Trojaner-Board - auch "ide/sata festplatte beschädigt" - aber systemwiederherstellung gelungen!

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - auch "ide/sata festplatte beschädigt" - aber systemwiederherstellung gelungen! (https://www.trojaner-board.de/100340-ide-sata-festplatte-beschaedigt-systemwiederherstellung-gelungen.html)

auch "ide/sata festplatte beschädigt" - aber systemwiederherstellung gelungen!

Guten Tag,

auch mich hat dieser Trojaner erwischt "ide/sata festplatte beschädigt" mit schwarzem hintergrundbild, und diesen popups.

habe dann auch einem anderen thread einfach den fixlog in otl kopiert. danach konnte ich wenigstens wieder einiges in windows starten, obwohl die popups und schwarzer hintergrund noch da waren.

habe dann systemwiederherstellung, 2 tage zurück gemacht. fast alles ist jetzt wieder okay. aber: einige dateien auf dem desktop und in meinen ordnern sind durchsichtig, als hätte man sie angeklickt. was ist das?

und wie kann ich mich vor dem trojaner schützen? das problem ist zwar jetzt weg, aber ich will das nicht nochmal. ging das über eine java lücke? ich erinnere mich, dass bevor die popups anfingen, java ohne grund gestartet wurde...

Hallo und :hallo:

Zitat:

habe dann auch einem anderen thread einfach den fixlog in otl kopiert.

Sowas bitte nicht mehr machen, denn Fixscripte sind indivuduell auf einen personenbezogenen Rechner abgestimmt und nicht einfach so auf jeden x-beliebigen Rechner übertragbar!

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL-Custom:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

habe einige windows updates gemacht (war etwas veraltet alles) und jetzt geht OTL.exe nicht mehr.

fehlermeldung: Exception EReadError in module OTL.exe at 000167C7.
Error reading frmMain. HorzScrollBar. Tracking: Access violation at adress
00416CA7 in module OTL.exe. Read of adress 6F383DE9.

Der malwarebytes log folgt, dauert bisschen

Windows-Update während einer Bereingungsprozedur sind ein wenig unpassend, findest du nicht? :balla:
Wenn man dir hier effektiv helfen soll, dann lass bitte solche Einzelaktionen ohne Absprache, also auch nicht irgendwelche Programme/Spiele installieren. Das kannst du machen wenn wir hier durch sind. Oder meinetwegen die auch die ganze Zeit, dann erwarte aber nicht, dass man hier ein format c verhindern kann...

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6863

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

15.06.2011 23:24:13
mbam-log-2011-06-15 (23-24-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 314101
Laufzeit: 56 Minute(n), 20 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\recycle.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\$Recycle.Bin\s-1-5-21-4021776669-3632399173-1879490895-1000\$R20IW6U.exe (Adware.TryMedia) -> Quarantined and deleted successfully.
c:\recycle.bin\recycle.bin.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\michael wehrmann\AppData\Local\Temp\jar_cache3034279949701890035.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\recycle.bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

hier OTL log, musste teilen, weil zu groß. teil 1 und 2

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\Shell - "" = AutoRun

O33 - MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\Shell - "" = AutoRun

O33 - MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a

O33 - MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\Shell - "" = AutoRun

O33 - MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\Shell\AutoRun\command - "" = J:\setup.exe

O33 - MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\Shell - "" = AutoRun

O33 - MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\Shell\AutoRun\command - "" = F:\setup.exe

O33 - MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\Shell - "" = AutoRun

O33 - MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\Shell - "" = AutoRun

O33 - MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\Shell - "" = AutoRun

O33 - MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\Shell - "" = AutoRun

O33 - MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\Shell\AutoRun\command - "" = J:\Desperados.exe -autorun

O33 - MountPoints2\K\Shell - "" = AutoRun

O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence

O4 - HKCU..\Run: [4E3E0230AEBB4E96]  File not found

[2011.06.14 19:42:17 | 000,000,128 | ---- | M] () -- C:\ProgramData\~43638520r

[2011.06.14 19:42:17 | 000,000,104 | ---- | M] () -- C:\ProgramData\~43638520

[2011.06.14 17:43:12 | 000,000,336 | ---- | M] () -- C:\ProgramData\43638520

[2011.06.14 22:42:07 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs

[2011.06.14 20:05:00 | 000,000,000 | ---D | M] -- C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF

[2010.10.27 16:03:17 | 000,000,000 | ---D | M] -- C:\Users\Michael Wehrmann\AppData\Roaming\Ahbye

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{018400fa-3d64-11df-9807-001e101f8aaa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{018400fa-3d64-11df-9807-001e101f8aaa}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0837dfe7-4950-11de-8072-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0837dfe7-4950-11de-8072-00238b4abf75}\ not found.
File G:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20e7e212-e186-11de-b5a6-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20e7e212-e186-11de-b5a6-00238b4abf75}\ not found.
File J:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ not found.
File F:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ not found.
File J:\Desperados.exe -autorun not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\4E3E0230AEBB4E96 deleted successfully.
C:\ProgramData\~43638520r moved successfully.
C:\ProgramData\~43638520 moved successfully.
C:\ProgramData\43638520 moved successfully.
File move failed. C:\Windows\System32\winrm.vbs scheduled to be moved on reboot.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Xp folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Vista folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Magma folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Iubito folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\GrayXP folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Desert Chrome folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Classic folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad\Updates folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad\GMDigit\Cache folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad\GMDigit folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\Ahbye folder moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.24.0 log created on 06162011_101116

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\winrm.vbs scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Stell uns bitte den Quarantäneordner von OTL zur Verfügung. Bitte dabei so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht behindern!
2.) Ordner MovedFiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

ist hochgeladen! danke dir!

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html
Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst oder Verküpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:

Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista- und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

