:13:45.0274 4532 OS Version: 6.1.7601 ServicePack: 1.0 20:13:45.0274 4532 Product type: Workstation 20:13:45.0274 4532 ComputerName: LAURELINDORENAN 20:13:45.0274 4532 UserName: *** 20:13:45.0274 4532 Windows directory: C:\Windows 20:13:45.0274 4532 System windows directory: C:\Windows 20:13:45.0274 4532 Running under WOW64 20:13:45.0274 4532 Processor architecture: Intel x64 20:13:45.0274 4532 Number of processors: 2 20:13:45.0274 4532 Page size: 0x1000 20:13:45.0274 4532 Boot type: Normal boot 20:13:45.0274 4532 ============================================================ 20:13:46.0444 4532 Initialize success 20:13:53.0745 3492 ============================================================ 20:13:53.0745 3492 Scan started 20:13:53.0745 3492 Mode: Manual; SigCheck; TDLFS; 20:13:53.0745 3492 ============================================================ 20:13:54.0385 3492 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 20:13:54.0494 3492 1394ohci - ok 20:13:54.0556 3492 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 20:13:54.0572 3492 ACPI - ok 20:13:54.0603 3492 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 20:13:54.0697 3492 AcpiPmi - ok 20:13:54.0790 3492 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 20:13:54.0806 3492 adp94xx - ok 20:13:54.0837 3492 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 20:13:54.0853 3492 adpahci - ok 20:13:54.0884 3492 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 20:13:54.0915 3492 adpu320 - ok 20:13:55.0087 3492 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys 20:13:55.0149 3492 AFD - ok 20:13:55.0180 3492 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 20:13:55.0196 3492 agp440 - ok 20:13:55.0227 3492 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 20:13:55.0243 3492 aliide - ok 20:13:55.0274 3492 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 20:13:55.0290 3492 amdide - ok 20:13:55.0321 3492 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 20:13:55.0383 3492 AmdK8 - ok 20:13:55.0414 3492 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 20:13:55.0446 3492 AmdPPM - ok 20:13:55.0492 3492 amdsata (6ec6d772eae38dc17c14aed9b178d24b) C:\Windows\system32\drivers\amdsata.sys 20:13:55.0508 3492 amdsata - ok 20:13:55.0539 3492 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 20:13:55.0570 3492 amdsbs - ok 20:13:55.0586 3492 amdxata (1142a21db581a84ea5597b03a26ebaa0) C:\Windows\system32\drivers\amdxata.sys 20:13:55.0602 3492 amdxata - ok 20:13:55.0664 3492 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 20:13:55.0836 3492 AppID - ok 20:13:55.0867 3492 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 20:13:55.0882 3492 arc - ok 20:13:55.0929 3492 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 20:13:55.0945 3492 arcsas - ok 20:13:55.0976 3492 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 20:13:56.0132 3492 AsyncMac - ok 20:13:56.0163 3492 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 20:13:56.0179 3492 atapi - ok 20:13:56.0226 3492 AtiHdmiService (38467ff83c2b4265d51f418812a91e3c) C:\Windows\system32\drivers\AtiHdmi.sys 20:13:56.0257 3492 AtiHdmiService - ok 20:13:56.0428 3492 atikmdag (a08339ae90972e268b9622c668f450e8) C:\Windows\system32\DRIVERS\atikmdag.sys 20:13:56.0600 3492 atikmdag - ok 20:13:56.0678 3492 avgntflt (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys 20:13:56.0694 3492 avgntflt - ok 20:13:56.0725 3492 avipbb (d959309ececca73fc79f8ef8521346b2) C:\Windows\system32\DRIVERS\avipbb.sys 20:13:56.0740 3492 avipbb - ok 20:13:56.0772 3492 avkmgr (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys 20:13:56.0772 3492 avkmgr - ok 20:13:56.0834 3492 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 20:13:56.0881 3492 b06bdrv - ok 20:13:56.0928 3492 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 20:13:56.0974 3492 b57nd60a - ok 20:13:57.0006 3492 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 20:13:57.0068 3492 Beep - ok 20:13:57.0099 3492 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 20:13:57.0130 3492 blbdrive - ok 20:13:57.0162 3492 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 20:13:57.0208 3492 bowser - ok 20:13:57.0224 3492 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 20:13:57.0286 3492 BrFiltLo - ok 20:13:57.0302 3492 