| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Alle Dateien versteckt nach Befall mit S.M.A.R.T VerschlüsselungstrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
19.06.2012, 08:05
| #16 |
 |  Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Hier ist die Log-File zum Fix. Zum Durchführen des Fixes habe ich Windows XP im abgesicherten Modues laufen lassen, da ich im normalen Modues keine Möglichkeit gefunden habe, den Virenscanner (Antivir) zu beenden, ohne ihn komplett zu deinstallieren. Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}\ not found.
Registry key HKEY_USERS\S-1-5-21-1060284298-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}\ not found.
Prefs.js: "SearchTheWeb" removed from browser.search.defaultenginename
Prefs.js: "Search Results" removed from browser.search.order.1
Prefs.js: "Search Results" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.iminent.com/?appId=ee260527-9c9f-4499-801f-41e10fbdeac4&lcid=1031&ref=homepage" removed from browser.startup.homepage
Prefs.js: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\lib folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\defaults\custombuttons folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\defaults\contenthandling folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\defaults\components folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\components folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\searchbar folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\options folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\uwa folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio\images folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio\css folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\images folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\css folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\modules folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\lib folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data\search folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\components folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6 folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\searchplugins\SearchTheWeb.xml moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\searchplugins\Search_Results.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\SearchTheWeb.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\Search_Results.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58124A0B-DC32-4180-9BFF-E0E21AE34026}\ deleted successfully.
C:\Programme\IMinent Toolbar\tbcore3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0}\ deleted successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ deleted successfully.
C:\Programme\Iminent\Iminent.WebBooster.InternetExplorer.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\ deleted successfully.
File C:\Programme\IMinent Toolbar\tbcore3.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
File C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1060284298-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\ not found.
File C:\Programme\IMinent Toolbar\tbcore3.dll not found.
Registry value HKEY_USERS\S-1-5-21-1060284298-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
File C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR deleted successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Iminent deleted successfully.
C:\Programme\Iminent\Iminent.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IminentMessenger deleted successfully.
C:\Programme\Iminent\Iminent.Messengers.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutorun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutorun not found.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1060284298-2111687655-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55d9909e-7c5c-11db-be65-0016e6808e97}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55d9909e-7c5c-11db-be65-0016e6808e97}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55d9909e-7c5c-11db-be65-0016e6808e97}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55d9909e-7c5c-11db-be65-0016e6808e97}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55d9909e-7c5c-11db-be65-0016e6808e97}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55d9909e-7c5c-11db-be65-0016e6808e97}\ not found.
File J:\autorun.exe not found.
========== FILES ==========
C:\Programme\Iminent\webbooster@iminent.com\defaults\preferences folder moved successfully.
C:\Programme\Iminent\webbooster@iminent.com\defaults folder moved successfully.
C:\Programme\Iminent\webbooster@iminent.com\chrome\content folder moved successfully.
C:\Programme\Iminent\webbooster@iminent.com\chrome folder moved successfully.
C:\Programme\Iminent\webbooster@iminent.com folder moved successfully.
C:\Programme\Iminent\tr folder moved successfully.
C:\Programme\Iminent\ro folder moved successfully.
C:\Programme\Iminent\it folder moved successfully.
C:\Programme\Iminent\inst\Bootstrapper folder moved successfully.
C:\Programme\Iminent\inst folder moved successfully.
C:\Programme\Iminent\fr folder moved successfully.
C:\Programme\Iminent\es folder moved successfully.
C:\Programme\Iminent\en folder moved successfully.
C:\Programme\Iminent\de folder moved successfully.
C:\Programme\Iminent folder moved successfully.
C:\Programme\IMinent Toolbar folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\components folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\searchbar folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\options folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\uwa folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\images folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\css folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\images folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\css folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin\lib folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\skin folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content\widgets folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content\modules folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content\lib folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content\data\search folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content\data folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome\content folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\chrome folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\components folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr\FirefoxExtension folder moved successfully.
C:\Programme\Windows Searchqu Toolbar\Datamngr folder moved successfully.
C:\Programme\Windows Searchqu Toolbar folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Iminent\Mediator\Datas folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Iminent\Mediator folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Iminent folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\include_files folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\cache folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} folder moved successfully.
C:\Dokumente und Einstellungen\***************\Anwendungsdaten\Toolbar4 folder moved successfully.
File\Folder C:\Programme\IMinent Toolbar not found.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Iminent\Mediator\Datas\Cache\apix.iminent.com folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Iminent\Mediator\Datas\Cache folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Iminent\Mediator\Datas folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Iminent\Mediator folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Iminent folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Iminent folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: ***************
->Temp folder emptied: 2062642705 bytes
->Temporary Internet Files folder emptied: 710400341 bytes
->Java cache emptied: 57755791 bytes
->FireFox cache emptied: 100443155 bytes
->Flash cache emptied: 8346956 bytes
User: LocalService
->Temp folder emptied: 82513 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 348 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 3091847 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 104064 bytes
Windows Temp folder emptied: 183277332 bytes
RecycleBin emptied: 7115661750 bytes
Total Files Cleaned = 9.769,00 mb
[EMPTYFLASH]
User: All Users
User: Default User
User: ***************
->Flash cache emptied: 0 bytes
User: LocalService
->Flash cache emptied: 0 bytes
User: NetworkService
Total Flash Files Cleaned = 0,00 mb
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.49.0 log created on 06192012_083826
Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\***************\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\OINVXB8E\software_devicedrivers;sz=300x250;kl=N;klg=de;kga=-1;kr=F;kw=fox+the+fox+precious+little+diamond;kgg=-1;kcr=de;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=8482917688311691[2] not found!
File\Folder C:\Dokumente und Einstellungen\***************\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\HUCZZVNF\music_musicretailers;sz=300x250;kl=N;klg=de;kga=-1;kr=F;kw=disco+band+scotch;kgg=-1;kcr=de;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=7339057191555076[2] not found!
Registry entries deleted on Reboot...
|
|
19.06.2012, 08:47
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html
__________________Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm! Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C  nach, da speichert der TDSS-Killer seine Logs.Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten! 
__________________ |
|
19.06.2012, 13:13
| #18 |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Hmm, wenn das Ganze im normalen Windows-Modus durchgeführt werden muss, dann muss ich noch einmal überprüfen, ob ich doch noch eine Möglichkeit finde, Avira Antivir zu deaktivieren, ohne es zu deinstallieren...
