Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Problem mit IDE/SATA-Fetsplatten (https://www.trojaner-board.de/100181-problem-ide-sata-fetsplatten.html)

Holzwurm 2 10.06.2011 16:49
Problem mit IDE/SATA-Fetsplatten
 
Hallo

Wie so viele habe ich mir auch etwas eingefangen.
Habe das gleiche Problem. http://www.trojaner-board.de/100072-...tgestellt.html

Ich habe einen OTL log und bitte um Hilfe.

Code:
OTL logfile created on: 10.06.2011 17:25:22 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = E:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 68,96% Memory free
6,23 Gb Paging File | 5,27 Gb Available in Paging File | 84,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 73,77 Gb Free Space | 49,49% Space Free | Partition Type: NTFS
Drive D: | 139,28 Gb Total Space | 120,37 Gb Free Space | 86,42% Space Free | Partition Type: NTFS
Drive E: | 1,89 Gb Total Space | 1,88 Gb Free Space | 99,51% Space Free | Partition Type: FAT
 
Computer Name: HOLZWURM | User Name: irarref575 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - E:\OTL.exe (OldTimer Tools)
PRC - C:\Users\irarref575\AppData\Local\Apps\2.0\1CEDPDX9.Z1J\8Q3ZH6PO.5TX\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\fritzbox-usb-fernanschluss.exe (AVM Berlin)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Windows\System32\ASUSTPE.exe (ASUS)
PRC - C:\Program Files\P4G\BatteryLife.exe (ATK)
PRC - C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
PRC - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe ()
PRC - C:\Program Files\ATK Hotkey\Hcontrol.exe (ATK0100)
PRC - C:\Program Files\ATK Hotkey\KBFiltr.exe ()
PRC - C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
PRC - C:\Program Files\ATKOSD2\ATKOSD2.exe ()
PRC - C:\Program Files\Wireless Console 2\wcourier.exe ()
PRC - C:\Program Files\ATK Hotkey\ATKOSD.exe ()
PRC - C:\Windows\System32\ACEngSvr.exe (ASUSTeK)
 
 
========== Modules (SafeList) ==========
 
MOD - E:\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (AdobeActiveFileMonitor9.0) -- C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (ACDaemon) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (IGDCTRL) -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
SRV - (ADSMService) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe ()
SRV - (ASLDRService) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avmaudio) -- C:\Windows\System32\drivers\avmaudio.sys (AVM Berlin)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (FlashUSB) -- C:\Windows\System32\drivers\FlashUSB.sys (Danish Wireless Design A/S)
DRV - (UsbDiag) -- C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) -- C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (LgBttPort) -- C:\Windows\System32\drivers\lgbtport.sys (LG Electronics Inc.)
DRV - (LGVMODEM) -- C:\Windows\System32\drivers\lgvmodem.sys (LG Electronics Inc.)
DRV - (lgbusenum) -- C:\Windows\System32\drivers\lgbtbus.sys (LG Electronics Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (AF15BDA) -- C:\Windows\System32\drivers\AF15BDA.sys (AfaTech                  )
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (AsDsm) -- C:\Windows\System32\drivers\AsDsm.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()
DRV - (SiSGbeLH) -- C:\Windows\System32\drivers\SiSGB6.sys (Silicon Integrated Systems Corp.)
DRV - (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s125mgmt.sys (MCCI Corporation)
DRV - (s125obex) -- C:\Windows\System32\drivers\s125obex.sys (MCCI Corporation)
DRV - (s125mdm) -- C:\Windows\System32\drivers\s125mdm.sys (MCCI Corporation)
DRV - (s125mdfl) -- C:\Windows\System32\drivers\s125mdfl.sys (MCCI Corporation)
DRV - (s125bus) Sony Ericsson Device 125 driver (WDM) -- C:\Windows\System32\drivers\s125bus.sys (MCCI Corporation)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "t-online.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {00ADD29A-66F4-4f22-BCC0-4C1D29DA647B}:1.0
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.06.05 20:40:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{00ADD29A-66F4-4f22-BCC0-4C1D29DA647B}: C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\{00ADD29A-66F4-4f22-BCC0-4C1D29DA647B}\ [2010.09.03 20:51:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.02 07:34:34 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.03 12:45:57 | 000,000,000 | -H-D | M]
 
[2010.12.10 20:36:37 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\irarref575\AppData\Roaming\mozilla\Extensions
[2010.12.10 20:36:37 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\irarref575\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2011.05.24 21:35:36 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\irarref575\AppData\Roaming\mozilla\Firefox\Profiles\x3t7edo9.default\extensions
[2010.04.29 08:36:44 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\irarref575\AppData\Roaming\mozilla\Firefox\Profiles\x3t7edo9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.04 17:26:35 | 000,000,000 | -H-D | M] (DownloadHelper) -- C:\Users\irarref575\AppData\Roaming\mozilla\Firefox\Profiles\x3t7edo9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.05.03 12:46:16 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.05.03 12:46:16 | 000,000,000 | -H-D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) --
[2010.09.03 20:51:24 | 000,000,000 | ---D | M] (LG Air Sync) -- C:\PROGRAM FILES\LG ELECTRONICS\LG PC SUITE IV\LINKAIR\{00ADD29A-66F4-4F22-BCC0-4C1D29DA647B}
() (No name found) -- C:\USERS\IRARREF575\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\X3T7EDO9.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.05.02 07:34:32 | 000,142,296 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.04.14 05:08:00 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AVMUSBFernanschluss] C:\Users\irarref575\AppData\Local\Apps\2.0\1CEDPDX9.Z1J\8Q3ZH6PO.5TX\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: LG Air Sync (R-Click) - Save as Mobile Image - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.)
O8 - Extra context menu item: LG Air Sync (R-Click) - Save as Mobile Memo - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.)
O8 - Extra context menu item: LG Air Sync (R-Click) - Save as Mobile Text file - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.)
O8 - Extra context menu item: LG Air Sync (R-Click) - Set as Mobile Wallpaper - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.)
O8 - Extra context menu item: LG Air Sync Option - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\irarref575\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\irarref575\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4e0a1186-b75b-11df-b5ba-00224332dce4}\Shell - "" = AutoRun
O33 - MountPoints2\{4e0a1186-b75b-11df-b5ba-00224332dce4}\Shell\AutoRun\command - "" = E:\LGAutoRun.exe
O33 - MountPoints2\{59da691c-0366-11df-8447-00235484469c}\Shell\AutoRun\command - "" = I:\Menu.exe
O33 - MountPoints2\{e3c08c06-1847-11e0-a30d-00224332dce4}\Shell - "" = AutoRun
O33 - MountPoints2\{e3c08c06-1847-11e0-a30d-00224332dce4}\Shell\AutoRun\command - "" = E:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.10 16:42:47 | 000,000,000 | ---D | C] -- C:\Users\irarref575\AppData\Roaming\Malwarebytes
[2011.06.10 16:42:39 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.06.10 16:42:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.06.10 16:42:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.10 16:42:34 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.06.10 16:42:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.06.09 16:20:46 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Restore
[2011.06.01 08:18:14 | 000,047,360 | -H-- | C] (VSO Software) -- C:\Users\irarref575\AppData\Roaming\pcouffin.sys
[2011.06.01 08:18:14 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Roaming\Vso
[2011.06.01 08:18:14 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\Documents\PcSetup
[2011.06.01 08:16:02 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011.05.26 10:58:47 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Local\PDF24
[2011.05.26 10:58:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2011.05.26 10:58:20 | 000,000,000 | ---D | C] -- C:\Program Files\PDF24
[2011.05.23 23:05:02 | 000,016,896 | ---- | C] (Danish Wireless Design A/S) -- C:\Windows\System32\drivers\FlashUSB.sys
[2011.05.23 23:05:02 | 000,000,000 | -H-D | C] -- C:\ifx
[2011.05.23 23:02:06 | 000,000,000 | -H-D | C] -- C:\LG_USB
[2011.05.23 22:16:56 | 000,101,248 | ---- | C] (AVM Berlin) -- C:\Windows\System32\drivers\avmaudio.sys
[2011.05.23 22:16:56 | 000,032,256 | ---- | C] (AVM Berlin) -- C:\Windows\System32\MiniInstaller.dll
[2011.05.23 22:16:56 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
[2011.05.23 22:16:11 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Local\Apps
[2011.05.23 22:16:10 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Local\Deployment
[2011.05.23 22:10:09 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\Documents\OneNote-Notizbücher
[2011.05.23 13:44:46 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Roaming\vlc
[2011.05.12 16:41:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2007.01.24 20:08:39 | 000,005,632 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.10 17:08:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.10 17:03:00 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2011.06.10 17:02:39 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.10 17:02:23 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.10 17:02:22 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.10 17:02:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.10 17:02:09 | 3220,463,616 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.10 16:42:39 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.10 16:38:52 | 000,678,092 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.10 16:38:52 | 000,637,304 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.10 16:38:52 | 000,147,244 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.10 16:38:52 | 000,120,808 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.09 16:44:41 | 000,000,136 | -H-- | M] () -- C:\ProgramData\~39968504r
[2011.06.09 16:44:41 | 000,000,112 | -H-- | M] () -- C:\ProgramData\~39968504
[2011.06.09 16:20:47 | 000,000,600 | -H-- | M] () -- C:\Users\irarref575\Desktop\Windows Vista Restore.lnk
[2011.06.09 16:20:34 | 000,000,336 | -H-- | M] () -- C:\ProgramData\39968504
[2011.06.09 11:05:52 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011.06.08 22:30:04 | 000,120,320 | -H-- | M] () -- C:\Users\irarref575\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.01 08:18:14 | 000,087,608 | -H-- | M] () -- C:\Users\irarref575\AppData\Roaming\inst.exe
[2011.06.01 08:18:14 | 000,047,360 | -H-- | M] (VSO Software) -- C:\Users\irarref575\AppData\Roaming\pcouffin.sys
[2011.06.01 08:18:14 | 000,007,887 | -H-- | M] () -- C:\Users\irarref575\AppData\Roaming\pcouffin.cat
[2011.06.01 08:18:14 | 000,001,144 | -H-- | M] () -- C:\Users\irarref575\AppData\Roaming\pcouffin.inf
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.23 23:00:09 | 000,002,413 | ---- | M] () -- C:\Windows\System32\lgAxconfig.ini
[2011.05.23 22:59:58 | 000,000,774 | -H-- | M] () -- C:\Users\irarref575\Desktop\LGMobile update.lnk
[2011.05.23 22:16:32 | 000,101,248 | ---- | M] (AVM Berlin) -- C:\Windows\System32\drivers\avmaudio.sys
[2011.05.23 22:16:30 | 000,032,256 | ---- | M] (AVM Berlin) -- C:\Windows\System32\MiniInstaller.dll
[2011.05.23 08:12:04 | 000,000,680 | -H-- | M] () -- C:\Users\irarref575\AppData\Local\d3d9caps.dat
 