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 20:13:57.0333 3492 BrFiltUp - ok 20:13:57.0380 3492 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 20:13:57.0411 3492 Brserid - ok 20:13:57.0442 3492 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 20:13:57.0474 3492 BrSerWdm - ok 20:13:57.0489 3492 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 20:13:57.0520 3492 BrUsbMdm - ok 20:13:57.0536 3492 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 20:13:57.0552 3492 BrUsbSer - ok 20:13:57.0583 3492 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 20:13:57.0614 3492 BTHMODEM - ok 20:13:57.0645 3492 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 20:13:57.0692 3492 cdfs - ok 20:13:57.0739 3492 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 20:13:57.0770 3492 cdrom - ok 20:13:57.0817 3492 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 20:13:57.0832 3492 circlass - ok 20:13:57.0864 3492 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 20:13:57.0895 3492 CLFS - ok 20:13:57.0942 3492 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 20:13:57.0942 3492 CmBatt - ok 20:13:57.0988 3492 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 20:13:58.0004 3492 cmdide - ok 20:13:58.0035 3492 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys 20:13:58.0082 3492 CNG - ok 20:13:58.0098 3492 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 20:13:58.0113 3492 Compbatt - ok 20:13:58.0144 3492 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 20:13:58.0176 3492 CompositeBus - ok 20:13:58.0191 3492 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 20:13:58.0207 3492 crcdisk - ok 20:13:58.0238 3492 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys 20:13:58.0285 3492 CSC - ok 20:13:58.0332 3492 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 20:13:58.0378 3492 DfsC - ok 20:13:58.0394 3492 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 20:13:58.0425 3492 discache - ok 20:13:58.0456 3492 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 20:13:58.0488 3492 Disk - ok 20:13:58.0519 3492 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 20:13:58.0550 3492 drmkaud - ok 20:13:58.0581 3492 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 20:13:58.0628 3492 DXGKrnl - ok 20:13:58.0706 3492 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 20:13:58.0800 3492 ebdrv - ok 20:13:58.0846 3492 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 20:13:58.0878 3492 elxstor - ok 20:13:58.0893 3492 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 20:13:58.0940 3492 ErrDev - ok 20:13:58.0971 3492 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 20:13:59.0018 3492 exfat - ok 20:13:59.0034 3492 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 20:13:59.0096 3492 fastfat - ok 20:13:59.0127 3492 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 20:13:59.0143 3492 fdc - ok 20:13:59.0174 3492 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 20:13:59.0174 3492 FileInfo - ok 20:13:59.0205 3492 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 20:13:59.0252 3492 Filetrace - ok 20:13:59.0283 3492 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 20:13:59.0299 3492 flpydisk - ok 20:13:59.0346 3492 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 20:13:59.0361 3492 FltMgr - ok 20:13:59.0377 3492 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 20:13:59.0392 3492 FsDepends - ok 20:13:59.0408 3492 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 20:13:59.0424 3492 Fs_Rec - ok 20:13:59.0470 3492 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 20:13:59.0502 3492 fvevol - ok 20:13:59.0517 3492 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 20:13:59.0533 3492 gagp30kx - ok 20:13:59.0580 3492 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 20:13:59.0626 3492 hcw85cir - ok 20:13:59.0658 3492 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 20:13:59.0704 3492 HdAudAddService - ok 20:13:59.0751 3492 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 20:13:59.0782 3492 HDAudBus - ok 20:13:59.0798 3492 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 20:13:59.0829 3492 HidBatt - ok 20:13:59.0860 3492 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 20:13:59.0876 3492 HidBth - ok 20:13:59.0923 3492 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 