__________________ |
|
19.06.2012, 14:37
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Na, dann mach es im abgesicherten Modus
__________________ Logfiles bitte immer in CODE-Tags posten |
|
20.06.2012, 07:41
| #20 |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Okay, hier ist das Ergebnis: Code:
ATTFilter 07:56:59.0125 0984 TDSS rootkit removing tool 2.7.40.0 Jun 15 2012 15:13:31
07:56:59.0140 0984 ============================================================
07:56:59.0140 0984 Current date / time: 2012/06/20 07:56:59.0140
07:56:59.0140 0984 SystemInfo:
07:56:59.0140 0984
07:56:59.0140 0984 OS Version: 5.1.2600 ServicePack: 3.0
07:56:59.0140 0984 Product type: Workstation
07:56:59.0140 0984 ComputerName: *****-29F472617
07:56:59.0140 0984 UserName: **************
07:56:59.0140 0984 Windows directory: C:\WINDOWS
07:56:59.0140 0984 System windows directory: C:\WINDOWS
07:56:59.0140 0984 Processor architecture: Intel x86
07:56:59.0140 0984 Number of processors: 2
07:56:59.0140 0984 Page size: 0x1000
07:56:59.0140 0984 Boot type: Safe boot
07:56:59.0140 0984 ============================================================
07:57:00.0187 0984 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
07:57:00.0187 0984 ============================================================
07:57:00.0187 0984 \Device\Harddisk0\DR0:
07:57:00.0187 0984 MBR partitions:
07:57:00.0187 0984 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xAFC6752
07:57:00.0203 0984 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xAFC67D0, BlocksNum 0x61AB7E8
07:57:00.0218 0984 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x11171FF7, BlocksNum 0x2711637
07:57:00.0234 0984 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x1388366D, BlocksNum 0x9940F14
07:57:00.0234 0984 ============================================================
07:57:00.0265 0984 C: <-> \Device\Harddisk0\DR0\Partition0
07:57:00.0312 0984 M: <-> \Device\Harddisk0\DR0\Partition1
07:57:00.0375 0984 O: <-> \Device\Harddisk0\DR0\Partition2
07:57:00.0437 0984 P: <-> \Device\Harddisk0\DR0\Partition3
07:57:00.0515 0984 ============================================================
07:57:00.0515 0984 Initialize success
07:57:00.0515 0984 ============================================================
07:57:28.0609 1028 ============================================================
07:57:28.0609 1028 Scan started
07:57:28.0609 1028 Mode: Manual; SigCheck; TDLFS;
07:57:28.0609 1028 ============================================================
07:57:28.0875 1028 Abiosdsk - ok
07:57:28.0890 1028 abp480n5 - ok
07:57:28.0968 1028 ACEDRV05 (0a1e97197609f92d2425b67da0bb0a7f) C:\WINDOWS\system32\drivers\ACEDRV05.sys
07:57:29.0515 1028 ACEDRV05 ( UnsignedFile.Multi.Generic ) - warning
07:57:29.0515 1028 ACEDRV05 - detected UnsignedFile.Multi.Generic (1)
07:57:29.0546 1028 ACEDRV06 (44010948bde6ade50dd1386657c73e83) C:\WINDOWS\system32\drivers\ACEDRV06.sys
07:57:29.0562 1028 ACEDRV06 ( UnsignedFile.Multi.Generic ) - warning
07:57:29.0562 1028 ACEDRV06 - detected UnsignedFile.Multi.Generic (1)
07:57:29.0609 1028 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
07:57:30.0437 1028 ACPI - ok
07:57:30.0468 1028 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
07:57:30.0593 1028 ACPIEC - ok
07:57:30.0656 1028 ACS (8cddbfcdac7226fe0202c7338107725b) C:\WINDOWS\system32\acs.exe
07:57:30.0718 1028 ACS ( UnsignedFile.Multi.Generic ) - warning
07:57:30.0718 1028 ACS - detected UnsignedFile.Multi.Generic (1)
07:57:30.0765 1028 Adobe LM Service (c1eb9968ec89fba5f3a264e2e57923ab) C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
07:57:30.0781 1028 Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning
07:57:30.0781 1028 Adobe LM Service - detected UnsignedFile.Multi.Generic (1)
07:57:30.0843 1028 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
07:57:30.0875 1028 AdobeFlashPlayerUpdateSvc - ok
07:57:30.0890 1028 adpu160m - ok
07:57:30.0921 1028 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
07:57:31.0046 1028 aec - ok
07:57:31.0078 1028 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
07:57:31.0140 1028 AFD - ok
07:57:31.0140 1028 Aha154x - ok
07:57:31.0171 1028 aic78u2 - ok
07:57:31.0187 1028 aic78xx - ok
07:57:31.0218 1028 Alerter (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
07:57:31.0343 1028 Alerter - ok
07:57:31.0359 1028 ALG (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
07:57:31.0421 1028 ALG - ok
07:57:31.0421 1028 AliIde - ok
07:57:31.0453 1028 amsint - ok
07:57:31.0546 1028 AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
07:57:31.0562 1028 AntiVirSchedulerService - ok
07:57:31.0609 1028 AntiVirService (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
07:57:31.0625 1028 AntiVirService - ok
07:57:31.0671 1028 AnyDVD (64f24088dbb1d68ee9963f66f8eb68cf) C:\WINDOWS\system32\Drivers\AnyDVD.sys
07:57:31.0890 1028 AnyDVD - ok
07:57:31.0968 1028 Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
07:57:31.0984 1028 Apple Mobile Device - ok
07:57:31.0984 1028 AppMgmt - ok
07:57:32.0031 1028 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
07:57:32.0156 1028 Arp1394 - ok
07:57:32.0171 1028 asc - ok
07:57:32.0187 1028 asc3350p - ok
07:57:32.0218 1028 asc3550 - ok
07:57:32.0296 1028 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
07:57:32.0343 1028 aspnet_state - ok
07:57:32.0375 1028 asuskbnt (f5c2ccdb273a546e9c3a15250f1d9165) C:\WINDOWS\system32\drivers\atkkbnt.sys
07:57:32.0390 1028 asuskbnt ( UnsignedFile.Multi.Generic ) - warning
07:57:32.0390 1028 asuskbnt - detected UnsignedFile.Multi.Generic (1)
07:57:32.0406 1028 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
07:57:32.0515 1028 AsyncMac - ok
07:57:32.0531 1028 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
07:57:32.0656 1028 atapi - ok
07:57:32.0656 1028 Atdisk - ok
07:57:32.0703 1028 ATKKeyboardService (fd2c83a58feab0751e723b1676bdbf46) C:\WINDOWS\ATKKBService.exe
07:57:34.0937 1028 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - warning
07:57:34.0937 1028 ATKKeyboardService - detected UnsignedFile.Multi.Generic (1)
07:57:35.0000 1028 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
07:57:35.0125 1028 Atmarpc - ok
07:57:35.0171 1028 AudioSrv (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
07:57:35.0328 1028 AudioSrv - ok
07:57:35.0375 1028 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
07:57:35.0468 1028 audstub - ok
07:57:35.0515 1028 avgntflt (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
07:57:35.0531 1028 avgntflt - ok
07:57:35.0578 1028 avipbb (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
07:57:35.0609 1028 avipbb - ok
07:57:35.0656 1028 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
07:57:35.0671 1028 avkmgr - ok
07:57:35.0750 1028 BBSvc (6f8638ea0a55d65b03e24f6d1153d8f7) C:\Programme\Microsoft\BingBar\BBSvc.EXE
07:57:35.0781 1028 BBSvc - ok
07:57:35.0812 1028 BBUpdate (785de7abda13309d6065305542829e76) C:\Programme\Microsoft\BingBar\SeaPort.EXE
07:57:35.0843 1028 BBUpdate - ok
07:57:35.0875 1028 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
07:57:35.0984 1028 Beep - ok
07:57:36.0046 1028 BITS (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
07:57:36.0281 1028 BITS - ok
07:57:36.0359 1028 Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Programme\Bonjour\mDNSResponder.exe
07:57:36.0375 1028 Bonjour Service - ok
07:57:36.0437 1028 Browser (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
07:57:36.0546 1028 Browser - ok
07:57:36.0578 1028 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
07:57:36.0687 1028 cbidf2k - ok
07:57:36.0703 1028 cd20xrnt - ok
07:57:36.0734 1028 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
07:57:36.0843 1028 Cdaudio - ok
07:57:36.0875 1028 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
07:57:37.0000 1028 Cdfs - ok
07:57:37.0015 1028 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
07:57:37.0140 1028 Cdrom - ok
07:57:37.0156 1028 Changer - ok
07:57:37.0187 1028 CiSvc (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
07:57:37.0296 1028 CiSvc - ok
07:57:37.0328 1028 ClipSrv (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
07:57:37.0437 1028 ClipSrv - ok
07:57:37.0515 1028 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
07:57:37.0593 1028 clr_optimization_v2.0.50727_32 - ok
07:57:37.0656 1028 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
07:57:37.0671 1028 clr_optimization_v4.0.30319_32 - ok
07:57:37.0687 1028 CmdIde - ok
07:57:37.0765 1028 cmpci (e5842ccf0953d3d46d5e26427b67e901) C:\WINDOWS\system32\drivers\cmaudio.sys
07:57:37.0828 1028 cmpci - ok
07:57:37.0843 1028 COMSysApp - ok
07:57:37.0890 1028 Cpqarray - ok
07:57:37.0921 1028 CryptSvc (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
07:57:38.0046 1028 CryptSvc - ok
07:57:38.0062 1028 dac2w2k - ok
07:57:38.0078 1028 dac960nt - ok
