Windows Recovery Maleware

machete81 · 31.03.2011, 10:44

2011/03/31 11:40:15.0660 4212 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/31 11:40:16.0004 4212 ================================================================================
2011/03/31 11:40:16.0004 4212 SystemInfo:
2011/03/31 11:40:16.0004 4212
2011/03/31 11:40:16.0004 4212 OS Version: 6.0.6002 ServicePack: 2.0
2011/03/31 11:40:16.0004 4212 Product type: Workstation
2011/03/31 11:40:16.0004 4212 ComputerName: MACHETE81-PC
2011/03/31 11:40:16.0004 4212 UserName: Machete 81
2011/03/31 11:40:16.0004 4212 Windows directory: C:\Windows
2011/03/31 11:40:16.0004 4212 System windows directory: C:\Windows
2011/03/31 11:40:16.0004 4212 Processor architecture: Intel x86
2011/03/31 11:40:16.0004 4212 Number of processors: 4
2011/03/31 11:40:16.0004 4212 Page size: 0x1000
2011/03/31 11:40:16.0004 4212 Boot type: Normal boot
2011/03/31 11:40:16.0004 4212 ================================================================================
2011/03/31 11:40:16.0472 4212 Initialize success
2011/03/31 11:40:29.0879 5068 ================================================================================
2011/03/31 11:40:29.0879 5068 Scan started
2011/03/31 11:40:29.0879 5068 Mode: Manual;
2011/03/31 11:40:29.0879 5068 ================================================================================
2011/03/31 11:40:31.0160 5068 acedrv11 (e6f53d6c0dea3d375362265e175ca638) C:\Windows\system32\drivers\acedrv11.sys
2011/03/31 11:40:31.0254 5068 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/03/31 11:40:31.0285 5068 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/03/31 11:40:31.0332 5068 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/03/31 11:40:31.0363 5068 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/03/31 11:40:31.0394 5068 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/03/31 11:40:31.0488 5068 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/03/31 11:40:31.0550 5068 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/03/31 11:40:31.0707 5068 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/31 11:40:31.0738 5068 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/03/31 11:40:31.0800 5068 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/03/31 11:40:31.0816 5068 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/03/31 11:40:31.0863 5068 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/03/31 11:40:31.0894 5068 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/03/31 11:40:32.0004 5068 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/03/31 11:40:32.0035 5068 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/03/31 11:40:32.0129 5068 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/31 11:40:32.0191 5068 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/03/31 11:40:32.0254 5068 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys
2011/03/31 11:40:32.0332 5068 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/03/31 11:40:32.0379 5068 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/03/31 11:40:32.0394 5068 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\Windows\system32\DRIVERS\avipbb.sys
2011/03/31 11:40:32.0441 5068 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/31 11:40:32.0519 5068 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/31 11:40:32.0597 5068 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/31 11:40:32.0629 5068 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/31 11:40:32.0691 5068 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/31 11:40:32.0722 5068 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/31 11:40:32.0738 5068 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/31 11:40:32.0800 5068 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/31 11:40:32.0816 5068 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/31 11:40:33.0004 5068 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/31 11:40:33.0050 5068 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/31 11:40:33.0082 5068 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
2011/03/31 11:40:33.0113 5068 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/03/31 11:40:33.0175 5068 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/03/31 11:40:33.0222 5068 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2011/03/31 11:40:33.0238 5068 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/03/31 11:40:33.0269 5068 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/03/31 11:40:33.0347 5068 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/03/31 11:40:33.0425 5068 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/03/31 11:40:33.0504 5068 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/31 11:40:33.0566 5068 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/31 11:40:33.0613 5068 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/31 11:40:33.0675 5068 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/03/31 11:40:33.0754 5068 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/03/31 11:40:33.0972 5068 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/03/31 11:40:34.0004 5068 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/03/31 11:40:34.0035 5068 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/31 11:40:34.0097 5068 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/31 11:40:34.0129 5068 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/31 11:40:34.0160 5068 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/31 11:40:34.0191 5068 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/03/31 11:40:34.0316 5068 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/31 11:40:34.0347 5068 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/31 11:40:34.0379 5068 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/03/31 11:40:34.0457 5068 HCW88AUD (b40c06b5438716366f2ca6239a741f39) C:\Windows\system32\drivers\hcw88aud.sys
2011/03/31 11:40:34.0488 5068 HCW88BDA (6c85512c2b958b2d0e82814915390050) C:\Windows\system32\drivers\hcw88bda.sys
2011/03/31 11:40:34.0535 5068 HCW88TSE (d1b38599f3678f536eb61406f4f0da6d) C:\Windows\system32\drivers\hcw88tse.sys
2011/03/31 11:40:34.0629 5068 HCW88TUNE (36baa5ace16bb31e2b0bfaf551ac9786) C:\Windows\system32\drivers\hcw88tun.sys
2011/03/31 11:40:34.0660 5068 hcw88vid (2688cd88b87e0f5996ed4330e42d344a) C:\Windows\system32\drivers\hcw88vid.sys
2011/03/31 11:40:34.0722 5068 HCW88XBAR (462f10c8b88cddeb2fdaa47fa34793bb) C:\Windows\system32\drivers\HCW88BAR.sys
2011/03/31 11:40:34.0785 5068 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/03/31 11:40:34.0863 5068 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/31 11:40:34.0894 5068 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/31 11:40:34.0925 5068 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
2011/03/31 11:40:34.0988 5068 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/31 11:40:35.0050 5068 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/03/31 11:40:35.0113 5068 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/03/31 11:40:35.0144 5068 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/03/31 11:40:35.0207 5068 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/31 11:40:35.0269 5068 iaStor (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
2011/03/31 11:40:35.0300 5068 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/03/31 11:40:35.0472 5068 IDSvix86 (78432a57d085328cf8baf125985425d2) C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys
2011/03/31 11:40:35.0519 5068 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/31 11:40:35.0660 5068 IntcAzAudAddService (34b8b4a442046e3d5fdd0b17926cf3f1) C:\Windows\system32\drivers\RTKVHDA.sys
2011/03/31 11:40:35.0754 5068 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/31 11:40:35.0832 5068 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/31 11:40:35.0910 5068 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/31 11:40:35.0957 5068 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/31 11:40:35.0988 5068 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/31 11:40:36.0066 5068 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/31 11:40:36.0082 5068 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/03/31 11:40:36.0144 5068 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/31 11:40:36.0175 5068 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/31 11:40:36.0238 5068 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/31 11:40:36.0300 5068 JRAID (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/03/31 11:40:36.0332 5068 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/31 11:40:36.0394 5068 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/31 11:40:36.0457 5068 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/31 11:40:36.0582 5068 LHidFilt (24e0ddb99aeccf86bb37702611761459) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2011/03/31 11:40:36.0660 5068 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys
2011/03/31 11:40:36.0722 5068 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/31 11:40:36.0832 5068 LMouFilt (d58b330d318361a66a9fe60d7c9b4951) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2011/03/31 11:40:36.0910 5068 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/31 11:40:36.0925 5068 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/31 11:40:36.0972 5068 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/31 11:40:37.0004 5068 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/31 11:40:37.0082 5068 MagicTune (7acae9601b3eb413f8bf5c90a77a6848) C:\Windows\system32\drivers\MTiCtwl.sys
2011/03/31 11:40:37.0144 5068 MBAMSwissArmy (d68e165c3123aba3b1282eddb4213bd8) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/03/31 11:40:37.0238 5068 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/03/31 11:40:37.0269 5068 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/31 11:40:37.0300 5068 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/31 11:40:37.0332 5068 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/31 11:40:37.0347 5068 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/31 11:40:37.0379 5068 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/31 11:40:37.0441 5068 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/03/31 11:40:37.0472 5068 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/31 11:40:37.0504 5068 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/31 11:40:37.0535 5068 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/03/31 11:40:37.0582 5068 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/31 11:40:37.0613 5068 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/31 11:40:37.0629 5068 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/31 11:40:37.0660 5068 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/03/31 11:40:37.0675 5068 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/03/31 11:40:37.0738 5068 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/31 11:40:37.0785 5068 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/31 11:40:37.0847 5068 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/31 11:40:37.0910 5068 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/31 11:40:37.0941 5068 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/31 11:40:37.0957 5068 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/03/31 11:40:37.0988 5068 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/31 11:40:38.0019 5068 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/31 11:40:38.0082 5068 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/03/31 11:40:38.0160 5068 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/31 11:40:38.0222 5068 NCPro (7acae9601b3eb413f8bf5c90a77a6848) C:\Windows\system32\drivers\MTictwl.sys