2011/06/16 10:48:51.0132 3924 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48
2011/06/16 10:48:51.0318 3924 ================================================================================
2011/06/16 10:48:51.0318 3924 SystemInfo:
2011/06/16 10:48:51.0318 3924
2011/06/16 10:48:51.0318 3924 OS Version: 6.0.6001 ServicePack: 1.0
2011/06/16 10:48:51.0318 3924 Product type: Workstation
2011/06/16 10:48:51.0319 3924 ComputerName: MICHAEL-LAPTOP
2011/06/16 10:48:51.0319 3924 UserName: Michael Wehrmann
2011/06/16 10:48:51.0319 3924 Windows directory: C:\Windows
2011/06/16 10:48:51.0319 3924 System windows directory: C:\Windows
2011/06/16 10:48:51.0319 3924 Processor architecture: Intel x86
2011/06/16 10:48:51.0319 3924 Number of processors: 2
2011/06/16 10:48:51.0319 3924 Page size: 0x1000
2011/06/16 10:48:51.0319 3924 Boot type: Normal boot
2011/06/16 10:48:51.0319 3924 ================================================================================
2011/06/16 10:48:52.0544 3924 Initialize success
2011/06/16 10:49:05.0356 0500 ================================================================================
2011/06/16 10:49:05.0356 0500 Scan started
2011/06/16 10:49:05.0356 0500 Mode: Manual;
2011/06/16 10:49:05.0356 0500 ================================================================================
2011/06/16 10:49:06.0598 0500 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/06/16 10:49:06.0673 0500 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/06/16 10:49:06.0741 0500 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/06/16 10:49:06.0781 0500 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/06/16 10:49:06.0820 0500 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/06/16 10:49:06.0905 0500 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/06/16 10:49:06.0956 0500 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/06/16 10:49:06.0998 0500 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/16 10:49:07.0054 0500 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/06/16 10:49:07.0102 0500 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/06/16 10:49:07.0143 0500 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/06/16 10:49:07.0179 0500 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/06/16 10:49:07.0219 0500 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/06/16 10:49:07.0287 0500 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/06/16 10:49:07.0329 0500 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/06/16 10:49:07.0396 0500 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/16 10:49:07.0463 0500 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/06/16 10:49:07.0533 0500 AVerAF15 (59ab11f9b541c6279e0d45dfb77d7b17) C:\Windows\system32\Drivers\AVerAF15.sys
2011/06/16 10:49:07.0591 0500 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/16 10:49:07.0672 0500 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/06/16 10:49:07.0701 0500 BMLoad (d002033c1a37f6af51b5f0ba6d0211bc) C:\Windows\system32\drivers\BMLoad.sys
2011/06/16 10:49:07.0762 0500 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/16 10:49:07.0811 0500 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/16 10:49:07.0852 0500 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/16 10:49:07.0902 0500 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/16 10:49:07.0943 0500 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/16 10:49:07.0988 0500 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/16 10:49:08.0024 0500 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/16 10:49:08.0063 0500 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/16 10:49:08.0142 0500 CamDrL (0f5ca31bb3fdb5c1e63c170cfbecc93b) C:\Windows\system32\DRIVERS\Camdrl.sys
2011/06/16 10:49:08.0208 0500 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/16 10:49:08.0272 0500 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/16 10:49:08.0331 0500 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/06/16 10:49:08.0400 0500 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/06/16 10:49:08.0514 0500 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/16 10:49:08.0542 0500 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/06/16 10:49:08.0596 0500 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/16 10:49:08.0639 0500 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/06/16 10:49:08.0684 0500 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/06/16 10:49:08.0780 0500 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/06/16 10:49:08.0855 0500 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/06/16 10:49:08.0932 0500 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/16 10:49:09.0002 0500 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/16 10:49:09.0070 0500 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/16 10:49:09.0109 0500 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/06/16 10:49:09.0208 0500 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/06/16 10:49:09.0290 0500 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/06/16 10:49:09.0372 0500 ewusbnet (0f40e249e4dd0ce47c7ca19c5c8fb48a) C:\Windows\system32\DRIVERS\ewusbnet.sys
2011/06/16 10:49:09.0419 0500 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/06/16 10:49:09.0472 0500 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/06/16 10:49:09.0519 0500 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/16 10:49:09.0587 0500 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/16 10:49:09.0626 0500 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/16 10:49:09.0679 0500 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/16 10:49:09.0731 0500 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/06/16 10:49:09.0773 0500 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/16 10:49:09.0824 0500 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/16 10:49:09.0894 0500 hamachi (7929a161f9951d173ca9900fe7067391) C:\Windows\system32\DRIVERS\hamachi.sys
2011/06/16 10:49:09.0958 0500 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/16 10:49:10.0024 0500 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/16 10:49:10.0101 0500 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/16 10:49:10.0140 0500 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/06/16 10:49:10.0213 0500 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/16 10:49:10.0269 0500 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/06/16 10:49:10.0351 0500 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/06/16 10:49:10.0398 0500 hwdatacard (92ca47da32009ccc00a5aded04abbd78) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/06/16 10:49:10.0440 0500 hwusbfake (089085538885367e281686762a973eb5) C:\Windows\system32\DRIVERS\ewusbfake.sys
2011/06/16 10:49:10.0486 0500 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/06/16 10:49:10.0539 0500 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/16 10:49:10.0601 0500 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/06/16 10:49:10.0746 0500 igfx (0627fc0c422cd6e0f23e1b0d1d9f0899) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/06/16 10:49:10.0883 0500 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/16 10:49:11.0031 0500 IntcAzAudAddService (56ac584fe02e0c1d5924892562cbd572) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/16 10:49:11.0096 0500 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/16 10:49:11.0133 0500 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/16 10:49:11.0260 0500 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/16 10:49:11.0322 0500 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/16 10:49:11.0365 0500 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/16 10:49:11.0404 0500 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/06/16 10:49:11.0480 0500 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/16 10:49:11.0525 0500 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/16 10:49:11.0559 0500 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/16 10:49:11.0602 0500 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/16 10:49:11.0658 0500 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/16 10:49:11.0693 0500 KMWDFILTER (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\Windows\system32\DRIVERS\KMWDFILTER.sys
2011/06/16 10:49:11.0758 0500 KSecDD (5367dc846cae9639b899bfd13b97a8c9) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/16 10:49:11.0828 0500 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/16 10:49:11.0910 0500 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/16 10:49:11.0966 0500 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/16 10:49:12.0003 0500 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/16 10:49:12.0083 0500 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/16 10:49:12.0237 0500 LVcKap (9a3d4fc6b86e7e36473079ab76ac703d) C:\Windows\system32\DRIVERS\LVcKap.sys
2011/06/16 10:49:12.0439 0500 LVMVDrv (0acbc11f19320af6c19f2e20013d9095) C:\Windows\system32\DRIVERS\LVMVDrv.sys
2011/06/16 10:49:12.0494 0500 LVPr2Mon (12866641284ebb41e627bb53c04da959) C:\Windows\system32\DRIVERS\LVPr2Mon.sys
2011/06/16 10:49:12.0537 0500 LVUSBSta (64bc29c3a0388bfc580bb8b1346f7659) C:\Windows\system32\drivers\LVUSBSta.sys
2011/06/16 10:49:12.0706 0500 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/06/16 10:49:12.0811 0500 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/06/16 10:49:12.0877 0500 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/06/16 10:49:12.0945 0500 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/16 10:49:12.0979 0500 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/16 10:49:13.0006 0500 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/16 10:49:13.0051 0500 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/16 10:49:13.0083 0500 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/16 10:49:13.0128 0500 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/06/16 10:49:13.0170 0500 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/16 10:49:13.0207 0500 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/16 10:49:13.0257 0500 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/06/16 10:49:13.0326 0500 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/16 10:49:13.0375 0500 mrxsmb10 (cf6e972f8e0d0f2970360a17572b366b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/16 10:49:13.0417 0500 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/16 10:49:13.0482 0500 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/06/16 10:49:13.0537 0500 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/06/16 10:49:13.0606 0500 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/16 10:49:13.0680 0500 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/16 10:49:13.0820 0500 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/16 10:49:13.0866 0500 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/16 10:49:13.0903 0500 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/16 10:49:13.0943 0500 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/06/16 10:49:13.0986 0500 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/16 10:49:14.0030 0500 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/16 10:49:14.0068 0500 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/06/16 10:49:14.0155 0500 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/16 10:49:14.0210 0500 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/06/16 10:49:14.0272 0500 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/16 10:49:14.0298 0500 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/16 10:49:14.0342 0500 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/16 10:49:14.0376 0500 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/16 10:49:14.0420 0500 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/16 10:49:14.0472 0500 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/16 10:49:14.0565 0500 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/16 10:49:14.0606 0500 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/06/16 10:49:14.0686 0500 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/16 10:49:14.0763 0500 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/06/16 10:49:14.0864 0500 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/16 10:49:14.0979 0500 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/16 10:49:15.0027 0500 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/06/16 10:49:15.0066 0500 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/06/16 10:49:15.0107 0500 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/06/16 10:49:15.0263 0500 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/06/16 10:49:15.0346 0500 OVT511Plus (c5739be3a8eecdf951955a38e1741f45) C:\Windows\system32\Drivers\omcamvid.sys
2011/06/16 10:49:15.0399 0500 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/16 10:49:15.0466 0500 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/06/16 10:49:15.0500 0500 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/16 10:49:15.0565 0500 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/06/16 10:49:15.0612 0500 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/06/16 10:49:15.0666 0500 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/06/16 10:49:15.0746 0500 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/16 10:49:15.0994 0500 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/16 10:49:16.0042 0500 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/06/16 10:49:16.0122 0500 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/16 10:49:16.0216 0500 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/06/16 10:49:16.0285 0500 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/16 10:49:16.0343 0500 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/16 10:49:16.0394 0500 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/16 10:49:16.0443 0500 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/16 10:49:16.0503 0500 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/16 10:49:16.0537 0500 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/16 10:49:16.0597 0500 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/16 10:49:16.0634 0500 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/16 10:49:16.0707 0500 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/06/16 10:49:16.0746 0500 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/16 10:49:16.0812 0500 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/06/16 10:49:16.0912 0500 RimUsb (f17713d108aca124a139fde877eef68a) C:\Windows\system32\Drivers\RimUsb.sys
