| |
| |||||||
Log-Analyse und Auswertung: "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhandenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
10.01.2012, 22:07
| #1 |
 |  "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Hallo liebe Leute, ich habe auch folgendes Problem, dass mein Computer aus Sicherheitsgründen eine kostenpflichtige Sicherheitssoftware/Update braucht und der Rechner gesperrt worden ist (inkl. schwarzer Bildschirm)… irgendwie habe ich es geschafft, dass ich wieder in den normalen Modus rein komme und habe bisher folgende Schritte laut „Was beachte ich wenn ich ein Thema eröffne“ durchgeführt. (http://www.trojaner-board.de/69886-a...-beachten.html) 1. defogger von jpshortstuff habe ich auf disable gesetzt und keine Fehlermeldung erhalten 2. Dann habe ich einen normalen Scan mit OTL durchgeführt siehe Logfiles mit Endung 1 3. ..und dann noch einmal ein Quick Scan mit dem dem Code „activex (…) CREATERRESTOREPOINT“ ..siehe Logfiles mit Endung 2 im Anhang… beide Dateien sind so lang, dass ich diese nur in den Anhang getan.. ich bitte um Verständnis.. 4. ..da ich ein 32bit System habe habe ich auch noch offline GMER scannen lassen.. 5. als ich gmer öffnen wollte zeigte sich ein blauer Bildschirm mit Code:
ATTFilter
„ A problem has been detected and Windows has been shut down to prevent damage to your computer.
BAD_POOL_HEADER
If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:
Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.
If problems continue, disable BIOS memory or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
Technical information:
***STOP: 0x00000019 (0x00000020, 0x856AB000, 0x856AB828, 0x1B050000)
Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further assistance.”
7. Ich versuche nun noch einmal GMER zu starten… der blaue Bildschirm erscheint wieder mit obigem Text.. nach erneutem Neustart erhalte ich wieder die zwei Fehlermeldungen (siehe unten) Weitere Info: nach jedem Scan habe ich einen Neustart gemacht…wobei kurz nach dem Start des Systems diese zwei Fehlermeldungen nacheinander auftauchen: Code:
ATTFilter „C:\WINDOWS\inf\Other.exe" konnte nicht gefunden werden. Stellen Sie sicher, dass Sie den Namen korrekt eingegeben haben und wiederholen Sie den Vorgang. Klicken Sie auf "Start" und anschließend auf "Suchen", um eine Datei zu suchen.“ und
„Die in der Registrierung angegebene Anwendung „C:\WINDOWS\inf\\Other.exe“ konnte nicht geladen oder gestartet werden. Stellen Sie sicher, dass die Datei vorhanden ist, oder entfernen Sie den Eintrag mit Bezug auf diese Datei aus der Registrierung.“
8. Ich habe Malwarebytes Anti-Malware vor Schritt 1 (vollständiger Scan) und nach Schritt 7 (Quick Scan) durchlaufen lassen (hatte es davor nicht auf dem Rechner gehabt und sind somit meine einzigen zwei Scans mit mbam.. für die jeweiligen Logfiles siehe Anhang. Hier mbam Scan vorher Code:
ATTFilter Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2012.01.10.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 *** :: xxx [Administrator] 10.01.2012 15:59:26 mbam-log-2012-01-10 (15-59-26).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 331807 Laufzeit: 1 Stunde(n), 24 Minute(n), 28 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 5 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{949D2AC5-6A69-11DB-97A5-806D6172696F} (Trojan.Ransom) -> Daten: C:\Documents and Settings\***\Application Data\Microsoft\loadhst.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|run (Trojan.Agent) -> Daten: C:\WINDOWS\system32\config\Win.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Fun (IM.Worm) -> Daten: C:\WINDOWS\system\Fun.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|dc2k5 (IM.Worm) -> Daten: C:\WINDOWS\SVIQ.EXE -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|dc (IM.Worm) -> Daten: C:\WINDOWS\dc.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 D:\Programme\Unlocker\eBay_shortcuts_1016.exe (Adware.Clicker) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\***\Application Data\Microsoft\loadhst.exe (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2012.01.10.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 *** :: ** [Administrator] 10.01.2012 19:07:10 mbam-log-2012-01-10 (19-07-10).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 270132 Laufzeit: 8 Minute(n), 15 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) 9. Anschließend habe ich noch einen ESET Scan gemacht.. Code:
ATTFilter ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=579ce66f2140a9428cbffdf0f96f7fc5
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-01-10 06:33:32
# local_time=2012-01-10 07:33:32 (+0100, W. Europe Standard Time)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775125 100 100 108289 101116854 4665 0
# compatibility_mode=2560 16777191 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 312 312 0 0
# scanned=3363
# found=0
# cleaned=0
# scan_time=124
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=579ce66f2140a9428cbffdf0f96f7fc5
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-10 08:22:20
# local_time=2012-01-10 09:22:20 (+0100, W. Europe Standard Time)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775125 100 100 108471 101117036 4847 0
# compatibility_mode=2560 16777191 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 494 494 0 0
# scanned=173763
# found=0
# cleaned=0
# scan_time=6469
Vielen Dank schon mal im Voraus für eure Hilfe! Lg.maggie |
|
11.01.2012, 19:07
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
__________________Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ |
|
11.01.2012, 19:10
| #3 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Hallo Arne,
__________________ich habe Malwarebytes bisher nicht verwendet und die zwei Scans, die ich bisher gemacht habe sind in meinem erstem Post (unter 8.). |
|
11.01.2012, 20:02
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.01.2012, 20:26
| #5 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden hier ist der OTL log OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.01.2012 20:09:15 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\***\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 1013,92 Mb Total Physical Memory | 472,58 Mb Available Physical Memory | 46,61% Memory free 2,38 Gb Paging File | 1,84 Gb Available in Paging File | 77,36% Paging File free Paging file location(s): c:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 15,14 Gb Total Space | 0,95 Gb Free Space | 6,24% Space Free | Partition Type: NTFS Drive D: | 59,39 Gb Total Space | 58,49 Gb Free Space | 98,48% Space Free | Partition Type: NTFS Computer Name: ** | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\***\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName}) PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\ThreatFire\TFTray.exe (PC Tools) PRC - C:\Program Files\ThreatFire\TFService.exe (PC Tools) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Labtec\WebCam10\WebCam10.exe () PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe (Labtec Inc.) PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Labtec Inc,) PRC - C:\Program Files\Common Files\AccSys\accsvc.exe (AccSys GmbH) PRC - C:\WINDOWS\system32\o2flash.exe (O2Micro International) PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll () MOD - C:\Program Files\Labtec\WebCam10\LAppRes.DLL () MOD - C:\Program Files\Labtec\WebCam10\WebCam10.exe () MOD - C:\Program Files\Common Files\LogiShrd\LComMgr\LCMServerPS.dll () MOD - C:\WINDOWS\system32\pdfcmnnt.dll () ========== Win32 Services (SafeList) ========== SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (OpenVPNService) -- D:\Programme\OpenVPN\bin\openvpnserv.exe () SRV - (ThreatFire) -- C:\Program Files\ThreatFire\TFService.exe (PC Tools) SRV - (hasplms) -- C:\WINDOWS\System32\hasplms.exe (SafeNet Inc.) SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten) SRV - (LVSrvLauncher) -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Labtec Inc.) SRV - (accsvc) -- C:\Program Files\Common Files\AccSys\accsvc.exe (AccSys GmbH) SRV - (O2Flash) -- C:\WINDOWS\system32\o2flash.exe (O2Micro International) SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (MDM) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (NdisrdMP) -- C:\WINDOWS\system32\drivers\Ndisrd.sys (NT Kernel Resources) DRV - (Ndisrd) -- C:\WINDOWS\system32\drivers\Ndisrd.sys (NT Kernel Resources) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (vpnva) -- C:\WINDOWS\system32\drivers\vpnva.sys (Cisco Systems, Inc.) DRV - (tap0901) -- C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project) DRV - (TfSysMon) -- C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools) DRV - (TfNetMon) -- C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools) DRV - (TfFsMon) -- C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools) DRV - (hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (SafeNet Inc.) DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys () DRV - (ss_bmdm) -- C:\WINDOWS\system32\drivers\ss_bmdm.sys (MCCI Corporation) DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\WINDOWS\system32\drivers\ss_bbus.sys (MCCI) DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys (MCCI Corporation) DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation) DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation) DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation) DRV - (aksfridge) -- C:\WINDOWS\system32\drivers\aksfridge.sys (Aladdin Knowledge Systems Ltd.) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (MPE) -- C:\WINDOWS\system32\drivers\MPE.sys (Microsoft Corporation) DRV - (MODRC) -- C:\WINDOWS\system32\drivers\modrc.sys (DiBcom S.A.) DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.) DRV - (LVMVDrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Labtec Inc.) DRV - (LVcKap) -- C:\WINDOWS\system32\drivers\Lvckap.sys () DRV - (PID_0928) Logitech QuickCam Express(PID_0928) -- C:\WINDOWS\system32\drivers\LV561AV.SYS (Labtec Inc.) DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) -- C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications) DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies) DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.) DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell) DRV - (O2SDRDR) -- C:\WINDOWS\system32\DRIVERS\o2sd.sys (O2Micro ) DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.) DRV - (O2MDRDR) -- C:\WINDOWS\system32\DRIVERS\o2media.sys (O2Micro ) DRV - (O2SCBUS) -- C:\WINDOWS\system32\drivers\ozscr.sys (O2Micro) DRV - (SE4501D) -- C:\WINDOWS\system32\drivers\SE4501D.sys (Siemens AG) DRV - (FUJ02E3) -- C:\WINDOWS\system32\drivers\fuj02e3.sys (FUJITSU LIMITED) DRV - (kbfilter) -- C:\WINDOWS\System32\drivers\kbfilter.sys (WayTech Development, Inc.) DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC) DRV - (FUJ02B1) -- C:\WINDOWS\system32\drivers\fuj02b1.sys (FUJITSU LIMITED) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://autoproxy.hawo.stw.uni-erlangen.de IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://autoproxy.hawo.stw.uni-erlangen.de IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://google.icq.com/search/search_frame.php IE - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.startup.homepage: "hxxp://www.gmx.de/" FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - prefs.js..network.proxy.autoconfig_url: "hxxp://autoproxy.hawo.stw.uni-erlangen.de/" FF - prefs.js..network.proxy.http: "proxy.hawo.stw.uni-erlangen.de" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.type: 2 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.11 16:47:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.11 16:47:03 | 000,000,000 | ---D | M] [2008.06.20 18:18:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\mozilla\Extensions [2012.01.09 13:57:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\c8yfc2oc.default\extensions [2010.07.09 10:51:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\c8yfc2oc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009.03.27 13:28:01 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\c8yfc2oc.default\extensions\moveplayer@movenetworks.com [2012.01.10 19:18:31 | 000,000,000 | ---D | M] (Avira SearchFree Toolbar plus Web Protection) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\c8yfc2oc.default\extensions\toolbar@ask.com [2011.05.11 16:41:13 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\c8yfc2oc.default\searchplugins\icqplugin-1.xml [2008.06.19 14:08:28 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\c8yfc2oc.default\searchplugins\icqplugin-2.xml [2008.06.20 18:18:31 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\c8yfc2oc.default\searchplugins\icqplugin-3.xml [2008.02.19 17:16:46 | 000,000,951 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\c8yfc2oc.default\searchplugins\icqplugin.xml () (No name found) -- C:\DOCUMENTS AND SETTINGS\***\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\C8YFC2OC.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}.XPI () (No name found) -- C:\DOCUMENTS AND SETTINGS\***\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\C8YFC2OC.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011.11.23 17:16:45 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2010.03.30 18:31:29 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010.04.20 11:41:09 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.03.30 18:30:58 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF O1 HOSTS File: ([2009.09.22 10:01:25 | 000,331,165 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 11344 more lines... O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName}) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Labtec Inc,) O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Labtec\WebCam10\WebCam10.exe () O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe (PC Tools) O4 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003..\Run: [Rainlendar2] D:\Programme\Rainlendar2\Rainlendar2.exe () O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Gigaset WLAN Adapter Monitor.lnk = File not found F3 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003 WinNT: Load - (C:\WINDOWS\inf\Other.exe) - File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.11.02 13:10:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\Shell - "" = AutoRun O33 - MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\Shell\AutoRun\command - "" = F:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 0 SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error. ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error. ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error. ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067) ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Labtec Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.01.11 20:06:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2012.01.10 19:26:18 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2012.01.10 16:32:02 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\***\Desktop\OTL.exe [2012.01.10 15:55:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\Malwarebytes [2012.01.10 15:55:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.01.10 15:55:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Anwendungsdaten\Malwarebytes [2012.01.10 15:55:35 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.01.10 15:55:35 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.01.09 14:01:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\AskToolbar [2012.01.09 13:57:49 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com [2012.01.09 13:57:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Local Settings\Application Data\AskToolbar [66 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.01.11 20:13:00 | 000,000,230 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2012.01.11 19:55:04 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.01.11 19:54:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.01.11 12:51:15 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2012.01.10 18:54:10 | 1063,272,448 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP [2012.01.10 17:40:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\***\defogger_reenable [2012.01.10 17:36:14 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Defogger.exe [2012.01.10 16:32:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\***\Desktop\OTL.exe [2012.01.10 15:55:38 | 000,000,766 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.01.09 22:33:00 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2012.01.09 13:40:26 | 000,223,744 | ---- | M] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.12.15 11:08:38 | 000,143,624 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.12.14 15:48:58 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [66 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.01.10 18:26:32 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\***\Desktop\gmer.exe [2012.01.10 17:40:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\***\defogger_reenable [2012.01.10 17:36:14 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Defogger.exe [2012.01.10 15:55:38 | 000,000,766 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.01.09 13:58:02 | 000,000,230 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2011.11.25 14:02:52 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Unl.exe [2011.06.06 14:17:05 | 000,629,654 | ---- | C] () -- C:\WINDOWS\System32\HZRecog.dat [2011.06.06 14:17:05 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\HZRecog.dll [2011.06.06 14:17:04 | 000,897,024 | ---- | C] () -- C:\WINDOWS\System32\vocon3200api.dll [2011.06.06 14:17:04 | 000,483,328 | ---- | C] () -- C:\WINDOWS\System32\vocon3200g2pmnc.dll [2011.06.06 14:17:04 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\vocon3200rsrc.dll [2011.06.06 14:17:04 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\audioin.dll [2011.06.06 14:17:03 | 004,063,308 | ---- | C] () -- C:\WINDOWS\System32\acmod3200_car_mnc_f16_full_lew2.dat [2011.06.06 14:16:41 | 000,715,038 | ---- | C] () -- C:\WINDOWS\unins000.exe [2011.06.06 14:16:41 | 000,000,910 | ---- | C] () -- C:\WINDOWS\unins000.dat [2010.11.19 21:23:31 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2010.08.02 18:51:02 | 000,037,863 | ---- | C] () -- C:\Documents and Settings\***\Application Data\mdbu.bin [2010.06.14 21:19:04 