========== Files Created - No Company Name ==========
 
[2011.06.10 16:42:39 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.09 16:20:48 | 000,000,136 | -H-- | C] () -- C:\ProgramData\~39968504r
[2011.06.09 16:20:48 | 000,000,112 | -H-- | C] () -- C:\ProgramData\~39968504
[2011.06.09 16:20:47 | 000,000,600 | -H-- | C] () -- C:\Users\irarref575\Desktop\Windows Vista Restore.lnk
[2011.06.09 16:20:34 | 000,000,336 | -H-- | C] () -- C:\ProgramData\39968504
[2011.06.01 08:18:14 | 000,087,608 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\inst.exe
[2011.06.01 08:18:14 | 000,007,887 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\pcouffin.cat
[2011.06.01 08:18:14 | 000,001,144 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\pcouffin.inf
[2011.01.23 21:16:45 | 000,000,680 | -H-- | C] () -- C:\Users\irarref575\AppData\Local\d3d9caps.dat
[2010.09.16 23:35:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll
[2010.09.16 23:35:32 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2010.09.03 21:26:52 | 000,038,214 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
[2010.06.29 06:34:58 | 000,005,632 | ---- | C] () -- C:\Windows\System32\StarOpen.sys
[2009.08.26 09:31:31 | 002,707,563 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\NMM-MetaData.db
[2009.06.22 21:18:01 | 000,256,158 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\mdbu.bin
[2009.05.31 21:46:55 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.31 21:46:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.03.12 00:57:00 | 000,013,855 | -H-- | C] () -- C:\Users\irarref575\AppData\Roaming\UserTile.png
[2009.03.01 19:23:19 | 000,000,126 | ---- | C] () -- C:\Windows\System32\AF15IRTBL.bin
[2009.01.15 00:36:02 | 000,000,098 | -H-- | C] () -- C:\Users\irarref575\AppData\Local\fusioncache.dat
[2009.01.02 19:17:04 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.01.02 18:30:01 | 000,120,320 | -H-- | C] () -- C:\Users\irarref575\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.11 01:24:47 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2008.11.11 01:19:16 | 000,033,136 | ---- | C] () -- C:\Windows\ASScrPro.exe
[2008.11.11 01:19:06 | 000,037,232 | ---- | C] () -- C:\Windows\ASScrProlog.exe
[2008.11.11 01:19:03 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2008.11.10 23:57:27 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.11.10 23:11:30 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008.04.16 13:11:34 | 000,678,092 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.04.16 13:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.04.16 13:11:34 | 000,147,244 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.04.16 13:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.04.16 12:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2008.03.09 16:01:07 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.03.09 15:32:51 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008.03.04 13:01:59 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
[2008.02.28 04:14:03 | 000,168,886 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007.08.06 19:18:31 | 000,081,920 | ---- | C] () -- C:\Windows\PGMonitor.exe
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,406,600 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,637,304 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,120,808 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.03.09 03:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005.02.25 06:15:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\EPSPTDV.DLL
 
========== LOP Check ==========
 
[2009.01.05 21:09:03 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\DAEMON Tools
[2009.01.05 20:56:31 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\DAEMON Tools Lite
[2009.01.05 21:09:03 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\DAEMON Tools Pro
[2011.03.09 10:01:50 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\FRITZ!
[2011.01.12 20:23:28 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\FUJIFILM
[2010.09.17 00:01:33 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\ML
[2009.06.05 11:35:26 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\Mp3tag
[2009.06.05 10:54:55 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\Nokia
[2009.06.05 10:41:02 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\PC Suite
[2009.03.12 00:57:00 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\PeerNetworking
[2011.01.28 21:43:34 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\Teleca
[2010.12.10 20:36:33 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\TomTom
[2011.06.01 08:18:15 | 000,000,000 | -H-D | M] -- C:\Users\irarref575\AppData\Roaming\Vso
[2011.06.10 17:01:20 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.12.20 16:46:06 | 000,000,428 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{DAC806BD-EA5E-43F7-A13C-BF225E18D1DF}.job
 
========== Purity Check ==========
 
 
 
< End of report >
Code:
OTL Extras logfile created on: 10.06.2011 17:25:22 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = E:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 68,96% Memory free
6,23 Gb Paging File | 5,27 Gb Available in Paging File | 84,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 73,77 Gb Free Space | 49,49% Space Free | Partition Type: NTFS
Drive D: | 139,28 Gb Total Space | 120,37 Gb Free Space | 86,42% Space Free | Partition Type: NTFS
Drive E: | 1,89 Gb Total Space | 1,88 Gb Free Space | 99,51% Space Free | Partition Type: FAT
 