07:57:38.0140 1028 DcomLaunch (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
07:57:38.0203 1028 DcomLaunch - ok
07:57:38.0265 1028 Dhcp (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
07:57:38.0375 1028 Dhcp - ok
07:57:38.0406 1028 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
07:57:38.0515 1028 Disk - ok
07:57:38.0531 1028 dmadmin - ok
07:57:38.0609 1028 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
07:57:38.0750 1028 dmboot - ok
07:57:38.0781 1028 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
07:57:38.0890 1028 dmio - ok
07:57:38.0921 1028 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
07:57:39.0031 1028 dmload - ok
07:57:39.0062 1028 dmserver (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
07:57:39.0187 1028 dmserver - ok
07:57:39.0218 1028 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
07:57:39.0312 1028 DMusic - ok
07:57:39.0343 1028 DNINDIS5 (d2ee54cdbced01d48f2b18642be79a98) C:\WINDOWS\system32\DNINDIS5.SYS
07:57:39.0359 1028 DNINDIS5 ( UnsignedFile.Multi.Generic ) - warning
07:57:39.0359 1028 DNINDIS5 - detected UnsignedFile.Multi.Generic (1)
07:57:39.0390 1028 Dnscache (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
07:57:39.0453 1028 Dnscache - ok
07:57:39.0484 1028 Dot3svc (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
07:57:39.0593 1028 Dot3svc - ok
07:57:39.0609 1028 dpti2o - ok
07:57:39.0656 1028 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
07:57:39.0750 1028 drmkaud - ok
07:57:39.0781 1028 EapHost (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
07:57:39.0890 1028 EapHost - ok
07:57:39.0921 1028 EIO (6f41da43aa4806a7bdbb2f9a8b05023e) C:\WINDOWS\system32\drivers\EIO.sys
07:57:39.0921 1028 EIO ( UnsignedFile.Multi.Generic ) - warning
07:57:39.0921 1028 EIO - detected UnsignedFile.Multi.Generic (1)
07:57:39.0953 1028 ElbyCDFL (c61c83501268b0110b5c5db7e63dee0c) C:\WINDOWS\system32\Drivers\ElbyCDFL.sys
07:57:39.0968 1028 ElbyCDFL ( UnsignedFile.Multi.Generic ) - warning
07:57:39.0968 1028 ElbyCDFL - detected UnsignedFile.Multi.Generic (1)
07:57:40.0000 1028 ElbyCDIO (d71233d7ccc2e64f8715a20428d5a33b) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
07:57:40.0015 1028 ElbyCDIO - ok
07:57:40.0046 1028 ERSvc (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
07:57:40.0156 1028 ERSvc - ok
07:57:40.0187 1028 Eventlog (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
07:57:40.0234 1028 Eventlog - ok
07:57:40.0296 1028 EventSystem (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
07:57:40.0328 1028 EventSystem - ok
07:57:40.0359 1028 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
07:57:40.0484 1028 Fastfat - ok
07:57:40.0515 1028 FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
07:57:40.0562 1028 FastUserSwitchingCompatibility - ok
07:57:40.0593 1028 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
07:57:40.0687 1028 Fdc - ok
07:57:40.0734 1028 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
07:57:40.0859 1028 Fips - ok
07:57:40.0890 1028 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
07:57:41.0015 1028 Flpydisk - ok
07:57:41.0046 1028 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
07:57:41.0156 1028 FltMgr - ok
07:57:41.0281 1028 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
07:57:41.0296 1028 FontCache3.0.0.0 - ok
07:57:41.0328 1028 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
07:57:41.0437 1028 Fs_Rec - ok
07:57:41.0453 1028 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
07:57:41.0562 1028 Ftdisk - ok
07:57:41.0578 1028 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
07:57:41.0703 1028 gameenum - ok
07:57:41.0734 1028 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
07:57:41.0750 1028 GEARAspiWDM - ok
07:57:41.0781 1028 ggsemc (52ada45f60d6382c9b3c52826cdb9d26) C:\WINDOWS\system32\DRIVERS\ggsemc.sys
07:57:41.0796 1028 ggsemc ( UnsignedFile.Multi.Generic ) - warning
07:57:41.0796 1028 ggsemc - detected UnsignedFile.Multi.Generic (1)
07:57:41.0812 1028 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
07:57:41.0921 1028 Gpc - ok
07:57:42.0000 1028 gusvc (751c1d2ca2abf4a9f5a6b8d7d45b907c) C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
07:57:42.0015 1028 gusvc - ok
07:57:42.0046 1028 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
07:57:42.0156 1028 HDAudBus - ok
07:57:42.0187 1028 HECI (f971d05559ce11ee22af7a7dce6bcfad) C:\WINDOWS\system32\DRIVERS\HECI.sys
07:57:42.0187 1028 HECI ( UnsignedFile.Multi.Generic ) - warning
07:57:42.0187 1028 HECI - detected UnsignedFile.Multi.Generic (1)
07:57:42.0234 1028 helpsvc (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
07:57:42.0343 1028 helpsvc - ok
07:57:42.0390 1028 HidServ (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
07:57:42.0484 1028 HidServ - ok
07:57:42.0500 1028 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
07:57:42.0609 1028 HidUsb - ok
07:57:42.0640 1028 hkmsvc (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
07:57:42.0750 1028 hkmsvc - ok
07:57:42.0750 1028 hpn - ok
07:57:42.0812 1028 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
07:57:42.0843 1028 HTTP - ok
07:57:42.0859 1028 HTTPFilter (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
07:57:42.0984 1028 HTTPFilter - ok
07:57:43.0000 1028 i2omgmt - ok
07:57:43.0015 1028 i2omp - ok
07:57:43.0046 1028 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
07:57:43.0171 1028 i8042prt - ok
07:57:43.0218 1028 IAANTMON (3f28b1e3e98b9eeac1add1f7b69bde77) C:\Programme\Intel\Intel Matrix Storage Manager\Iaantmon.exe
07:57:43.0234 1028 IAANTMON ( UnsignedFile.Multi.Generic ) - warning
07:57:43.0234 1028 IAANTMON - detected UnsignedFile.Multi.Generic (1)
07:57:43.0265 1028 iaStor (294110966cedd127629c5be48367c8cf) C:\WINDOWS\system32\drivers\iaStor.sys
07:57:43.0265 1028 iaStor ( UnsignedFile.Multi.Generic ) - warning
07:57:43.0265 1028 iaStor - detected UnsignedFile.Multi.Generic (1)
07:57:43.0421 1028 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
07:57:43.0453 1028 idsvc - ok
07:57:43.0484 1028 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
07:57:43.0593 1028 Imapi - ok
07:57:43.0625 1028 ImapiService (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
07:57:43.0734 1028 ImapiService - ok
07:57:43.0750 1028 InCDFs - ok
07:57:43.0765 1028 InCDPass - ok
07:57:43.0781 1028 InCDRm - ok
07:57:43.0812 1028 ini910u - ok
07:57:44.0109 1028 IntcAzAudAddService (6197403d9e9027d55052bb16ccf33cca) C:\WINDOWS\system32\drivers\RtkHDAud.sys
07:57:44.0296 1028 IntcAzAudAddService ( UnsignedFile.Multi.Generic ) - warning
07:57:44.0296 1028 IntcAzAudAddService - detected UnsignedFile.Multi.Generic (1)
07:57:44.0406 1028 IntelIde - ok
07:57:44.0437 1028 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
07:57:44.0546 1028 intelppm - ok
07:57:44.0578 1028 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
07:57:44.0687 1028 Ip6Fw - ok
07:57:44.0718 1028 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
07:57:44.0828 1028 IpFilterDriver - ok
07:57:44.0859 1028 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
07:57:44.0953 1028 IpInIp - ok
07:57:44.0984 1028 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
07:57:45.0093 1028 IpNat - ok
07:57:45.0203 1028 iPod Service (b84a28b3984185eda8867541af14cddb) C:\Programme\iPod\bin\iPodService.exe
07:57:45.0234 1028 iPod Service - ok
07:57:45.0265 1028 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
07:57:45.0375 1028 IPSec - ok
07:57:45.0390 1028 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
07:57:45.0453 1028 IRENUM - ok
07:57:45.0500 1028 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
07:57:45.0609 1028 isapnp - ok
07:57:45.0640 1028 JGOGO (c995c0e8b4503fac38793bb0236ad246) C:\WINDOWS\system32\DRIVERS\JGOGO.sys
07:57:45.0656 1028 JGOGO ( UnsignedFile.Multi.Generic ) - warning
07:57:45.0656 1028 JGOGO - detected UnsignedFile.Multi.Generic (1)
07:57:45.0656 1028 JRAID (06b9c22897ebdc6aba993c77f173d882) C:\WINDOWS\system32\DRIVERS\jraid.sys
07:57:45.0671 1028 JRAID ( UnsignedFile.Multi.Generic ) - warning
07:57:45.0671 1028 JRAID - detected UnsignedFile.Multi.Generic (1)
07:57:45.0750 1028 jswpsapi (396c4dbcf101bed7487219025ffdbf75) C:\Programme\NETGEAR\WN111v2\jswpsapi.exe
07:57:45.0765 1028 jswpsapi ( UnsignedFile.Multi.Generic ) - warning
07:57:45.0765 1028 jswpsapi - detected UnsignedFile.Multi.Generic (1)
07:57:45.0796 1028 JSWSCIMD (ad67795900aa8c05cc4570f5349e0639) C:\WINDOWS\system32\DRIVERS\jswscimd.sys
07:57:45.0859 1028 JSWSCIMD - ok
07:57:45.0875 1028 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
07:57:45.0984 1028 Kbdclass - ok
07:57:46.0015 1028 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
07:57:46.0109 1028 kbdhid - ok
07:57:46.0156 1028 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
07:57:46.0265 1028 kmixer - ok
07:57:46.0296 1028 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