20:13:59.0954 3492 HidIr - ok 20:14:00.0001 3492 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys 20:14:00.0016 3492 HidUsb - ok 20:14:00.0048 3492 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 20:14:00.0079 3492 HpSAMD - ok 20:14:00.0141 3492 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 20:14:00.0204 3492 HTTP - ok 20:14:00.0250 3492 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 20:14:00.0266 3492 hwpolicy - ok 20:14:00.0297 3492 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 20:14:00.0313 3492 i8042prt - ok 20:14:00.0344 3492 iaStorV (3df4395a7cf8b7a72a5f4606366b8c2d) C:\Windows\system32\drivers\iaStorV.sys 20:14:00.0375 3492 iaStorV - ok 20:14:00.0422 3492 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 20:14:00.0438 3492 iirsp - ok 20:14:00.0469 3492 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 20:14:00.0469 3492 intelide - ok 20:14:00.0500 3492 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 20:14:00.0516 3492 intelppm - ok 20:14:00.0547 3492 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 20:14:00.0609 3492 IpFilterDriver - ok 20:14:00.0625 3492 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 20:14:00.0656 3492 IPMIDRV - ok 20:14:00.0672 3492 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 20:14:00.0718 3492 IPNAT - ok 20:14:00.0750 3492 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 20:14:00.0828 3492 IRENUM - ok 20:14:00.0843 3492 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 20:14:00.0859 3492 isapnp - ok 20:14:00.0890 3492 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 20:14:00.0906 3492 iScsiPrt - ok 20:14:00.0952 3492 k57nd60a (7dbafe10c1b777305c80bea42fbda710) C:\Windows\system32\DRIVERS\k57nd60a.sys 20:14:00.0968 3492 k57nd60a - ok 20:14:00.0999 3492 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 20:14:00.0999 3492 kbdclass - ok 20:14:01.0046 3492 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 20:14:01.0077 3492 kbdhid - ok 20:14:01.0124 3492 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys 20:14:01.0140 3492 KSecDD - ok 20:14:01.0186 3492 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys 20:14:01.0218 3492 KSecPkg - ok 20:14:01.0249 3492 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 20:14:01.0296 3492 ksthunk - ok 20:14:01.0342 3492 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 20:14:01.0389 3492 lltdio - ok 20:14:01.0420 3492 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 20:14:01.0436 3492 LSI_FC - ok 20:14:01.0452 3492 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 20:14:01.0467 3492 LSI_SAS - ok 20:14:01.0483 3492 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 20:14:01.0498 3492 LSI_SAS2 - ok 20:14:01.0530 3492 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 20:14:01.0545 3492 LSI_SCSI - ok 20:14:01.0561 3492 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 20:14:01.0608 3492 luafv - ok 20:14:01.0654 3492 MBAMProtector (23a854450dab5c9b7a42ab9be6f2e4bd) C:\Windows\system32\drivers\mbam.sys 20:14:01.0670 3492 MBAMProtector - ok 20:14:01.0701 3492 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 20:14:01.0717 3492 megasas - ok 20:14:01.0748 3492 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 20:14:01.0764 3492 MegaSR - ok 20:14:01.0795 3492 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 20:14:01.0842 3492 Modem - ok 20:14:01.0857 3492 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 20:14:01.0888 3492 monitor - ok 20:14:01.0920 3492 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 20:14:01.0935 3492 mouclass - ok 20:14:01.0966 3492 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 20:14:01.0998 3492 mouhid - ok 20:14:02.0044 3492 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 20:14:02.0060 3492 mountmgr - ok 20:14:02.0107 3492 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 20:14:02.0122 3492 mpio - ok 20:14:02.0154 3492 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 20:14:02.0200 3492 mpsdrv - ok 20:14:02.0232 3492 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 20:14:02.0310 3492 MRxDAV - ok 20:14:02.0341 3492 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 20:14:02.0388 3492 mrxsmb - ok 20:14:02.0434 3492 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 