Computer Name: HOLZWURM | User Name: irarref575 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
.js [@ = JSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
jsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00A2323B-8220-4716-B91A-8011D873DBD3}" = rport=445 | protocol=6 | dir=out | app=system |
"{1336F39A-AFAC-4DB6-A290-FF12B67734C3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1FBB7E3B-3312-47F7-B997-300235CD3663}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3A96E6D3-C280-4997-BC71-D9155CEC4794}" = rport=138 | protocol=17 | dir=out | app=system |
"{45553A84-5EB7-4383-8845-3FBF5FAFD6C5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{45E483D3-CB34-4D49-BF3C-1089B225F3AA}" = lport=138 | protocol=17 | dir=in | app=system |
"{4C05F9B7-CF2D-41DF-8D71-66BA40B7C85A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{52D05BB7-D592-457A-9BBE-F9BA99C3D687}" = lport=139 | protocol=6 | dir=in | app=system |
"{601D63A7-F111-4CA0-B58B-C7CEB746D8A3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{78E2D20C-A5AD-424B-A96D-D1D411E0E28C}" = rport=137 | protocol=17 | dir=out | app=system |
"{797061C8-B8F8-4BF7-95FB-F0D36C5B79C7}" = lport=445 | protocol=6 | dir=in | app=system |
"{93920541-E658-4EAF-A897-C3A4F51A5495}" = lport=137 | protocol=17 | dir=in | app=system |
"{96CE9379-8C59-4124-AC74-BDFEED0E6E6B}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9735E29B-085B-44FA-9CCE-D1FB110C1051}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{A8A09511-E36E-47C2-A72A-A9CEE2B68B1C}" = rport=139 | protocol=6 | dir=out | app=system |
"{AF6E000A-F7C0-4C5F-ACBF-527232BC9145}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BA00EA41-CEF6-480D-ACA2-8B17CF031788}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D84069AA-D67E-488D-BE97-0EE796EDC0FB}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{E3A0E6F3-0573-4AD2-B46C-F3D6C9563E85}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B89225-D4D3-4AA4-898A-5F30872F2AF2}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{1974B17D-9FCF-4978-80CF-BC580DEF4771}" = protocol=6 | dir=in | app=c:\users\irarref575\appdata\local\apps\2.0\1cedpdx9.z1j\8q3zh6po.5tx\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\fritzbox-usb-fernanschluss.exe |
"{32A42354-83D6-4999-A6A4-D93EE4F6F8D5}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{43FB0FC8-798F-4510-8931-85AAAF4EC93C}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{48D36D0C-1463-428F-A7BE-FC373E667899}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{524F97C3-658D-4C69-81C8-C7CFD6BECD76}" = protocol=17 | dir=in | app=c:\users\irarref575\appdata\local\apps\2.0\1cedpdx9.z1j\8q3zh6po.5tx\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\fritzbox-usb-fernanschluss.exe |
"{584796A8-8E57-494D-AFAD-20F90E6A3E14}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{5FC8016D-D74D-46F6-BF48-E51FB10295CA}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{71819097-990E-418B-AEB0-D25150E08CA2}" = protocol=17 | dir=in | app=c:\users\irarref575\appdata\local\apps\2.0\1cedpdx9.z1j\8q3zh6po.5tx\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\fritzbox-usb-fernanschluss.exe |
"{73D5A79B-882D-47E7-8D9D-5ABD72627C71}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{775FCAEC-D7E7-4C91-B569-B72421394B38}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{7AB0479E-AD45-4723-8C26-ACB13507CD41}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7C2220E9-041F-4A7B-8086-BFD3BD31885D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{831B8E3C-EBA1-4351-9B60-FA681B5EFF57}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9CF141DC-A75F-43C4-8DD1-775E44C7919A}" = protocol=6 | dir=in | app=c:\users\irarref575\appdata\local\apps\2.0\1cedpdx9.z1j\8q3zh6po.5tx\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\fritzbox-usb-fernanschluss.exe |
"{CEB49EC0-0ECF-4212-AEAB-6562D0F66586}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{D30E1B66-5793-4BCE-9674-6D95DD26875C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{DD4D1ABC-C2DB-4B9E-A2A4-C69DB847C9B7}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{EBD9B9A8-043B-49B2-BD59-23D48F372714}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{F81CCF73-B251-4EFD-8F9D-06499A3E94AA}" = protocol=6 | dir=in | app=c:\program files\msi\arcsoft totalmedia\totalmedia.exe |
"{FBB6952B-A3F8-4F6F-9AA3-2DE0815AF73D}" = protocol=17 | dir=in | app=c:\program files\msi\arcsoft totalmedia\totalmedia.exe |
"TCP Query User{0C681BFB-5BCB-43FC-BB80-7640C575E2EC}C:\users\irarref575\desktop\jdownloader_portableapps\commonfiles\java\bin\javaw.exe" = protocol=6 | dir=in | app=c:\users\irarref575\desktop\jdownloader_portableapps\commonfiles\java\bin\javaw.exe |
"TCP Query User{1102CEB2-1136-46F9-8DB1-81A311DEE7F8}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"TCP Query User{147B9FE5-06B0-49CD-8FE8-787DABBD69C0}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{1D23D45B-08E2-4D20-A89A-EA54F6130F54}C:\program files\sony ericsson\update service\update service.exe" = protocol=6 | dir=in | app=c:\program files\sony ericsson\update service\update service.exe |
"TCP Query User{2E0CA8F8-E509-4C1E-BEF4-9089FF5C0D8A}D:\neuer ordner\steam\steamapps\oz.racing\day of defeat source\hl2.exe" = protocol=6 | dir=in | app=d:\neuer ordner\steam\steamapps\oz.racing\day of defeat source\hl2.exe |
"TCP Query User{4F2C8516-669A-4AF2-B0DE-9FE8AFF40B61}D:\spiele\steamapps\oz.racing\day of defeat source\hl2.exe" = protocol=6 | dir=in | app=d:\spiele\steamapps\oz.racing\day of defeat source\hl2.exe |
"TCP Query User{67AEE045-D564-4E54-BD10-C0FE4845DD10}C:\program files\fritz!box monitor\fritzboxmonitor.exe" = protocol=6 | dir=in | app=c:\program files\fritz!box monitor\fritzboxmonitor.exe |
"TCP Query User{AAF0A85B-6B1C-4981-9EFA-D5E4D32ECF64}C:\program files\fritz!box monitor\fritzboxmonitor.exe" = protocol=6 | dir=in | app=c:\program files\fritz!box monitor\fritzboxmonitor.exe |
"TCP Query User{ACAECD4E-123A-4FAE-9309-CB74AC1F1FB7}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{D61F9CA2-24E6-4BC4-ACE9-9E1078F39F99}D:\neuer ordner\cod4\cod4\iw3mp.exe" = protocol=6 | dir=in | app=d:\neuer ordner\cod4\cod4\iw3mp.exe |
"TCP Query User{D8A0D2B4-A941-4AD2-91CE-9A5E5B1C060F}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{E296349A-C379-44B6-A31E-BAB6640A262E}D:\spiele\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=d:\spiele\tmnationsforever\tmforever.exe |
"TCP Query User{ECF60BC5-9EC9-494D-B1EC-0490F8CAF1FE}D:\spiele\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=d:\spiele\tmnationsforever\tmforever.exe |
"UDP Query User{2689C806-7553-4728-A8A4-6F149C96DCEB}D:\spiele\steamapps\oz.racing\day of defeat source\hl2.exe" = protocol=17 | dir=in | app=d:\spiele\steamapps\oz.racing\day of defeat source\hl2.exe |
"UDP Query User{3B3F54F4-0863-4D8A-A307-39E3477A54D5}C:\users\irarref575\desktop\jdownloader_portableapps\commonfiles\java\bin\javaw.exe" = protocol=17 | dir=in | app=c:\users\irarref575\desktop\jdownloader_portableapps\commonfiles\java\bin\javaw.exe |
"UDP Query User{3BAAE4DB-74DB-47AD-AB09-5C2EA06BA8F2}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{4A81A867-E6BC-42F4-A59E-C97FBCB88FD8}D:\spiele\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=d:\spiele\tmnationsforever\tmforever.exe |
"UDP Query User{7D0C2B6B-A706-4C51-9970-E6CC81CF1F89}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{8222BDE7-C16B-43AC-994C-57FA1CF6BAD9}D:\neuer ordner\steam\steamapps\oz.racing\day of defeat source\hl2.exe" = protocol=17 | dir=in | app=d:\neuer ordner\steam\steamapps\oz.racing\day of defeat source\hl2.exe |
"UDP Query User{8AB6D321-361E-4A08-BADD-36BF0D676D54}C:\program files\fritz!box monitor\fritzboxmonitor.exe" = protocol=17 | dir=in | app=c:\program files\fritz!box monitor\fritzboxmonitor.exe |
"UDP Query User{A39FF9F3-919D-434A-B12E-67D155315506}D:\neuer ordner\cod4\cod4\iw3mp.exe" = protocol=17 | dir=in | app=d:\neuer ordner\cod4\cod4\iw3mp.exe |
"UDP Query User{BA985D21-8843-4846-92B1-04F4EDF46BB4}C:\program files\sony ericsson\update service\update service.exe" = protocol=17 | dir=in | app=c:\program files\sony ericsson\update service\update service.exe |
"UDP Query User{BF6CF929-AE18-4695-9763-D79507A07039}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{CC46F96F-4DC4-4AF3-8188-C014F830D27B}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{F369DD4E-EB21-452A-9626-5BBCF234594F}C:\program files\fritz!box monitor\fritzboxmonitor.exe" = protocol=17 | dir=in | app=c:\program files\fritz!box monitor\fritzboxmonitor.exe |
"UDP Query User{FD224C18-2BD6-432C-A647-8E116B863710}D:\spiele\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=d:\spiele\tmnationsforever\tmforever.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{065D5505-3821-4C2E-BB6C-FE66A7E7CB4F}" = USB Flash Port Driver
"{088D5DC3-A607-DF3D-6406-7CA7F597F25F}" = Catalyst Control Center Localization Norwegian
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0A1129C7-E4F7-4EDC-DD38-DC8B467F5DAD}" = CCC Help Italian
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{11435553-1388-0583-98C3-AD3C49E9A038}" = Catalyst Control Center Graphics Full Existing
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}" = ASUS Data Security Manager
"{1C94CB71-A432-873C-E0AC-121EDBD817CE}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{230142CE-A81E-CC3C-35CC-5CC8A49CCB1E}" = Catalyst Control Center Localization Japanese
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 25
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{29B9C0F8-380D-133D-6551-142BB77F94C8}" = ccc-core-static
"{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver
"{2C85768B-0BDA-8FB8-3CC8-B36C3CD86151}" = Catalyst Control Center Localization Thai
"{3117A9EF-16BE-3404-CBC8-9AC1BB009335}" = CCC Help French
"{31C74C17-B0AC-0F77-E772-9F7FA9891E36}" = CCC Help Turkish
"{37D7562E-389B-6675-13E2-6D4F6994DD9A}" = Catalyst Control Center Localization Dutch
"{389E3080-0B6D-BA11-3369-490623D5FD49}" = CCC Help Portuguese
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E8DE1A6-B365-4FF6-B917-2892A34990E8}" = LG USB Modem Drivers
"{3EE772A4-97F3-806B-924F-6D77EE00C1AE}" = CCC Help Hungarian
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{431633E7-E6A4-3205-3B80-3F9BC437F797}" = Skins
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{46647CBB-A2D5-AA8E-F951-1712A74668C4}" = Catalyst Control Center Localization Turkish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52F3D26F-AE33-2F25-1374-DDB65CEB12F3}" = CCC Help Czech
"{54FB7140-FD80-2389-3332-9D85FC74915D}" = Catalyst Control Center Localization Swedish
"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun
"{593D6CC5-D02A-BF6C-6463-278368587E02}" = Catalyst Control Center Localization Greek
"{5C1748A8-912B-DF0B-5C35-A9C3A2D546A7}" = Catalyst Control Center Localization Czech
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{5EB5EEA7-6432-5827-0080-899DA70A97BA}" = ATI Catalyst Install Manager
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F5D5DE9-D467-43D4-0D43-68B4598FF5CB}" = Catalyst Control Center Localization Russian
"{60204E20-6172-2517-9B6F-6A87416956A1}" = CCC Help Dutch
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{6AE16305-FD12-FFF0-85FA-722360417549}" = Catalyst Control Center Localization Korean
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6E32B134-CA8D-49DD-B94C-0DB155CE70B5}" = ccc-Branding
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7234908A-5F80-B67A-8DE8-98B75FA43810}" = CCC Help Chinese Traditional
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{730801C2-7C9B-2260-614D-A44767CA5DBC}" = CCC Help Thai
"{73B9CDF5-9B29-3DD5-0028-C68CD2490F1E}" = CCC Help Korean
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{74A929E2-FBD8-4736-A84E-2ABBB2ABADF2}" = AVM FRITZ!DSL
"{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}" = Nokia PC Suite
"{7DEEE76B-ED3D-657E-5475-D67ADA440E47}" = CCC Help Norwegian
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.0.0
"{82427977-8776-4087-90CA-9F65174D3C4D}" = Nokia Connectivity Cable Driver
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{8439EDA7-A85C-E830-2E23-197A1BFD24F5}" = Catalyst Control Center Localization Italian
"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9980C99E-6954-614B-EA1C-333473FC2900}" = ccc-utility
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A55D681-02D1-6E48-F717-3ACFF6DBB27C}" = CCC Help Russian
"{9B74C58F-A6AE-F383-4AC1-F432FDF35884}" = CCC Help Chinese Standard
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater
"{9F88C8F3-5953-B3D7-7F91-A7CE3A6F5119}" = Catalyst Control Center Localization Finnish
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A4E83A4C-B057-E197-F156-2FBEFA0761FE}" = Catalyst Control Center Localization French
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9C95D56-88AA-0CF9-FFE4-E0A45C04A6DC}" = Catalyst Control Center Localization Portuguese
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.6 - Deutsch
"{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}" = LG Bluetooth Drivers
"{AEA1F5BA-BC7A-05F2-2832-58B4BCEAABEB}" = Catalyst Control Center Localization Danish
"{B10DEBAF-64A4-0FB5-9518-97A21DC2A321}" = CCC Help Greek
"{B5D0714F-56A4-52A2-4C62-6B4E8853F25A}" = Catalyst Control Center Localization Spanish
"{B7CB0BF3-791E-44D3-9F04-786E36D51C9D}" = PC Connectivity Solution
"{B9B7F425-0B72-E926-06FF-136154B31077}" = CCC Help Japanese
"{BA09B3B4-7D61-B444-52AE-4C3C3CADADDA}" = CCC Help Spanish
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C5AEAA52-29F8-DF1E-B472-C2ABDC6EA349}" = Catalyst Control Center Localization Chinese Traditional
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC77812E-22CB-754E-15C4-1E7BB9B2E89A}" = Catalyst Control Center Graphics Previews Vista
"{CC81D746-51BB-4F97-52EB-BF64E14B1904}" = CCC Help Swedish
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEE0CD9D-7759-7D58-F33D-D1968D29B8A2}" = Catalyst Control Center Localization Hungarian
"{D09E159D-0264-4597-B200-A9B4C0866F25}" = Samsung RAW Converter 4
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{D45D831B-1431-0A69-841B-828F958E95BB}" = CCC Help Danish
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9F9D5C6-B889-C333-033B-863C85BB0D6F}" = CCC Help Finnish
"{DA918D70-293B-6776-CD3C-7965EC7D8680}" = Catalyst Control Center Graphics Previews Common
"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DD07CD74-B4BF-1347-D10C-5A32485D8451}" = CCC Help English
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E3DE4A3B-DB2A-9107-BCDD-1C6A64CFB4F5}" = Catalyst Control Center Localization German
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EAEDD68A-1037-35C3-707A-1A5316856EF8}" = Catalyst Control Center Core Implementation
"{F0F8875B-F4F4-6BBC-5D86-CFAD9D6B7F12}" = Catalyst Control Center Localization Polish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F53B03FE-A48A-9051-F350-554E415730F5}" = Catalyst Control Center Localization Chinese Standard
"{F6141E53-ABEC-97AF-99E7-C12588A20812}" = Catalyst Control Center Graphics Full New
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8935FC0-DE7D-41C3-FC9C-7867B29D2E10}" = Catalyst Control Center Graphics Light
"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = P4P
"{FFA6416E-798F-773E-B7A9-0F79BA40ECB8}" = CCC Help Polish
"{FFB768E4-E427-4553-BC36-A11F5E62A94D}" = Adobe Flash Player 10 ActiveX
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Windows-Treiberpaket - Infineon Technologies (FlashUSB) USB  (04/16/2009 1.0.0.6)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBoxMonitor" = AVM FRITZ!Box Monitor
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"D978F69D5F15B845BD6BC6F8BF9BCD36982A2087" = Windows-Treiberpaket - Nokia Modem  (02/24/2009 4.0)
"Digital Editions" = Adobe Digital Editions
"DivX Setup.divx.com" = DivX-Setup
"E7F682214B951640C9C539C41FDA1A7F836FF7B6" = Windows-Treiberpaket - Nokia Modem  (02/23/2009 7.01.0.2)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{D09E159D-0264-4597-B200-A9B4C0866F25}" = Samsung RAW Converter 4
"Intelli-studio" = SAMSUNG Intelli-studio
"LG Internet Kit" = LG Internet Kit
"LG PC Suite IV" = LG PC Suite IV
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de)
"Mp3tag" = Mp3tag v2.43
"Nokia PC Suite" = Nokia PC Suite
"Picasa2" = Picasa 2
"PokerStars" = PokerStars
"Rossmann Fotowelt Software" = Rossmann Fotowelt Software 4.9
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TmNationsForever_is1" = TmNationsForever
"TomTom HOME" = TomTom HOME 2.8.1.2218
"Valentin Meteo Data 1.0.24_is1" = Valentin Meteo Data 1.0.24
"VLC media player" = VLC media player 1.1.7
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f018cf21c0452c64" = AVM FRITZ!Box USB-Fernanschluss
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 02.05.2011 09:37:28 | Computer Name = Holzwurm | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 02.05.2011 09:38:37 | Computer Name = Holzwurm | Source = WinMgmt | ID = 10
Description =
 
Error - 02.05.2011 09:46:18 | Computer Name = Holzwurm | Source = EventSystem | ID = 4621
Description =
 
Error - 03.05.2011 06:35:01 | Computer Name = Holzwurm | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 03.05.2011 06:35:01 | Computer Name = Holzwurm | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 03.05.2011 06:35:45 | Computer Name = Holzwurm | Source = WinMgmt | ID = 10
Description =
 
Error - 03.05.2011 06:39:51 | Computer Name = Holzwurm | Source = VSS | ID = 8193
Description =
 
Error - 03.05.2011 06:44:43 | Computer Name = Holzwurm | Source = VSS | ID = 8193
Description =
 
Error - 03.05.2011 06:45:29 | Computer Name = Holzwurm | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 03.05.2011 06:46:45 | Computer Name = Holzwurm | Source = EventSystem | ID = 4621
Description =
 
[ Media Center Events ]
Error - 30.01.2011 16:01:59 | Computer Name = Holzwurm | Source = MCUpdate | ID = 0
Description = Es konnte nicht auf den MCUpdate-Mutex gewartet werden. Ausnahme:
'Der Wartezustand wurde aufgrund eines abgebrochenen Mutex beendet.'.
 