2011/03/31 11:40:38.0285 5068 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/03/31 11:40:38.0363 5068 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/31 11:40:38.0394 5068 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/31 11:40:38.0488 5068 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/31 11:40:38.0535 5068 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/31 11:40:38.0550 5068 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/31 11:40:38.0629 5068 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/31 11:40:38.0675 5068 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/03/31 11:40:38.0691 5068 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/31 11:40:38.0754 5068 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/03/31 11:40:38.0847 5068 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/31 11:40:38.0879 5068 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/31 11:40:39.0082 5068 nvlddmkm (514aa99218e1cda96790665a91292e8b) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/03/31 11:40:39.0269 5068 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/03/31 11:40:39.0300 5068 nvrd32 (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/03/31 11:40:39.0347 5068 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/03/31 11:40:39.0394 5068 nvstor32 (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/03/31 11:40:39.0457 5068 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/03/31 11:40:39.0566 5068 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/03/31 11:40:39.0644 5068 OlyCamComm (f4cb9c1991314b1352ddbd8a968e4471) C:\Windows\system32\DRIVERS\OlyCamComm.sys
2011/03/31 11:40:39.0722 5068 PAC207 (9482616a0f87384c5afb5f34a317bf6c) C:\Windows\system32\DRIVERS\PFC027.SYS
2011/03/31 11:40:39.0847 5068 Parport (8a79fdf04a73428597e2caf9d0d67850) C:\Windows\system32\DRIVERS\parport.sys
2011/03/31 11:40:39.0879 5068 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/03/31 11:40:39.0894 5068 Parvdm (6c580025c81caf3ae9e3617c22cad00e) C:\Windows\system32\DRIVERS\parvdm.sys
2011/03/31 11:40:39.0972 5068 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/03/31 11:40:39.0988 5068 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/03/31 11:40:40.0035 5068 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/03/31 11:40:40.0129 5068 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/31 11:40:40.0269 5068 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/31 11:40:40.0300 5068 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/03/31 11:40:40.0363 5068 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/31 11:40:40.0441 5068 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/03/31 11:40:40.0504 5068 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/31 11:40:40.0519 5068 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/31 11:40:40.0566 5068 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/31 11:40:40.0613 5068 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/31 11:40:40.0644 5068 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/31 11:40:40.0675 5068 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/31 11:40:40.0707 5068 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/31 11:40:40.0738 5068 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/31 11:40:40.0800 5068 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/03/31 11:40:40.0816 5068 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/31 11:40:40.0879 5068 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/03/31 11:40:40.0941 5068 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/31 11:40:41.0004 5068 RTL8169 (9a929308a64183d3d9dccbb6df4badae) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/03/31 11:40:41.0050 5068 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/31 11:40:41.0129 5068 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/31 11:40:41.0160 5068 Serenum (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys
2011/03/31 11:40:41.0207 5068 Serial (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys
2011/03/31 11:40:41.0238 5068 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/31 11:40:41.0285 5068 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/03/31 11:40:41.0316 5068 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/31 11:40:41.0332 5068 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/31 11:40:41.0347 5068 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/31 11:40:41.0379 5068 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/03/31 11:40:41.0441 5068 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/03/31 11:40:41.0472 5068 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/03/31 11:40:41.0504 5068 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/03/31 11:40:41.0629 5068 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/31 11:40:41.0738 5068 sptd (0c1dad75274cb6e31f053ce3e08bf9c3) C:\Windows\system32\Drivers\sptd.sys
2011/03/31 11:40:41.0738 5068 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 0c1dad75274cb6e31f053ce3e08bf9c3
2011/03/31 11:40:41.0754 5068 sptd - detected Locked file (1)
2011/03/31 11:40:41.0816 5068 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/03/31 11:40:41.0957 5068 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/31 11:40:42.0144 5068 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/31 11:40:42.0238 5068 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/03/31 11:40:42.0347 5068 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/31 11:40:42.0379 5068 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/31 11:40:42.0457 5068 SymEvent (9d98270b5f10a4c84e8da417c30756e1) C:\Windows\system32\Drivers\SYMEVENT.SYS
2011/03/31 11:40:42.0519 5068 SYMREDRV (7f4011a719bf30e3dbd84d3a0a45c91c) C:\Windows\System32\Drivers\SYMREDRV.SYS
2011/03/31 11:40:42.0550 5068 SYMTDI (2f03cbdb0f22278d05d5d616c993ab58) C:\Windows\System32\Drivers\SYMTDI.SYS
2011/03/31 11:40:42.0582 5068 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/31 11:40:42.0613 5068 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/31 11:40:42.0691 5068 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/03/31 11:40:42.0769 5068 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/31 11:40:42.0816 5068 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/31 11:40:42.0847 5068 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/31 11:40:42.0879 5068 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/31 11:40:42.0925 5068 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/31 11:40:42.0972 5068 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/31 11:40:43.0097 5068 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/31 11:40:43.0175 5068 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/31 11:40:43.0238 5068 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/31 11:40:43.0269 5068 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/03/31 11:40:43.0300 5068 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/31 11:40:43.0363 5068 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/31 11:40:43.0410 5068 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/03/31 11:40:43.0457 5068 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/31 11:40:43.0488 5068 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/31 11:40:43.0519 5068 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/31 11:40:43.0597 5068 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\Windows\system32\Drivers\usbaapl.sys
2011/03/31 11:40:43.0675 5068 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
2011/03/31 11:40:43.0738 5068 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/31 11:40:43.0754 5068 usbcir (47b9770ea21436de4ad5aea7926e0900) C:\Windows\system32\DRIVERS\usbcir.sys
2011/03/31 11:40:43.0800 5068 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/31 11:40:43.0847 5068 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/31 11:40:43.0894 5068 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/03/31 11:40:43.0925 5068 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/31 11:40:43.0957 5068 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/03/31 11:40:43.0988 5068 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/31 11:40:44.0019 5068 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/31 11:40:44.0066 5068 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/31 11:40:44.0113 5068 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/31 11:40:44.0129 5068 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/03/31 11:40:44.0160 5068 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/03/31 11:40:44.0191 5068 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/03/31 11:40:44.0254 5068 viamraid (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/03/31 11:40:44.0316 5068 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/31 11:40:44.0379 5068 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/03/31 11:40:44.0441 5068 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/03/31 11:40:44.0457 5068 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/03/31 11:40:44.0504 5068 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/31 11:40:44.0550 5068 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/31 11:40:44.0582 5068 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/31 11:40:44.0629 5068 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/03/31 11:40:44.0675 5068 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/31 11:40:44.0800 5068 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/03/31 11:40:44.0910 5068 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/03/31 11:40:44.0972 5068 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/31 11:40:45.0035 5068 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/31 11:40:45.0144 5068 {95808DC4-FA4A-4C74-92FE-5B863F82066B} (74ec37b9eaf9fca015b933a526825c7a) C:\Program Files\CyberLink\PowerDVD\000.fcl