2011/06/16 10:49:16.0962 0500 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/06/16 10:49:17.0013 0500 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/06/16 10:49:17.0154 0500 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/16 10:49:17.0223 0500 RTL8169 (2fc33077f85d7dc0d03678c06d43898c) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/06/16 10:49:17.0297 0500 RTL8187B (c279a9a9f946359548e5665c0e8bab15) C:\Windows\system32\DRIVERS\RTL8187B.sys
2011/06/16 10:49:17.0372 0500 RTSTOR (d1fb9a678bd6c2b1129fcb09d5feb6dd) C:\Windows\system32\drivers\RTSTOR.SYS
2011/06/16 10:49:17.0438 0500 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/16 10:49:17.0570 0500 scsk4 (322c39bbe37c321622e57b2e48be8e2c) C:\Windows\system32\drivers\scsk4.sys
2011/06/16 10:49:17.0652 0500 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/16 10:49:17.0772 0500 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/16 10:49:17.0820 0500 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/16 10:49:17.0866 0500 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/16 10:49:17.0960 0500 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/06/16 10:49:18.0003 0500 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/16 10:49:18.0058 0500 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/16 10:49:18.0109 0500 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/06/16 10:49:18.0192 0500 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/06/16 10:49:18.0238 0500 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/06/16 10:49:18.0300 0500 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/06/16 10:49:18.0383 0500 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/06/16 10:49:18.0493 0500 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/16 10:49:18.0569 0500 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/06/16 10:49:18.0569 0500 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/06/16 10:49:18.0579 0500 sptd - detected LockedFile.Multi.Generic (1)
2011/06/16 10:49:18.0637 0500 srv (73dddbeec61e78568082916a27aadaee) C:\Windows\system32\DRIVERS\srv.sys
2011/06/16 10:49:18.0672 0500 srv2 (805fac010405ad3f82ef8df0bb035d81) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/16 10:49:18.0736 0500 srvnet (f63a0a58aafe34d7a1a0a74abccdd9c0) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/16 10:49:18.0818 0500 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/16 10:49:18.0869 0500 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/16 10:49:18.0915 0500 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/16 10:49:18.0967 0500 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/16 10:49:19.0104 0500 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/06/16 10:49:19.0206 0500 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/16 10:49:19.0262 0500 tcpipBM (dcfeb82ca988598ceb8f83148616038e) C:\Windows\system32\drivers\tcpipBM.sys
2011/06/16 10:49:19.0330 0500 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/16 10:49:19.0367 0500 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/16 10:49:19.0420 0500 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/16 10:49:19.0466 0500 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/16 10:49:19.0533 0500 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/16 10:49:19.0619 0500 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/16 10:49:19.0661 0500 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/16 10:49:19.0690 0500 tunnel (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/16 10:49:19.0758 0500 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/06/16 10:49:19.0813 0500 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/16 10:49:19.0887 0500 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/16 10:49:19.0936 0500 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/06/16 10:49:20.0006 0500 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/16 10:49:20.0238 0500 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/16 10:49:20.0318 0500 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/16 10:49:20.0428 0500 usbaudio (292a25bb75a568ae2c67169ba2c6365a) C:\Windows\system32\drivers\usbaudio.sys
2011/06/16 10:49:20.0481 0500 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/16 10:49:20.0545 0500 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/16 10:49:20.0583 0500 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/16 10:49:20.0626 0500 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/16 10:49:20.0672 0500 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/06/16 10:49:20.0730 0500 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/16 10:49:20.0780 0500 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/16 10:49:20.0875 0500 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/16 10:49:20.0948 0500 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/16 10:49:21.0006 0500 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/16 10:49:21.0141 0500 VClone (1cdaa48cb2f7744b8d25650e050766a5) C:\Windows\system32\DRIVERS\VClone.sys
2011/06/16 10:49:21.0247 0500 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/16 10:49:21.0291 0500 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/16 10:49:21.0344 0500 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/06/16 10:49:21.0380 0500 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/06/16 10:49:21.0415 0500 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/06/16 10:49:21.0474 0500 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/16 10:49:21.0509 0500 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/06/16 10:49:21.0582 0500 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/06/16 10:49:21.0632 0500 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/06/16 10:49:21.0697 0500 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/16 10:49:21.0764 0500 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:49:21.0787 0500 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:49:21.0935 0500 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/06/16 10:49:22.0000 0500 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/16 10:49:22.0186 0500 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/16 10:49:22.0281 0500 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/16 10:49:22.0362 0500 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/16 10:49:22.0482 0500 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/06/16 10:49:22.0502 0500 ================================================================================
2011/06/16 10:49:22.0503 0500 Scan finished
2011/06/16 10:49:22.0503 0500 ================================================================================
2011/06/16 10:49:22.0520 4092 Detected object count: 1
2011/06/16 10:49:22.0520 4092 Actual detected object count: 1
2011/06/16 10:50:03.0719 4092 LockedFile.Multi.Generic(sptd) - User select action: Skip
2011/06/16 10:50:25.0698 3356 ================================================================================
2011/06/16 10:50:25.0698 3356 Scan started
2011/06/16 10:50:25.0698 3356 Mode: Manual;
2011/06/16 10:50:25.0698 3356 ================================================================================
2011/06/16 10:50:26.0249 3356 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/06/16 10:50:26.0325 3356 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/06/16 10:50:26.0381 3356 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/06/16 10:50:26.0422 3356 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/06/16 10:50:26.0470 3356 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/06/16 10:50:26.0556 3356 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/06/16 10:50:26.0607 3356 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/06/16 10:50:26.0649 3356 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/16 10:50:26.0705 3356 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/06/16 10:50:26.0753 3356 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/06/16 10:50:26.0794 3356 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/06/16 10:50:26.0842 3356 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/06/16 10:50:26.0882 3356 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/06/16 10:50:26.0928 3356 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/06/16 10:50:26.0980 3356 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/06/16 10:50:27.0036 3356 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/16 10:50:27.0103 3356 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/06/16 10:50:27.0173 3356 AVerAF15 (59ab11f9b541c6279e0d45dfb77d7b17) C:\Windows\system32\Drivers\AVerAF15.sys
2011/06/16 10:50:27.0232 3356 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/16 10:50:27.0291 3356 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/06/16 10:50:27.0318 3356 BMLoad (d002033c1a37f6af51b5f0ba6d0211bc) C:\Windows\system32\drivers\BMLoad.sys
2011/06/16 10:50:27.0369 3356 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/16 10:50:27.0418 3356 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/16 10:50:27.0459 3356 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/16 10:50:27.0509 3356 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/16 10:50:27.0549 3356 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/16 10:50:27.0583 3356 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/16 10:50:27.0619 3356 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/16 10:50:27.0659 3356 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/16 10:50:27.0737 3356 CamDrL (0f5ca31bb3fdb5c1e63c170cfbecc93b) C:\Windows\system32\DRIVERS\Camdrl.sys
2011/06/16 10:50:27.0804 3356 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/16 10:50:27.0868 3356 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/16 10:50:27.0915 3356 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/06/16 10:50:27.0984 3356 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/06/16 10:50:28.0054 3356 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/16 10:50:28.0081 3356 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/06/16 10:50:28.0136 3356 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/16 10:50:28.0173 3356 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/06/16 10:50:28.0224 3356 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/06/16 10:50:28.0320 3356 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/06/16 10:50:28.0396 3356 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/06/16 10:50:28.0461 3356 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/16 10:50:28.0541 3356 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/16 10:50:28.0599 3356 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/16 10:50:28.0639 3356 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/06/16 10:50:28.0726 3356 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/06/16 10:50:28.0786 3356 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/06/16 10:50:28.0867 3356 ewusbnet (0f40e249e4dd0ce47c7ca19c5c8fb48a) C:\Windows\system32\DRIVERS\ewusbnet.sys
2011/06/16 10:50:28.0915 3356 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/06/16 10:50:28.0991 3356 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/06/16 10:50:29.0037 3356 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/16 10:50:29.0105 3356 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/16 10:50:29.0144 3356 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/16 10:50:29.0186 3356 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/16 10:50:29.0237 3356 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/06/16 10:50:29.0280 3356 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/16 10:50:29.0330 3356 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/16 10:50:29.0379 3356 hamachi (7929a161f9951d173ca9900fe7067391) C:\Windows\system32\DRIVERS\hamachi.sys
2011/06/16 10:50:29.0442 3356 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/16 10:50:29.0497 3356 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/16 10:50:29.0575 3356 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/16 10:50:29.0614 3356 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/06/16 10:50:29.0687 3356 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/16 10:50:29.0754 3356 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/06/16 10:50:29.0836 3356 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/06/16 10:50:29.0883 3356 hwdatacard (92ca47da32009ccc00a5aded04abbd78) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/06/16 10:50:29.0924 3356 hwusbfake (089085538885367e281686762a973eb5) C:\Windows\system32\DRIVERS\ewusbfake.sys
2011/06/16 10:50:29.0960 3356 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/06/16 10:50:30.0012 3356 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/16 10:50:30.0075 3356 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/06/16 10:50:30.0219 3356 igfx (0627fc0c422cd6e0f23e1b0d1d9f0899) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/06/16 10:50:30.0290 3356 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/16 10:50:30.0426 3356 IntcAzAudAddService (56ac584fe02e0c1d5924892562cbd572) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/16 10:50:30.0492 3356 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/16 10:50:30.0528 3356 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/16 10:50:30.0622 3356 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/16 10:50:30.0684 3356 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/16 10:50:30.0728 3356 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/16 10:50:30.0777 3356 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/06/16 10:50:30.0842 3356 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/16 10:50:30.0888 3356 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/16 10:50:30.0922 3356 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/16 10:50:30.0964 3356 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/16 10:50:31.0020 3356 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/16 10:50:31.0056 3356 KMWDFILTER (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\Windows\system32\DRIVERS\KMWDFILTER.sys