[ System Events ]
Error - 09.06.2011 14:07:47 | Computer Name = Holzwurm | Source = Microsoft-Windows-Eventlog | ID = 22
Description =
 
Error - 09.06.2011 14:08:34 | Computer Name = Holzwurm | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 10.06.2011 10:01:20 | Computer Name = Holzwurm | Source = Microsoft-Windows-Eventlog | ID = 22
Description =
 
Error - 10.06.2011 10:02:32 | Computer Name = Holzwurm | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 10.06.2011 10:33:51 | Computer Name = Holzwurm | Source = Microsoft-Windows-Eventlog | ID = 22
Description =
 
Error - 10.06.2011 10:34:41 | Computer Name = Holzwurm | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 10.06.2011 10:52:26 | Computer Name = Holzwurm | Source = Microsoft-Windows-Eventlog | ID = 22
Description =
 
Error - 10.06.2011 10:54:22 | Computer Name = Holzwurm | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 10.06.2011 11:02:15 | Computer Name = Holzwurm | Source = Microsoft-Windows-Eventlog | ID = 22
Description =
 
Error - 10.06.2011 11:03:08 | Computer Name = Holzwurm | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
 
< End of report >

Malwarebytes habe ich durchlaufen lassen aber vergesser vor dem Neustart den Bericht zu sichern. Sorry.

Im Benutzerkonto 2 kommen die Fehlermeldungen nicht. Ich kann aber auf keine Dateien meines Kontos zugreifen. Alles leer bzw. wird nicht angezeigt.

Danke

Wer suchet der findet

Code:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
 
Datenbank Version: 6826
 
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005
 
10.06.2011 16:50:31
mbam-log-2011-06-10 (16-50-31).txt
 
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 168851
Laufzeit: 4 Minute(n), 44 Sekunde(n)
 
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7
 
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hupbXGtblaxktVF (Trojan.FakeAlert) -> Value: hupbXGtblaxktVF -> Quarantined and deleted successfully.
 
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
 
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Wer suchet der findet
 
 
Infizierte Dateien:
c:\programdata\hupbxgtblaxktvf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\39968504.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\irarref575\AppData\Local\Temp\9186.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\irarref575\AppData\Local\Temp\91B6.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\irarref575\AppData\Local\Temp\9840.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\irarref575\AppData\Local\Temp\tmp9138.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Ist das ein Virus? Kann ich irgendwie an meine Daten kommen?

Für Hilfe bin ich sehr dankbar.

Gruß Christian

cosinus 14.06.2011 10:30
Zitat:
Art des Suchlaufs: Quick-Scan
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Holzwurm 2 14.06.2011 17:45
Code:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6826

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

10.06.2011 17:24:32
mbam-log-2011-06-10 (17-24-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 87745
Laufzeit: 20 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Systemwiederherstellung funktioniert nicht.

cosinus 14.06.2011 19:10
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4e0a1186-b75b-11df-b5ba-00224332dce4}\Shell - "" = AutoRun
O33 - MountPoints2\{4e0a1186-b75b-11df-b5ba-00224332dce4}\Shell\AutoRun\command - "" = E:\LGAutoRun.exe
O33 - MountPoints2\{59da691c-0366-11df-8447-00235484469c}\Shell\AutoRun\command - "" = I:\Menu.exe
O33 - MountPoints2\{e3c08c06-1847-11e0-a30d-00224332dce4}\Shell - "" = AutoRun
O33 - MountPoints2\{e3c08c06-1847-11e0-a30d-00224332dce4}\Shell\AutoRun\command - "" = E:\iStudio.exe
[2011.06.09 16:20:46 | 000,000,000 | -H-D | C] -- C:\Users\irarref575\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Restore
[2011.06.09 16:44:41 | 000,000,136 | -H-- | M] () -- C:\ProgramData\~39968504r
[2011.06.09 16:44:41 | 000,000,112 | -H-- | M] () -- C:\ProgramData\~39968504
[2011.06.09 16:20:47 | 000,000,600 | -H-- | M] () -- C:\Users\irarref575\Desktop\Windows Vista Restore.lnk
[2011.06.09 16:20:34 | 000,000,336 | -H-- | M] () -- C:\ProgramData\39968504
[2011.06.01 08:18:14 | 000,087,608 | -H-- | M] () -- C:\Users\irarref575\AppData\Roaming\inst.exe
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Holzwurm 2 14.06.2011 20:43
Code:
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e0a1186-b75b-11df-b5ba-00224332dce4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4e0a1186-b75b-11df-b5ba-00224332dce4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e0a1186-b75b-11df-b5ba-00224332dce4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4e0a1186-b75b-11df-b5ba-00224332dce4}\ not found.
File E:\LGAutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59da691c-0366-11df-8447-00235484469c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59da691c-0366-11df-8447-00235484469c}\ not found.
File I:\Menu.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e3c08c06-1847-11e0-a30d-00224332dce4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e3c08c06-1847-11e0-a30d-00224332dce4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e3c08c06-1847-11e0-a30d-00224332dce4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e3c08c06-1847-11e0-a30d-00224332dce4}\ not found.
File E:\iStudio.exe not found.
C:\Users\irarref575\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Restore folder moved successfully.
C:\ProgramData\~39968504r moved successfully.
C:\ProgramData\~39968504 moved successfully.
C:\Users\irarref575\Desktop\Windows Vista Restore.lnk moved successfully.
C:\ProgramData\39968504 moved successfully.
C:\Users\irarref575\AppData\Roaming\inst.exe moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.24.0 log created on 06142011_213943
Nach dem Neustart sind die Ordner auf dem Desktop transparent Dargestellt. Auf fast alle kann ich zugreifen. "Eigene Dateien" und "Lokale Einstellungen" wird der zugriff verweigert.
Gruß Christian