2011/03/31 11:40:45.0222 5068 ================================================================================
2011/03/31 11:40:45.0222 5068 Scan finished
2011/03/31 11:40:45.0222 5068 ================================================================================
2011/03/31 11:40:45.0238 4812 Detected object count: 1
2011/03/31 11:40:59.0238 4812 Locked file(sptd) - User select action: Skip
2011/03/31 11:42:58.0911 3712 ================================================================================
2011/03/31 11:42:58.0911 3712 Scan started
2011/03/31 11:42:58.0911 3712 Mode: Manual;
2011/03/31 11:42:58.0911 3712 ================================================================================
2011/03/31 11:42:59.0254 3712 acedrv11 (e6f53d6c0dea3d375362265e175ca638) C:\Windows\system32\drivers\acedrv11.sys
2011/03/31 11:42:59.0333 3712 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/03/31 11:42:59.0379 3712 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/03/31 11:42:59.0426 3712 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/03/31 11:42:59.0458 3712 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/03/31 11:42:59.0489 3712 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/03/31 11:42:59.0536 3712 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/03/31 11:42:59.0551 3712 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/03/31 11:42:59.0583 3712 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/31 11:42:59.0614 3712 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/03/31 11:42:59.0645 3712 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/03/31 11:42:59.0661 3712 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/03/31 11:42:59.0692 3712 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/03/31 11:42:59.0723 3712 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/03/31 11:42:59.0770 3712 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/03/31 11:42:59.0786 3712 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/03/31 11:42:59.0833 3712 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/31 11:42:59.0879 3712 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/03/31 11:42:59.0926 3712 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys
2011/03/31 11:42:59.0989 3712 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/03/31 11:43:00.0020 3712 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/03/31 11:43:00.0036 3712 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\Windows\system32\DRIVERS\avipbb.sys
2011/03/31 11:43:00.0067 3712 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/31 11:43:00.0114 3712 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/31 11:43:00.0145 3712 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/31 11:43:00.0161 3712 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/31 11:43:00.0192 3712 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/31 11:43:00.0208 3712 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/31 11:43:00.0223 3712 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/31 11:43:00.0254 3712 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/31 11:43:00.0270 3712 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/31 11:43:00.0379 3712 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/31 11:43:00.0442 3712 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/31 11:43:00.0489 3712 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
2011/03/31 11:43:00.0520 3712 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/03/31 11:43:00.0551 3712 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/03/31 11:43:00.0583 3712 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2011/03/31 11:43:00.0614 3712 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/03/31 11:43:00.0645 3712 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/03/31 11:43:00.0723 3712 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/03/31 11:43:00.0754 3712 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/03/31 11:43:00.0801 3712 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/31 11:43:00.0848 3712 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/31 11:43:00.0879 3712 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/31 11:43:00.0926 3712 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/03/31 11:43:00.0973 3712 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/03/31 11:43:01.0098 3712 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/03/31 11:43:01.0129 3712 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/03/31 11:43:01.0161 3712 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/31 11:43:01.0208 3712 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/31 11:43:01.0239 3712 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/31 11:43:01.0270 3712 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/31 11:43:01.0301 3712 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/03/31 11:43:01.0348 3712 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/31 11:43:01.0379 3712 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/31 11:43:01.0426 3712 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/03/31 11:43:01.0458 3712 HCW88AUD (b40c06b5438716366f2ca6239a741f39) C:\Windows\system32\drivers\hcw88aud.sys
2011/03/31 11:43:01.0504 3712 HCW88BDA (6c85512c2b958b2d0e82814915390050) C:\Windows\system32\drivers\hcw88bda.sys
2011/03/31 11:43:01.0536 3712 HCW88TSE (d1b38599f3678f536eb61406f4f0da6d) C:\Windows\system32\drivers\hcw88tse.sys
2011/03/31 11:43:01.0567 3712 HCW88TUNE (36baa5ace16bb31e2b0bfaf551ac9786) C:\Windows\system32\drivers\hcw88tun.sys
2011/03/31 11:43:01.0598 3712 hcw88vid (2688cd88b87e0f5996ed4330e42d344a) C:\Windows\system32\drivers\hcw88vid.sys
2011/03/31 11:43:01.0614 3712 HCW88XBAR (462f10c8b88cddeb2fdaa47fa34793bb) C:\Windows\system32\drivers\HCW88BAR.sys
2011/03/31 11:43:01.0661 3712 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/03/31 11:43:01.0723 3712 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/31 11:43:01.0754 3712 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/31 11:43:01.0786 3712 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
2011/03/31 11:43:01.0817 3712 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/31 11:43:01.0879 3712 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/03/31 11:43:01.0942 3712 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/03/31 11:43:01.0973 3712 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/03/31 11:43:02.0004 3712 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/31 11:43:02.0067 3712 iaStor (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
2011/03/31 11:43:02.0129 3712 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/03/31 11:43:02.0239 3712 IDSvix86 (78432a57d085328cf8baf125985425d2) C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys
2011/03/31 11:43:02.0286 3712 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/31 11:43:02.0364 3712 IntcAzAudAddService (34b8b4a442046e3d5fdd0b17926cf3f1) C:\Windows\system32\drivers\RTKVHDA.sys
2011/03/31 11:43:02.0411 3712 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/31 11:43:02.0442 3712 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/31 11:43:02.0473 3712 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/31 11:43:02.0520 3712 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/31 11:43:02.0551 3712 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/31 11:43:02.0583 3712 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/31 11:43:02.0598 3712 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/03/31 11:43:02.0661 3712 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/31 11:43:02.0692 3712 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/31 11:43:02.0708 3712 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/31 11:43:02.0739 3712 JRAID (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/03/31 11:43:02.0770 3712 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/31 11:43:02.0817 3712 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/31 11:43:02.0864 3712 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/31 11:43:02.0926 3712 LHidFilt (24e0ddb99aeccf86bb37702611761459) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2011/03/31 11:43:02.0973 3712 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys
2011/03/31 11:43:02.0989 3712 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/31 11:43:03.0020 3712 LMouFilt (d58b330d318361a66a9fe60d7c9b4951) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2011/03/31 11:43:03.0051 3712 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/31 11:43:03.0083 3712 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/31 11:43:03.0114 3712 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/31 11:43:03.0161 3712 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/31 11:43:03.0192 3712 MagicTune (7acae9601b3eb413f8bf5c90a77a6848) C:\Windows\system32\drivers\MTiCtwl.sys
2011/03/31 11:43:03.0239 3712 MBAMSwissArmy (d68e165c3123aba3b1282eddb4213bd8) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/03/31 11:43:03.0270 3712 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/03/31 11:43:03.0301 3712 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/31 11:43:03.0333 3712 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/31 11:43:03.0364 3712 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/31 11:43:03.0411 3712 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/31 11:43:03.0426 3712 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/31 11:43:03.0458 3712 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/03/31 11:43:03.0489 3712 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/31 11:43:03.0520 3712 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/31 11:43:03.0551 3712 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/03/31 11:43:03.0583 3712 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/31 11:43:03.0614 3712 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/31 11:43:03.0645 3712 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/31 11:43:03.0676 3712 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/03/31 11:43:03.0692 3712 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/03/31 11:43:03.0739 3712 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/31 11:43:03.0770 3712 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/31 11:43:03.0817 3712 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/31 11:43:03.0864 3712 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/31 11:43:03.0895 3712 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/31 11:43:03.0926 3712 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/03/31 11:43:03.0958 3712 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/31 11:43:03.0973 3712 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/31 11:43:03.0989 3712 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/03/31 11:43:04.0036 3712 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/31 11:43:04.0067 3712 NCPro (7acae9601b3eb413f8bf5c90a77a6848) C:\Windows\system32\drivers\MTictwl.sys