07:57:46.0359 1028 KSecDD - ok
07:57:46.0421 1028 lanmanserver (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
07:57:46.0468 1028 lanmanserver - ok
07:57:46.0500 1028 lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
07:57:46.0546 1028 lanmanworkstation - ok
07:57:46.0562 1028 lbrtfdc - ok
07:57:46.0609 1028 LmHosts (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
07:57:46.0718 1028 LmHosts - ok
07:57:46.0765 1028 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
07:57:46.0781 1028 MBAMProtector - ok
07:57:46.0875 1028 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
07:57:46.0937 1028 MBAMService - ok
07:57:46.0953 1028 Messenger (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
07:57:47.0078 1028 Messenger - ok
07:57:47.0093 1028 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
07:57:47.0187 1028 mnmdd - ok
07:57:47.0218 1028 mnmsrvc (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
07:57:47.0328 1028 mnmsrvc - ok
07:57:47.0359 1028 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
07:57:47.0468 1028 Modem - ok
07:57:47.0484 1028 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
07:57:47.0593 1028 Mouclass - ok
07:57:47.0609 1028 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
07:57:47.0718 1028 mouhid - ok
07:57:47.0750 1028 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
07:57:47.0843 1028 MountMgr - ok
07:57:47.0890 1028 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
07:57:47.0906 1028 MozillaMaintenance - ok
07:57:47.0921 1028 mraid35x - ok
07:57:47.0953 1028 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
07:57:48.0062 1028 MRxDAV - ok
07:57:48.0093 1028 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
07:57:48.0171 1028 MRxSmb - ok
07:57:48.0203 1028 MSDTC (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
07:57:48.0296 1028 MSDTC - ok
07:57:48.0343 1028 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
07:57:48.0453 1028 Msfs - ok
07:57:48.0468 1028 MSIServer - ok
07:57:48.0500 1028 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
07:57:48.0593 1028 MSKSSRV - ok
07:57:48.0609 1028 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
07:57:48.0703 1028 MSPCLOCK - ok
07:57:48.0718 1028 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
07:57:48.0828 1028 MSPQM - ok
07:57:48.0843 1028 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
07:57:48.0953 1028 mssmbios - ok
07:57:48.0968 1028 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
07:57:49.0000 1028 Mup - ok
07:57:49.0031 1028 MxlW2k (a1520761f42dbb06db7929d6fa9753ea) C:\WINDOWS\system32\drivers\MxlW2k.sys
07:57:49.0031 1028 MxlW2k ( UnsignedFile.Multi.Generic ) - warning
07:57:49.0031 1028 MxlW2k - detected UnsignedFile.Multi.Generic (1)
07:57:49.0093 1028 napagent (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
07:57:49.0203 1028 napagent - ok
07:57:49.0234 1028 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
07:57:49.0328 1028 NDIS - ok
07:57:49.0343 1028 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
07:57:49.0375 1028 NdisTapi - ok
07:57:49.0406 1028 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
07:57:49.0515 1028 Ndisuio - ok
07:57:49.0531 1028 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
07:57:49.0640 1028 NdisWan - ok
07:57:49.0671 1028 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
07:57:49.0687 1028 NDProxy - ok
07:57:49.0718 1028 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
07:57:49.0812 1028 NetBIOS - ok
07:57:49.0859 1028 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
07:57:49.0968 1028 NetBT - ok
07:57:50.0000 1028 NetDDE (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
07:57:50.0109 1028 NetDDE - ok
07:57:50.0125 1028 NetDDEdsdm (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
07:57:50.0218 1028 NetDDEdsdm - ok
07:57:50.0250 1028 Netlogon (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
07:57:50.0359 1028 Netlogon - ok
07:57:50.0406 1028 Netman (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
07:57:50.0515 1028 Netman - ok
07:57:50.0609 1028 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
07:57:50.0625 1028 NetTcpPortSharing - ok
07:57:50.0640 1028 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
07:57:50.0750 1028 NIC1394 - ok
07:57:50.0812 1028 Nla (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
07:57:50.0828 1028 Nla - ok
07:57:50.0843 1028 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
07:57:50.0953 1028 Npfs - ok
07:57:51.0015 1028 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
07:57:51.0140 1028 Ntfs - ok
07:57:51.0171 1028 NtLmSsp (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
07:57:51.0281 1028 NtLmSsp - ok
07:57:51.0328 1028 NtmsSvc (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
07:57:51.0453 1028 NtmsSvc - ok
07:57:51.0468 1028 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
07:57:51.0562 1028 Null - ok
07:57:51.0953 1028 nv (70cb8915895ccb92ddf23ce890c4f5be) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
07:57:52.0281 1028 nv - ok
07:57:52.0375 1028 NVSvc (f96df45cfbdc670584293e03c2ab602a) C:\WINDOWS\system32\nvsvc32.exe
07:57:52.0406 1028 NVSvc - ok
07:57:52.0468 1028 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
07:57:52.0609 1028 NwlnkFlt - ok
07:57:52.0671 1028 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
07:57:52.0781 1028 NwlnkFwd - ok
07:57:52.0843 1028 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
07:57:52.0953 1028 ohci1394 - ok
07:57:53.0062 1028 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
07:57:53.0062 1028 ose - ok
07:57:53.0109 1028 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
07:57:53.0203 1028 Parport - ok
07:57:53.0234 1028 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
07:57:53.0343 1028 PartMgr - ok
07:57:53.0375 1028 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
07:57:53.0484 1028 ParVdm - ok
07:57:53.0500 1028 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
07:57:53.0593 1028 PCI - ok
07:57:53.0609 1028 PCIDump - ok
07:57:53.0625 1028 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
07:57:53.0718 1028 PCIIde - ok
07:57:53.0765 1028 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
07:57:53.0859 1028 Pcmcia - ok
07:57:53.0875 1028 PDCOMP - ok
07:57:53.0890 1028 PDFRAME - ok
07:57:53.0906 1028 PDRELI - ok
07:57:53.0937 1028 PDRFRAME - ok
07:57:53.0953 1028 perc2 - ok
07:57:53.0968 1028 perc2hib - ok
07:57:54.0062 1028 PlugPlay (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
07:57:54.0078 1028 PlugPlay - ok
07:57:54.0109 1028 PolicyAgent (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
07:57:54.0203 1028 PolicyAgent - ok
07:57:54.0234 1028 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
07:57:54.0343 1028 PptpMiniport - ok
07:57:54.0375 1028 PQNTDrv (4228630829c0e521c43d882a00533374) C:\WINDOWS\system32\drivers\PQNTDrv.sys
07:57:54.0390 1028 PQNTDrv ( UnsignedFile.Multi.Generic ) - warning
07:57:54.0390 1028 PQNTDrv - detected UnsignedFile.Multi.Generic (1)
07:57:54.0390 1028 ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
07:57:54.0484 1028 ProtectedStorage - ok
07:57:54.0500 1028 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
07:57:54.0609 1028 PSched - ok
07:57:54.0625 1028 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
07:57:54.0750 1028 Ptilink - ok
07:57:54.0781 1028 PxHelp20 (1962166e0ceb740704f30fa55ad3d509) C:\WINDOWS\system32\Drivers\PxHelp20.sys
07:57:54.0781 1028 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
07:57:54.0781 1028 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
07:57:54.0796 1028 ql1080 - ok
07:57:54.0812 1028 Ql10wnt - ok
07:57:54.0828 1028 ql12160 - ok
07:57:54.0859 1028 ql1240 - ok
07:57:54.0875 1028 ql1280 - ok
07:57:54.0906 1028 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
07:57:55.0000 1028 RasAcd - ok
07:57:55.0031 1028 RasAuto (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
07:57:55.0140 1028 RasAuto - ok
07:57:55.0171 1028 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
07:57:55.0265 1028 Rasl2tp - ok
07:57:55.0312 1028 RasMan (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
07:57:55.0406 1028 RasMan - ok
07:57:55.0421 1028 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
07:57:55.0531 1028 RasPppoe - ok
07:57:55.0546 1028 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
07:57:55.0640 1028 Raspti - ok
07:57:55.0671 1028 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
07:57:55.0781 1028 Rdbss - ok
07:57:55.0796 1028 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
07:57:55.0906 1028 RDPCDD - ok
07:57:55.0968 1028 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
07:57:56.0031 1028 RDPWD - ok
07:57:56.0078 1028 RDSessMgr (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
07:57:56.0171 1028 RDSessMgr - ok