cosinus 14.06.2011 21:26
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Holzwurm 2 14.06.2011 21:58
Code:
2011/06/14 22:41:23.0322 4092        TDSS rootkit removing tool 2.5.4.0 Jun  7 2011 17:31:48
2011/06/14 22:41:25.0325 4092        ================================================================================
2011/06/14 22:41:30.0447 4092        SystemInfo:
2011/06/14 22:41:30.0447 4092       
2011/06/14 22:41:30.0448 4092        OS Version: 6.0.6002 ServicePack: 2.0
2011/06/14 22:41:30.0448 4092        Product type: Workstation
2011/06/14 22:41:30.0448 4092        ComputerName: HOLZWURM
2011/06/14 22:41:30.0449 4092        UserName: irarref575
2011/06/14 22:41:30.0449 4092        Windows directory: C:\Windows
2011/06/14 22:41:30.0449 4092        System windows directory: C:\Windows
2011/06/14 22:41:30.0449 4092        Processor architecture: Intel x86
2011/06/14 22:41:30.0449 4092        Number of processors: 2
2011/06/14 22:41:30.0449 4092        Page size: 0x1000
2011/06/14 22:41:30.0449 4092        Boot type: Normal boot
2011/06/14 22:41:30.0449 4092        ================================================================================
2011/06/14 22:41:34.0048 4092        Initialize success
2011/06/14 22:51:58.0020 0272        ================================================================================
2011/06/14 22:51:58.0020 0272        Scan started
2011/06/14 22:51:58.0020 0272        Mode: Manual;
2011/06/14 22:51:58.0021 0272        ================================================================================
2011/06/14 22:51:58.0674 0272        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/06/14 22:51:58.0760 0272        adp94xx        (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/06/14 22:51:58.0804 0272        adpahci        (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/06/14 22:51:58.0846 0272        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/06/14 22:51:58.0880 0272        adpu320        (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/06/14 22:51:59.0006 0272        AF15BDA        (3cd15ebaa1d68bc18ce14a26683bc1ec) C:\Windows\system32\DRIVERS\AF15BDA.sys
2011/06/14 22:51:59.0080 0272        Afc            (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys
2011/06/14 22:51:59.0196 0272        AFD            (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/06/14 22:51:59.0323 0272        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/06/14 22:51:59.0439 0272        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/14 22:51:59.0490 0272        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/06/14 22:51:59.0561 0272        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/06/14 22:51:59.0585 0272        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/06/14 22:51:59.0614 0272        AmdK7          (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/06/14 22:51:59.0639 0272        AmdK8          (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/06/14 22:51:59.0827 0272        arc            (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/06/14 22:51:59.0894 0272        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/06/14 22:51:59.0931 0272        AsDsm          (4385e371c25c94c804e9d3152bd9e1f7) C:\Windows\system32\drivers\AsDsm.sys
2011/06/14 22:52:00.0036 0272        ASMMAP          (7b4d08d2017ac06689d422e06c43f0aa) C:\Program Files\ATKGFNEX\ASMMAP.sys
2011/06/14 22:52:00.0194 0272        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/14 22:52:00.0254 0272        atapi          (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/06/14 22:52:00.0450 0272        athr            (d59e7a5daa08c91172e95b4f1ca6d8c3) C:\Windows\system32\DRIVERS\athr.sys
2011/06/14 22:52:00.0659 0272        atikmdag        (8ae1745bfc7d383daa3f82fe8d7be7c0) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/06/14 22:52:00.0781 0272        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/06/14 22:52:00.0874 0272        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys
2011/06/14 22:52:00.0917 0272        avmaudio        (728c4a6c722535c16d1025f51aa31e22) C:\Windows\system32\DRIVERS\avmaudio.sys
2011/06/14 22:52:01.0011 0272        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/14 22:52:01.0082 0272        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/06/14 22:52:01.0130 0272        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/14 22:52:01.0246 0272        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/14 22:52:01.0272 0272        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/14 22:52:01.0461 0272        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/14 22:52:01.0492 0272        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/14 22:52:01.0525 0272        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/14 22:52:01.0555 0272        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/14 22:52:01.0640 0272        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/14 22:52:01.0702 0272        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/14 22:52:01.0818 0272        cdrom          (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/14 22:52:01.0884 0272        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/06/14 22:52:01.0928 0272        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/06/14 22:52:02.0058 0272        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/14 22:52:02.0088 0272        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/06/14 22:52:02.0112 0272        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/14 22:52:02.0138 0272        crcdisk        (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/06/14 22:52:02.0176 0272        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/06/14 22:52:02.0263 0272        DfsC            (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/06/14 22:52:02.0448 0272        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/06/14 22:52:02.0550 0272        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/14 22:52:02.0604 0272        DXGKrnl        (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/14 22:52:02.0686 0272        E1G60          (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/14 22:52:02.0776 0272        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/06/14 22:52:02.0893 0272        elxstor        (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/06/14 22:52:02.0943 0272        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/06/14 22:52:03.0119 0272        exfat          (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/06/14 22:52:03.0166 0272        fastfat        (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/06/14 22:52:03.0278 0272        fdc            (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/14 22:52:03.0351 0272        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/14 22:52:03.0390 0272        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/14 22:52:03.0481 0272        FlashUSB        (5575ee5823de1558f8486eb4e33ffa99) C:\Windows\system32\DRIVERS\FlashUSB.sys
2011/06/14 22:52:03.0518 0272        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/14 22:52:03.0562 0272        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/06/14 22:52:03.0707 0272        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/14 22:52:03.0734 0272        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/14 22:52:03.0988 0272        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/14 22:52:04.0126 0272        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/14 22:52:04.0192 0272        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/14 22:52:04.0242 0272        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/06/14 22:52:04.0285 0272        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/14 22:52:04.0325 0272        HpCISSs        (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/06/14 22:52:04.0393 0272        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/06/14 22:52:04.0442 0272        i2omp          (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/06/14 22:52:04.0515 0272        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/14 22:52:04.0543 0272        iaStorV        (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/06/14 22:52:04.0662 0272        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/14 22:52:04.0798 0272        IntcAzAudAddService (b795745f7e51aa20d46753ec5a811aca) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/14 22:52:04.0890 0272        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/14 22:52:04.0954 0272        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/14 22:52:04.0996 0272        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/06/14 22:52:05.0062 0272        IPMIDRV        (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/14 22:52:05.0114 0272        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/14 22:52:05.0144 0272        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/14 22:52:05.0173 0272        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/06/14 22:52:05.0298 0272        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/14 22:52:05.0349 0272        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/14 22:52:05.0431 0272        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/14 22:52:05.0460 0272        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/14 22:52:05.0504 0272        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/14 22:52:05.0574 0272        kbfiltr        (cc2a86d7bbf14977340dca61bbcba771) C:\Windows\system32\DRIVERS\kbfiltr.sys
2011/06/14 22:52:05.0626 0272        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/14 22:52:05.0734 0272        LgBttPort      (4dd47b5af0b24871ebb9efc012a7474e) C:\Windows\system32\DRIVERS\lgbtport.sys
2011/06/14 22:52:05.0863 0272        lgbusenum      (1d038ca6c529203087a990e5e97887b4) C:\Windows\system32\DRIVERS\lgbtbus.sys
2011/06/14 22:52:05.0903 0272        LGVMODEM        (26f1976a330195d62a6224c76968cf0d) C:\Windows\system32\DRIVERS\lgvmodem.sys
2011/06/14 22:52:05.0974 0272        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/14 22:52:06.0030 0272        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/14 22:52:06.0063 0272        LSI_SAS        (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/14 22:52:06.0117 0272        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/14 22:52:06.0152 0272        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/14 22:52:06.0218 0272        megasas        (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/06/14 22:52:06.0299 0272        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/06/14 22:52:06.0349 0272        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/14 22:52:06.0438 0272        MODEMCSA        (cbb59c41f19efea1a000793e08070a62) C:\Windows\system32\drivers\MODEMCSA.sys
2011/06/14 22:52:06.0495 0272        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/14 22:52:06.0528 0272        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/14 22:52:06.0563 0272        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/14 22:52:06.0592 0272        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/14 22:52:06.0662 0272        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/06/14 22:52:06.0698 0272        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/14 22:52:06.0736 0272        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/14 22:52:06.0777 0272        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/06/14 22:52:06.0856 0272        mrxsmb          (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/14 22:52:07.0000 0272        mrxsmb10        (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/14 22:52:07.0086 0272        mrxsmb20        (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/14 22:52:07.0240 0272        msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/06/14 22:52:07.0273 0272        msdsm          (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/06/14 22:52:07.0320 0272        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/14 22:52:07.0387 0272        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/14 22:52:07.0473 0272        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/14 22:52:07.0537 0272        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/14 22:52:07.0566 0272        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/14 22:52:07.0613 0272        MsRPC          (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/06/14 22:52:07.0657 0272        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/14 22:52:07.0685 0272        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/14 22:52:07.0727 0272        MTsensor        (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys
2011/06/14 22:52:07.0772 0272        Mup            (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/06/14 22:52:07.0886 0272        NativeWifiP    (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/14 22:52:07.0970 0272        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/06/14 22:52:08.0050 0272        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/14 22:52:08.0093 0272        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/14 22:52:08.0167 0272        NdisWan        (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/14 22:52:08.0210 0272        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/14 22:52:08.0240 0272        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/14 22:52:08.0283 0272        netbt          (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/14 22:52:08.0404 0272        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/14 22:52:08.0557 0272        nmwcd          (4a8a2aa0706b659175169decf198e9d7) C:\Windows\system32\drivers\ccdcmb.sys
2011/06/14 22:52:08.0611 0272        nmwcdc          (fd3e61831095ac62e6840d986b5a2016) C:\Windows\system32\drivers\ccdcmbo.sys
2011/06/14 22:52:08.0648 0272        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/06/14 22:52:08.0696 0272        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/14 22:52:08.0766 0272        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/06/14 22:52:08.0830 0272        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/14 22:52:08.0883 0272        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/14 22:52:08.0934 0272        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/06/14 22:52:08.0985 0272        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/06/14 22:52:09.0019 0272        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/06/14 22:52:09.0148 0272        ohci1394        (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/06/14 22:52:09.0242 0272        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/14 22:52:09.0291 0272        partmgr        (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/06/14 22:52:09.0330 0272        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/14 22:52:09.0422 0272        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys
2011/06/14 22:52:09.0479 0272        pci            (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/06/14 22:52:09.0558 0272        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
2011/06/14 22:52:09.0626 0272        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/06/14 22:52:09.0752 0272        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/14 22:52:09.0991 0272        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/14 22:52:10.0083 0272        Processor      (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/06/14 22:52:10.0224 0272        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/14 22:52:10.0330 0272        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\Windows\system32\Drivers\PxHelp20.sys
2011/06/14 22:52:10.0432 0272        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/06/14 22:52:10.0473 0272        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/14 22:52:10.0507 0272        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/14 22:52:10.0541 0272        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/14 22:52:10.0578 0272        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/14 22:52:10.0626 0272        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/14 22:52:10.0675 0272        RasSstp        (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/14 22:52:10.0723 0272        rdbss          (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/14 22:52:10.0760 0272        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/14 22:52:10.0807 0272        rdpdr          (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/06/14 22:52:10.0835 0272        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/14 22:52:10.0902 0272        RDPWD          (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/06/14 22:52:10.0981 0272        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/14 22:52:11.0028 0272        RTSTOR          (52532a4ca8b251775decc87c4813abfb) C:\Windows\system32\drivers\RTSTOR.SYS
2011/06/14 22:52:11.0107 0272        s125bus        (06847aa6f3a9bf7c44134d00a2e578c0) C:\Windows\system32\DRIVERS\s125bus.sys
2011/06/14 22:52:11.0183 0272        s125mdfl        (f83f88e1b125308fb5015ea0349502b0) C:\Windows\system32\DRIVERS\s125mdfl.sys
2011/06/14 22:52:11.0215 0272        s125mdm        (402a97756c14940ad6ae5169c2fb105e) C:\Windows\system32\DRIVERS\s125mdm.sys
2011/06/14 22:52:11.0265 0272        s125mgmt        (82b14c51de76825ec769a6374e4c57d6) C:\Windows\system32\DRIVERS\s125mgmt.sys
2011/06/14 22:52:11.0307 0272        s125obex        (bedfc5707c356fd073bf1a4afe442d91) C:\Windows\system32\DRIVERS\s125obex.sys
2011/06/14 22:52:11.0355 0272        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/14 22:52:11.0442 0272        sdbus          (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
2011/06/14 22:52:11.0480 0272        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/14 22:52:11.0525 0272        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/14 22:52:11.0556 0272        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/14 22:52:11.0594 0272        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/14 22:52:11.0654 0272        sffdisk        (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/06/14 22:52:11.0695 0272        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/14 22:52:11.0725 0272        sffp_sd        (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/14 22:52:11.0762 0272        sfloppy        (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/06/14 22:52:11.0825 0272        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/06/14 22:52:11.0937 0272        SiSGbeLH        (a029482be40def54df02fce751aa16dc) C:\Windows\system32\DRIVERS\SiSGB6.sys
2011/06/14 22:52:11.0976 0272        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/06/14 22:52:12.0024 0272        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/06/14 22:52:12.0081 0272        Smb            (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/06/14 22:52:12.0177 0272        smserial        (d9bfd2298f5cf116d8eaae3b02dcee2e) C:\Windows\system32\DRIVERS\smserial.sys
2011/06/14 22:52:12.0241 0272        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/14 22:52:12.0337 0272        sptd            (71e276f6d189413266ea22171806597b) C:\Windows\system32\Drivers\sptd.sys
2011/06/14 22:52:12.0337 0272        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
2011/06/14 22:52:12.0351 0272        sptd - detected LockedFile.Multi.Generic (1)
2011/06/14 22:52:12.0408 0272        srv            (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
2011/06/14 22:52:12.0455 0272        srv2            (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/14 22:52:12.0497 0272        srvnet          (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/14 22:52:12.0545 0272        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/06/14 22:52:12.0632 0272        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/14 22:52:12.0680 0272        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/14 22:52:12.0718 0272        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/14 22:52:12.0768 0272        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/14 22:52:12.0837 0272        SynTP          (55f6e55cc2430ca8713387106fa79817) C:\Windows\system32\DRIVERS\SynTP.sys
2011/06/14 22:52:12.0996 0272        Tcpip          (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/06/14 22:52:13.0062 0272        Tcpip6          (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/14 22:52:13.0116 0272        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/14 22:52:13.0162 0272        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/14 22:52:13.0195 0272        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/14 22:52:13.0238 0272        tdx            (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/14 22:52:13.0282 0272        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/14 22:52:13.0372 0272        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/14 22:52:13.0415 0272        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/14 22:52:13.0457 0272        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/14 22:52:13.0518 0272        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/06/14 22:52:13.0609 0272        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/14 22:52:13.0686 0272        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/14 22:52:13.0729 0272        uliahci        (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/06/14 22:52:13.0783 0272        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/14 22:52:13.0822 0272        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/14 22:52:13.0862 0272        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/14 22:52:13.0940 0272        upperdev        (587e643a4e2ffd9a00f114b057ceb773) C:\Windows\system32\DRIVERS\usbser_lowerflt.sys
2011/06/14 22:52:13.0991 0272        usbbus          (8ef48ff1c23b1ce6f96d09a45959eb20) C:\Windows\system32\DRIVERS\lgusbbus.sys
2011/06/14 22:52:14.0056 0272        usbccgp        (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/14 22:52:14.0088 0272        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/14 22:52:14.0162 0272        UsbDiag        (a0e24c5c2d0cff04bbd3753a72fae80b) C:\Windows\system32\DRIVERS\lgusbdiag.sys
2011/06/14 22:52:14.0199 0272        usbehci        (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/14 22:52:14.0248 0272        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/14 22:52:14.0321 0272        USBModem        (cc09a1132b1f6a8362107cc134e90d0b) C:\Windows\system32\DRIVERS\lgusbmodem.sys
2011/06/14 22:52:14.0351 0272        usbohci        (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
2011/06/14 22:52:14.0391 0272        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/14 22:52:14.0461 0272        usbscan        (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/14 22:52:14.0514 0272        usbser          (d575246188f63de0accf6eac5fb59e6a) C:\Windows\system32\drivers\usbser.sys
2011/06/14 22:52:14.0581 0272        UsbserFilt      (fca6a196d47cb972a0e4adc0db9cd17c) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys
2011/06/14 22:52:14.0626 0272        USBSTOR        (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/14 22:52:14.0669 0272        usbuhci        (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/14 22:52:14.0832 0272        usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/14 22:52:14.0894 0272        vga            (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/14 22:52:14.0932 0272        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/14 22:52:14.0971 0272        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/06/14 22:52:15.0005 0272        ViaC7          (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/06/14 22:52:15.0045 0272        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/06/14 22:52:15.0088 0272        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/14 22:52:15.0134 0272        volmgrx        (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/06/14 22:52:15.0193 0272        volsnap        (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/06/14 22:52:15.0296 0272        vsmraid        (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/06/14 22:52:15.0350 0272        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/14 22:52:15.0381 0272        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/14 22:52:15.0426 0272        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/14 22:52:15.0483 0272        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/06/14 22:52:15.0581 0272        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/14 22:52:15.0744 0272        WmiAcpi        (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/14 22:52:15.0896 0272        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/06/14 22:52:15.0990 0272        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/14 22:52:16.0049 0272        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/14 22:52:16.0147 0272        yukonwlh        (7d1f3b131d503ef43ee594b5a2b9b427) C:\Windows\system32\DRIVERS\yk60x86.sys
2011/06/14 22:52:16.0214 0272        MBR (0x1B8)    (64b1e91c5c6c2157642651010728f90f) \Device\Harddisk0\DR0
2011/06/14 22:52:16.0237 0272        ================================================================================
2011/06/14 22:52:16.0237 0272        Scan finished
2011/06/14 22:52:16.0237 0272        ================================================================================
2011/06/14 22:52:16.0256 1576        Detected object count: 1
2011/06/14 22:52:16.0256 1576        Actual detected object count: 1
2011/06/14 22:52:40.0068 1576        LockedFile.Multi.Generic(sptd) - User select action: Skip
unhide ausgeführt ich glaube es ist alles wieder da.