2011/03/31 11:43:04.0098 3712 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/03/31 11:43:04.0129 3712 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/31 11:43:04.0161 3712 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/31 11:43:04.0208 3712 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/31 11:43:04.0223 3712 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/31 11:43:04.0254 3712 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/31 11:43:04.0333 3712 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/31 11:43:04.0348 3712 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/03/31 11:43:04.0379 3712 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/31 11:43:04.0442 3712 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/03/31 11:43:04.0489 3712 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/31 11:43:04.0520 3712 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/31 11:43:04.0708 3712 nvlddmkm (514aa99218e1cda96790665a91292e8b) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/03/31 11:43:04.0786 3712 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/03/31 11:43:04.0817 3712 nvrd32 (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/03/31 11:43:04.0848 3712 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/03/31 11:43:04.0879 3712 nvstor32 (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/03/31 11:43:04.0911 3712 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/03/31 11:43:04.0989 3712 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/03/31 11:43:05.0036 3712 OlyCamComm (f4cb9c1991314b1352ddbd8a968e4471) C:\Windows\system32\DRIVERS\OlyCamComm.sys
2011/03/31 11:43:05.0083 3712 PAC207 (9482616a0f87384c5afb5f34a317bf6c) C:\Windows\system32\DRIVERS\PFC027.SYS
2011/03/31 11:43:05.0129 3712 Parport (8a79fdf04a73428597e2caf9d0d67850) C:\Windows\system32\DRIVERS\parport.sys
2011/03/31 11:43:05.0161 3712 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/03/31 11:43:05.0176 3712 Parvdm (6c580025c81caf3ae9e3617c22cad00e) C:\Windows\system32\DRIVERS\parvdm.sys
2011/03/31 11:43:05.0239 3712 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/03/31 11:43:05.0254 3712 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/03/31 11:43:05.0301 3712 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/03/31 11:43:05.0348 3712 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/31 11:43:05.0426 3712 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/31 11:43:05.0458 3712 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/03/31 11:43:05.0504 3712 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/31 11:43:05.0536 3712 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/03/31 11:43:05.0583 3712 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/31 11:43:05.0598 3712 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/31 11:43:05.0645 3712 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/31 11:43:05.0661 3712 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/31 11:43:05.0708 3712 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/31 11:43:05.0723 3712 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/31 11:43:05.0739 3712 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/31 11:43:05.0770 3712 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/31 11:43:05.0801 3712 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/03/31 11:43:05.0817 3712 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/31 11:43:05.0879 3712 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/03/31 11:43:05.0926 3712 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/31 11:43:05.0958 3712 RTL8169 (9a929308a64183d3d9dccbb6df4badae) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/03/31 11:43:05.0989 3712 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/31 11:43:06.0036 3712 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/31 11:43:06.0067 3712 Serenum (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys
2011/03/31 11:43:06.0098 3712 Serial (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys
2011/03/31 11:43:06.0145 3712 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/31 11:43:06.0192 3712 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/03/31 11:43:06.0208 3712 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/31 11:43:06.0239 3712 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/31 11:43:06.0254 3712 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/31 11:43:06.0286 3712 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/03/31 11:43:06.0317 3712 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/03/31 11:43:06.0348 3712 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/03/31 11:43:06.0379 3712 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/03/31 11:43:06.0489 3712 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/31 11:43:06.0536 3712 sptd (0c1dad75274cb6e31f053ce3e08bf9c3) C:\Windows\system32\Drivers\sptd.sys
2011/03/31 11:43:06.0536 3712 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 0c1dad75274cb6e31f053ce3e08bf9c3
2011/03/31 11:43:06.0536 3712 sptd - detected Locked file (1)
2011/03/31 11:43:06.0583 3712 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/03/31 11:43:06.0598 3712 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/31 11:43:06.0629 3712 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/31 11:43:06.0661 3712 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/03/31 11:43:06.0708 3712 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/31 11:43:06.0754 3712 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/31 11:43:06.0801 3712 SymEvent (9d98270b5f10a4c84e8da417c30756e1) C:\Windows\system32\Drivers\SYMEVENT.SYS
2011/03/31 11:43:06.0833 3712 SYMREDRV (7f4011a719bf30e3dbd84d3a0a45c91c) C:\Windows\System32\Drivers\SYMREDRV.SYS
2011/03/31 11:43:06.0864 3712 SYMTDI (2f03cbdb0f22278d05d5d616c993ab58) C:\Windows\System32\Drivers\SYMTDI.SYS
2011/03/31 11:43:06.0895 3712 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/31 11:43:06.0911 3712 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/31 11:43:06.0989 3712 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/03/31 11:43:07.0020 3712 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/31 11:43:07.0067 3712 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/31 11:43:07.0114 3712 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/31 11:43:07.0129 3712 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/31 11:43:07.0176 3712 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/31 11:43:07.0223 3712 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/31 11:43:07.0301 3712 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/31 11:43:07.0333 3712 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/31 11:43:07.0348 3712 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/31 11:43:07.0379 3712 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/03/31 11:43:07.0426 3712 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/31 11:43:07.0473 3712 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/31 11:43:07.0520 3712 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/03/31 11:43:07.0567 3712 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/31 11:43:07.0583 3712 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/31 11:43:07.0629 3712 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/31 11:43:07.0676 3712 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\Windows\system32\Drivers\usbaapl.sys
2011/03/31 11:43:07.0723 3712 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
2011/03/31 11:43:07.0770 3712 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/31 11:43:07.0786 3712 usbcir (47b9770ea21436de4ad5aea7926e0900) C:\Windows\system32\DRIVERS\usbcir.sys
2011/03/31 11:43:07.0817 3712 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/31 11:43:07.0864 3712 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/31 11:43:07.0895 3712 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/03/31 11:43:07.0926 3712 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/31 11:43:07.0973 3712 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/03/31 11:43:07.0989 3712 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/31 11:43:08.0020 3712 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/31 11:43:08.0067 3712 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/31 11:43:08.0114 3712 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/31 11:43:08.0129 3712 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/03/31 11:43:08.0161 3712 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/03/31 11:43:08.0192 3712 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/03/31 11:43:08.0223 3712 viamraid (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/03/31 11:43:08.0270 3712 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/31 11:43:08.0301 3712 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/03/31 11:43:08.0364 3712 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/03/31 11:43:08.0379 3712 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/03/31 11:43:08.0426 3712 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/31 11:43:08.0473 3712 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/31 11:43:08.0489 3712 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/31 11:43:08.0536 3712 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/03/31 11:43:08.0583 3712 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/31 11:43:08.0676 3712 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/03/31 11:43:08.0754 3712 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/03/31 11:43:08.0801 3712 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/31 11:43:08.0864 3712 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/31 11:43:08.0942 3712 {95808DC4-FA4A-4C74-92FE-5B863F82066B} (74ec37b9eaf9fca015b933a526825c7a) C:\Program Files\CyberLink\PowerDVD\000.fcl
2011/03/31 11:43:08.0973 3712 ================================================================================
2011/03/31 11:43:08.0973 3712 Scan finished
2011/03/31 11:43:08.0973 3712 ================================================================================
2011/03/31 11:43:08.0989 4824 Detected object count: 1
2011/03/31 11:43:14.0833 4824 Locked file(sptd) - User select action: Skip