07:57:56.0218 1028 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
07:57:56.0328 1028 redbook - ok
07:57:56.0359 1028 RemoteAccess (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
07:57:56.0468 1028 RemoteAccess - ok
07:57:56.0484 1028 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
07:57:56.0593 1028 ROOTMODEM - ok
07:57:56.0625 1028 RpcLocator (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
07:57:56.0734 1028 RpcLocator - ok
07:57:56.0796 1028 RpcSs (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
07:57:56.0812 1028 RpcSs - ok
07:57:56.0843 1028 RSVP (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
07:57:56.0953 1028 RSVP - ok
07:57:56.0953 1028 rt2870 - ok
07:57:56.0984 1028 SamSs (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
07:57:57.0078 1028 SamSs - ok
07:57:57.0109 1028 Samsung UPD Service (a4a640a4923e225c80012a902d95510d) C:\WINDOWS\system32\SUPDSvc.exe
07:57:57.0125 1028 Samsung UPD Service - ok
07:57:57.0156 1028 SCardSvr (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
07:57:57.0265 1028 SCardSvr - ok
07:57:57.0312 1028 Schedule (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
07:57:57.0421 1028 Schedule - ok
07:57:57.0468 1028 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
07:57:57.0515 1028 Secdrv - ok
07:57:57.0531 1028 seclogon (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
07:57:57.0640 1028 seclogon - ok
07:57:57.0671 1028 SENS (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
07:57:57.0765 1028 SENS - ok
07:57:57.0796 1028 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
07:57:57.0906 1028 serenum - ok
07:57:57.0921 1028 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
07:57:58.0015 1028 Serial - ok
07:57:58.0093 1028 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
07:57:58.0203 1028 Sfloppy - ok
07:57:58.0250 1028 SharedAccess (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
07:57:58.0375 1028 SharedAccess - ok
07:57:58.0406 1028 ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
07:57:58.0421 1028 ShellHWDetection - ok
07:57:58.0421 1028 Simbad - ok
07:57:58.0734 1028 Skype C2C Service (4ca43b85f22c7739311788b651a779cb) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
07:57:58.0875 1028 Skype C2C Service - ok
07:57:58.0953 1028 SkypeUpdate (17eab7852ff9f15fbaab4e95efc0b812) C:\Programme\Skype\Updater\Updater.exe
07:57:58.0968 1028 SkypeUpdate - ok
07:57:59.0093 1028 Sparrow - ok
07:57:59.0140 1028 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
07:57:59.0234 1028 splitter - ok
07:57:59.0265 1028 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
07:57:59.0296 1028 Spooler - ok
07:57:59.0375 1028 sptd (73205bd9a388639c210636793fe3fd61) C:\WINDOWS\system32\Drivers\sptd.sys
07:57:59.0375 1028 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 73205bd9a388639c210636793fe3fd61
07:57:59.0375 1028 sptd ( LockedFile.Multi.Generic ) - warning
07:57:59.0375 1028 sptd - detected LockedFile.Multi.Generic (1)
07:57:59.0390 1028 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
07:57:59.0437 1028 sr - ok
07:57:59.0484 1028 srservice (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
07:57:59.0531 1028 srservice - ok
07:57:59.0562 1028 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
07:57:59.0609 1028 Srv - ok
07:57:59.0640 1028 SSDPSRV (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
07:57:59.0687 1028 SSDPSRV - ok
07:57:59.0718 1028 SSHDRV84 (cfc9b1ca57b41323a721d5f01fb2f899) C:\WINDOWS\system32\drivers\SSHDRV84.sys
07:57:59.0734 1028 SSHDRV84 ( UnsignedFile.Multi.Generic ) - warning
07:57:59.0734 1028 SSHDRV84 - detected UnsignedFile.Multi.Generic (1)
07:57:59.0750 1028 SSHDRV86 (b9e31f2a3640403b0ea3a867bb73b9f4) C:\WINDOWS\system32\drivers\SSHDRV86.sys
07:57:59.0765 1028 SSHDRV86 ( UnsignedFile.Multi.Generic ) - warning
07:57:59.0765 1028 SSHDRV86 - detected UnsignedFile.Multi.Generic (1)
07:57:59.0812 1028 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
07:57:59.0812 1028 ssmdrv - ok
07:57:59.0859 1028 stisvc (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
07:58:00.0000 1028 stisvc - ok
07:58:00.0015 1028 SunkFilt (09dfd0f2199704a27b4953233c23a036) C:\WINDOWS\System32\Drivers\sunkfilt.sys
07:58:00.0015 1028 SunkFilt ( UnsignedFile.Multi.Generic ) - warning
07:58:00.0015 1028 SunkFilt - detected UnsignedFile.Multi.Generic (1)
07:58:00.0046 1028 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
07:58:00.0156 1028 swenum - ok
07:58:00.0187 1028 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
07:58:00.0296 1028 swmidi - ok
07:58:00.0296 1028 SwPrv - ok
07:58:00.0328 1028 symc810 - ok
07:58:00.0359 1028 symc8xx - ok
07:58:00.0375 1028 sym_hi - ok
07:58:00.0390 1028 sym_u3 - ok
07:58:00.0421 1028 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
07:58:00.0531 1028 sysaudio - ok
07:58:00.0546 1028 SysmonLog (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
07:58:00.0656 1028 SysmonLog - ok
07:58:00.0718 1028 TapiSrv (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
07:58:00.0828 1028 TapiSrv - ok
07:58:00.0890 1028 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
07:58:00.0921 1028 Tcpip - ok
07:58:00.0953 1028 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
07:58:01.0046 1028 TDPIPE - ok
07:58:01.0093 1028 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
07:58:01.0187 1028 TDTCP - ok
07:58:01.0218 1028 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
07:58:01.0312 1028 TermDD - ok
07:58:01.0359 1028 TermService (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
07:58:01.0453 1028 TermService - ok
07:58:01.0500 1028 Themes (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
07:58:01.0515 1028 Themes - ok
07:58:01.0515 1028 TosIde - ok
07:58:01.0546 1028 TrkWks (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
07:58:01.0656 1028 TrkWks - ok
07:58:01.0703 1028 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
07:58:01.0812 1028 Udfs - ok
07:58:01.0828 1028 ultra - ok
07:58:01.0890 1028 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
07:58:02.0015 1028 Update - ok
07:58:02.0046 1028 upnphost (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
07:58:02.0109 1028 upnphost - ok
07:58:02.0140 1028 UPS (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
07:58:02.0250 1028 UPS - ok
07:58:02.0281 1028 USBAAPL (026f7f224f088ee11e383bca448fff81) C:\WINDOWS\system32\Drivers\usbaapl.sys
07:58:02.0281 1028 USBAAPL ( UnsignedFile.Multi.Generic ) - warning
07:58:02.0281 1028 USBAAPL - detected UnsignedFile.Multi.Generic (1)
07:58:02.0312 1028 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
07:58:02.0421 1028 usbccgp - ok
07:58:02.0453 1028 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
07:58:02.0562 1028 usbehci - ok
07:58:02.0578 1028 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
07:58:02.0671 1028 usbhub - ok
07:58:02.0687 1028 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
07:58:02.0796 1028 usbprint - ok
07:58:02.0812 1028 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
07:58:02.0921 1028 usbscan - ok
07:58:02.0937 1028 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
07:58:03.0031 1028 USBSTOR - ok
07:58:03.0046 1028 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
07:58:03.0156 1028 usbuhci - ok
07:58:03.0156 1028 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
07:58:03.0265 1028 VgaSave - ok
07:58:03.0281 1028 ViaIde - ok
07:58:03.0312 1028 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
07:58:03.0406 1028 VolSnap - ok
07:58:03.0453 1028 VSS (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
07:58:03.0500 1028 VSS - ok
07:58:03.0531 1028 W32Time (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
07:58:03.0640 1028 W32Time - ok
07:58:03.0671 1028 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
07:58:03.0765 1028 Wanarp - ok
07:58:03.0796 1028 wceusbsh (dc7f91b2ed24a738c807ea07f298928c) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
07:58:03.0828 1028 wceusbsh - ok
07:58:03.0843 1028 WDICA - ok
07:58:03.0890 1028 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
07:58:04.0000 1028 wdmaud - ok
07:58:04.0015 1028 WebClient (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
07:58:04.0125 1028 WebClient - ok
07:58:04.0187 1028 winmgmt (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
07:58:04.0296 1028 winmgmt - ok
07:58:04.0437 1028 WinRM (f10075c2ec96d2eb118012e78ece2fc2) C:\WINDOWS\system32\WsmSvc.dll
07:58:04.0578 1028 WinRM - ok
07:58:04.0640 1028 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
07:58:04.0703 1028 WmdmPmSN - ok
07:58:04.0765 1028 WmiApSrv (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
07:58:04.0875 1028 WmiApSrv - ok
07:58:04.0984 1028 WMPNetworkSvc (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
07:58:05.0046 1028 WMPNetworkSvc - ok
07:58:05.0109 1028 WN111v2 (966860e5ea3591aa471ec9ced49dc8d2) C:\WINDOWS\system32\DRIVERS\WN111v2.sys