Gruß Christian

cosinus 15.06.2011 08:50
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Holzwurm 2 15.06.2011 17:44
Code:
ComboFix 11-06-15.01 - irarref575 15.06.2011  17:31:07.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3071.2066 [GMT 2:00]
ausgeführt von:: c:\users\irarref575\Desktop\confi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\irarref575\AppData\Roaming\pcouffin.sys
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-15 bis 2011-06-15  ))))))))))))))))))))))))))))))
.
.
2011-06-15 15:52 . 2011-06-15 15:52        --------        d-----w-        c:\users\irarref575\AppData\Local\temp
2011-06-15 15:52 . 2011-06-15 15:52        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2011-06-15 15:52 . 2011-06-15 15:52        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-15 15:21 . 2011-06-15 15:21        --------        d-----w-        c:\users\irarref575\Bilder
2011-06-14 19:39 . 2011-06-14 19:39        --------        d-----w-        C:\_OTL
2011-06-14 07:42 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8855A1BA-9F22-4E81-9C62-B506D6BBAEC8}\mpengine.dll
2011-06-10 14:53 . 2011-06-10 14:53        --------        d-----w-        c:\users\Gast\AppData\Roaming\Malwarebytes
2011-06-10 14:42 . 2011-06-10 14:42        --------        d-----w-        c:\users\irarref575\AppData\Roaming\Malwarebytes
2011-06-10 14:42 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-10 14:42 . 2011-06-10 14:42        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-10 14:42 . 2011-06-10 14:42        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-06-10 14:42 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-01 06:18 . 2011-06-01 06:18        --------        d-----w-        c:\users\irarref575\AppData\Roaming\Vso
2011-06-01 06:16 . 2011-06-09 09:05        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-26 08:58 . 2011-05-26 08:58        --------        d-----w-        c:\users\irarref575\AppData\Local\PDF24
2011-05-26 08:58 . 2011-05-26 08:58        --------        d-----w-        c:\program files\PDF24
2011-05-23 21:05 . 2011-06-14 08:20        --------        d-----w-        C:\ifx
2011-05-23 21:05 . 2010-05-12 10:23        16896        ----a-w-        c:\windows\system32\drivers\FlashUSB.sys
2011-05-23 21:02 . 2011-05-23 21:02        --------        d-----w-        C:\LG_USB
2011-05-23 20:16 . 2011-05-23 20:16        101248        ----a-w-        c:\windows\system32\drivers\avmaudio.sys
2011-05-23 20:16 . 2011-05-23 20:16        32256        ----a-w-        c:\windows\system32\MiniInstaller.dll
2011-05-23 20:16 . 2011-05-23 20:16        --------        d-----w-        c:\users\irarref575\AppData\Local\Apps
2011-05-23 20:16 . 2011-06-15 15:16        --------        d-----w-        c:\users\irarref575\AppData\Local\Deployment
2011-05-23 11:44 . 2011-06-14 08:20        --------        d-----w-        c:\users\irarref575\AppData\Roaming\vlc
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-15 15:15 . 2008-11-10 23:24        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2011-04-14 03:07 . 2011-05-03 10:45        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-05-02 05:34 . 2011-03-25 19:39        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08        143360        ----a-w-        c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AVMUSBFernanschluss"="c:\users\irarref575\AppData\Local\Apps\2.0\1CEDPDX9.Z1J\8Q3ZH6PO.5TX\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2011-05-23 147456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2007-10-12 106496]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
.
c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ExifLauncher2.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ExifLauncher2.lnk
backup=c:\windows\pss\ExifLauncher2.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^irarref575^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\irarref575\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04        39792        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-07-29 00:25        497648        ----a-w-        c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2008-11-10 23:19        37232        ----a-w-        c:\windows\ASScrProlog.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2008-11-10 23:19        33136        ----a-w-        c:\windows\ASScrPro.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMFBoxMonitor]
2009-07-06 01:00        1503232        ----a-w-        c:\program files\FRITZ!Box Monitor\FRITZBoxMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\B2C_AGENT]
2011-01-13 07:20        395192        ----a-w-        c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 03:52        104936        ----a-w-        c:\program files\CyberLink\Power2Go\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40        687560        ----a-w-        c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4200 Series]
2005-03-08 04:00        98304        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIAEE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4200 Series (Kopie 1)]
2005-03-08 04:00        98304        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIAEE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47        31016        ----a-w-        c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG LinkAir]
2010-08-05 11:49        2436968        ----a-w-        c:\program files\LG Electronics\LG PC Suite IV\LinkAir\LinkAir.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-06-09 18:16        2363392        ----a-w-        c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50        155648        ----a-w-        c:\windows\System32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2Go_Menu]
2008-06-14 02:11        210216        ----a-w-        c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-03-20 12:32        1312256        ----a-w-        c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2011-04-28 07:59        220552        ----a-w-        c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
2007-08-03 04:52        778240        ----a-w-        c:\program files\P4P\P4P.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 20:17        61440        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-03-09 12:30        247728        ----a-w-        c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9f0cf51a7f715;Google Update Service (gupdate1c9f0cf51a7f715);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 133104]
R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2010-05-12 16896]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 133104]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-06 169408]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-01-05 717296]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-05-01 136360]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files\FRITZ!DSL\IGDCTRL.EXE [2009-07-28 73528]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [2011-05-23 101248]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSGB6.sys [2007-06-20 47616]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - avgntflt
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 18:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 11:15]
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 11:15]
.
2010-12-20 c:\windows\Tasks\User_Feed_Synchronization-{DAC806BD-EA5E-43F7-A13C-BF225E18D1DF}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: LG Air Sync (R-Click) - Save as Mobile Image - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/206
IE: LG Air Sync (R-Click) - Save as Mobile Memo - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/208
IE: LG Air Sync (R-Click) - Save as Mobile Text file - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/210
IE: LG Air Sync (R-Click) - Set as Mobile Wallpaper - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/205
IE: LG Air Sync Option - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/209
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\irarref575\AppData\Roaming\Mozilla\Firefox\Profiles\x3t7edo9.default\
FF - prefs.js: browser.startup.homepage - t-online.de
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKU-Default-Run-FRITZ!protect - FwebProt.exe
MSConfigStartUp-Sony Ericsson PC Suite - c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
MSConfigStartUp-Steam - d:\spiele\Steam.exe
AddRemove-Asus_Camera_ScreenSaver - c:\windows\ASUS Camera ScreenSaver Uninstaller.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-06-15 17:52
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
.
C:\ADSM_PData_0150
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-06-15  17:54:43
ComboFix-quarantined-files.txt  2011-06-15 15:54
.
Vor Suchlauf: 12 Verzeichnis(se), 100.634.177.536 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 100.175.810.560 Bytes frei
.
- - End Of File - - 1604DE7820AF8C8EBAE097AC54575BD0
Gruß Christian

cosinus 15.06.2011 21:19
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Dirlook::
C:\ifx
c:\users\irarref575\AppData\Roaming\Vso