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2010.06.13 14:37:11 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.04.10 15:02:23 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll [2010.04.10 15:02:23 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys [2010.04.10 14:41:15 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\***\Application Data\$_hpcst$.hpc [2010.03.04 12:27:21 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll [2010.01.28 22:40:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\inscal32.INI [2010.01.13 16:32:28 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll [2009.11.29 21:14:26 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat [2009.11.29 21:14:26 | 000,000,039 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat [2009.02.08 19:30:35 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDEALC2600.ini [2008.10.03 15:20:36 | 000,051,370 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini [2008.09.10 23:31:10 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2008.08.15 16:19:38 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\PUTTY.RND [2008.08.12 14:01:58 | 000,001,685 | ---- | C] () -- C:\WINDOWS\MSIM.INI [2008.08.11 18:36:32 | 000,007,278 | ---- | C] () -- C:\WINDOWS\msim_evl.ini [2008.08.11 18:36:17 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\MSIMHELP.DLL [2008.02.13 21:30:21 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat [2007.10.25 16:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2007.03.06 16:50:30 | 001,669,664 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys [2007.01.19 19:52:45 | 000,000,012 | -H-- | C] () -- C:\WINDOWS\fontsetup.dll [2007.01.19 19:52:45 | 000,000,003 | -H-- | C] () -- C:\WINDOWS\defin.dll [2007.01.08 22:34:38 | 000,004,638 | ---- | C] () -- C:\WINDOWS\hpdj3500.ini [2007.01.08 22:33:30 | 000,000,478 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini [2007.01.07 17:46:29 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\fusioncache.dat [2007.01.07 13:57:22 | 000,001,427 | ---- | C] () -- C:\WINDOWS\mozver.dat [2007.01.06 20:09:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2006.12.22 20:41:31 | 000,223,744 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006.11.02 14:32:54 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006.11.02 13:58:14 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\RtkHDAud.dat [2006.11.02 13:58:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2006.11.02 13:19:41 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2006.11.02 13:14:32 | 000,001,038 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2006.11.02 13:11:34 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006.11.02 13:10:19 | 000,143,624 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2006.11.02 13:08:01 | 000,023,500 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2005.01.21 12:02:28 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\RMDevice.dll [2004.08.04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004.08.04 13:00:00 | 000,445,044 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004.08.04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004.08.04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004.08.04 13:00:00 | 000,072,754 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004.08.04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004.08.04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004.08.04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004.08.04 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004.08.04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2003.07.30 10:48:28 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2003.07.30 09:49:22 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001.03.30 21:58:36 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\Property.dll ========== LOP Check ========== [2008.02.13 21:30:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier [2006.12.23 17:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Prism [2009.10.09 10:00:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2007.03.07 17:10:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Artweaver [2012.01.09 14:01:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\AskToolbar [2009.08.04 18:26:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\CadSoft [2010.06.15 22:40:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Dropbox [2011.09.29 13:56:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\gtk-2.0 [2011.12.13 00:02:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ICQ [2008.11.13 20:56:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ICQ Toolbar [2007.01.07 12:22:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ICQLite [2010.04.10 14:41:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Samsung [2012.01.09 22:33:00 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job [2012.01.11 20:13:00 | 000,000,230 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > [2008.03.20 13:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe [2006.11.02 14:21:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ahead [2012.01.09 13:58:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avira [2008.11.13 21:27:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\hps [2009.09.17 21:17:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lavasoft [2008.02.13 21:30:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier [2010.09.26 21:01:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft [2008.09.09 10:30:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Tools [2006.12.23 17:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Prism [2009.12.08 11:00:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype [2010.07.02 21:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2009.10.09 10:00:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2007.05.10 18:40:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage < %ALLUSERSPROFILE%\Application Data\*.exe /s > [2011.06.29 11:50:50 | 000,195,240 | ---- | M] (Avira GmbH) -- C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\SELFUPDATE\avrestart.exe [2011.06.24 15:39:31 | 000,581,288 | ---- | M] (Avira GmbH) -- C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\SELFUPDATE\update.exe [2008.12.09 22:36:52 | 001,403,232 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\hps\3018\setup_Mueller_Fotowelt.exe [2009.11.23 23:32:17 | 001,184,912 | ---- | M] (Lavasoft) -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe [2009.11.23 23:32:18 | 000,788,880 | ---- | M] (Lavasoft) -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe [2009.09.24 21:19:14 | 000,640,760 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe [2009.11.23 23:32:19 | 001,638,640 | ---- | M] (Lavasoft) -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe [2009.11.23 23:32:19 | 000,822,904 | ---- | M] (Lavasoft) -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe [2009.11.23 23:32:20 | 000,816,272 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe [2009.11.23 23:32:22 | 000,641,632 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe [2009.11.23 23:32:36 | 000,015,880 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe [2009.11.23 23:32:37 | 000,862,040 | ---- | M] (Lavasoft) -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe [2009.09.24 21:19:19 | 000,303,976 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\64\AAWDriverTool.exe < %APPDATA%\*. > [2008.06.16 11:05:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Adobe [2008.04.21 16:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\AdobeAUM [2007.01.16 21:50:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\AdobeUM [2007.01.23 20:42:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Ahead [2008.09.25 22:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Apple Computer [2007.03.07 17:10:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Artweaver [2012.01.09 14:01:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\AskToolbar [2010.03.28 09:54:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Avira [2009.08.04 18:26:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\CadSoft [2009.04.25 20:20:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\DivX [2010.06.15 22:40:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Dropbox [2011.09.14 15:57:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\dvdcss [2011.09.29 13:56:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\gtk-2.0 [2008.08.12 10:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Help [2011.12.13 00:02:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ICQ [2008.11.13 20:56:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ICQ Toolbar [2007.01.07 12:22:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ICQLite [2006.11.02 13:48:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Identities [2008.02.15 18:12:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Lavasoft [2007.01.07 13:57:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Macromedia [2012.01.10 15:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Malwarebytes [2012.01.10 17:27:12 | 000,000,000 | --SD | M] -- C:\Documents and Settings\***\Application Data\Microsoft [2010.01.21 21:58:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Move Networks [2008.06.20 18:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Mozilla [2010.04.10 14:41:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Samsung [2011.12.13 00:15:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Skype [2011.07.03 11:58:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\skypePM [2007.01.07 13:53:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Sun [2006.12.22 20:20:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\vlc [2007.11.07 15:06:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\WinRAR < %APPDATA%\*.exe /s > [2007.01.16 21:49:13 | 023,813,608 | ---- | M] ( ) -- C:\Documents and Settings\***\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe [2008.10.03 15:20:55 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe [2008.10.03 15:21:12 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe [2008.10.03 15:20:47 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe < %SYSTEMDRIVE%\*.exe > [1996.08.16 13:49:54 | 000,298,496 | ---- | M] (InstallShield Corporation, Inc.) -- C:\uninst.exe [1 C:\*.tmp files -> C:\*.tmp -> ] < MD5 for: AGP440.SYS > [2004.08.04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2009.12.07 22:45:01 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2009.12.07 22:45:01 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2009.12.07 22:45:01 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\sp3.cab:AGP440.sys [2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\agp440.sys [2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys < MD5 for: ATAPI.SYS > [2004.08.04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2009.12.07 22:45:01 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2009.12.07 22:45:01 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2009.12.07 22:45:01 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\sp3.cab:atapi.sys [2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys [2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004.08.04 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\eventlog.dll [2008.04.14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll [2004.08.04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: IASTOR.SYS > [2005.10.12 12:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\drivers\iaStor.sys < MD5 for: NETLOGON.DLL > [2008.04.14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\netlogon.dll [2008.04.14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll [2009.02.06 19:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll [2009.02.06 19:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll [2004.08.04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: NVATABUS.SYS > [2005.08.18 16:52:06 | 000,093,568 | ---- | M] (NVIDIA Corporation) MD5=0344AA9113DC16EEC379F4652020849D -- C:\WINDOWS\system32\drivers\nvatabus.sys < MD5 for: SCECLI.DLL > [2004.08.04 13:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [2008.04.14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\scecli.dll [2008.04.14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll < MD5 for: USER32.DLL > [2005.03.02 19:19:56 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=1800F293BCCC8EDE8A70E12B88D80036 -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2007.03.08 16:48:36 | 000,578,048 | ---- | M] (Microsoft Corporation) MD5=7AA4F6C00405DFC4B70ED4214E7D687B -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\user32.dll [2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll [2005.03.02 19:09:30 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=DE2DB164BBB35DB061AF0997E4499054 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2005.03.02 19:09:30 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=DE2DB164BBB35DB061AF0997E4499054 -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll < MD5 for: USERINIT.EXE > [2004.08.04 13:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe [2008.04.14 01:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 01:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\userinit.exe [2008.04.14 01:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe < MD5 for: VIAMRAID.SYS > [2005.04.08 10:43:26 | 000,060,928 | ---- | M] (VIA Technologies inc,.ltd) MD5=0363E216E4EB5052969C96608934DBDE -- C:\WINDOWS\system32\drivers\viamraid.sys < MD5 for: WINLOGON.EXE > [2004.08.04 13:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2009.11.29 21:48:45 | 003,932,160 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2009.11.24 18:04:37 | 000,262,144 | ---- | M] () -- C:\WINDOWS\System32\config\security.sav [2009.11.29 21:48:45 | 025,165,824 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2009.11.29 21:48:45 | 008,388,608 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] ========== Alternate Data Streams ========== @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29 @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Anwendungsdaten\TEMP:C895616B < End of report > [code/] |
|
11.01.2012, 20:34
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-2052111302-1682526488-839522115-1003\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.11.02 13:10:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\Shell - "" = AutoRun
O33 - MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\Shell\AutoRun\command - "" = F:\autorun.exe
[2012.01.09 14:01:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\AskToolbar
[2012.01.09 13:57:49 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com
[2012.01.09 13:57:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Local Settings\Application Data\AskToolbar
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Anwendungsdaten\TEMP:C895616B
:Commands
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ --> "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden |
|
11.01.2012, 20:52
| #7 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Nach dem Anmelden hat der PC länger zum hochfahren gebraucht.. hoffe das ist kein schlechtes Zeichen.. die zwei Fehlermeldungen Code:
ATTFilter „C:\WINDOWS\inf\Other.exe" konnte nicht gefunden werden. Stellen Sie sicher, dass Sie den Namen korrekt eingegeben haben und wiederholen Sie den Vorgang. Klicken Sie auf "Start" und anschließend auf "Suchen", um eine Datei zu suchen.“ und
„Die in der Registrierung angegebene Anwendung „C:\WINDOWS\inf\\Other.exe“ konnte nicht geladen oder gestartet werden. Stellen Sie sicher, dass die Datei vorhanden ist, oder entfernen Sie den Eintrag mit Bezug auf diese Datei aus der Registrierung.“
hier das Logfile: Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-2052111302-1682526488-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_USERS\S-1-5-21-2052111302-1682526488-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Programme\Ask.com\Updater\Updater.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78bdea93-bd71-11e0-a507-001742138fb0}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78bdea93-bd71-11e0-a507-001742138fb0}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{78bdea93-bd71-11e0-a507-001742138fb0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78bdea93-bd71-11e0-a507-001742138fb0}\ not found.
File F:\autorun.exe not found.
C:\Documents and Settings\***\Application Data\AskToolbar folder moved successfully.
C:\Programme\Ask.com\Updater folder moved successfully.
C:\Programme\Ask.com\assets\oobe folder moved successfully.
C:\Programme\Ask.com\assets folder moved successfully.
C:\Programme\Ask.com folder moved successfully.
C:\Documents and Settings\***\Local Settings\Application Data\AskToolbar\Downloaded Program Files\temp folder moved successfully.
C:\Documents and Settings\***\Local Settings\Application Data\AskToolbar\Downloaded Program Files folder moved successfully.
C:\Documents and Settings\***\Local Settings\Application Data\AskToolbar\APNU folder moved successfully.
C:\Documents and Settings\***\Local Settings\Application Data\AskToolbar folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29 deleted successfully.
ADS C:\Documents and Settings\All Users\Anwendungsdaten\TEMP:C895616B deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Guest
->Temp folder emptied: 826937 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 263724 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Nur für meinem Schat
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: ****
->Temp folder emptied: 852705 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 8005 bytes
->FireFox cache emptied: 55936044 bytes
->Flash cache emptied: 1126 bytes
User: ***
->Temp folder emptied: 445738363 bytes
->Temporary Internet Files folder emptied: 61645257 bytes
->Java cache emptied: 48114194 bytes
->FireFox cache emptied: 53842110 bytes
->Flash cache emptied: 190649 bytes
%systemdrive% .tmp files removed: 321716610 bytes
%systemroot% .tmp files removed: 5063284 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 110828473 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34320 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.054,00 mb
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.31.0 log created on 01112012_204024
Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot.