20:14:02.0466 3492 mrxsmb10 - ok 20:14:02.0512 3492 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 20:14:02.0528 3492 mrxsmb20 - ok 20:14:02.0559 3492 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 20:14:02.0575 3492 msahci - ok 20:14:02.0622 3492 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 20:14:02.0637 3492 msdsm - ok 20:14:02.0684 3492 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 20:14:02.0731 3492 Msfs - ok 20:14:02.0762 3492 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 20:14:02.0824 3492 mshidkmdf - ok 20:14:02.0840 3492 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 20:14:02.0856 3492 msisadrv - ok 20:14:02.0887 3492 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 20:14:02.0934 3492 MSKSSRV - ok 20:14:02.0949 3492 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 20:14:02.0996 3492 MSPCLOCK - ok 20:14:03.0012 3492 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 20:14:03.0058 3492 MSPQM - ok 20:14:03.0105 3492 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 20:14:03.0121 3492 MsRPC - ok 20:14:03.0136 3492 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 20:14:03.0152 3492 mssmbios - ok 20:14:03.0168 3492 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 20:14:03.0214 3492 MSTEE - ok 20:14:03.0230 3492 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 20:14:03.0261 3492 MTConfig - ok 20:14:03.0292 3492 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 20:14:03.0308 3492 Mup - ok 20:14:03.0355 3492 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 20:14:03.0402 3492 NativeWifiP - ok 20:14:03.0464 3492 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 20:14:03.0511 3492 NDIS - ok 20:14:03.0542 3492 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 20:14:03.0589 3492 NdisCap - ok 20:14:03.0620 3492 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 20:14:03.0667 3492 NdisTapi - ok 20:14:03.0714 3492 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 20:14:03.0745 3492 Ndisuio - ok 20:14:03.0792 3492 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 20:14:03.0870 3492 NdisWan - ok 20:14:03.0901 3492 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 20:14:03.0948 3492 NDProxy - ok 20:14:03.0963 3492 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 20:14:04.0010 3492 NetBIOS - ok 20:14:04.0041 3492 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 20:14:04.0088 3492 NetBT - ok 20:14:04.0291 3492 NETw5s64 (39ede676d17f37af4573c2b33ec28aca) C:\Windows\system32\DRIVERS\NETw5s64.sys 20:14:04.0494 3492 NETw5s64 - ok 20:14:04.0650 3492 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys 20:14:04.0821 3492 netw5v64 - ok 20:14:04.0852 3492 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 20:14:04.0868 3492 nfrd960 - ok 20:14:04.0899 3492 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 20:14:04.0946 3492 Npfs - ok 20:14:04.0977 3492 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 20:14:05.0024 3492 nsiproxy - ok 20:14:05.0086 3492 Ntfs (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\Windows\system32\drivers\Ntfs.sys 20:14:05.0164 3492 Ntfs - ok 20:14:05.0180 3492 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 20:14:05.0242 3492 Null - ok 20:14:05.0289 3492 nvraid (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\Windows\system32\drivers\nvraid.sys 20:14:05.0305 3492 nvraid - ok 20:14:05.0352 3492 nvstor (f7cd50fe7139f07e77da8ac8033d1832) C:\Windows\system32\drivers\nvstor.sys 20:14:05.0367 3492 nvstor - ok 20:14:05.0398 3492 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 20:14:05.0430 3492 nv_agp - ok 20:14:05.0461 3492 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 20:14:05.0492 3492 ohci1394 - ok 20:14:05.0554 3492 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 20:14:05.0570 3492 Parport - ok 20:14:05.0601 3492 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 20:14:05.0617 3492 partmgr - ok 20:14:05.0648 3492 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 20:14:05.0664 3492 pci - ok 20:14:05.0679 3492 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 20:14:05.0695 3492 pciide - ok 20:14:05.0726 3492 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 20:14:05.0742 3492 pcmcia - ok 20:14:05.0773 3492 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 