Filelook::
c:\windows\system32\acovcnt.exe
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Holzwurm 2 16.06.2011 06:06
Code:
ComboFix 11-06-15.01 - irarref575 15.06.2011  23:17:34.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3071.2141 [GMT 2:00]
ausgeführt von:: c:\users\irarref575\Desktop\confi.exe
Benutzte Befehlsschalter :: c:\users\irarref575\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-15 bis 2011-06-15  ))))))))))))))))))))))))))))))
.
.
2011-06-15 21:38 . 2011-06-15 21:38        --------        d-----w-        c:\users\irarref575\AppData\Local\temp
2011-06-15 21:38 . 2011-06-15 21:38        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2011-06-15 21:38 . 2011-06-15 21:38        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-15 15:21 . 2011-06-15 15:21        --------        d-----w-        c:\users\irarref575\Bilder
2011-06-14 19:39 . 2011-06-14 19:39        --------        d-----w-        C:\_OTL
2011-06-14 07:42 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8855A1BA-9F22-4E81-9C62-B506D6BBAEC8}\mpengine.dll
2011-06-10 14:53 . 2011-06-10 14:53        --------        d-----w-        c:\users\Gast\AppData\Roaming\Malwarebytes
2011-06-10 14:42 . 2011-06-10 14:42        --------        d-----w-        c:\users\irarref575\AppData\Roaming\Malwarebytes
2011-06-10 14:42 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-10 14:42 . 2011-06-10 14:42        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-10 14:42 . 2011-06-10 14:42        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-06-10 14:42 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-01 06:18 . 2011-06-01 06:18        --------        d-----w-        c:\users\irarref575\AppData\Roaming\Vso
2011-06-01 06:16 . 2011-06-09 09:05        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-26 08:58 . 2011-05-26 08:58        --------        d-----w-        c:\users\irarref575\AppData\Local\PDF24
2011-05-26 08:58 . 2011-05-26 08:58        --------        d-----w-        c:\program files\PDF24
2011-05-23 21:05 . 2011-06-14 08:20        --------        d-----w-        C:\ifx
2011-05-23 21:05 . 2010-05-12 10:23        16896        ----a-w-        c:\windows\system32\drivers\FlashUSB.sys
2011-05-23 21:02 . 2011-05-23 21:02        --------        d-----w-        C:\LG_USB
2011-05-23 20:16 . 2011-05-23 20:16        101248        ----a-w-        c:\windows\system32\drivers\avmaudio.sys
2011-05-23 20:16 . 2011-05-23 20:16        32256        ----a-w-        c:\windows\system32\MiniInstaller.dll
2011-05-23 20:16 . 2011-05-23 20:16        --------        d-----w-        c:\users\irarref575\AppData\Local\Apps
2011-05-23 20:16 . 2011-06-15 15:16        --------        d-----w-        c:\users\irarref575\AppData\Local\Deployment
2011-05-23 11:44 . 2011-06-14 08:20        --------        d-----w-        c:\users\irarref575\AppData\Roaming\vlc
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-15 19:04 . 2008-11-10 23:24        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2011-04-14 03:07 . 2011-05-03 10:45        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-05-02 05:34 . 2011-03-25 19:39        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((  Look  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:\windows\system32\acovcnt.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 45056
Created time: 2008-11-10 23:24
Modified time: 2011-06-15 19:04
MD5: 6BCAF46E2B7FA9ACE92B4D39F3037C5C
SHA1: 6D5A81E3CF59832D73F28D6E87F51D073C3E4095
.
---- Directory of C:\ifx ----
.
2011-05-23 21:05 . 2010-05-12 10:23        7602        ----a-w-        c:\ifx\flashusb.cat
2011-05-23 21:05 . 2010-03-25 15:02        1852        ----a-w-        c:\ifx\FlashUSB.inf
2011-05-23 21:05 . 2010-05-12 10:23        16896        ----a-w-        c:\ifx\FlashUsb.sys
2011-05-23 21:05 . 2010-06-17 11:42        253952        ----a-w-        c:\ifx\Uninstall.exe
.
---- Directory of c:\users\irarref575\AppData\Roaming\Vso ----
.
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08        143360        ----a-w-        c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AVMUSBFernanschluss"="c:\users\irarref575\AppData\Local\Apps\2.0\1CEDPDX9.Z1J\8Q3ZH6PO.5TX\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2011-05-23 147456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2007-10-12 106496]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
.
c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ExifLauncher2.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ExifLauncher2.lnk
backup=c:\windows\pss\ExifLauncher2.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^irarref575^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\irarref575\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04        39792        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-07-29 00:25        497648        ----a-w-        c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2008-11-10 23:19        37232        ----a-w-        c:\windows\ASScrProlog.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2008-11-10 23:19        33136        ----a-w-        c:\windows\ASScrPro.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMFBoxMonitor]
2009-07-06 01:00        1503232        ----a-w-        c:\program files\FRITZ!Box Monitor\FRITZBoxMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\B2C_AGENT]
2011-01-13 07:20        395192        ----a-w-        c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 03:52        104936        ----a-w-        c:\program files\CyberLink\Power2Go\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40        687560        ----a-w-        c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4200 Series]
2005-03-08 04:00        98304        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIAEE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4200 Series (Kopie 1)]
2005-03-08 04:00        98304        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIAEE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47        31016        ----a-w-        c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG LinkAir]
2010-08-05 11:49        2436968        ----a-w-        c:\program files\LG Electronics\LG PC Suite IV\LinkAir\LinkAir.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-06-09 18:16        2363392        ----a-w-        c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50        155648        ----a-w-        c:\windows\System32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2Go_Menu]
2008-06-14 02:11        210216        ----a-w-        c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-03-20 12:32        1312256        ----a-w-        c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2011-04-28 07:59        220552        ----a-w-        c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
2007-08-03 04:52        778240        ----a-w-        c:\program files\P4P\P4P.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 20:17        61440        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-03-09 12:30        247728        ----a-w-        c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9f0cf51a7f715;Google Update Service (gupdate1c9f0cf51a7f715);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 133104]
R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2010-05-12 16896]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 133104]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-06 169408]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-01-05 717296]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-05-01 136360]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files\FRITZ!DSL\IGDCTRL.EXE [2009-07-28 73528]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [2011-05-23 101248]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSGB6.sys [2007-06-20 47616]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - avgntflt
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 18:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 11:15]
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-19 11:15]
.
2010-12-20 c:\windows\Tasks\User_Feed_Synchronization-{DAC806BD-EA5E-43F7-A13C-BF225E18D1DF}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: LG Air Sync (R-Click) - Save as Mobile Image - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/206
IE: LG Air Sync (R-Click) - Save as Mobile Memo - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/208
IE: LG Air Sync (R-Click) - Save as Mobile Text file - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/210
IE: LG Air Sync (R-Click) - Set as Mobile Wallpaper - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/205
IE: LG Air Sync Option - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/209
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\irarref575\AppData\Roaming\Mozilla\Firefox\Profiles\x3t7edo9.default\
FF - prefs.js: browser.startup.homepage - t-online.de
FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-06-15 23:38
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3004)
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
Zeit der Fertigstellung: 2011-06-15  23:40:27
ComboFix-quarantined-files.txt  2011-06-15 21:40
ComboFix2.txt  2011-06-15 15:54
.
Vor Suchlauf: 13 Verzeichnis(se), 98.035.630.080 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 98.003.214.336 Bytes frei
.
- - End Of File - - 3ABC2AC2AA0FE5CD008FF97BB59A89F9
Gruß Christian

cosinus 16.06.2011 10:11
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Holzwurm 2 17.06.2011 11:17
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-17 12:13:18
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 ST9320320AS rev.0303
Running: z26dddcv.exe; Driver: C:\Users\IRARRE~1\AppData\Local\Temp\uxrcipow.sys


---- System - GMER 1.0.15 ----

INT 0x51        ?                                                                                                                    84B92BF8
INT 0x52        ?                                                                                                                    86515BF8
INT 0x62        ?                                                                                                                    86515BF8
INT 0x72        ?                                                                                                                    86515BF8
INT 0xB2        ?                                                                                                                    84B92BF8

---- Kernel code sections - GMER 1.0.15 ----

?              System32\Drivers\spqm.sys                                                                                            Das System kann den angegebenen Pfad nicht finden. !
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                                                            section is writeable [0x8E002000, 0x1F875A, 0xE8000020]
.text          USBPORT.SYS!DllUnload                                                                                                8A75A41B 5 Bytes  JMP 865151D8
.text          abr4umom.SYS                                                                                                        8EC9D000 22 Bytes  [82, 13, 21, 82, 6C, 12, 21, ...]
.text          abr4umom.SYS                                                                                                        8EC9D017 137 Bytes  [00, 32, 27, 7A, 80, 3D, 25, ...]
.text          abr4umom.SYS                                                                                                        8EC9D0A1 43 Bytes  [60, 2E, 82, 74, 56, 28, 82, ...]
.text          abr4umom.SYS                                                                                                        8EC9D0CE 10 Bytes  [00, 00, 00, 00, 00, 00, 6A, ...]
.text          abr4umom.SYS                                                                                                        8EC9D0DA 12 Bytes  [00, 00, 02, 00, 00, 00, 25, ...]
.text          ...                                                                                                                 

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar]                                            [806996D2] \SystemRoot\System32\Drivers\spqm.sys
IAT            \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar]                                            [80699040] \SystemRoot\System32\Drivers\spqm.sys
IAT            \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                    [806997FC] \SystemRoot\System32\Drivers\spqm.sys
IAT            \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort]                                            [806990BE] \SystemRoot\System32\Drivers\spqm.sys
IAT            \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                      [8069913C] \SystemRoot\System32\Drivers\spqm.sys
IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                  [806A9048] \SystemRoot\System32\Drivers\spqm.sys
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortNotification]                                          CC000CC2
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortWritePortUchar]                                        83EC8B55
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortWritePortUlong]                                        575320EC
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortGetPhysicalAddress]                                    458DFF33
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong]                          8D5750FC
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortGetScatterGatherList]                                  5750F845
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortReadPortUchar]                                          8957046A
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortStallExecution]                                        75E8FC7D
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortGetParentBusType]                                      BB0001E8
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortRequestCallback]                                        000000EA
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortWritePortBufferUshort]                                  850FC33B
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortGetUnCachedExtension]                                  0000012B
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortCompleteRequest]                                        0FFC7D39
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortMoveMemory]                                            00012284
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests]                              458D5600
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb]                                106A50F4
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb]                                  38335668
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortReadPortUshort]                                        FC75FF36
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortReadPortBufferUshort]                                  D1E85757
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortInitialize]                                            8B0001E7
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortGetDeviceBase]                                          1BDEF7F0
IAT            \SystemRoot\System32\Drivers\abr4umom.SYS[ataport.SYS!AtaPortDeviceStateChange]                                      23D6F7F6

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              855291F8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              AsDsm.sys (Data Security Manager Driver/Windows (R) Codename Longhorn DDK provider)

Device          \FileSystem\fastfat \FatCdrom                                                                                        875FC1F8

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device          \Driver\volmgr \Device\VolMgrControl                                                                                855261F8
Device          \Driver\usbohci \Device\USBPDO-0                                                                                    865211F8
Device          \Driver\usbohci \Device\USBPDO-1                                                                                    865211F8
Device          \Driver\usbehci \Device\USBPDO-2                                                                                    8651C1F8
Device          \Driver\volmgr \Device\HarddiskVolume1                                                                              855261F8
Device          \Driver\volmgr \Device\HarddiskVolume2                                                                              855261F8
Device          \Driver\cdrom \Device\CdRom0                                                                                        8653E2F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                          855281F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  855281F8
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  855281F8
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                  855281F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                                                                          855281F8
Device          \Driver\volmgr \Device\HarddiskVolume3                                                                              855261F8
Device          \Driver\cdrom \Device\CdRom1                                                                                        8653E2F8
Device          \Driver\volmgr \Device\HarddiskVolume4                                                                              855261F8
Device          \Driver\netbt \Device\NetBt_Wins_Export                                                                              8679F500
Device          \Driver\PCI_PNP3358 \Device\0000004b                                                                                spqm.sys
Device          \Driver\Smb \Device\NetbiosSmb                                                                                      86DF31F8
Device          \Driver\iScsiPrt \Device\RaidPort0                                                                                  865A91F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{0F823EC0-F707-4AFE-B0F9-8A306EFB3D98}                                            8679F500
Device          \Driver\usbohci \Device\USBFDO-0                                                                                    865211F8
Device          \Driver\usbohci \Device\USBFDO-1                                                                                    865211F8
Device          \Driver\usbehci \Device\USBFDO-2                                                                                    8651C1F8
Device          \Driver\sptd \Device\1758438358                                                                                      spqm.sys
Device          \Driver\netbt \Device\NetBT_Tcpip_{4E22DF29-9B64-460B-84F7-11597EB4DD95}                                            8679F500
Device          \Driver\abr4umom \Device\Scsi\abr4umom1                                                                              865AC1F8
Device          \Driver\abr4umom \Device\Scsi\abr4umom1Port4Path0Target0Lun0                                                        865AC1F8
Device          \FileSystem\fastfat \Fat                                                                                            875FC1F8

AttachedDevice  \FileSystem\fastfat \Fat                                                                                            fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

Device          \FileSystem\cdfs \Cdfs                                                                                              87A0B1F8

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                              0xB5 0x02 0x53 0x28 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                           
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xAE 0x4D 0xF2 0x8F ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x99 0x2F 0x0F 0x78 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                  0xB5 0x02 0x53 0x28 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)       
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xAE 0x4D 0xF2 0x8F ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x99 0x2F 0x0F 0x78 ...