Registry entries deleted on Reboot...
|
|
11.01.2012, 20:59
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.01.2012, 21:13
| #9 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden hier das logfile von TDSS-Killer Code:
ATTFilter 21:06:14.0640 3120 TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26
21:06:14.0796 3120 ============================================================
21:06:14.0796 3120 Current date / time: 2012/01/11 21:06:14.0796
21:06:14.0796 3120 SystemInfo:
21:06:14.0796 3120
21:06:14.0796 3120 OS Version: 5.1.2600 ServicePack: 3.0
21:06:14.0796 3120 Product type: Workstation
21:06:14.0796 3120 ComputerName: **
21:06:14.0796 3120 UserName: ***
21:06:14.0796 3120 Windows directory: C:\WINDOWS
21:06:14.0796 3120 System windows directory: C:\WINDOWS
21:06:14.0796 3120 Processor architecture: Intel x86
21:06:14.0796 3120 Number of processors: 2
21:06:14.0796 3120 Page size: 0x1000
21:06:14.0796 3120 Boot type: Normal boot
21:06:14.0796 3120 ============================================================
21:06:15.0484 3120 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000, SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000050
21:06:15.0640 3120 Initialize success
21:06:55.0781 3676 ============================================================
21:06:55.0781 3676 Scan started
21:06:55.0781 3676 Mode: Manual; SigCheck; TDLFS;
21:06:55.0781 3676 ============================================================
21:06:56.0437 3676 Abiosdsk - ok
21:06:56.0453 3676 abp480n5 - ok
21:06:56.0500 3676 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:06:57.0046 3676 ACPI - ok
21:06:57.0093 3676 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
21:06:57.0250 3676 ACPIEC - ok
21:06:57.0265 3676 adpu160m - ok
21:06:57.0296 3676 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:06:57.0453 3676 aec - ok
21:06:57.0562 3676 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:06:57.0593 3676 AFD - ok
21:06:57.0671 3676 AgereSoftModem (705bee10b4911ee333afcd826988743c) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
21:06:57.0781 3676 AgereSoftModem - ok
21:06:57.0796 3676 Aha154x - ok
21:06:57.0812 3676 aic78u2 - ok
21:06:57.0828 3676 aic78xx - ok
21:06:57.0875 3676 aksfridge (45f65f2f7ae28e5e56ab64e3ac61bd52) C:\WINDOWS\system32\drivers\aksfridge.sys
21:06:57.0937 3676 aksfridge - ok
21:06:58.0031 3676 AliIde - ok
21:06:58.0046 3676 amsint - ok
21:06:58.0125 3676 AR5211 (3d769924a07c00f5bb4b890f3934cd1e) C:\WINDOWS\system32\DRIVERS\ar5211.sys
21:06:58.0203 3676 AR5211 - ok
21:06:58.0234 3676 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
21:06:58.0453 3676 Arp1394 - ok
21:06:58.0453 3676 asc - ok
21:06:58.0468 3676 asc3350p - ok
21:06:58.0484 3676 asc3550 - ok
21:06:58.0515 3676 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:06:58.0671 3676 AsyncMac - ok
21:06:58.0703 3676 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:06:58.0859 3676 atapi - ok
21:06:58.0875 3676 Atdisk - ok
21:06:58.0890 3676 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:06:59.0046 3676 Atmarpc - ok
21:06:59.0156 3676 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:06:59.0312 3676 audstub - ok
21:06:59.0406 3676 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
21:06:59.0421 3676 avgio - ok
21:06:59.0468 3676 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
21:06:59.0500 3676 avgntflt - ok
21:06:59.0531 3676 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
21:06:59.0546 3676 avipbb - ok
21:06:59.0578 3676 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:06:59.0765 3676 Beep - ok
21:06:59.0875 3676 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:07:00.0062 3676 cbidf2k - ok
21:07:00.0109 3676 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:07:00.0296 3676 CCDECODE - ok
21:07:00.0312 3676 cd20xrnt - ok
21:07:00.0375 3676 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:07:00.0546 3676 Cdaudio - ok
21:07:00.0562 3676 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:07:00.0703 3676 Cdfs - ok
21:07:00.0734 3676 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:07:00.0890 3676 Cdrom - ok
21:07:00.0890 3676 Changer - ok
21:07:00.0937 3676 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:07:01.0078 3676 CmBatt - ok
21:07:01.0078 3676 CmdIde - ok
21:07:01.0109 3676 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:07:01.0265 3676 Compbatt - ok
21:07:01.0343 3676 Cpqarray - ok
21:07:01.0359 3676 dac2w2k - ok
21:07:01.0375 3676 dac960nt - ok
21:07:01.0406 3676 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:07:01.0562 3676 Disk - ok
21:07:01.0640 3676 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
21:07:01.0843 3676 dmboot - ok
21:07:01.0890 3676 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
21:07:02.0078 3676 dmio - ok
21:07:02.0109 3676 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:07:02.0296 3676 dmload - ok
21:07:02.0390 3676 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:07:02.0578 3676 DMusic - ok
21:07:02.0625 3676 dpti2o - ok
21:07:02.0671 3676 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:07:02.0859 3676 drmkaud - ok
21:07:02.0921 3676 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:07:03.0109 3676 Fastfat - ok
21:07:03.0156 3676 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
21:07:03.0312 3676 Fdc - ok
21:07:03.0375 3676 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
21:07:03.0515 3676 Fips - ok
21:07:03.0609 3676 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
21:07:03.0765 3676 Flpydisk - ok
21:07:03.0812 3676 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:07:04.0000 3676 FltMgr - ok
21:07:04.0109 3676 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
21:07:04.0125 3676 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
21:07:04.0125 3676 FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
21:07:04.0187 3676 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:07:04.0343 3676 Fs_Rec - ok
21:07:04.0390 3676 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:07:04.0546 3676 Ftdisk - ok
21:07:04.0593 3676 FUJ02B1 (00845dcd64fe6348ddf7890c310c17b9) C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys
21:07:04.0640 3676 FUJ02B1 - ok
21:07:04.0703 3676 FUJ02E3 (ef9f310f86fd504afcdcedf8280091fb) C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys
21:07:04.0734 3676 FUJ02E3 - ok
21:07:04.0781 3676 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:07:04.0968 3676 Gpc - ok
21:07:05.0062 3676 hardlock (995178a443b07fa9eeaea041d7b4b5ca) C:\WINDOWS\system32\drivers\hardlock.sys
21:07:05.0140 3676 hardlock - ok
21:07:05.0234 3676 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:07:05.0453 3676 HDAudBus - ok
21:07:05.0500 3676 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:07:05.0656 3676 hidusb - ok
21:07:05.0656 3676 hpn - ok
21:07:05.0718 3676 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:07:05.0734 3676 HTTP - ok
21:07:05.0765 3676 hwdatacard - ok
21:07:05.0781 3676 hwusbdev - ok
21:07:05.0796 3676 i2omgmt - ok
21:07:05.0812 3676 i2omp - ok
21:07:05.0828 3676 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:07:05.0984 3676 i8042prt - ok
21:07:06.0062 3676 ialm (81efe1c5542afb2570758f39ae3b1151) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