cosinus · 31.03.2011, 13:36

Mach ein Skip, SPTD ist ok.

Danach bitte Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

machete81 · 01.04.2011, 11:53

GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-01 12:50:51
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD5000AAKS-07YGA0 rev.12.01C02
Running: qetdw9vd.exe; Driver: C:\Users\MACHET~1\AppData\Local\Temp\kwddiuoc.sys


---- System - GMER 1.0.15 ----

SSDT            87738850                                                                                                                                                   ZwConnectPort
SSDT            8A0D07AC                                                                                                                                                   ZwCreateThread
SSDT            8A0D0798                                                                                                                                                   ZwOpenProcess
SSDT            8A0D079D                                                                                                                                                   ZwOpenThread
SSDT            8A0D07A7                                                                                                                                                   ZwTerminateProcess

INT 0x52        ?                                                                                                                                                          86DF2BF8
INT 0x62        ?                                                                                                                                                          86DF2BF8
INT 0x72        ?                                                                                                                                                          86DF2BF8
INT 0x92        ?                                                                                                                                                          85CFEBF8
INT 0xA2        ?                                                                                                                                                          85CFEBF8
INT 0xB2        ?                                                                                                                                                          85CFEBF8
INT 0xB2        ?                                                                                                                                                          85CFEBF8
INT 0xB2        ?                                                                                                                                                          86DF2BF8
INT 0xB2        ?                                                                                                                                                          85CFEBF8

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!KeInsertQueue + 3B1                                                                                                                           82C729A8 4 Bytes  [50, 88, 73, 87] {PUSH EAX; MOV [EBX-0x79], DH}
.text           ntoskrnl.exe!KeInsertQueue + 411                                                                                                                           82C72A08 4 Bytes  [AC, 07, 0D, 8A]
.text           ntoskrnl.exe!KeInsertQueue + 5E1                                                                                                                           82C72BD8 4 Bytes  [98, 07, 0D, 8A]
.text           ntoskrnl.exe!KeInsertQueue + 5FD                                                                                                                           82C72BF4 4 Bytes  [9D, 07, 0D, 8A]
.text           ntoskrnl.exe!KeInsertQueue + 811                                                                                                                           82C72E08 4 Bytes  [A7, 07, 0D, 8A]
?               System32\Drivers\spxb.sys                                                                                                                                  Das System kann den angegebenen Pfad nicht finden. !
.text           C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                                                                   section is writeable [0x8D407340, 0x4128C7, 0xE8000020]
.text           USBPORT.SYS!DllUnload                                                                                                                                      8DBD441B 5 Bytes  JMP 86DF21D8 
.vmp2           C:\Windows\system32\drivers\acedrv11.sys                                                                                                                   entry point in ".vmp2" section [0x9E6CA69D]
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                                                                                     section is writeable [0x9E6CF300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                                                                                     section is writeable [0x9E712300, 0x1BEE, 0xE8000020]
.text           C:\Program Files\CyberLink\PowerDVD\000.fcl                                                                                                                section is writeable [0xA2010000, 0x2892, 0xE8000020]
.vmp2           C:\Program Files\CyberLink\PowerDVD\000.fcl                                                                                                                entry point in ".vmp2" section [0xA2033050]

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \SystemRoot\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                                      85CFC2D8
IAT             \SystemRoot\system32\drivers\pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                          [88A706D0] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                             [88A74708] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar]                                                                                  [88A4B6A4] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar]                                                                                   [88A4B046] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                                                           [88A4B7CE] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort]                                                                                  [88A4B0C4] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                                                            [88A4B142] \SystemRoot\System32\Drivers\spxb.sys
IAT             \SystemRoot\system32\drivers\ataport.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                                       85CFE2D8
IAT             \SystemRoot\system32\drivers\storport.sys[ntoskrnl.exe!DbgBreakPoint]                                                                                      85CFD2D8
IAT             \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                                       86DF22D8

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                                                                      [73157817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                                                       [731AA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                                                                   [7315BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                                                             [7314F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                                                       [731575E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                                                                    [7314E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]                                                        [73188395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]                                                           [7315DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                                                                   [7314FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                                                                    [7314FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                                                                     [731471CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                                                             [731DCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                                                                [7317C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                                                                   [7314D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                                                             [73146853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                                                            [7314687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                                                               [73152AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device                                                                                                                                                                     85D041F8
Device                                                                                                                                                                     Ntfs.sys (NT-Dateisystemtreiber/Microsoft Corporation)
Device          \Driver\volmgr \Device\VolMgrControl                                                                                                                       85D001F8
Device          \Driver\usbuhci \Device\USBPDO-0                                                                                                                           86F881F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                                                           86F881F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                                                           86F881F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                                                           86F881F8
Device          \Driver\usbehci \Device\USBPDO-4                                                                                                                           86F0E1F8