2011/06/16 10:50:31.0121 3356 KSecDD (5367dc846cae9639b899bfd13b97a8c9) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/16 10:50:31.0201 3356 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/16 10:50:31.0272 3356 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/16 10:50:31.0317 3356 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/16 10:50:31.0347 3356 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/16 10:50:31.0382 3356 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/16 10:50:31.0493 3356 LVcKap (9a3d4fc6b86e7e36473079ab76ac703d) C:\Windows\system32\DRIVERS\LVcKap.sys
2011/06/16 10:50:31.0612 3356 LVMVDrv (0acbc11f19320af6c19f2e20013d9095) C:\Windows\system32\DRIVERS\LVMVDrv.sys
2011/06/16 10:50:31.0678 3356 LVPr2Mon (12866641284ebb41e627bb53c04da959) C:\Windows\system32\DRIVERS\LVPr2Mon.sys
2011/06/16 10:50:31.0724 3356 LVUSBSta (64bc29c3a0388bfc580bb8b1346f7659) C:\Windows\system32\drivers\LVUSBSta.sys
2011/06/16 10:50:31.0823 3356 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/06/16 10:50:31.0918 3356 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/06/16 10:50:31.0972 3356 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/06/16 10:50:32.0040 3356 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/16 10:50:32.0074 3356 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/16 10:50:32.0105 3356 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/16 10:50:32.0146 3356 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/16 10:50:32.0178 3356 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/16 10:50:32.0234 3356 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/06/16 10:50:32.0277 3356 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/16 10:50:32.0314 3356 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/16 10:50:32.0363 3356 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/06/16 10:50:32.0422 3356 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/16 10:50:32.0470 3356 mrxsmb10 (cf6e972f8e0d0f2970360a17572b366b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/16 10:50:32.0524 3356 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/16 10:50:32.0589 3356 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/06/16 10:50:32.0632 3356 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/06/16 10:50:32.0711 3356 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/16 10:50:32.0739 3356 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/16 10:50:32.0803 3356 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/16 10:50:32.0850 3356 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/16 10:50:32.0887 3356 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/16 10:50:32.0927 3356 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/06/16 10:50:32.0970 3356 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/16 10:50:33.0025 3356 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/16 10:50:33.0054 3356 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/06/16 10:50:33.0128 3356 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/16 10:50:33.0183 3356 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/06/16 10:50:33.0223 3356 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/16 10:50:33.0258 3356 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/16 10:50:33.0304 3356 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/16 10:50:33.0338 3356 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/16 10:50:33.0393 3356 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/16 10:50:33.0435 3356 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/16 10:50:33.0527 3356 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/16 10:50:33.0565 3356 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/06/16 10:50:33.0648 3356 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/16 10:50:33.0724 3356 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/06/16 10:50:33.0781 3356 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/16 10:50:33.0829 3356 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/16 10:50:33.0878 3356 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/06/16 10:50:33.0916 3356 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/06/16 10:50:33.0958 3356 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/06/16 10:50:34.0067 3356 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/06/16 10:50:34.0130 3356 OVT511Plus (c5739be3a8eecdf951955a38e1741f45) C:\Windows\system32\Drivers\omcamvid.sys
2011/06/16 10:50:34.0180 3356 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/16 10:50:34.0215 3356 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/06/16 10:50:34.0261 3356 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/16 10:50:34.0337 3356 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/06/16 10:50:34.0384 3356 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/06/16 10:50:34.0427 3356 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/06/16 10:50:34.0496 3356 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/16 10:50:34.0644 3356 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/16 10:50:34.0692 3356 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/06/16 10:50:34.0772 3356 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/16 10:50:34.0855 3356 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/06/16 10:50:34.0913 3356 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/16 10:50:34.0971 3356 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/16 10:50:35.0011 3356 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/16 10:50:35.0082 3356 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/16 10:50:35.0171 3356 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/16 10:50:35.0273 3356 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/16 10:50:35.0324 3356 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/16 10:50:35.0355 3356 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/16 10:50:35.0424 3356 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/06/16 10:50:35.0455 3356 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/16 10:50:35.0518 3356 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/06/16 10:50:35.0596 3356 RimUsb (f17713d108aca124a139fde877eef68a) C:\Windows\system32\Drivers\RimUsb.sys
2011/06/16 10:50:35.0635 3356 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/06/16 10:50:35.0686 3356 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/06/16 10:50:35.0759 3356 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/16 10:50:35.0818 3356 RTL8169 (2fc33077f85d7dc0d03678c06d43898c) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/06/16 10:50:35.0869 3356 RTL8187B (c279a9a9f946359548e5665c0e8bab15) C:\Windows\system32\DRIVERS\RTL8187B.sys
2011/06/16 10:50:35.0910 3356 RTSTOR (d1fb9a678bd6c2b1129fcb09d5feb6dd) C:\Windows\system32\drivers\RTSTOR.SYS
2011/06/16 10:50:35.0963 3356 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/16 10:50:36.0020 3356 scsk4 (322c39bbe37c321622e57b2e48be8e2c) C:\Windows\system32\drivers\scsk4.sys
2011/06/16 10:50:36.0079 3356 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/16 10:50:36.0126 3356 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/16 10:50:36.0163 3356 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/16 10:50:36.0205 3356 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/16 10:50:36.0298 3356 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/06/16 10:50:36.0341 3356 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/16 10:50:36.0375 3356 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/16 10:50:36.0414 3356 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/06/16 10:50:36.0475 3356 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/06/16 10:50:36.0505 3356 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/06/16 10:50:36.0550 3356 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/06/16 10:50:36.0621 3356 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/06/16 10:50:36.0687 3356 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/16 10:50:36.0774 3356 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/06/16 10:50:36.0774 3356 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/06/16 10:50:36.0784 3356 sptd - detected LockedFile.Multi.Generic (1)
2011/06/16 10:50:36.0842 3356 srv (73dddbeec61e78568082916a27aadaee) C:\Windows\system32\DRIVERS\srv.sys
2011/06/16 10:50:36.0878 3356 srv2 (805fac010405ad3f82ef8df0bb035d81) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/16 10:50:36.0916 3356 srvnet (f63a0a58aafe34d7a1a0a74abccdd9c0) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/16 10:50:37.0001 3356 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/16 10:50:37.0052 3356 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/16 10:50:37.0098 3356 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/16 10:50:37.0139 3356 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/16 10:50:37.0264 3356 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/06/16 10:50:37.0342 3356 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/16 10:50:37.0379 3356 tcpipBM (dcfeb82ca988598ceb8f83148616038e) C:\Windows\system32\drivers\tcpipBM.sys
2011/06/16 10:50:37.0435 3356 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/16 10:50:37.0483 3356 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/16 10:50:37.0525 3356 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/16 10:50:37.0571 3356 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/16 10:50:37.0638 3356 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/16 10:50:37.0735 3356 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/16 10:50:37.0788 3356 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/16 10:50:37.0824 3356 tunnel (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/16 10:50:37.0886 3356 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/06/16 10:50:37.0940 3356 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/16 10:50:38.0014 3356 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/16 10:50:38.0063 3356 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/06/16 10:50:38.0122 3356 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/16 10:50:38.0165 3356 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/16 10:50:38.0222 3356 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/16 10:50:38.0311 3356 usbaudio (292a25bb75a568ae2c67169ba2c6365a) C:\Windows\system32\drivers\usbaudio.sys
2011/06/16 10:50:38.0364 3356 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/16 10:50:38.0416 3356 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/16 10:50:38.0455 3356 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/16 10:50:38.0498 3356 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/16 10:50:38.0543 3356 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/06/16 10:50:38.0601 3356 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/16 10:50:38.0652 3356 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/16 10:50:38.0702 3356 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/16 10:50:38.0763 3356 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/16 10:50:38.0821 3356 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/16 10:50:38.0945 3356 VClone (1cdaa48cb2f7744b8d25650e050766a5) C:\Windows\system32\DRIVERS\VClone.sys
2011/06/16 10:50:39.0007 3356 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/16 10:50:39.0051 3356 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/16 10:50:39.0104 3356 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/06/16 10:50:39.0140 3356 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/06/16 10:50:39.0176 3356 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/06/16 10:50:39.0234 3356 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/16 10:50:39.0269 3356 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/06/16 10:50:39.0342 3356 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/06/16 10:50:39.0392 3356 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/06/16 10:50:39.0458 3356 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/16 10:50:39.0502 3356 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:50:39.0525 3356 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:50:39.0606 3356 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/06/16 10:50:39.0670 3356 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/16 10:50:39.0857 3356 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/16 10:50:39.0952 3356 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/16 10:50:40.0033 3356 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/16 10:50:40.0142 3356 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/06/16 10:50:40.0163 3356 ================================================================================
2011/06/16 10:50:40.0163 3356 Scan finished
2011/06/16 10:50:40.0163 3356 ================================================================================
2011/06/16 10:50:40.0183 2932 Detected object count: 1
2011/06/16 10:50:40.0183 2932 Actual detected object count: 1
2011/06/16 10:51:02.0646 2932 HKLM\SYSTEM\ControlSet001\services\sptd - will be deleted after reboot
2011/06/16 10:51:02.0703 2932 HKLM\SYSTEM\ControlSet002\services\sptd - will be deleted after reboot
2011/06/16 10:51:02.0746 2932 C:\Windows\system32\Drivers\sptd.sys - will be deleted after reboot
2011/06/16 10:51:02.0746 2932 LockedFile.Multi.Generic(sptd) - User select action: Delete