20:14:05.0788 3492 pcw - ok 20:14:05.0820 3492 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 20:14:05.0882 3492 PEAUTH - ok 20:14:05.0944 3492 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 20:14:05.0991 3492 PptpMiniport - ok 20:14:06.0007 3492 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 20:14:06.0038 3492 Processor - ok 20:14:06.0085 3492 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 20:14:06.0132 3492 Psched - ok 20:14:06.0178 3492 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 20:14:06.0241 3492 ql2300 - ok 20:14:06.0256 3492 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 20:14:06.0272 3492 ql40xx - ok 20:14:06.0288 3492 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 20:14:06.0319 3492 QWAVEdrv - ok 20:14:06.0334 3492 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 20:14:06.0397 3492 RasAcd - ok 20:14:06.0428 3492 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 20:14:06.0475 3492 RasAgileVpn - ok 20:14:06.0646 3492 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 20:14:06.0724 3492 Rasl2tp - ok 20:14:06.0756 3492 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 20:14:06.0802 3492 RasPppoe - ok 20:14:06.0849 3492 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 20:14:06.0912 3492 RasSstp - ok 20:14:06.0943 3492 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 20:14:06.0990 3492 rdbss - ok 20:14:07.0005 3492 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 20:14:07.0036 3492 rdpbus - ok 20:14:07.0068 3492 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 20:14:07.0130 3492 RDPCDD - ok 20:14:07.0177 3492 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys 20:14:07.0208 3492 RDPDR - ok 20:14:07.0224 3492 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 20:14:07.0286 3492 RDPENCDD - ok 20:14:07.0317 3492 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 20:14:07.0348 3492 RDPREFMP - ok 20:14:07.0395 3492 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys 20:14:07.0442 3492 RDPWD - ok 20:14:07.0489 3492 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 20:14:07.0504 3492 rdyboost - ok 20:14:07.0567 3492 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 20:14:07.0598 3492 rspndr - ok 20:14:07.0629 3492 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys 20:14:07.0676 3492 s3cap - ok 20:14:07.0707 3492 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 20:14:07.0723 3492 sbp2port - ok 20:14:07.0754 3492 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 20:14:07.0785 3492 scfilter - ok 20:14:07.0816 3492 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys 20:14:07.0848 3492 sdbus - ok 20:14:07.0879 3492 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 20:14:07.0926 3492 secdrv - ok 20:14:07.0957 3492 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 20:14:07.0972 3492 Serenum - ok 20:14:07.0988 3492 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 20:14:08.0019 3492 Serial - ok 20:14:08.0050 3492 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 20:14:08.0066 3492 sermouse - ok 20:14:08.0097 3492 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 20:14:08.0113 3492 sffdisk - ok 20:14:08.0128 3492 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 20:14:08.0160 3492 sffp_mmc - ok 20:14:08.0175 3492 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\DRIVERS\sffp_sd.sys 20:14:08.0191 3492 sffp_sd - ok 20:14:08.0206 3492 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 20:14:08.0238 3492 sfloppy - ok 20:14:08.0253 3492 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 20:14:08.0269 3492 SiSRaid2 - ok 20:14:08.0284 3492 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 20:14:08.0300 3492 SiSRaid4 - ok 20:14:08.0331 3492 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 20:14:08.0378 3492 Smb - ok 20:14:08.0425 3492 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 20:14:08.0440 3492 spldr - ok 20:14:08.0487 3492 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 20:14:08.0534 3492 srv - ok 20:14:08.0565 3492 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 20:14:08.0612 3492 srv2 - ok 20:14:08.0628 3492 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 20:14:08.0659 3492 srvnet - ok 20:14:08.0706 3492 sscebus (f74634f46692c8315e7f37f698af3225) C:\Windows\system32\DRIVERS\sscebus.sys 