07:58:05.0171 1028 WN111v2 - ok
07:58:05.0203 1028 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
07:58:05.0203 1028 WpdUsb - ok
07:58:05.0359 1028 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
07:58:05.0390 1028 WPFFontCache_v0400 - ok
07:58:05.0453 1028 wscsvc (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
07:58:05.0546 1028 wscsvc - ok
07:58:05.0578 1028 WSIMD (43f767d59bfc25d8f4fc2eb42043ec1e) C:\WINDOWS\system32\DRIVERS\wsimd.sys
07:58:05.0593 1028 WSIMD ( UnsignedFile.Multi.Generic ) - warning
07:58:05.0593 1028 WSIMD - detected UnsignedFile.Multi.Generic (1)
07:58:05.0625 1028 wuauserv (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
07:58:05.0718 1028 wuauserv - ok
07:58:05.0765 1028 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
07:58:05.0796 1028 WudfPf - ok
07:58:05.0828 1028 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
07:58:05.0843 1028 WudfRd - ok
07:58:05.0859 1028 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
07:58:05.0875 1028 WudfSvc - ok
07:58:05.0937 1028 WZCSVC (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
07:58:06.0062 1028 WZCSVC - ok
07:58:06.0109 1028 xmlprov (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
07:58:06.0218 1028 xmlprov - ok
07:58:06.0250 1028 yukonwxp (4322c32ced8c4772e039616dcbf01d3f) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
07:58:06.0281 1028 yukonwxp - ok
07:58:06.0312 1028 z520bus (f0f412800d61bb5614fc567d272b4071) C:\WINDOWS\system32\DRIVERS\z520bus.sys
07:58:06.0343 1028 z520bus - ok
07:58:06.0375 1028 z520mdfl (c74e6f770617cd75a50bb655baa37a87) C:\WINDOWS\system32\DRIVERS\z520mdfl.sys
07:58:06.0453 1028 z520mdfl - ok
07:58:06.0484 1028 z520mdm (c5897913d4ce3d851573b52c33055cb2) C:\WINDOWS\system32\DRIVERS\z520mdm.sys
07:58:06.0515 1028 z520mdm - ok
07:58:06.0546 1028 z520mgmt (0e9c6528bbe7b83cb179ade881eaa38e) C:\WINDOWS\system32\DRIVERS\z520mgmt.sys
07:58:06.0562 1028 z520mgmt - ok
07:58:06.0593 1028 z520obex (f69d28f2b6d6f4493e564549a2d9816b) C:\WINDOWS\system32\DRIVERS\z520obex.sys
07:58:06.0593 1028 z520obex - ok
07:58:06.0656 1028 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
07:58:07.0156 1028 \Device\Harddisk0\DR0 - ok
07:58:07.0171 1028 Boot (0x1200) (ce393909314b93a6d39dff15e252b9a5) \Device\Harddisk0\DR0\Partition0
07:58:07.0171 1028 \Device\Harddisk0\DR0\Partition0 - ok
07:58:07.0187 1028 Boot (0x1200) (c9c30af5fee7f77597efe9a733adaec8) \Device\Harddisk0\DR0\Partition1
07:58:07.0203 1028 \Device\Harddisk0\DR0\Partition1 - ok
07:58:07.0234 1028 Boot (0x1200) (46bd63feb67b89c6ec3d289fbb27a02e) \Device\Harddisk0\DR0\Partition2
07:58:07.0234 1028 \Device\Harddisk0\DR0\Partition2 - ok
07:58:07.0250 1028 Boot (0x1200) (29259bcbbc937a3d2175d8a8042a31ab) \Device\Harddisk0\DR0\Partition3
07:58:07.0265 1028 \Device\Harddisk0\DR0\Partition3 - ok
07:58:07.0265 1028 ============================================================
07:58:07.0265 1028 Scan finished
07:58:07.0265 1028 ============================================================
07:58:07.0390 1020 Detected object count: 26
07:58:07.0390 1020 Actual detected object count: 26
07:59:29.0250 1020 ACEDRV05 ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0250 1020 ACEDRV05 ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0250 1020 ACEDRV06 ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0250 1020 ACEDRV06 ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0265 1020 ACS ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0265 1020 ACS ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0281 1020 Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0281 1020 Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0281 1020 asuskbnt ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0281 1020 asuskbnt ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0296 1020 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0296 1020 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0312 1020 DNINDIS5 ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0312 1020 DNINDIS5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0328 1020 EIO ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0328 1020 EIO ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0343 1020 ElbyCDFL ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0343 1020 ElbyCDFL ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0343 1020 ggsemc ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0343 1020 ggsemc ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0359 1020 HECI ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0359 1020 HECI ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0375 1020 IAANTMON ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0375 1020 IAANTMON ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0390 1020 iaStor ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0390 1020 iaStor ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0390 1020 IntcAzAudAddService ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0390 1020 IntcAzAudAddService ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0406 1020 JGOGO ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0406 1020 JGOGO ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0421 1020 JRAID ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0421 1020 JRAID ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0421 1020 jswpsapi ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0421 1020 jswpsapi ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0437 1020 MxlW2k ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0437 1020 MxlW2k ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0437 1020 PQNTDrv ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0437 1020 PQNTDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0453 1020 PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0453 1020 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0468 1020 sptd ( LockedFile.Multi.Generic ) - skipped by user
07:59:29.0468 1020 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
07:59:29.0468 1020 SSHDRV84 ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0468 1020 SSHDRV84 ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0484 1020 SSHDRV86 ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0484 1020 SSHDRV86 ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0484 1020 SunkFilt ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0484 1020 SunkFilt ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0500 1020 USBAAPL ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0500 1020 USBAAPL ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:29.0500 1020 WSIMD ( UnsignedFile.Multi.Generic ) - skipped by user
07:59:29.0500 1020 WSIMD ( UnsignedFile.Multi.Generic ) - User select action: Skip
07:59:41.0531 0980 Deinitialize success
|
|
20.06.2012, 09:39
| #21 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ --> Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner |
|
20.06.2012, 21:52
| #22 |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Gut, wird gemacht. Ich komme allerdings frühestens in vier Tagen dazu. Danke Dir, Arne! Gruß, Karsten |
|
25.06.2012, 08:00
| #23 |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Hier ist das Resultat des ComboFix-Scans: Combofix Logfile: Code:
ATTFilter ComboFix 12-06-24.03 - *************** 25.06.2012 8:46.1.2 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2031.1732 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\***************\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\***************\Anwendungsdaten\Awyqh
c:\dokumente und einstellungen\***************\Anwendungsdaten\Awyqh\daipx.exe
c:\dokumente und einstellungen\***************\Anwendungsdaten\Ykiqym
c:\dokumente und einstellungen\***************\Anwendungsdaten\Ykiqym\diuqz.roi
c:\dokumente und einstellungen\***************\Eigene Dateien\$AP1C.tmp
c:\dokumente und einstellungen\***************\Eigene Dateien\$AP28.tmp
c:\dokumente und einstellungen\***************\Eigene Dateien\$AP62.tmp
c:\dokumente und einstellungen\***************\Eigene Dateien\$AP92.tmp
c:\dokumente und einstellungen\***************\Eigene Dateien\$AP99.tmp
c:\dokumente und einstellungen\***************\WINDOWS
c:\windows\AutoRun.ini
c:\windows\IsUn0407.exe
c:\windows\iun6002.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\AegisI5Installer.exe
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\Thumbs.db
o:\eigene dateien\$AP10.tmp
o:\eigene dateien\$AP14.tmp
o:\eigene dateien\$AP18.tmp
o:\eigene dateien\$AP19.tmp
o:\eigene dateien\$AP49.tmp
o:\eigene dateien\$AP5.tmp
o:\eigene dateien\$AP6.tmp
o:\eigene dateien\$AP84.tmp
o:\eigene dateien\$AP99.tmp
o:\eigene dateien\$APE.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-05-25 bis 2012-06-25 ))))))))))))))))))))))))))))))
.
.