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Combofix Logfile:

Code:

ComboFix 11-06-15.04 - Michael Wehrmann 16.06.2011  15:39:38.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2936.2142 [GMT 2:00]

ausgeführt von:: c:\users\Michael Wehrmann\Desktop\cofi.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Michael Wehrmann\AppData\Roaming\EurekaLog

c:\windows\IsUn0407.exe

D:\install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-05-16 bis 2011-06-16  ))))))))))))))))))))))))))))))

.

.

2011-06-16 13:48 . 2011-06-16 13:49        --------        d-----w-        c:\users\Michael Wehrmann\AppData\Local\temp

2011-06-16 13:48 . 2011-06-16 13:48        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-06-16 13:48 . 2011-06-16 13:48        --------        d-----w-        c:\windows\ServiceProfiles\LocalService\AppData\Local\temp

2011-06-16 08:22 . 2011-06-16 08:22        --------        d-----w-        c:\program files\7-Zip

2011-06-16 08:11 . 2011-06-16 08:36        --------        d-----w-        C:\_OTL

2011-06-15 19:11 . 2011-06-15 19:11        --------        d-----w-        c:\windows\system32\EventProviders

2011-06-15 15:40 . 2011-06-15 15:40        --------        d-----w-        C:\Downloads

2011-06-14 21:53 . 2011-06-14 21:53        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2011-06-14 21:02 . 2010-02-12 10:48        293376        ----a-w-        c:\windows\system32\browserchoice.exe

2011-06-14 20:51 . 2009-11-08 08:55        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll

2011-06-14 20:51 . 2009-11-08 08:55        49472        ----a-w-        c:\windows\system32\netfxperf.dll

2011-06-14 20:51 . 2009-11-08 08:55        297808        ----a-w-        c:\windows\system32\mscoree.dll

2011-06-14 20:51 . 2009-11-08 08:55        295264        ----a-w-        c:\windows\system32\PresentationHost.exe

2011-06-14 20:51 . 2009-11-08 08:55        1130824        ----a-w-        c:\windows\system32\dfshim.dll

2011-06-14 20:48 . 2010-02-20 23:39        24064        ----a-w-        c:\windows\system32\nshhttp.dll

2011-06-14 20:48 . 2010-02-20 23:37        31232        ----a-w-        c:\windows\system32\httpapi.dll

2011-06-14 20:48 . 2010-02-20 21:18        411136        ----a-w-        c:\windows\system32\drivers\http.sys

2011-06-14 20:46 . 2010-09-20 09:25        231936        ----a-w-        c:\windows\system32\msshsq.dll

2011-06-14 20:37 . 2009-09-10 15:21        1418752        ----a-w-        c:\program files\Windows Media Player\setup_wm.exe

2011-06-14 20:37 . 2009-09-10 15:21        310784        ----a-w-        c:\windows\system32\unregmp2.exe

2011-06-14 20:37 . 2009-09-10 15:21        168960        ----a-w-        c:\program files\Windows Media Player\wmplayer.exe

2011-06-14 20:37 . 2009-07-14 12:58        7680        ----a-w-        c:\windows\system32\spwmp.dll

2011-06-14 20:37 . 2009-07-14 10:58        107520        ----a-w-        c:\program files\Windows Media Player\wmpshare.exe

2011-06-14 20:37 . 2009-07-14 12:59        4096        ----a-w-        c:\windows\system32\msdxm.ocx

2011-06-14 20:37 . 2009-07-14 12:59        4096        ----a-w-        c:\windows\system32\dxmasf.dll

2011-06-14 20:37 . 2009-07-14 10:59        107520        ----a-w-        c:\program files\Windows Media Player\wmpconfig.exe

2011-06-14 20:37 . 2009-09-10 15:21        8147456        ----a-w-        c:\windows\system32\wmploc.DLL

2011-06-14 20:37 . 2010-10-28 12:56        2048        ----a-w-        c:\windows\system32\tzres.dll

2011-06-14 20:35 . 2010-11-06 11:10        357376        ----a-w-        c:\windows\system32\taskschd.dll

2011-06-14 20:35 . 2010-11-06 11:09        603648        ----a-w-        c:\windows\system32\schedsvc.dll

2011-06-14 20:35 . 2010-11-06 11:10        345088        ----a-w-        c:\windows\system32\wmicmiplugin.dll

2011-06-14 20:35 . 2010-11-06 11:10        270336        ----a-w-        c:\windows\system32\taskcomp.dll

2011-06-14 20:35 . 2010-11-05 00:53        171520        ----a-w-        c:\windows\system32\taskeng.exe

2011-06-14 20:35 . 2009-07-14 13:00        313344        ----a-w-        c:\windows\system32\wmpdxm.dll

2011-06-14 20:33 . 2010-08-31 15:40        531968        ----a-w-        c:\windows\system32\comctl32.dll