21:07:06.0171 3676 ialm - ok
21:07:06.0312 3676 iaStor (309c4d86d989fb1fcf64bd30dc81c51b) C:\WINDOWS\system32\DRIVERS\iaStor.sys
21:07:06.0406 3676 iaStor - ok
21:07:06.0453 3676 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:07:06.0640 3676 Imapi - ok
21:07:06.0656 3676 ini910u - ok
21:07:06.0859 3676 IntcAzAudAddService (b12a9fc49cd2765a43829d834f518aed) C:\WINDOWS\system32\drivers\RtkHDAud.sys
21:07:07.0203 3676 IntcAzAudAddService - ok
21:07:07.0281 3676 IntelIde - ok
21:07:07.0312 3676 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:07:07.0515 3676 intelppm - ok
21:07:07.0593 3676 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:07:07.0734 3676 Ip6Fw - ok
21:07:07.0796 3676 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:07:07.0937 3676 IpFilterDriver - ok
21:07:08.0000 3676 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:07:08.0156 3676 IpInIp - ok
21:07:08.0234 3676 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:07:08.0421 3676 IpNat - ok
21:07:08.0484 3676 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:07:08.0671 3676 IPSec - ok
21:07:08.0750 3676 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
21:07:08.0937 3676 irda - ok
21:07:09.0000 3676 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:07:09.0171 3676 IRENUM - ok
21:07:09.0265 3676 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:07:09.0437 3676 isapnp - ok
21:07:09.0515 3676 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:07:09.0687 3676 Kbdclass - ok
21:07:09.0750 3676 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:07:09.0921 3676 kbdhid - ok
21:07:09.0984 3676 kbfilter (42e6807cc66e8dd682cd9d7297aa798c) C:\WINDOWS\system32\drivers\kbfilter.sys
21:07:10.0015 3676 kbfilter ( UnsignedFile.Multi.Generic ) - warning
21:07:10.0015 3676 kbfilter - detected UnsignedFile.Multi.Generic (1)
21:07:10.0109 3676 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:07:10.0281 3676 kmixer - ok
21:07:10.0359 3676 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:07:10.0390 3676 KSecDD - ok
21:07:10.0437 3676 Lbd - ok
21:07:10.0484 3676 lbrtfdc - ok
21:07:10.0656 3676 LVcKap (b72e763eb92b8dbe45c455ba6e4babd0) C:\WINDOWS\system32\DRIVERS\LVcKap.sys
21:07:10.0843 3676 LVcKap - ok
21:07:11.0031 3676 LVMVDrv (e8a376abc340c35318a79b766c2406bb) C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys
21:07:11.0265 3676 LVMVDrv - ok
21:07:11.0312 3676 LVUSBSta (839da24941c0395c69c681f12b721a47) C:\WINDOWS\system32\drivers\LVUSBSta.sys
21:07:11.0328 3676 LVUSBSta - ok
21:07:11.0375 3676 MDC8021X (d7010580bf4e45d5e793a1fe75758c69) C:\WINDOWS\system32\DRIVERS\mdc8021x.sys
21:07:11.0390 3676 MDC8021X ( UnsignedFile.Multi.Generic ) - warning
21:07:11.0390 3676 MDC8021X - detected UnsignedFile.Multi.Generic (1)
21:07:11.0484 3676 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:07:11.0687 3676 mnmdd - ok
21:07:11.0718 3676 mod7700 - ok
21:07:11.0796 3676 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
21:07:11.0953 3676 Modem - ok
21:07:12.0000 3676 MODRC (370e88453ec0d7bea6eb24be8d865dbe) C:\WINDOWS\system32\DRIVERS\modrc.sys
21:07:12.0015 3676 MODRC - ok
21:07:12.0031 3676 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:07:12.0187 3676 Mouclass - ok
21:07:12.0203 3676 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:07:12.0390 3676 mouhid - ok
21:07:12.0421 3676 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:07:12.0593 3676 MountMgr - ok
21:07:12.0640 3676 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
21:07:12.0812 3676 MPE - ok
21:07:12.0843 3676 mraid35x - ok
21:07:12.0906 3676 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:07:13.0062 3676 MRxDAV - ok
21:07:13.0109 3676 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:07:13.0140 3676 MRxSmb - ok
21:07:13.0171 3676 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:07:13.0296 3676 Msfs - ok
21:07:13.0328 3676 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:07:13.0515 3676 MSKSSRV - ok
21:07:13.0531 3676 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:07:13.0687 3676 MSPCLOCK - ok
21:07:13.0718 3676 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:07:13.0859 3676 MSPQM - ok
21:07:13.0906 3676 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:07:14.0046 3676 mssmbios - ok
21:07:14.0140 3676 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
21:07:14.0281 3676 MSTEE - ok
21:07:14.0359 3676 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:07:14.0390 3676 Mup - ok
21:07:14.0437 3676 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:07:14.0578 3676 NABTSFEC - ok
21:07:14.0640 3676 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:07:14.0796 3676 NDIS - ok
21:07:14.0828 3676 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:07:15.0031 3676 NdisIP - ok
21:07:15.0093 3676 Ndisrd (ef6574a4a8359379caf7092850fe4c81) C:\WINDOWS\system32\DRIVERS\ndisrd.sys
21:07:15.0125 3676 Ndisrd ( UnsignedFile.Multi.Generic ) - warning
21:07:15.0125 3676 Ndisrd - detected UnsignedFile.Multi.Generic (1)
21:07:15.0125 3676 NdisrdMP (ef6574a4a8359379caf7092850fe4c81) C:\WINDOWS\system32\DRIVERS\ndisrd.sys
21:07:15.0125 3676 NdisrdMP ( UnsignedFile.Multi.Generic ) - warning
21:07:15.0125 3676 NdisrdMP - detected UnsignedFile.Multi.Generic (1)
21:07:15.0203 3676 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:07:15.0218 3676 NdisTapi - ok
21:07:15.0265 3676 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:07:15.0406 3676 Ndisuio - ok
21:07:15.0468 3676 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:07:15.0625 3676 NdisWan - ok
21:07:15.0687 3676 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:07:15.0718 3676 NDProxy - ok
21:07:15.0796 3676 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:07:15.0968 3676 NetBIOS - ok
21:07:16.0031 3676 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:07:16.0218 3676 NetBT - ok
21:07:16.0343 3676 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
21:07:16.0500 3676 NIC1394 - ok
21:07:16.0609 3676 NPF (d21fee8db254ba762656878168ac1db6) C:\WINDOWS\system32\drivers\npf.sys
21:07:16.0625 3676 NPF ( UnsignedFile.Multi.Generic ) - warning
21:07:16.0625 3676 NPF - detected UnsignedFile.Multi.Generic (1)
21:07:16.0671 3676 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:07:16.0843 3676 Npfs - ok
21:07:16.0937 3676 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:07:17.0203 3676 Ntfs - ok
21:07:17.0296 3676 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:07:17.0437 3676 Null - ok
21:07:17.0515 3676 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:07:17.0671 3676 NwlnkFlt - ok
21:07:17.0734 3676 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:07:17.0921 3676 NwlnkFwd - ok
21:07:18.0015 3676 O2MDRDR (3201b873d5d296f926981c7477cd598a) C:\WINDOWS\system32\DRIVERS\o2media.sys
21:07:18.0046 3676 O2MDRDR - ok
21:07:18.0109 3676 O2SCBUS (dd3764730845a74a7fc1021148803fdd) C:\WINDOWS\system32\DRIVERS\ozscr.sys
21:07:18.0140 3676 O2SCBUS - ok
21:07:18.0218 3676 O2SDRDR (552f07ea923cb37fe586b5fee080876e) C:\WINDOWS\system32\DRIVERS\o2sd.sys
21:07:18.0234 3676 O2SDRDR - ok
21:07:18.0312 3676 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
21:07:18.0484 3676 ohci1394 - ok
21:07:18.0578 3676 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