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                                                    SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\volmgr \Device\HarddiskVolume1                                                                                                                     85D001F8
Device          \Driver\volmgr \Device\HarddiskVolume2                                                                                                                     85D001F8
Device          \Driver\cdrom \Device\CdRom0                                                                                                                               86F9B1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-2                                                                                                                85D021F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                                                         85D021F8
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                                                         85D021F8
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                                                         85D021F8
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                                                         85D021F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-3                                                                                                                85D021F8
Device          \Driver\volmgr \Device\HarddiskVolume3                                                                                                                     85D001F8
Device          \Driver\USBSTOR \Device\00000080                                                                                                                           877A81F8
Device          \Driver\volmgr \Device\HarddiskVolume4                                                                                                                     85D001F8
Device          \Driver\USBSTOR \Device\00000081                                                                                                                           877A81F8
Device          \Driver\volmgr \Device\HarddiskVolume5                                                                                                                     85D001F8
Device          \Driver\USBSTOR \Device\00000082                                                                                                                           877A81F8
Device          \Driver\volmgr \Device\HarddiskVolume6                                                                                                                     85D001F8
Device          \Driver\USBSTOR \Device\00000083                                                                                                                           877A81F8
Device          \Driver\volmgr \Device\HarddiskVolume7                                                                                                                     85D001F8
Device          \Driver\USBSTOR \Device\00000084                                                                                                                           877A81F8
Device          \Driver\volmgr \Device\HarddiskVolume8                                                                                                                     85D001F8
Device          \Driver\Smb \Device\NetbiosSmb                                                                                                                             876F61F8
Device          \Driver\iScsiPrt \Device\RaidPort0                                                                                                                         86FA5500

AttachedDevice  \Driver\tdx \Device\Udp                                                                                                                                    SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                                                           86F881F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                                                           86F881F8
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                                                           86F881F8
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                                                           86F881F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                                                                           86F0E1F8
Device          \Driver\USBSTOR \Device\0000007f                                                                                                                           877A81F8

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                                                         771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                                                         285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                                                         2
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                                                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                                                        C:\Spiele\Alcohol 120\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                        0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                     0xDA 0x07 0x92 0x42 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001                                                                  
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                                                               0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew                                                            0xE1 0x25 0xD4 0x68 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40                                                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew                                                     0xA9 0xB7 0xA3 0x7F ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                        C:\Program Files\DAEMON Tools Pro\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                        1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                     0x7A 0xD2 0x8F 0x66 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                                                  
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                               0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                            0xB8 0xBD 0xEB 0xDC ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                                             
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                       0x61 0x79 0xA1 0x52 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                                       
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                                                            C:\Spiele\Alcohol 120\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                            0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                         0xDA 0x07 0x92 0x42 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)                                              
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                                                                   0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew                                                                0xE1 0x25 0xD4 0x68 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)                                       
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew                                                         0xA9 0xB7 0xA3 0x7F ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                       
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                            C:\Program Files\DAEMON Tools Pro\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                            1
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                         0x7A 0xD2 0x8F 0x66 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                                              
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                   0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                0xB8 0xBD 0xEB 0xDC ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                                         
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                           0x61 0x79 0xA1 0x52 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat                                                                    0xA1 0x40 0xB7 0x4F ...
Reg             HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Spiele\SimCity\x2122 Societies\vcredist_x86.exe      1
Reg             HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Spiele\SimCity\x2122 Societies\dotnetfx.exe          1
Reg             HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Spiele\SimCity\x2122 Societies\PackageInstaller.exe  1

---- EOF - GMER 1.0.15 ----

--- --- ---

machete81 · 01.04.2011, 12:04

Osam.exe doch gefunden Log folgt...sorry

machete81 · 01.04.2011, 12:50

OSAM Logfile:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 13:48:30 on 01.04.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.5.18

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"olycamdetect.exe_20101211_202902_0886.job" - "OLYMPUS IMAGING CORP." - C:\Program Files\Olympus\ib\olycamdetect.exe
"olycamdetect.exe_20101211_233336_0744.job" - "OLYMPUS IMAGING CORP." - C:\Program Files\Olympus\ib\olycamdetect.exe
"{1A4C63F3-D99B-4E54-ABAE-B8C141A77285}.job" - "Skype Technologies S.A." - C:\Program Files\Skype\Phone\Skype.exe
"{991E9A86-84A9-4D5D-AEC3-B1A066CFB0CB}.job" - "Skype Technologies S.A." - C:\Program Files\Skype\Phone\Skype.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a5exk6is" (a5exk6is) - ? - C:\Windows\system32\drivers\a5exk6is.sys  (Hidden registry entry, rootkit activity | File not found)
"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv11.sys
"ao8jbn90" (ao8jbn90) - ? - C:\Windows\system32\drivers\ao8jbn90.sys  (Hidden registry entry, rootkit activity | File not found)
"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\MACHET~1\AppData\Local\Temp\catchme.sys  (File not found)
"EraserUtilRebootDrv" (EraserUtilRebootDrv) - ? - C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"kwddiuoc" (kwddiuoc) - ? - C:\Users\MACHET~1\AppData\Local\Temp\kwddiuoc.sys  (Hidden registry entry, rootkit activity | File not found)
"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"MagicTune" (MagicTune) - ? - C:\Windows\System32\drivers\MTiCtwl.sys  (File found, but it contains no detailed information)
"MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbamswissarmy.sys
"NCPro" (NCPro) - ? - C:\Windows\system32\drivers\MTictwl.sys  (File found, but it contains no detailed information)
"NETBT" (netbt) - ? - C:\Windows\System32\DRIVERS\netbt.sys  (File not found)
"SPBBCDrv" (SPBBCDrv) - ? - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys  (File not found)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"Symantec Intrusion Prevention Driver" (IDSvix86) - "Symantec Corporation" - C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys
"SymEvent" (SymEvent) - "Symantec Corporation" - C:\Windows\system32\Drivers\SYMEVENT.SYS
"SYMREDRV" (SYMREDRV) - "Symantec Corporation" - C:\Windows\System32\Drivers\SYMREDRV.SYS
"SYMTDI" (SYMTDI) - "Symantec Corporation" - C:\Windows\System32\Drivers\SYMTDI.SYS

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\kbcplext.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\mcplext.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - c:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - c:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Intelligente Auswahl" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
"ICQ6" - "ICQ, LLC." - C:\Program Files\ICQ6.5\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{1F364306-AA45-47B5-9F9D-39A8B94E7EF1} "FG2CatchUrl" - "FlashGet" - D:\FlashGet universal\ComDlls\bhoCATCH.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Machete 81\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Logitech SetPoint.lnk" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\SetPoint.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Olympus ib" - "OLYMPUS IMAGING CORP." - "C:\Program Files\Olympus\ib\olycamdetect.exe" /Startup
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce )-----
"FlashPlayerUpdate" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\FlashUtil10m_Plugin.exe -update plugin
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"BDRegion" - "cyberlink" - C:\Program Files\Cyberlink\Shared Files\brs.exe
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"MDS_Menu" - "CyberLink Corp." - "C:\Program Files\Olympus\ib\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Olympus\ib" UpdateWithCreateOnce "Software\OLYMPUS\ib\1.0"
"Olympus ib" - "OLYMPUS IMAGING CORP." - "C:\Program Files\Olympus\ib\olycamdetect.exe" /Startup