2011-06-14 20:33 . 2010-06-11 15:30        1257472        ----a-w-        c:\windows\system32\msxml3.dll

2011-06-14 20:33 . 2009-04-02 12:37        604672        ----a-w-        c:\windows\system32\WMSPDMOD.DLL

2011-06-14 20:32 . 2010-01-25 12:48        472576        ----a-w-        c:\windows\system32\secproc_isv.dll

2011-06-14 20:32 . 2010-01-25 12:48        472064        ----a-w-        c:\windows\system32\secproc.dll

2011-06-14 20:32 . 2010-01-25 08:35        346624        ----a-w-        c:\windows\system32\RMActivate_ssp_isv.exe

2011-06-14 20:32 . 2010-01-25 08:35        523776        ----a-w-        c:\windows\system32\RMActivate_isv.exe

2011-06-14 20:32 . 2010-01-25 08:34        511488        ----a-w-        c:\windows\system32\RMActivate.exe

2011-06-14 20:32 . 2010-01-25 08:34        347136        ----a-w-        c:\windows\system32\RMActivate_ssp.exe

2011-06-14 20:32 . 2010-01-25 12:48        151040        ----a-w-        c:\windows\system32\secproc_ssp_isv.dll

2011-06-14 20:32 . 2010-01-25 12:48        151040        ----a-w-        c:\windows\system32\secproc_ssp.dll

2011-06-14 20:32 . 2010-01-25 12:45        329216        ----a-w-        c:\windows\system32\msdrm.dll

2011-06-14 20:32 . 2011-05-02 12:00        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-06-14 20:32 . 2009-04-23 12:43        784896        ----a-w-        c:\windows\system32\rpcrt4.dll

2011-06-14 20:31 . 2009-12-28 12:35        11776        ----a-w-        c:\windows\system32\tsbyuv.dll

2011-06-14 20:31 . 2009-12-28 12:32        22528        ----a-w-        c:\windows\system32\msyuv.dll

2011-06-14 20:31 . 2009-12-28 12:32        31744        ----a-w-        c:\windows\system32\msvidc32.dll

2011-06-14 20:31 . 2009-12-28 12:32        13312        ----a-w-        c:\windows\system32\msrle32.dll

2011-06-14 20:31 . 2009-12-28 12:31        50176        ----a-w-        c:\windows\system32\iyuv_32.dll

2011-06-14 20:31 . 2009-12-28 12:28        91136        ----a-w-        c:\windows\system32\avifil32.dll

2011-06-14 20:31 . 2009-12-28 12:32        123904        ----a-w-        c:\windows\system32\msvfw32.dll

2011-06-14 20:31 . 2009-12-28 12:31        82944        ----a-w-        c:\windows\system32\mciavi32.dll

2011-06-14 20:31 . 2009-12-28 12:28        65024        ----a-w-        c:\windows\system32\avicap32.dll

2011-06-14 20:31 . 2010-12-17 16:43        2067456        ----a-w-        c:\windows\system32\mstscax.dll

2011-06-14 20:31 . 2010-12-17 15:06        677888        ----a-w-        c:\windows\system32\mstsc.exe

2011-06-14 20:31 . 2011-05-02 15:58        738816        ----a-w-        c:\windows\system32\inetcomm.dll

2011-06-14 20:30 . 2010-10-18 14:01        81920        ----a-w-        c:\windows\system32\consent.exe

2011-06-14 20:30 . 2010-01-21 15:59        62464        ----a-w-        c:\windows\system32\l3codeca.acm

2011-06-14 20:28 . 2009-02-13 08:49        1255936        ----a-w-        c:\windows\system32\lsasrv.dll

2011-06-14 20:28 . 2009-03-17 03:38        13824        ----a-w-        c:\windows\system32\apilogen.dll

2011-06-14 20:28 . 2009-03-17 03:38        24064        ----a-w-        c:\windows\system32\amxread.dll

2011-06-14 20:28 . 2009-02-13 08:49        72704        ----a-w-        c:\windows\system32\secur32.dll

2011-06-14 20:08 . 2011-05-24 17:12        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{26E12B43-B7DA-4AC5-8C12-D9BE37F51474}\mpengine.dll

2011-06-14 20:06 . 2009-12-23 12:43        171520        ----a-w-        c:\windows\system32\wintrust.dll

2011-06-14 20:04 . 2010-01-15 00:04        98304        ----a-w-        c:\windows\system32\cabview.dll

2011-06-14 18:44 . 2011-06-14 18:44        --------        d-----w-        c:\users\Michael Wehrmann\AppData\Roaming\Malwarebytes

2011-06-14 18:44 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-14 18:44 . 2011-06-14 18:44        --------        d-----w-        c:\programdata\Malwarebytes

2011-06-14 18:44 . 2011-06-14 18:44        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-06-14 18:23 . 2011-04-14 16:40        142296        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-06-14 18:23 . 2011-04-14 16:40        89048        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2011-06-14 18:23 . 2011-04-14 16:40        781272        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-06-14 18:23 . 2011-04-14 16:40        465880        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2011-06-14 18:23 . 2011-04-14 16:40        1874904        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2011-06-14 18:23 . 2011-04-14 16:40        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2011-06-14 18:23 . 2010-01-01 08:00        1974616        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll

2011-06-14 18:23 . 2010-01-01 08:00        1892184        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-06-12 12:09 . 2011-06-14 15:44        --------        d-----w-        c:\users\Michael Wehrmann\.freemind

2011-06-12 12:08 . 2011-06-12 12:08        --------        d-----w-        c:\program files\FreeMind

2011-06-01 19:44 . 2011-06-14 18:04        --------        d-----w-        c:\program files\ICQ7.5

2011-05-27 07:01 . 2011-05-27 07:01        95672        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppdf32.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-24 17:14 . 2010-12-28 09:55        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-04-14 16:40 . 2011-06-14 18:23        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-12 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-12 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-12 145944]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]

2011-05-29 07:11        449584        ----a-w-        c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2008-10-31 11:06        6609440        ----a-w-        c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe"

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" /hide

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"MobileConnect"=%programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4021776669-3632399173-1879490895-1000]

"EnableNotificationsRef"=dword:00000001

.

R1 vcdrom;Virtual CD-ROM Device Driver;c:\users\Michael Wehrmann\Desktop\diablo 2\VCdRom.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

R3 AVerAF15;AVerMedia BDA Digital Tuner;c:\windows\system32\Drivers\AVerAF15.sys [2007-07-17 269056]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-06-29 112128]

R3 Hecfdiacc;Hecfdiacc; [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-06-29 102912]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-11 9216]

S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2008-06-24 337920]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - BMLoad

.

.

------- Zusätzlicher Suchlauf -------

.

IE: ???QQ??

IE: Free YouTube to Mp3 Converter - c:\users\Michael Wehrmann\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe

LSP: bmnet.dll

DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab

FF - ProfilePath - c:\users\Michael Wehrmann\AppData\Roaming\Mozilla\Firefox\Profiles\a7xxmj5j.default\

FF - prefs.js: browser.startup.homepage - google.de

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

.