20:14:08.0721 3492 sscebus - ok 20:14:08.0768 3492 sscemdfl (82732b391efd69b0548044be9cb37bfc) C:\Windows\system32\DRIVERS\sscemdfl.sys 20:14:08.0768 3492 sscemdfl - ok 20:14:08.0799 3492 sscemdm (43d56ace4469d90f9790e8352d87d9b5) C:\Windows\system32\DRIVERS\sscemdm.sys 20:14:08.0815 3492 sscemdm - ok 20:14:08.0862 3492 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 20:14:08.0877 3492 stexstor - ok 20:14:08.0924 3492 STHDA (caf5a9708671b14b9670260735b22c4e) C:\Windows\system32\DRIVERS\stwrt64.sys 20:14:08.0955 3492 STHDA - ok 20:14:08.0986 3492 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys 20:14:09.0002 3492 storflt - ok 20:14:09.0049 3492 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys 20:14:09.0049 3492 storvsc - ok 20:14:09.0096 3492 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 20:14:09.0111 3492 swenum - ok 20:14:09.0158 3492 SynTP (639b57dc871be4b86283027faf1f4e30) C:\Windows\system32\DRIVERS\SynTP.sys 20:14:09.0174 3492 SynTP - ok 20:14:09.0220 3492 tap0901 (3b73c849b41fb20d77b0e553214061a5) C:\Windows\system32\DRIVERS\tap0901.sys 20:14:09.0252 3492 tap0901 - ok 20:14:09.0345 3492 Tcpip (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\drivers\tcpip.sys 20:14:09.0423 3492 Tcpip - ok 20:14:09.0470 3492 TCPIP6 (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\DRIVERS\tcpip.sys 20:14:09.0517 3492 TCPIP6 - ok 20:14:09.0548 3492 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 20:14:09.0595 3492 tcpipreg - ok 20:14:09.0626 3492 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 20:14:09.0673 3492 TDPIPE - ok 20:14:09.0704 3492 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 20:14:09.0735 3492 TDTCP - ok 20:14:09.0798 3492 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 20:14:09.0860 3492 tdx - ok 20:14:09.0891 3492 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 20:14:09.0907 3492 TermDD - ok 20:14:09.0954 3492 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 20:14:10.0000 3492 tssecsrv - ok 20:14:10.0047 3492 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 20:14:10.0094 3492 TsUsbFlt - ok 20:14:10.0141 3492 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 20:14:10.0203 3492 tunnel - ok 20:14:10.0234 3492 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 20:14:10.0234 3492 uagp35 - ok 20:14:10.0281 3492 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 20:14:10.0344 3492 udfs - ok 20:14:10.0375 3492 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 20:14:10.0390 3492 uliagpkx - ok 20:14:10.0422 3492 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 20:14:10.0453 3492 umbus - ok 20:14:10.0468 3492 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 20:14:10.0500 3492 UmPass - ok 20:14:10.0531 3492 usbccgp (481dff26b4dca8f4cbac1f7dce1d6829) C:\Windows\system32\DRIVERS\usbccgp.sys 20:14:10.0562 3492 usbccgp - ok 20:14:10.0578 3492 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 20:14:10.0609 3492 usbcir - ok 20:14:10.0656 3492 usbehci (74ee782b1d9c241efe425565854c661c) C:\Windows\system32\drivers\usbehci.sys 20:14:10.0671 3492 usbehci - ok 20:14:10.0702 3492 usbhub (dc96bd9ccb8403251bcf25047573558e) C:\Windows\system32\DRIVERS\usbhub.sys 20:14:10.0734 3492 usbhub - ok 20:14:10.0749 3492 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys 20:14:10.0780 3492 usbohci - ok 20:14:10.0812 3492 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 20:14:10.0843 3492 usbprint - ok 20:14:10.0874 3492 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 20:14:10.0905 3492 usbscan - ok 20:14:10.0936 3492 USBSTOR (d76510cfa0fc09023077f22c2f979d86) C:\Windows\system32\DRIVERS\USBSTOR.SYS 20:14:10.0968 3492 USBSTOR - ok 20:14:10.0999 3492 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\drivers\usbuhci.sys 20:14:11.0014 3492 usbuhci - ok 20:14:11.0046 3492 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys 20:14:11.0077 3492 usbvideo - ok 20:14:11.0124 3492 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 20:14:11.0155 3492 vdrvroot - ok 20:14:11.0186 3492 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 20:14:11.0217 3492 vga - ok 20:14:11.0233 3492 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 20:14:11.0280 3492 VgaSave - ok 20:14:11.0326 3492 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 