21:07:18.0781 3676 Parport - ok
21:07:18.0843 3676 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:07:19.0000 3676 PartMgr - ok
21:07:19.0078 3676 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:07:19.0218 3676 ParVdm - ok
21:07:19.0296 3676 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
21:07:19.0468 3676 PCI - ok
21:07:19.0546 3676 PCIDump - ok
21:07:19.0656 3676 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:07:19.0812 3676 PCIIde - ok
21:07:19.0953 3676 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
21:07:20.0171 3676 Pcmcia - ok
21:07:20.0234 3676 PDCOMP - ok
21:07:20.0250 3676 PDFRAME - ok
21:07:20.0281 3676 PDRELI - ok
21:07:20.0296 3676 PDRFRAME - ok
21:07:20.0328 3676 perc2 - ok
21:07:20.0343 3676 perc2hib - ok
21:07:20.0437 3676 PID_0928 (d395b2dc1705454aa36a34099e066df0) C:\WINDOWS\system32\DRIVERS\LV561AV.SYS
21:07:20.0484 3676 PID_0928 - ok
21:07:20.0593 3676 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:07:20.0750 3676 PptpMiniport - ok
21:07:20.0796 3676 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:07:21.0015 3676 PSched - ok
21:07:21.0078 3676 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:07:21.0218 3676 Ptilink - ok
21:07:21.0328 3676 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:07:21.0343 3676 PxHelp20 - ok
21:07:21.0375 3676 ql1080 - ok
21:07:21.0406 3676 Ql10wnt - ok
21:07:21.0437 3676 ql12160 - ok
21:07:21.0468 3676 ql1240 - ok
21:07:21.0500 3676 ql1280 - ok
21:07:21.0546 3676 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:07:21.0703 3676 RasAcd - ok
21:07:21.0812 3676 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
21:07:21.0937 3676 Rasirda - ok
21:07:21.0984 3676 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:07:22.0203 3676 Rasl2tp - ok
21:07:22.0250 3676 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:07:22.0390 3676 RasPppoe - ok
21:07:22.0421 3676 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:07:22.0578 3676 Raspti - ok
21:07:22.0656 3676 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:07:22.0812 3676 Rdbss - ok
21:07:22.0859 3676 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:07:23.0000 3676 RDPCDD - ok
21:07:23.0078 3676 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:07:23.0250 3676 rdpdr - ok
21:07:23.0312 3676 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
21:07:23.0328 3676 RDPWD - ok
21:07:23.0375 3676 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:07:23.0515 3676 redbook - ok
21:07:23.0625 3676 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
21:07:23.0796 3676 sdbus - ok
21:07:23.0843 3676 SE4501D (b84c83e5355c2aa96bb5c5fab9f5d3e4) C:\WINDOWS\system32\DRIVERS\SE4501D.sys
21:07:23.0859 3676 SE4501D ( UnsignedFile.Multi.Generic ) - warning
21:07:23.0859 3676 SE4501D - detected UnsignedFile.Multi.Generic (1)
21:07:23.0953 3676 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:07:24.0140 3676 Secdrv - ok
21:07:24.0171 3676 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
21:07:24.0359 3676 serenum - ok
21:07:24.0390 3676 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
21:07:24.0562 3676 Serial - ok
21:07:24.0625 3676 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:07:24.0765 3676 Sfloppy - ok
21:07:24.0796 3676 Simbad - ok
21:07:24.0843 3676 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:07:24.0968 3676 SLIP - ok
21:07:25.0078 3676 SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:\WINDOWS\system32\DRIVERS\smcirda.sys
21:07:25.0156 3676 SMCIRDA - ok
21:07:25.0187 3676 Sparrow - ok
21:07:25.0218 3676 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:07:25.0359 3676 splitter - ok
21:07:25.0421 3676 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
21:07:25.0562 3676 sr - ok
21:07:25.0656 3676 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:07:25.0718 3676 Srv - ok
21:07:25.0796 3676 sscdbus (d6870895fe46a464a19141440eb6cc1e) C:\WINDOWS\system32\DRIVERS\sscdbus.sys
21:07:25.0859 3676 sscdbus - ok
21:07:25.0953 3676 sscdmdfl (0fe167362e4689b716cdc8d93adedda8) C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
21:07:26.0000 3676 sscdmdfl - ok
21:07:26.0046 3676 sscdmdm (55a15707e32b6709242ad127e62ca55a) C:\WINDOWS\system32\DRIVERS\sscdmdm.sys
21:07:26.0109 3676 sscdmdm - ok
21:07:26.0171 3676 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
21:07:26.0203 3676 ssmdrv - ok
21:07:26.0281 3676 ss_bbus (7d5d8db6196e6b32277553dcd1648f2e) C:\WINDOWS\system32\DRIVERS\ss_bbus.sys
21:07:26.0312 3676 ss_bbus - ok
21:07:26.0359 3676 ss_bmdfl (56e2f50d93012799d6fd0328c7e0d105) C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys
21:07:26.0375 3676 ss_bmdfl - ok
21:07:26.0437 3676 ss_bmdm (578f256d5297be0ea0bbd8d5a3f500f9) C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys
21:07:26.0468 3676 ss_bmdm - ok
21:07:26.0531 3676 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:07:26.0750 3676 streamip - ok
21:07:26.0781 3676 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:07:26.0921 3676 swenum - ok
21:07:26.0984 3676 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:07:27.0140 3676 swmidi - ok
21:07:27.0171 3676 symc810 - ok
21:07:27.0203 3676 symc8xx - ok
21:07:27.0234 3676 sym_hi - ok
21:07:27.0265 3676 sym_u3 - ok
21:07:27.0328 3676 SynTP (f8393bdfb6726a0f97dd23aa54f3087d) C:\WINDOWS\system32\DRIVERS\SynTP.sys
21:07:27.0343 3676 SynTP - ok
21:07:27.0390 3676 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:07:27.0531 3676 sysaudio - ok
21:07:27.0625 3676 tap0901 (98a1e6bc9f766b0b0a5bf00af847ef20) C:\WINDOWS\system32\DRIVERS\tap0901.sys
21:07:27.0640 3676 tap0901 ( UnsignedFile.Multi.Generic ) - warning
21:07:27.0640 3676 tap0901 - detected UnsignedFile.Multi.Generic (1)
21:07:27.0750 3676 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:07:27.0828 3676 Tcpip - ok
21:07:27.0875 3676 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:07:28.0078 3676 TDPIPE - ok
21:07:28.0125 3676 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:07:28.0265 3676 TDTCP - ok
21:07:28.0328 3676 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:07:28.0468 3676 TermDD - ok
21:07:28.0546 3676 TfFsMon (95746e5b1473432f3d9458940dba6e3a) C:\WINDOWS\system32\drivers\TfFsMon.sys
21:07:28.0562 3676 TfFsMon - ok
21:07:28.0609 3676 TfNetMon (02ffdd873e31c5c2d57ca87d11ec36af) C:\WINDOWS\system32\drivers\TfNetMon.sys
21:07:28.0625 3676 TfNetMon - ok
21:07:28.0656 3676 TfSysMon (f8bd92251ab439383c051ce907d78cce) C:\WINDOWS\system32\drivers\TfSysMon.sys
21:07:28.0671 3676 TfSysMon - ok
21:07:28.0687 3676 TosIde - ok
21:07:28.0750 3676 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:07:28.0953 3676 Udfs - ok
21:07:29.0031 3676 ultra - ok
21:07:29.0359 3676 UnlockerDriver5 (4847639d852763ee39415c929470f672) D:\Programme\Unlocker\UnlockerDriver5.sys
21:07:29.0375 3676 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning
21:07:29.0375 3676 UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)
21:07:29.0484 3676 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:07:29.0734 3676 Update - ok
21:07:29.0812 3676 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:07:29.0937 3676 usbccgp - ok
21:07:29.0984 3676 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:07:30.0109 3676 usbehci - ok