------- Dateityp-Verknüpfung -------

.

txtfile=c:\windows\notepad.exe %1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-25108333.sys

AddRemove-Baldur's Gate - c:\windows\IsUn0407.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-06-16 15:49

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]

"OOSAFEERASE03.00.00.01MSWINDOWS"="199BC25A69F7A3CC6F011FCC60EDDAD5D68BCC1C23E915A451C8F266996BAA2C0C92DEA4AC4392DADA1C6909A764657A860B1DEB6F48BC2B69A1444F0762DAE85A79ACE7619F1DA1EBCED03D0978CCDB745C43591319B06CF041F186620DF93DA87EB71D3F8679A63482B8E4B9ADAB51C1C294FD5E850EAF356469E53ADD4B0291F722013155ACF2BBC6163B22696DB481A6FC38571FC73F756BA90DD1AFE493A05FA092D7CD9412FACAF5435DF6D2E238117BA9B758A16AE65B475E9E3DB3CF57517C9506946016E0E57341BE04713E6331A439FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98085D575E7D6A3B9808A9C6AECB7A5D14070B9563DA0D3A042CEBD65DE936C90794DA2849D7FDDC36DC4AAFC7F9B02B0CB9A9DDAB6566DBBD851304BE198EE627E8B96E5C33C9F71320319FD63799EC44C37D0DB26358DF59A97EF32D1A0EC17ED61EBC19558386EB7559E97F31B3DAB46C921E20FC8871ED77B42F35E46760175AAB428EA988085F9B2587F664AC8C35D327F4EE5F91E3A58F739EB778416E1137BC13A39E30A023952BD3C8D0A640ACDEAFD5F0BA80AC3FD52B9068D537B81EF25EA592263F18FD2BB4915379B4D59936D36A48C4D7658C7400B8D083583306D7D2D6E73773594EE6C1E14966E1D28DC46EBEEC348CCBF2D8C9AC4E0B27F4A5F48F64074DFCF5021805CEB2A228E02C3C0FC52BC70BC26E3416E691F89AB96B1B3DF124667FA020D163C568BEFB4BB08E79D4A2BE2F4F0C7A26451FDE1F5ED960BA094A0512313E6BF8159A4DC003E6F5A52546DECC9BEDE6EC8BCED392E68820989156B043A4898014F2CBE6CE1F316E3ED3DF70A875CA74145E4E71C7FA23F79C5EFA72101A43EFB576D1A7F45584B6A462093F7C50ED65F7C91FD386E4E8C9C021BCDA6E563E5C961D59AD7385E8D2E8B6B21DF63FB3BF283B141E0992ACBBB170F6FBC5BF64ADA0C65F9CFD2FFD8CD6991FDD3A7D8FCA6905D7F5FE98D6395149566BF163B08D70B6B79DBF77F2EF66B7E8DADB6A0814B55FE6838B2DE06EB58A5CC44470B36DDA9709DB54260E4C492579EF6686B6EDB7E1117545A95B4EA7775F26FE3C117F6574CD07CDA9A836E1D3917ED776CAEC510D7B7DB610E98FA4B789325A3C033A4BBDD35130923005C71FC46BA18605E996421F515F01C12C5E56D711048ED3587A48C074F495A4D5C7C47B1E2AA33C82CF48492A334431613B439DEB9972E45A154C082B888B9C09DFE57003CA5EDB18F9C8194618449432D3D07EF032CB2A83F1E6F6344D7142C1C386B30E53EE61CE45D306666A1161E4F5B775D3D2222CD99C172BD5976850E85B122A2F042EDE8F96DA565177DB9D03A2934FCBF9A107A952C196D4"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(600)

c:\windows\system32\bmnet.dll

.

Zeit der Fertigstellung: 2011-06-16  15:52:33

ComboFix-quarantined-files.txt  2011-06-16 13:52

.

Vor Suchlauf: 11 Verzeichnis(se), 54.936.539.136 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 54.984.900.608 Bytes frei

.

- - End Of File - - 883343D363376C2F74BC51546F4301A8

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 20:48:30 on 16.06.2011
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 4.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Bytemobile Boot Time Load Driver" (BMLoad) - "Bytemobile, Inc." - C:\Windows\System32\drivers\BMLoad.sys

"Bytemobile Kernel Network Provider" (tcpipBM) - "Bytemobile, Inc." - C:\Windows\system32\drivers\tcpipBM.sys

"catchme" (catchme) - ? - C:\Users\MICHAE~1\AppData\Local\Temp\catchme.sys  (File not found)

"Driver for MagicISO SCSI Host Controller" (mcdbus) - ? - C:\Windows\System32\DRIVERS\mcdbus.sys  (File not found)

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys

"Hecfdiacc" (Hecfdiacc) - ? - C:\Windows\system32\drivers\Hecfdiacc.sys  (File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MBAMProtector" (MBAMProtector) - ? - C:\Windows\system32\drivers\mbam.sys  (File not found)

"MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbamswissarmy.sys

"npkcrypt" (npkcrypt) - ? - D:\Ragnarok\npkcrypt.sys  (File not found)

"SCSK4 Driver Service" (scsk4) - "SoftCamp Co., Inc." - C:\Windows\System32\drivers\scsk4.sys

"Virtual CD-ROM Device Driver" (vcdrom) - ? - C:\Users\Michael Wehrmann\Desktop\diablo 2\VCdRom.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{BD88A479-9623-4897-8546-BC62B9628F44} "SPTHandler" - ? -   (File not found | COM-object registry key not found)

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

{DAF7E6E6-D53A-439A-B28D-12271406B8A9} "RIM AxLoader" - "Research In Motion Limited." - C:\Windows\Downloaded Program Files\axloader.dll / hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Michael Wehrmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - ? - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"Process Monitor" (LVPrcSrv) - "Logitech Inc." - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

"Vodafone Mobile Connect Service" (VMCService) - "Vodafone" - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"BMI over [MSAFD-Tcpip [RAW/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll

"BMI over [MSAFD-Tcpip [TCP/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll

"BMI over [MSAFD-Tcpip [UDP/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

und MBRCheck

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: FUJITSU SIEMENS
BIOS Manufacturer: Phoenix
System Manufacturer: FUJITSU SIEMENS
System Product Name: AMILO Li3710
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 141):
0x8244E000 \SystemRoot\system32\ntkrnlpa.exe
0x8241B000 \SystemRoot\system32\hal.dll
0x8040A000 \SystemRoot\system32\kdcom.dll
0x80412000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80472000 \SystemRoot\system32\PSHED.dll
0x80483000 \SystemRoot\system32\BOOTVID.dll
0x8048B000 \SystemRoot\system32\CLFS.SYS
0x804CC000 \SystemRoot\system32\CI.dll
0x80606000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80682000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068F000 \SystemRoot\system32\drivers\acpi.sys
0x806D5000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806DE000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E6000 \SystemRoot\system32\drivers\pci.sys
0x8070D000 \SystemRoot\System32\drivers\partmgr.sys
0x8071C000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8071F000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x80729000 \SystemRoot\system32\drivers\volmgr.sys
0x80738000 \SystemRoot\System32\drivers\volmgrx.sys
0x80782000 \SystemRoot\System32\drivers\mountmgr.sys
0x80792000 \SystemRoot\system32\drivers\atapi.sys
0x8079A000 \SystemRoot\system32\drivers\ataport.SYS
0x807B8000 \SystemRoot\system32\drivers\msahci.sys
0x807C2000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x805AC000 \SystemRoot\system32\drivers\fltmgr.sys
0x807D0000 \SystemRoot\system32\drivers\fileinfo.sys
0x82A05000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82A76000 \SystemRoot\system32\drivers\ndis.sys
0x82B81000 \SystemRoot\system32\drivers\msrpc.sys
0x82BAC000 \SystemRoot\system32\drivers\NETIO.SYS
0x8A000000 \SystemRoot\System32\drivers\tcpip.sys
0x8A0E9000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8A206000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8A315000 \SystemRoot\system32\drivers\volsnap.sys
0x8A34E000 \SystemRoot\System32\Drivers\spldr.sys
0x8A356000 \SystemRoot\System32\Drivers\mup.sys
0x8A365000 \SystemRoot\System32\drivers\ecache.sys
0x8A38C000 \SystemRoot\system32\drivers\disk.sys
0x8A39D000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8A3BE000 \SystemRoot\system32\drivers\crcdisk.sys
0x8A3C7000 \SystemRoot\system32\drivers\BMLoad.sys
0x8A3EF000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8A104000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8DA03000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8E0E7000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8E186000 \SystemRoot\System32\drivers\watchdog.sys
0x8E193000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8E19E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8E1DC000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8E1EB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8A10D000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8A12F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8A142000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8A14D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8A158000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8A170000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8A3FA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8A17F000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8A188000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8A1B6000 \SystemRoot\system32\DRIVERS\storport.sys
0x82BE6000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8A1F7000 \SystemRoot\System32\Drivers\RootMdm.sys
0x82BF1000 \SystemRoot\system32\drivers\modem.sys
0x807E0000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x805DE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8E20B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8E22E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8E23D000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8E251000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8E266000 \SystemRoot\system32\DRIVERS\hamachi.sys
0x8E26B000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0x8E272000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8E282000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8E284000 \SystemRoot\system32\DRIVERS\ks.sys
0x8E2AE000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8E2B8000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8E2C5000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8E2F9000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8E409000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8E629000 \SystemRoot\system32\drivers\portcls.sys
0x8E656000 \SystemRoot\system32\drivers\drmk.sys
0x8E67B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8E684000 \SystemRoot\System32\Drivers\Null.SYS
0x8E68B000 \SystemRoot\System32\Drivers\Beep.SYS
0x8E69B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8E6A2000 \SystemRoot\System32\drivers\vga.sys
0x8E6AE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8E6CF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8E6D7000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8E6DF000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8E6EA000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8E6F8000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8E701000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8E717000 \SystemRoot\System32\Drivers\tcpipBM.SYS
0x8E71C000 \SystemRoot\system32\DRIVERS\smb.sys
0x8E730000 \SystemRoot\system32\drivers\afd.sys
0x8E778000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8E7AA000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8E7B3000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8E7C9000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8E7D7000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8E315000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8E7EA000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8E351000 \SystemRoot\System32\Drivers\dfsc.sys
0x8E368000 \SystemRoot\system32\drivers\RTSTOR.SYS
0x8E7F4000 \SystemRoot\system32\drivers\USBD.SYS
0x8E7F6000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8E37C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8E400000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8E38C000 \SystemRoot\system32\DRIVERS\RTL8187B.sys
0x8FA03000 \SystemRoot\system32\DRIVERS\udfs.sys
0x8FA3E000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8FA4B000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8FA56000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x81AA0000 \SystemRoot\System32\win32k.sys
0x8FA60000 \SystemRoot\System32\drivers\Dxapi.sys
0x8FA6A000 \SystemRoot\system32\DRIVERS\monitor.sys
0x81CC0000 \SystemRoot\System32\TSDDD.dll
0x81CE0000 \SystemRoot\System32\cdd.dll
0x8FA79000 \SystemRoot\system32\drivers\luafv.sys
0x8FA94000 \SystemRoot\system32\drivers\spsys.sys
0x8FB43000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8FB53000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8FB7D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8FB87000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA9401000 \SystemRoot\system32\drivers\HTTP.sys
0xA946E000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA948B000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA94A4000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA94B9000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA94D8000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA9511000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA9529000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA9550000 \SystemRoot\System32\DRIVERS\srv.sys
0xA959C000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xAE40E000 \SystemRoot\system32\drivers\peauth.sys
0xAE4EC000 \SystemRoot\System32\Drivers\secdrv.SYS
0xAE4F6000 \SystemRoot\System32\drivers\tcpipreg.sys
0xAE502000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0xAE507000 \SystemRoot\system32\DRIVERS\ipnat.sys
0x76F60000 \Windows\System32\ntdll.dll