20:14:11.0342 3492 vhdmp - ok 20:14:11.0373 3492 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 20:14:11.0389 3492 viaide - ok 20:14:11.0420 3492 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys 20:14:11.0436 3492 vmbus - ok 20:14:11.0451 3492 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys 20:14:11.0482 3492 VMBusHID - ok 20:14:11.0498 3492 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 20:14:11.0514 3492 volmgr - ok 20:14:11.0560 3492 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 20:14:11.0576 3492 volmgrx - ok 20:14:11.0607 3492 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 20:14:11.0623 3492 volsnap - ok 20:14:11.0670 3492 vpnva (0e4df91e83da5739ffb18535d4db10aa) C:\Windows\system32\DRIVERS\vpnva64.sys 20:14:11.0685 3492 vpnva - ok 20:14:11.0701 3492 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 20:14:11.0716 3492 vsmraid - ok 20:14:11.0732 3492 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 20:14:11.0763 3492 vwifibus - ok 20:14:11.0794 3492 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 20:14:11.0810 3492 vwififlt - ok 20:14:11.0841 3492 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 20:14:11.0857 3492 WacomPen - ok 20:14:11.0888 3492 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 20:14:11.0950 3492 WANARP - ok 20:14:11.0950 3492 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 20:14:11.0997 3492 Wanarpv6 - ok 20:14:12.0028 3492 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 20:14:12.0044 3492 Wd - ok 20:14:12.0075 3492 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 20:14:12.0106 3492 Wdf01000 - ok 20:14:12.0153 3492 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 20:14:12.0184 3492 WfpLwf - ok 20:14:12.0216 3492 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 20:14:12.0216 3492 WIMMount - ok 20:14:12.0294 3492 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 20:14:12.0340 3492 WinUsb - ok 20:14:12.0372 3492 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 20:14:12.0387 3492 WmiAcpi - ok 20:14:12.0418 3492 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 20:14:12.0465 3492 ws2ifsl - ok 20:14:12.0512 3492 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 20:14:12.0559 3492 WudfPf - ok 20:14:12.0606 3492 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 20:14:12.0652 3492 WUDFRd - ok 20:14:12.0699 3492 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 20:14:12.0808 3492 \Device\Harddisk0\DR0 - ok 20:14:12.0824 3492 Boot (0x1200) (c7070e71c5251cf55364c42a391e2ca8) \Device\Harddisk0\DR0\Partition0 20:14:12.0824 3492 \Device\Harddisk0\DR0\Partition0 - ok 20:14:12.0855 3492 Boot (0x1200) (5a5ce6aba1fccd911c591620f991ad8a) \Device\Harddisk0\DR0\Partition1 20:14:12.0855 3492 \Device\Harddisk0\DR0\Partition1 - ok 20:14:12.0871 3492 Boot (0x1200) (0c6b21408c8658457fa2a5415e0ae8c8) \Device\Harddisk0\DR0\Partition2 20:14:12.0871 3492 \Device\Harddisk0\DR0\Partition2 - ok 20:14:12.0871 3492 ============================================================ 20:14:12.0871 3492 Scan finished 20:14:12.0871 3492 ============================================================ 20:14:12.0886 3276 Detected object count: 0 20:14:12.0886 3276 Actual detected object count: 0 |
|
11.10.2011, 09:42
| #13 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Joa, Anlass noch weiterzugraben hätten wir erstmal nicht. Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.10.2011, 09:51
| #14 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll Moin, hab ich gemacht, ich häng es dir als pdf an, ich weiß nicht was du davon haben willst - ein bisschen überfordernd ;-D Also ist erst mal alles in Ordnung und ich muss mir keine weiteren Gedanken machen? edit: das mit dem Anhang hat wohl nicht geklappt?! |
|
11.10.2011, 09:55
| #15 |
| | Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll so, jetzt aber...?! |
|
| Themen zu Virus? 3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll |
| .dll, adobe, antivir, antivirus, autorun, avira, bho, c:\windows\system32\rundll32.exe, desktop, error, explorer, firefox, flash player, format, google earth, mozilla thunderbird, mp3, neustart, plug-in, registry, rundll, scan, security, senden, software, spyware.onlinegames, usb, virus, webcheck, windows, wlan |
Linear-Darstellung