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"LIDIL hpzll5mu" - "Hewlett-Packard Company" - C:\Windows\system32\hpzll5mu.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"COM Host" (comHost) - ? - "c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe"  (File not found)
"DATA BECKER Update Service" (DBService) - "DATA BECKER GmbH & Co KG" - C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
"Dragon Age: Origins - Inhaltsupdater" (DAUpdaterSvc) - "BioWare" - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
"FSCLBaseUpdaterService" (FSCLBaseUpdaterService) - ? - c:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe
"Fujitsu Siemens Computers Diagnostic Testhandler" (TestHandler) - "Fujitsu Siemens Computers" - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe
"PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe  (File found, but it contains no detailed information)
"PnkBstrB" (PnkBstrB) - ? - C:\Windows\system32\PnkBstrB.exe  (File found, but it contains no detailed information)
"StarWind AE Service" (StarWindServiceAE) - "Rocket Division Software" - C:\Spiele\Alcohol 120\StarWind\StarWindServiceAE.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe
"Symantec Event Manager" (ccEvtMgr) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Symantec IS Kennwortprüfung" (ISPwdSvc) - ? - "c:\Program Files\Norton Internet Security\isPwdSvc.exe"  (File not found)
"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Symantec Settings Manager" (ccSetMgr) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

machete81 · 01.04.2011, 12:53

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: FUJITSU SIEMENS
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: FUJITSU SIEMENS
System Product Name: G31T-M2
Logical Drives Mask: 0x000007dc

Kernel Drivers (total 165):
0x82C05000 \SystemRoot\system32\ntoskrnl.exe
0x82FB0000 \SystemRoot\system32\hal.dll
0x8880F000 \SystemRoot\system32\kdcom.dll
0x88816000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x88886000 \SystemRoot\system32\PSHED.dll
0x88897000 \SystemRoot\system32\BOOTVID.dll
0x8889F000 \SystemRoot\system32\CLFS.SYS
0x888E0000 \SystemRoot\system32\CI.dll
0x889C0000 \SystemRoot\system32\drivers\Wdf01000.sys
0x88A3C000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x88A49000 \SystemRoot\System32\Drivers\spxb.sys
0x88B47000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x88B50000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x88B76000 \SystemRoot\system32\drivers\acpi.sys
0x88BBC000 \SystemRoot\system32\drivers\msisadrv.sys
0x88BC4000 \SystemRoot\system32\drivers\pci.sys
0x88BEB000 \SystemRoot\System32\drivers\partmgr.sys
0x88800000 \SystemRoot\system32\drivers\volmgr.sys
0x88C06000 \SystemRoot\System32\drivers\volmgrx.sys
0x88C50000 \SystemRoot\system32\drivers\intelide.sys
0x88C57000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x88C65000 \SystemRoot\System32\drivers\mountmgr.sys
0x88C75000 \SystemRoot\system32\drivers\nvraid.sys
0x88C8E000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x88CAF000 \SystemRoot\system32\drivers\atapi.sys
0x88CB7000 \SystemRoot\system32\drivers\ataport.SYS
0x88CD5000 \SystemRoot\system32\drivers\vsmraid.sys
0x88CF3000 \SystemRoot\system32\drivers\storport.sys
0x88D34000 \SystemRoot\system32\drivers\fltmgr.sys
0x88D66000 \SystemRoot\system32\drivers\fileinfo.sys
0x88D76000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88DE7000 \SystemRoot\system32\drivers\ndis.sys
0x88EF2000 \SystemRoot\system32\drivers\msrpc.sys
0x88F1D000 \SystemRoot\system32\drivers\NETIO.SYS
0x89008000 \SystemRoot\System32\drivers\tcpip.sys
0x890F2000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8910D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8921D000 \SystemRoot\system32\drivers\volsnap.sys
0x89256000 \SystemRoot\System32\Drivers\spldr.sys
0x8925E000 \SystemRoot\System32\Drivers\mup.sys
0x8926D000 \SystemRoot\System32\drivers\ecache.sys
0x89294000 \SystemRoot\system32\drivers\disk.sys
0x892A5000 \SystemRoot\system32\drivers\crcdisk.sys
0x892CE000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x892D9000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x892E2000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8D407000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8DB6F000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x892F1000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8DB71000 \SystemRoot\System32\drivers\watchdog.sys
0x88F58000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8DB7D000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8DB99000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8DBA4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8DBE2000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8E009000 \SystemRoot\system32\drivers\hcw88vid.sys
0x8E085000 \SystemRoot\system32\drivers\STREAM.SYS
0x8E092000 \SystemRoot\system32\drivers\ks.sys
0x8E0BC000 \SystemRoot\system32\drivers\hcw88aud.sys
0x8E0BF000 \SystemRoot\system32\drivers\hcw88tse.sys
0x8E109000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8E119000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8E127000 \SystemRoot\system32\DRIVERS\parport.sys
0x8E13F000 \SystemRoot\system32\DRIVERS\serial.sys
0x8E159000 \SystemRoot\system32\DRIVERS\serenum.sys
0x8E163000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8E17B000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8E181000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8E1B0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8E1BB000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8E1D2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8E1DD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8E200000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8E20F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8E223000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8E238000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8E248000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8E253000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8E25E000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8E260000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8E26E000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8E278000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8E285000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8E2BA000 \SystemRoot\system32\drivers\HCW88BAR.sys
0x8E2C4000 \SystemRoot\system32\drivers\hcw88tun.sys
0x8E2EC000 \SystemRoot\system32\drivers\hcw88bda.sys
0x8E323000 \SystemRoot\system32\drivers\BdaSup.SYS
0x8E326000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8FC0A000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8FDEA000 \SystemRoot\system32\drivers\portcls.sys
0x8FE17000 \SystemRoot\system32\drivers\drmk.sys
0x8FE3C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8FE45000 \SystemRoot\System32\Drivers\Null.SYS
0x8FE4C000 \SystemRoot\System32\Drivers\Beep.SYS
0x8FE53000 \SystemRoot\system32\drivers\MTictwl.sys
0x8FE60000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8FE67000 \SystemRoot\System32\drivers\vga.sys
0x8FE73000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8FE94000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8FE9C000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8FEA4000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8FEAF000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8FEBD000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8FEC6000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8FEDC000 \SystemRoot\system32\DRIVERS\smb.sys
0x8FEF0000 \SystemRoot\system32\drivers\afd.sys
0x8FF38000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8FF4E000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8FF5C000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8FF6F000 \SystemRoot\System32\Drivers\SYMTDI.SYS
0x8FF9B000 \??\C:\Windows\system32\Drivers\SYMEVENT.SYS
0x8FFBD000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8FFC3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8FC00000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8E337000 \SystemRoot\System32\Drivers\dfsc.sys
0x8E34E000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8FE57000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8E36A000 \SystemRoot\system32\DRIVERS\usbcir.sys
0x8FE59000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8E380000 \SystemRoot\system32\DRIVERS\hidir.sys
0x8E38B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8E39B000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8E3A4000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8E3AC000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8E3B9000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8E3C4000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x8E3CC000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x99030000 \SystemRoot\System32\win32k.sys
0x8E3E1000 \SystemRoot\System32\drivers\Dxapi.sys
0x89392000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8E3EB000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8E3F4000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x8E000000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x8DBF1000 \SystemRoot\system32\DRIVERS\monitor.sys
0x99250000 \SystemRoot\System32\TSDDD.dll
0x99270000 \SystemRoot\System32\cdd.dll
0x893A9000 \SystemRoot\system32\drivers\luafv.sys
0x893C4000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9E40A000 \SystemRoot\system32\drivers\spsys.sys
0x9E4BA000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9E4CA000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9E4DD000 \SystemRoot\system32\drivers\HTTP.sys
0x9E54A000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9E567000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9E580000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9E595000 \SystemRoot\system32\drivers\mrxdav.sys
0x9E5B6000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9E5D5000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9E60E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9E626000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9E64E000 \SystemRoot\System32\DRIVERS\srv.sys
0x9E69C000 \SystemRoot\system32\DRIVERS\parvdm.sys
0x9E6A3000 \??\C:\Windows\system32\drivers\acedrv11.sys
0x9E6CF000 \SystemRoot\system32\DRIVERS\atksgt.sys
0x9E712000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0x9E717000 \SystemRoot\system32\drivers\peauth.sys
0x9E7F5000 \SystemRoot\System32\Drivers\secdrv.SYS
0x893E0000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA200F000 \??\C:\Program Files\CyberLink\PowerDVD\000.fcl
0xA203B000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xA2050000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0xA2062000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xA2078000 \SystemRoot\system32\drivers\MSPQM.sys
0xA207A000 \??\C:\Users\MACHET~1\AppData\Local\Temp\kwddiuoc.sys
0x778E0000 \Windows\System32\ntdll.dll