2012-06-24 16:53 . 2012-06-24 16:53 -------- d-----w- c:\windows\LastGood
2012-06-20 20:39 . 2012-06-20 20:39 -------- d-----w- c:\dokumente und einstellungen\***************\Lokale Einstellungen\Anwendungsdaten\Identities
2012-06-20 20:39 . 2012-06-20 20:39 -------- d-----w- c:\dokumente und einstellungen\***************\Anwendungsdaten\Siupmu
2012-06-19 06:38 . 2012-06-19 06:38 -------- d-----w- C:\_OTL
2012-06-14 19:22 . 2012-05-11 14:40 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-13 19:06 . 2012-06-13 19:06 -------- d-----w- c:\programme\ESET
2012-06-03 10:33 . 2012-06-03 10:33 388096 ----a-r- c:\dokumente und einstellungen\***************\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-03 10:19 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-03 10:14 . 2012-06-03 10:14 -------- d-----w- c:\windows\system32\wbem\Repository
2012-06-02 20:41 . 2012-06-02 20:41 -------- d-----w- c:\dokumente und einstellungen\***************\Anwendungsdaten\Malwarebytes
2012-06-02 20:41 . 2012-06-03 10:19 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2012-06-02 20:41 . 2012-06-02 20:41 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-05-30 11:59 . 2012-05-30 11:59 4966600 ----a-w- c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-05-28 10:38 . 2012-06-24 17:10 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-28 10:38 . 2012-06-24 17:10 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 13:19 . 2007-06-18 19:01 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2007-06-18 19:01 15896 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2006-11-15 15:19 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2006-11-15 15:19 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2006-11-15 15:19 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2007-06-18 19:01 15896 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2006-11-15 15:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2004-08-04 12:00 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-06-18 19:01 23576 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2006-11-15 15:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2006-11-15 15:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2007-06-19 19:14 18160 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2006-11-19 00:24 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2005-05-26 03:19 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2004-08-04 12:00 604160 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2004-08-04 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-08-04 12:00 1863296 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-08-04 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec
2012-05-09 16:16 . 2011-10-25 18:18 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-05-09 16:16 . 2009-03-28 12:25 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-05 03:14 . 2004-08-04 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2004-08-04 00:50 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2006-11-15 15:18 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-19 20:50 . 2006-11-18 22:51 28352 ----a-w- c:\windows\system32\drivers\MxlW2k.sys
2008-08-07 02:33 . 2009-02-19 18:00 761856 ----a-w- c:\programme\Pointofix.exe
2012-04-21 01:18 . 2012-05-28 10:32 97208 ----a-w- c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealPlayer"="c:\programme\Real\RealPlayer\realplay.exe" [2006-11-20 1003520]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" [2005-09-08 94208]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 401491]
"AnyDVD"="c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe" [2011-11-21 5389944]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2012-02-29 17148552]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-13 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"Sunkist2k"="c:\programme\Multimedia Card Reader\shwicon2k.exe" [2005-02-25 131072]
"C-Media Mixer"="Mixer.exe" [2002-10-15 1818624]
"Acrobat Assistant 7.0"="c:\programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"nwiz"="nwiz.exe" [2008-09-17 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2009-10-12 614400]
"MMTray"="c:\programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2004-08-29 131072]
"mmtask"="c:\programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2004-08-29 53248]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\***************\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2006-11-27 25214]
NETGEAR WN111v2 Setup-Assistent.lnk - c:\programme\NETGEAR\WN111v2\WN111V2.exe [2009-3-25 1523770]
WISO Mein Steuer-Sparbuch heute.lnk - c:\programme\WISO\Steuersoftware 2011\mshaktuell.exe [2011-2-20 1224304]
ymetray.lnk - c:\programme\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-10-3 54512]
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk
backup=c:\windows\pss\Adobe Acrobat - Schnellstart.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2004-12-14 01:12 483328 ----a-w- c:\programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2005-05-19 13:47 57344 ----a-w- c:\programme\SlySoft\CloneCD\CloneCDTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:22 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBB36X Configure]
2006-06-02 08:46 385024 ------r- c:\windows\system32\JMRaidTool.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-05-11 10:47 151552 ----a-w- c:\programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-07 15:51 421160 ----a-w- c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-08-29 10:52 53248 ----a-w- c:\programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-08-29 10:52 131072 ----a-w- c:\programme\Musicmatch\Musicmatch Jukebox\mm_tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-09-17 21:55 13574144 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-09-17 21:55 86016 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-09-17 21:55 1657376 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Omnipage]
2002-06-03 10:38 49152 ----a-w- c:\programme\ScanSoft\OmniPageSE\opware32.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-05-27 02:47 16208384 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 10:04 2879488 ------r- c:\windows\SkyTel.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Programme\\Microsoft ActiveSync\\WcesMgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Sony Ericsson\\Update Service\\ma3platform.exe"=
"c:\\Programme\\Real\\RealPlayer\\trueplay.exe"=
"c:\\Programme\\ScanSoft\\OmniPageSE\\EregGer\\NAVBrowser.exe"=
"c:\\Programme\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\WINDOWS\\system32\\SUPDSvc.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.11.2006 21:18 639224]
R1 SSHDRV84;SSHDRV84;c:\windows\system32\drivers\SSHDRV84.sys [06.01.2007 14:04 76800]
R1 SSHDRV86;SSHDRV86;c:\windows\system32\drivers\SSHDRV86.sys [06.01.2007 14:26 81408]
S1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [25.10.2011 20:18 36000]
S2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [24.11.2006 21:44 99840]
S2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [25.10.2011 20:18 86224]
S2 BBSvc;Bing Bar Update Service;c:\programme\Microsoft\BingBar\BBSvc.EXE [09.11.2011 14:16 196376]
S2 BBUpdate;BBUpdate;c:\programme\Microsoft\BingBar\SeaPort.EXE [13.10.2011 17:21 249648]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [03.06.2012 12:19 654408]
S2 Skype C2C Service;Skype C2C Service;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe [30.05.2012 13:56 3048136]
S2 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [31.01.2012 16:09 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [28.05.2012 12:38 250056]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [24.07.2003 12:10 17149]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\programme\NETGEAR\WN111v2\jswpsapi.exe [27.02.2008 11:54 360547]
S3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [01.10.2008 16:45 57440]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [03.06.2012 12:19 22344]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [28.05.2012 12:32 129976]
S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [18.04.2010 18:34 132464]
S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [14.01.2009 02:23 458752]
S3 z520bus;Sony Ericsson 520 driver (WDM);c:\windows\system32\drivers\z520bus.sys [25.01.2007 01:50 57648]
S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;c:\windows\system32\drivers\z520mdfl.sys [25.01.2007 01:50 8336]
S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;c:\windows\system32\drivers\z520mdm.sys [25.01.2007 01:50 93488]
S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;c:\windows\system32\drivers\z520mgmt.sys [25.01.2007 01:50 84928]
S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\z520obex.sys [25.01.2007 01:50 82864]
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-28 17:10]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
HKCU-Run-Uqevkaenos - c:\dokumente und einstellungen\***************\Anwendungsdaten\Awyqh\daipx.exe
HKLM-Run-jswtrayutil - c:\programme\NETGEAR\WN111v2\jswtrayutil.exe
AddRemove-IMBoosterARP - c:\programme\Iminent\inst\Bootstrapper\Bootstrapper.exe
AddRemove-PCI Audio Applications - c:\windows\IsUn0407.exe
AddRemove-Windows CE Services - c:\windows\ISUN0407.EXE
AddRemove-Windows Searchqu Toolbar - c:\programme\Windows Searchqu Toolbar\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-25 08:50
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Zeit der Fertigstellung: 2012-06-25 08:52:11
ComboFix-quarantined-files.txt 2012-06-25 06:52
.
Vor Suchlauf: 17 Verzeichnis(se), 62.015.057.920 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 62.286.508.032 Bytes frei
.
- - End Of File - - E8B1B1899198B995821EF5A1720724E4
Das Programm hat zu Beginn davor gewarnt, dass der Realtime-Scanner von Antivir aktiv sei, obwohl ich den Rechner im abgesicherten Modus gestartet hatte. Im Taskmanager habe ich jedoch keinen Hinweis darauf gefunden, dass ein Antivir-Task aktiv wäre, und es gab auch keinerlei Probleme während des Scans. |
|
25.06.2012, 10:16
| #24 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Alle Dateien versteckt nach Befall mit S.M.A.R.T VerschlüsselungstrojanerCode:
ATTFilter Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
Zitat:
Ich hab doch vorher exztra gefragt ob der normale Modus uneingeschränkt funktioniert?!  
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.06.2012, 19:37
| #25 | |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Zu Frage 1: Nein, es bestand keine Internetverbindung und ich habe das Programm nicht abgebrochen. Zu Frage 2: Wenn ich Dich zitieren darf (Posting vom 19.6.2012, 15:37): Zitat:
 |
|
25.06.2012, 21:06
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Hätte ich bloß mal geschrieben abgesicherter Modus mit Netzwerktreibern 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.06.2012, 21:12
| #27 |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Gut. Welche der Schritte sollte ich dann mit Netzwerktreibern wiederholen? Nur ComboFix oder auch TDSS? Gruß, Karsten |
|
26.06.2012, 09:28
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Wiederhol nur combofix im abgesicherten Modus mit Netzwerk. Lösche aber die combofix.exe vorher und lad es neu runter, denn dieses Tool wird mitunter mehrmals täglich aktualisiert
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.06.2012, 07:54
| #29 |
| | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Okay, hier ist das Ergebnis des neuen ComboFix-Scans: Combofix Logfile: Code:
ATTFilter ComboFix 12-06-26.02 - *************** 27.06.2012 8:41.2.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2031.1660 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\***************\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-05-27 bis 2012-06-27 ))))))))))))))))))))))))))))))
.