21:07:30.0171 3676 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:07:30.0328 3676 usbhub - ok
21:07:30.0421 3676 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:07:30.0578 3676 usbprint - ok
21:07:30.0625 3676 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:07:30.0796 3676 usbscan - ok
21:07:30.0890 3676 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:07:31.0062 3676 USBSTOR - ok
21:07:31.0093 3676 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:07:31.0265 3676 usbuhci - ok
21:07:31.0312 3676 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:07:31.0500 3676 VgaSave - ok
21:07:31.0531 3676 ViaIde - ok
21:07:31.0593 3676 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
21:07:31.0765 3676 VolSnap - ok
21:07:31.0859 3676 vpnva (fc94804932cfc35f01b3ae510e3b4d5c) C:\WINDOWS\system32\DRIVERS\vpnva.sys
21:07:31.0890 3676 vpnva - ok
21:07:31.0953 3676 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:07:32.0171 3676 Wanarp - ok
21:07:32.0218 3676 WDICA - ok
21:07:32.0296 3676 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:07:32.0515 3676 wdmaud - ok
21:07:32.0625 3676 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
21:07:32.0687 3676 WpdUsb - ok
21:07:32.0781 3676 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:07:32.0937 3676 WS2IFSL - ok
21:07:33.0031 3676 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:07:33.0171 3676 WSTCODEC - ok
21:07:33.0234 3676 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:07:33.0265 3676 WudfPf - ok
21:07:33.0312 3676 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:07:33.0343 3676 WudfRd - ok
21:07:33.0484 3676 yukonwxp (70deae7df954af41b49fa492c01e3a2a) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
21:07:33.0515 3676 yukonwxp - ok
21:07:33.0546 3676 zlportio - ok
21:07:33.0593 3676 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
21:07:33.0937 3676 \Device\Harddisk0\DR0 - ok
21:07:33.0953 3676 Boot (0x1200) (7e107c5040f3658d3c07a525a2bab2ed) \Device\Harddisk0\DR0\Partition0
21:07:33.0953 3676 \Device\Harddisk0\DR0\Partition0 - ok
21:07:33.0984 3676 Boot (0x1200) (9fe12762592df860d247723b31a2ba59) \Device\Harddisk0\DR0\Partition1
21:07:33.0984 3676 \Device\Harddisk0\DR0\Partition1 - ok
21:07:33.0984 3676 ============================================================
21:07:33.0984 3676 Scan finished
21:07:33.0984 3676 ============================================================
21:07:34.0093 3052 Detected object count: 9
21:07:34.0093 3052 Actual detected object count: 9
21:08:15.0109 3052 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0109 3052 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0109 3052 kbfilter ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0109 3052 kbfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0109 3052 MDC8021X ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0109 3052 MDC8021X ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0109 3052 Ndisrd ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0109 3052 Ndisrd ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0125 3052 NdisrdMP ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0125 3052 NdisrdMP ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0125 3052 NPF ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0125 3052 NPF ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0125 3052 SE4501D ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0125 3052 SE4501D ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0125 3052 tap0901 ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0125 3052 tap0901 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:08:15.0125 3052 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user
21:08:15.0125 3052 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
|
|
11.01.2012, 21:38
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.01.2012, 22:08
| #11 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden ..beim Ausführen von Combofix wird folgendes Fenster gezeigt: Code:
ATTFilter This machine does not have the 'Microsoft Windows recovery console' installed. Alternately, an existing installation of the recovery console may be present but requires updating.
Without it, ComboFix shall not attempt the fixing of some serious infections.
Click 'Yes' to have ComboFix download/install it.
NOTE: this requires an active internet connection.
PS: obwohl ich Antivir deaktiviert habe hat ComboFix gemeldet, dass es noch läuft..? warum? |
|
11.01.2012, 23:39
| #12 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden ..zu den Kapersky TDSS-Killer-Schritt: soll ich mit den 9 gefundenen Objekten irgendwas machen oder einfach nur so lassen? (siehe TDSS-Killer logfile im vorigen Post) "21:07:34.0093 3052 Detected object count: 9" PS: habe Combofix abgebrochen und warte auf neue Instruktionen Morgen was ich tun soll ohne CD.. Beim runterfahren wurden 9 neue Updates von Windows installiert und beim wieder hochfahren kamen immer noch diese zwei Fehlermeldungen: Code:
ATTFilter „C:\WINDOWS\inf\Other.exe" konnte nicht gefunden werden. Stellen Sie sicher, dass Sie den Namen korrekt eingegeben haben und wiederholen Sie den Vorgang. Klicken Sie auf "Start" und anschließend auf "Suchen", um eine Datei zu suchen.“ und
„Die in der Registrierung angegebene Anwendung „C:\WINDOWS\inf\\Other.exe“ konnte nicht geladen oder gestartet werden. Stellen Sie sicher, dass die Datei vorhanden ist, oder entfernen Sie den Eintrag mit Bezug auf diese Datei aus der Registrierung.“
|
|
12.01.2012, 19:00
| #13 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhandenZitat:
Natürlich sollst du die WHK installieren
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.01.2012, 20:01
| #14 |
| | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden sry...hab da was falsch verstanden.... nach den 50 Stufen stand noch kurz prepare deleting files oder ähnliches (war nur kurz zu sehen) und dann kam wieder der blaue Bildschirm mit: Code:
ATTFilter „ A problem has been detected and Windows has been shut down to prevent damage to your computer.
BAD_POOL_HEADER
If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:
Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.
If problems continue, disable BIOS memory or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
Technical information:
***STOP: 0x00000019 (0x00000020, 0x856AB000, 0x856AB828, 0x1B050000)
Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further assistance.”
|
|
12.01.2012, 20:25
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden Starte Windows neu, lösch die alte combofix.exe, lade CF neu runter und probier es bitte nochmal.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu "Aus Sicherheitsgründen wurde ihr System (...)" Trojaner & mehr - Logfiles bereits vorhanden |
| administrator, adware.clicker, antivir, bildschirm, computer, continue, dateisystem, down, ebay, entfernen, error, explorer, fehlermeldung, gesperrt, heuristiks/extra, heuristiks/shuriken, hook, iexplore.exe, installation, locker, neustart, nicht gefunden, problem, programme, rechner gesperrt, scan, schwarzer bildschirm, senden, shut down, stop: 0x00000019, system, trojaner, updates, windows, windows updates, wurde ihr |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Hybrid-Darstellung