Processes (total 65):
0 System Idle Process
4 System
480 C:\Windows\System32\smss.exe
544 csrss.exe
600 C:\Windows\System32\wininit.exe
612 csrss.exe
644 C:\Windows\System32\services.exe
656 C:\Windows\System32\lsass.exe
668 C:\Windows\System32\lsm.exe
816 C:\Windows\System32\svchost.exe
848 C:\Windows\System32\winlogon.exe
932 C:\Windows\System32\nvvsvc.exe
960 C:\Windows\System32\svchost.exe
1028 C:\Windows\System32\svchost.exe
1064 C:\Windows\System32\svchost.exe
1092 C:\Windows\System32\svchost.exe
1104 C:\Windows\System32\svchost.exe
1188 C:\Windows\System32\audiodg.exe
1216 C:\Windows\System32\SLsvc.exe
1324 C:\Windows\System32\svchost.exe
1340 C:\Windows\System32\svchost.exe
1424 C:\Windows\System32\brsvc01a.exe
1444 C:\Windows\System32\LEXBCES.EXE
1452 C:\Windows\System32\brss01a.exe
1484 C:\Windows\System32\LEXPPS.EXE
1552 C:\Windows\System32\spoolsv.exe
1588 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1632 C:\Windows\System32\svchost.exe
1932 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1944 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1956 C:\Program Files\Bonjour\mDNSResponder.exe
1984 C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
2012 C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe
508 C:\Windows\System32\rundll32.exe
1904 C:\Windows\System32\svchost.exe
2136 C:\Windows\System32\IoctlSvc.exe
2156 C:\Windows\System32\PnkBstrA.exe
2172 C:\Windows\System32\PnkBstrB.exe
2200 C:\Windows\System32\svchost.exe
2244 C:\Windows\System32\svchost.exe
2284 C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe
2316 C:\Windows\System32\svchost.exe
2368 C:\Windows\System32\SearchIndexer.exe
2564 WUDFHost.exe
3128 C:\Windows\System32\dwm.exe
3180 C:\Windows\explorer.exe
3352 C:\Windows\RtHDVCpl.exe
3368 C:\Windows\System32\rundll32.exe
3392 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3400 C:\Program Files\CyberLink\Shared Files\brs.exe
3472 C:\Windows\PixArt\Pac207\Monitor.exe
3676 C:\Windows\ehome\ehtray.exe
3684 C:\Program Files\Olympus\ib\olycamdetect.exe
3732 C:\Windows\ehome\ehmsas.exe
3752 C:\Program Files\Logitech\SetPoint\SetPoint.exe
3832 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
3964 C:\Windows\System32\mobsync.exe
3520 C:\Windows\ehome\ehsched.exe
1652 C:\Windows\ehome\ehrecvr.exe
5564 C:\Program Files\iPod\bin\iPodService.exe
5716 C:\Program Files\Mozilla Firefox\firefox.exe
4308 C:\Users\Machete 81\Desktop\osam.exe
1440 C:\Windows\System32\SearchProtocolHost.exe
5752 C:\Windows\System32\SearchFilterHost.exe
5836 C:\Users\Machete 81\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`ee100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000004e`c4400000 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000AAKS-07YGA0, Rev: 12.01C02

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

cosinus · 01.04.2011, 14:21

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

machete81 · 03.04.2011, 17:15

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6253

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

03.04.2011 16:14:56
mbam-log-2011-04-03 (16-14-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 359657
Laufzeit: 1 Stunde(n), 47 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus · 04.04.2011, 08:19

Das andere Log kommt auch?

machete81 · 05.04.2011, 03:37

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/05/2011 at 02:03 AM

Application Version : 4.50.1002

Core Rules Database Version : 6751
Trace Rules Database Version: 4563

Scan type : Complete Scan
Total Scan Time : 02:54:49

Memory items scanned : 704
Memory threats detected : 0
Registry items scanned : 10003
Registry threats detected : 0
File items scanned : 204682
File threats detected : 5

Adware.Tracking Cookie
C:\Users\Machete 81\AppData\Roaming\Microsoft\Windows\Cookies\machete_81@doubleclick[1].txt
counter.cam-content.com [ C:\Users\Machete 81\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\YANUMHDQ ]
s0.2mdn.net [ C:\Users\Machete 81\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\YANUMHDQ ]
www.naiadsystems.com [ C:\Users\Machete 81\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\YANUMHDQ ]
akamai.smartadserver.com [ C:\Windows\System32\config\systemprofile\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\A7974TBN ]

machete81 · 05.04.2011, 08:59

SuperAntiSpyWare hat nach Klicken auf "Fertig stellen" allerdings "selbstständig Daten gelöscht....???

cosinus · 05.04.2011, 11:33

Das waren eh nur harmlose Cookies.
Noch Probleme offen=?

machete81 · 05.04.2011, 22:58

Also, bis jetzt nicht. Läuft alles...
Vielen Danke ansonsten erstmal für Geduld und alles.

cosinus · 06.04.2011, 09:00

Dann wären wir durch!

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

01.04.2011, 14:21	#37
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows Recovery Maleware Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

04.04.2011, 08:19	#39
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows Recovery Maleware Das andere Log kommt auch? __________________ Logfiles bitte immer in CODE-Tags posten

05.04.2011, 11:33	#42
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows Recovery Maleware Das waren eh nur harmlose Cookies. Noch Probleme offen=? __________________ Logfiles bitte immer in CODE-Tags posten

Windows Recovery Maleware

Log-Analyse und Auswertung: Windows Recovery Maleware