.
2012-06-20 20:39 . 2012-06-20 20:39 -------- d-----w- c:\dokumente und einstellungen\***************\Lokale Einstellungen\Anwendungsdaten\Identities
2012-06-20 20:39 . 2012-06-20 20:39 -------- d-----w- c:\dokumente und einstellungen\***************\Anwendungsdaten\Siupmu
2012-06-19 15:35 . 2012-06-19 15:35 4967624 ----a-w- c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-06-19 06:38 . 2012-06-19 06:38 -------- d-----w- C:\_OTL
2012-06-14 19:22 . 2012-05-11 14:40 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-13 19:06 . 2012-06-13 19:06 -------- d-----w- c:\programme\ESET
2012-06-03 10:33 . 2012-06-03 10:33 388096 ----a-r- c:\dokumente und einstellungen\***************\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-03 10:19 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-03 10:14 . 2012-06-03 10:14 -------- d-----w- c:\windows\system32\wbem\Repository
2012-06-02 20:41 . 2012-06-02 20:41 -------- d-----w- c:\dokumente und einstellungen\***************\Anwendungsdaten\Malwarebytes
2012-06-02 20:41 . 2012-06-03 10:19 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2012-06-02 20:41 . 2012-06-02 20:41 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-05-28 10:38 . 2012-06-24 17:10 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-28 10:38 . 2012-06-24 17:10 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 13:19 . 2007-06-18 19:01 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2007-06-18 19:01 15896 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2006-11-15 15:19 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2006-11-15 15:19 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2006-11-15 15:19 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2007-06-18 19:01 15896 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2006-11-15 16:01 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2006-11-15 15:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2006-11-15 15:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2004-08-04 12:00 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-06-18 19:01 23576 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2006-11-15 15:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2006-11-15 15:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2007-06-19 19:14 18160 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2006-11-19 00:24 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2005-05-26 03:19 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2004-08-04 12:00 604160 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2004-08-04 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-08-04 12:00 1863296 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-08-04 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec
2012-05-09 16:16 . 2011-10-25 18:18 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-05-09 16:16 . 2009-03-28 12:25 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-05 03:14 . 2004-08-04 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2004-08-04 00:50 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2006-11-15 15:18 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-19 20:50 . 2006-11-18 22:51 28352 ----a-w- c:\windows\system32\drivers\MxlW2k.sys
2008-08-07 02:33 . 2009-02-19 18:00 761856 ----a-w- c:\programme\Pointofix.exe
2012-04-21 01:18 . 2012-05-28 10:32 97208 ----a-w- c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-25_06.50.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-15 15:19 . 2012-06-02 13:19 35864 c:\windows\system32\dllcache\wups.dll
+ 2012-06-26 18:38 . 2012-06-26 18:38 1259008 c:\windows\Installer\1c2de.msi
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealPlayer"="c:\programme\Real\RealPlayer\realplay.exe" [2006-11-20 1003520]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" [2005-09-08 94208]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 401491]
"AnyDVD"="c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe" [2011-11-21 5389944]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2012-02-29 17148552]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-13 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"Sunkist2k"="c:\programme\Multimedia Card Reader\shwicon2k.exe" [2005-02-25 131072]
"C-Media Mixer"="Mixer.exe" [2002-10-15 1818624]
"Acrobat Assistant 7.0"="c:\programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"nwiz"="nwiz.exe" [2008-09-17 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2009-10-12 614400]
"MMTray"="c:\programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2004-08-29 131072]
"mmtask"="c:\programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2004-08-29 53248]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\***************\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2006-11-27 25214]
NETGEAR WN111v2 Setup-Assistent.lnk - c:\programme\NETGEAR\WN111v2\WN111V2.exe [2009-3-25 1523770]
WISO Mein Steuer-Sparbuch heute.lnk - c:\programme\WISO\Steuersoftware 2011\mshaktuell.exe [2011-2-20 1224304]
ymetray.lnk - c:\programme\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-10-3 54512]
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk
backup=c:\windows\pss\Adobe Acrobat - Schnellstart.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2004-12-14 01:12 483328 ----a-w- c:\programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2005-05-19 13:47 57344 ----a-w- c:\programme\SlySoft\CloneCD\CloneCDTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:22 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBB36X Configure]
2006-06-02 08:46 385024 ------r- c:\windows\system32\JMRaidTool.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-05-11 10:47 151552 ----a-w- c:\programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-07 15:51 421160 ----a-w- c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-08-29 10:52 53248 ----a-w- c:\programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-08-29 10:52 131072 ----a-w- c:\programme\Musicmatch\Musicmatch Jukebox\mm_tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-09-17 21:55 13574144 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-09-17 21:55 86016 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-09-17 21:55 1657376 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Omnipage]
2002-06-03 10:38 49152 ----a-w- c:\programme\ScanSoft\OmniPageSE\opware32.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-05-27 02:47 16208384 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 10:04 2879488 ------r- c:\windows\SkyTel.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Programme\\Microsoft ActiveSync\\WcesMgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Sony Ericsson\\Update Service\\ma3platform.exe"=
"c:\\Programme\\Real\\RealPlayer\\trueplay.exe"=
"c:\\Programme\\ScanSoft\\OmniPageSE\\EregGer\\NAVBrowser.exe"=
"c:\\Programme\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\WINDOWS\\system32\\SUPDSvc.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.11.2006 21:18 639224]
R1 SSHDRV84;SSHDRV84;c:\windows\system32\drivers\SSHDRV84.sys [06.01.2007 14:04 76800]
R1 SSHDRV86;SSHDRV86;c:\windows\system32\drivers\SSHDRV86.sys [06.01.2007 14:26 81408]
R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [01.10.2008 16:45 57440]
R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [14.01.2009 02:23 458752]
S1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [25.10.2011 20:18 36000]
S2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [24.11.2006 21:44 99840]
S2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [25.10.2011 20:18 86224]
S2 BBSvc;Bing Bar Update Service;c:\programme\Microsoft\BingBar\BBSvc.EXE [09.11.2011 14:16 196376]
S2 BBUpdate;BBUpdate;c:\programme\Microsoft\BingBar\SeaPort.EXE [13.10.2011 17:21 249648]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [03.06.2012 12:19 654408]
S2 Skype C2C Service;Skype C2C Service;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe [19.06.2012 17:32 3048136]
S2 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [31.01.2012 16:09 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [28.05.2012 12:38 250056]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [24.07.2003 12:10 17149]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\programme\NETGEAR\WN111v2\jswpsapi.exe [27.02.2008 11:54 360547]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [03.06.2012 12:19 22344]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [28.05.2012 12:32 129976]
S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [18.04.2010 18:34 132464]
S3 z520bus;Sony Ericsson 520 driver (WDM);c:\windows\system32\drivers\z520bus.sys [25.01.2007 01:50 57648]
S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;c:\windows\system32\drivers\z520mdfl.sys [25.01.2007 01:50 8336]
S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;c:\windows\system32\drivers\z520mdm.sys [25.01.2007 01:50 93488]
S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;c:\windows\system32\drivers\z520mgmt.sys [25.01.2007 01:50 84928]
S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\z520obex.sys [25.01.2007 01:50 82864]
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-28 17:10]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\***************\Anwendungsdaten\Mozilla\Firefox\Profiles\6s0ymhre.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-27 08:45
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Zeit der Fertigstellung: 2012-06-27 08:46:46
ComboFix-quarantined-files.txt 2012-06-27 06:46
ComboFix2.txt 2012-06-25 06:52
.
Vor Suchlauf: 19 Verzeichnis(se), 62.308.319.232 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 62.293.266.432 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 93B8BD2C17A45CB2E0CDCE8DFCAE140A
|
|
28.06.2012, 08:57
| #30 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter Folder::
c:\dokumente und einstellungen\***************\Anwendungsdaten\Siupmu
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner |
| abgesicherten, administrator, autostart, befall, dateisystem, ebenfalls, entfernen, explorer, folge, forum, gelöscht, heuristiks/extra, heuristiks/shuriken, infizierte, laufwerke, malwarebytes, microsoft, netzwerkverbindung, neu, quarantäne, rechner, service, service pack 3, systemfehler, verschlüsselungstrojaner, version, windows-explorer |
Linear-Darstellung