---- Files - GMER 1.0.15 ----

File            C:\ADSM_PData_0150                                                                                                  0 bytes
File            C:\ADSM_PData_0150\DB                                                                                                0 bytes
File            C:\ADSM_PData_0150\DB\SI.db                                                                                          624 bytes
File            C:\ADSM_PData_0150\DB\UL.db                                                                                          16 bytes
File            C:\ADSM_PData_0150\DB\VL.db                                                                                          16 bytes
File            C:\ADSM_PData_0150\DB\_avt                                                                                          512 bytes
File            C:\ADSM_PData_0150\DragWait.exe                                                                                      253952 bytes executable
File            C:\ADSM_PData_0150\_avt                                                                                              512 bytes
File            C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86                                                          0 bytes
File            C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\AsDsm.sys                                                29752 bytes executable
File            C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\_avt                                                    512 bytes

---- EOF - GMER 1.0.15 ----

cosinus 17.06.2011 14:04
Was ist mit den anderen Logs?

Holzwurm 2 17.06.2011 15:58
Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:        ASUSTeK Computer Inc.
BIOS Manufacturer:                American Megatrends Inc.
System Manufacturer:                ASUSTeK Computer Inc.
System Product Name:                F5SL
Logical Drives Mask:                0x000000ec

Kernel Drivers (total 157):
  0x82212000 \SystemRoot\system32\ntkrnlpa.exe
  0x825CC000 \SystemRoot\system32\hal.dll
  0x80401000 \SystemRoot\system32\kdcom.dll
  0x80408000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x80478000 \SystemRoot\system32\PSHED.dll
  0x80489000 \SystemRoot\system32\BOOTVID.dll
  0x80491000 \SystemRoot\system32\CLFS.SYS
  0x804D2000 \SystemRoot\system32\CI.dll
  0x80607000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x80683000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x80690000 \SystemRoot\System32\Drivers\spru.sys
  0x80790000 \SystemRoot\System32\Drivers\WMILIB.SYS
  0x80799000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
  0x805B2000 \SystemRoot\system32\drivers\acpi.sys
  0x807BF000 \SystemRoot\system32\drivers\msisadrv.sys
  0x807C7000 \SystemRoot\system32\drivers\pci.sys
  0x807EE000 \SystemRoot\System32\drivers\partmgr.sys
  0x807FD000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8A209000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x8A213000 \SystemRoot\system32\drivers\volmgr.sys
  0x8A222000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8A26C000 \SystemRoot\system32\drivers\pciide.sys
  0x8A273000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x8A281000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8A291000 \SystemRoot\system32\drivers\atapi.sys
  0x8A299000 \SystemRoot\system32\drivers\ataport.SYS
  0x8A2B7000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8A2E9000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8A2F9000 \SystemRoot\System32\Drivers\AsDsm.sys
  0x8A303000 \SystemRoot\System32\Drivers\PxHelp20.sys
  0x8A30D000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A406000 \SystemRoot\system32\drivers\ndis.sys
  0x8A511000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A53C000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A60C000 \SystemRoot\System32\drivers\tcpip.sys
  0x8A6F6000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8A80F000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8A91F000 \SystemRoot\system32\drivers\wd.sys
  0x8A927000 \SystemRoot\system32\drivers\volsnap.sys
  0x8A960000 \SystemRoot\System32\Drivers\spldr.sys
  0x8A968000 \SystemRoot\System32\Drivers\mup.sys
  0x8A977000 \SystemRoot\System32\drivers\ecache.sys
  0x8A99E000 \SystemRoot\system32\drivers\disk.sys
  0x8A9AF000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x8A9D0000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8A800000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8A711000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8A71A000 \SystemRoot\system32\DRIVERS\ATKACPI.sys
  0x8A722000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8E207000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x8E6D1000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8E771000 \SystemRoot\System32\drivers\watchdog.sys
  0x8E77D000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8E790000 \SystemRoot\system32\DRIVERS\kbfiltr.sys
  0x8E792000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8E79D000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8E7CC000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8E7CE000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8E7D9000 \SystemRoot\system32\drivers\Afc.sys
  0x8E7E1000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8A731000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8A73B000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8A779000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8A788000 \SystemRoot\system32\DRIVERS\SiSGB6.sys
  0x8EA09000 \SystemRoot\system32\DRIVERS\athr.sys
  0x8EC00000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8EC8D000 \SystemRoot\System32\Drivers\avv401bs.SYS
  0x8ECC3000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8ECC7000 \SystemRoot\system32\DRIVERS\avmaudio.sys
  0x8ECE0000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8ECEB000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8ED1A000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8ED5B000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8ED72000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8ED7D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8EDA0000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8EDAF000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8EDC3000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8EDD8000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8EDE8000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8EBD6000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8EDEA000 \SystemRoot\system32\DRIVERS\lgbtbus.sys
  0x8EDED000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8A798000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8A7A5000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8A7DA000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8EDF7000 \SystemRoot\system32\DRIVERS\lgvmodem.sys
  0x8A7EB000 \SystemRoot\system32\drivers\modem.sys
  0x8EDFB000 \SystemRoot\system32\DRIVERS\lgbtport.sys
  0x8F000000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8A577000 \SystemRoot\system32\drivers\portcls.sys
  0x8A5A4000 \SystemRoot\system32\drivers\drmk.sys
  0x8F207000 \SystemRoot\system32\DRIVERS\smserial.sys
  0x8F2F7000 \SystemRoot\system32\drivers\MODEMCSA.sys
  0x8F301000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8F30A000 \SystemRoot\System32\Drivers\Null.SYS
  0x8F311000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8F321000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8F328000 \SystemRoot\System32\drivers\vga.sys
  0x8F334000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8F355000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8F35D000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8F365000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8F370000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8F37E000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8F387000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8F39D000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8F3B1000 \SystemRoot\system32\drivers\afd.sys
  0x8A5C9000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8A37E000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8F1F2000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8A394000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8F3F9000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8A3A7000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8A600000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8A3E3000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8F60E000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8F634000 \SystemRoot\system32\drivers\RTSTOR.SYS
  0x8F648000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8F655000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8F660000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x96AC0000 \SystemRoot\System32\win32k.sys
  0x8F668000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8F672000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x96CE0000 \SystemRoot\System32\TSDDD.dll
  0x96D00000 \SystemRoot\System32\cdd.dll
  0x96D10000 \SystemRoot\System32\ATMFD.DLL
  0x8F681000 \SystemRoot\system32\drivers\luafv.sys
  0x8F69C000 \SystemRoot\system32\drivers\spsys.sys
  0x8F74C000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8F75C000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x8F786000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x8F790000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x8F7A3000 \??\C:\Program Files\ATKGFNEX\ASMMAP.sys
  0x9D60F000 \SystemRoot\system32\drivers\HTTP.sys
  0x9D67C000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9D699000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9D6B2000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9D6C7000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9D6E8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9D707000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9D740000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9D758000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9D780000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9D7CF000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x9D7D8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x9D7E8000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x9EC05000 \SystemRoot\system32\drivers\peauth.sys
  0x9ECE3000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x9ECF8000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9ED02000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x9ED0E000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0x9ED23000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x9ED35000 \SystemRoot\System32\Drivers\fastfat.SYS
  0x9ED5D000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x77760000 \Windows\System32\ntdll.dll
  0x10000000 \Program Files\DAEMON Tools Lite\daemon.dll

Processes (total 67):
      0 System Idle Process
      4 System
    456 C:\Windows\System32\smss.exe
    588 csrss.exe
    648 C:\Windows\System32\wininit.exe
    660 csrss.exe
    692 C:\Windows\System32\services.exe
    708 C:\Windows\System32\lsass.exe
    732 C:\Windows\System32\winlogon.exe
    768 C:\Windows\System32\lsm.exe
    928 C:\Windows\System32\svchost.exe
    988 C:\Windows\System32\svchost.exe
    1024 C:\Windows\System32\svchost.exe
    1092 C:\Windows\System32\Ati2evxx.exe
    1128 C:\Windows\System32\svchost.exe
    1204 C:\Windows\System32\svchost.exe
    1244 C:\Windows\System32\svchost.exe
    1300 C:\Windows\System32\audiodg.exe
    1332 C:\Windows\System32\SLsvc.exe
    1368 C:\Windows\System32\svchost.exe
    1488 C:\Windows\System32\svchost.exe
    1576 C:\Windows\System32\Ati2evxx.exe
    1660 C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
    1672 C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    1704 C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    1780 C:\Windows\System32\spoolsv.exe
    1804 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1816 C:\Windows\System32\svchost.exe
    1856 C:\Windows\System32\taskeng.exe
    536 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    548 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    916 C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
    1700 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2064 C:\Windows\System32\svchost.exe
    2120 C:\Windows\System32\svchost.exe
    2168 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    2260 C:\Windows\System32\svchost.exe
    2308 C:\Windows\System32\SearchIndexer.exe
    2644 WUDFHost.exe
    2836 C:\Windows\servicing\TrustedInstaller.exe
    3348 C:\Windows\System32\taskeng.exe
    3444 C:\Windows\System32\taskeng.exe
    3460 C:\Windows\System32\dwm.exe
    3480 C:\Windows\explorer.exe
    3520 C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    3572 C:\Program Files\ATKOSD2\ATKOSD2.exe
    3592 C:\Program Files\Wireless Console 2\wcourier.exe
    3600 C:\Program Files\P4G\BatteryLife.exe
    3668 C:\Program Files\ASUS\Splendid\ACMON.exe
    3684 C:\Windows\System32\SearchProtocolHost.exe
    3724 C:\Program Files\ATK Hotkey\HControl.exe
    3844 ACEngSvr.exe
    4092 C:\Program Files\ATK Hotkey\ATKOSD.exe
      12 C:\Program Files\ATK Hotkey\KBFiltr.exe
    688 C:\Windows\System32\ASUSTPE.exe
    2800 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2932 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2472 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2940 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    1060 C:\Windows\ehome\ehtray.exe
    3260 C:\Windows\ehome\ehmsas.exe
    1352 C:\Windows\System32\svchost.exe
    476 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    4072 WmiPrvSE.exe
    2792 C:\Windows\System32\wuauclt.exe
    3000 C:\Windows\System32\SearchFilterHost.exe
    1796 C:\Users\irarref575\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`71167600  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000027`b3aef400  (NTFS)

PhysicalDrive0 Model Number: ST9320320AS, Rev: 0303   

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: 16FACB29D75458833E397367B1DA17929157C2B3


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
Gruß Christian


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:55 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131