Processes (total 38):
0 System Idle Process
4 System
428 C:\Windows\System32\smss.exe
544 csrss.exe
588 C:\Windows\System32\wininit.exe
600 csrss.exe
632 C:\Windows\System32\services.exe
668 C:\Windows\System32\lsass.exe
676 C:\Windows\System32\lsm.exe
744 C:\Windows\System32\winlogon.exe
852 C:\Windows\System32\svchost.exe
916 C:\Windows\System32\svchost.exe
960 C:\Windows\System32\svchost.exe
1068 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\svchost.exe
1112 C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
1184 C:\Windows\System32\svchost.exe
1248 C:\Windows\System32\audiodg.exe
1284 C:\Windows\System32\SLsvc.exe
1316 C:\Windows\System32\svchost.exe
1484 C:\Windows\System32\svchost.exe
1732 C:\Windows\System32\spoolsv.exe
1756 C:\Windows\System32\svchost.exe
2012 C:\Windows\System32\dwm.exe
2040 C:\Windows\System32\taskeng.exe
304 C:\Windows\explorer.exe
300 C:\Windows\System32\hkcmd.exe
1028 C:\Windows\System32\igfxpers.exe
1596 C:\Windows\System32\PnkBstrA.exe
2052 C:\Windows\System32\svchost.exe
2228 C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
2380 C:\Windows\System32\igfxsrvc.exe
2940 C:\Windows\System32\alg.exe
192 C:\Windows\System32\taskeng.exe
2028 C:\Program Files\Mozilla Firefox\firefox.exe
3704 C:\Program Files\Mozilla Firefox\plugin-container.exe
2752 C:\Users\Michael Wehrmann\Desktop\osam_autorun_manager_5_0_portable\osam.exe
3112 C:\Users\Michael Wehrmann\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`32900000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000020`78900000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-22UST0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Zitat:

"Hecfdiacc" (Hecfdiacc) - ? - C:\Windows\system32\drivers\Hecfdiacc.sys (File not found)
"npkcrypt" (npkcrypt) - ? - D:\Ragnarok\npkcrypt.sys (File not found)

Bitte mit OSAM deaktivieren und löschen

erledigt.

hier neuer log

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:55:03 on 16.06.2011
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 4.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Bytemobile Boot Time Load Driver" (BMLoad) - "Bytemobile, Inc." - C:\Windows\System32\drivers\BMLoad.sys

"Bytemobile Kernel Network Provider" (tcpipBM) - "Bytemobile, Inc." - C:\Windows\system32\drivers\tcpipBM.sys

"catchme" (catchme) - ? - C:\Users\MICHAE~1\AppData\Local\Temp\catchme.sys  (File not found)

"Driver for MagicISO SCSI Host Controller" (mcdbus) - ? - C:\Windows\System32\DRIVERS\mcdbus.sys  (File not found)

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MBAMProtector" (MBAMProtector) - ? - C:\Windows\system32\drivers\mbam.sys  (File not found)

"MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbamswissarmy.sys

"SCSK4 Driver Service" (scsk4) - "SoftCamp Co., Inc." - C:\Windows\System32\drivers\scsk4.sys

"Virtual CD-ROM Device Driver" (vcdrom) - ? - C:\Users\Michael Wehrmann\Desktop\diablo 2\VCdRom.sys  (File not found)

(Disabled) "Hecfdiacc" (Hecfdiacc) - ? - C:\Windows\system32\drivers\Hecfdiacc.sys  (File not found)

(Disabled) "npkcrypt" (npkcrypt) - ? - D:\Ragnarok\npkcrypt.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{BD88A479-9623-4897-8546-BC62B9628F44} "SPTHandler" - ? -   (File not found | COM-object registry key not found)

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

{DAF7E6E6-D53A-439A-B28D-12271406B8A9} "RIM AxLoader" - "Research In Motion Limited." - C:\Windows\Downloaded Program Files\axloader.dll / hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Michael Wehrmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - ? - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"Process Monitor" (LVPrcSrv) - "Logitech Inc." - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

"Vodafone Mobile Connect Service" (VMCService) - "Vodafone" - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"BMI over [MSAFD-Tcpip [RAW/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll

"BMI over [MSAFD-Tcpip [TCP/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll

"BMI over [MSAFD-Tcpip [UDP/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

erstmal mbam log

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6886

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

18.06.2011 15:50:44
mbam-log-2011-06-18 (15-50-44).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 321068
Laufzeit: 56 Minute(n), 9 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

ich bitte noch um ein wenig geduld für die nächsten scans, sie kommen asap

mittlerweile alles okay und nochmals danke für die hilfe damals. ich bitte nun, den thread zu löschen! vielen dank.

Nein, wir löschen hier keine Stränge

okay, das verstehe ich. kann ich meinen namen aus den logs austragen?

http://www.trojaner-board.de/108422-...-anfragen.html

Wenn genug Zeit da ist, wird sich DaGuru für dich darum kümmern - aber eigentlich ist es nicht unsere Aufgabe nachträglich die Namen zu editieren! Es war DEINE Aufgabe die Logs entsprechend richtig zu editieren und dann erst zu posten!

alles klar. falls es noch klappen sollte, danke ich jedenfalls. machs gut!