Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows-Sicherheitscenterdienst kann nicht gestartet werden (https://www.trojaner-board.de/100773-windows-sicherheitscenterdienst-gestartet.html)

MrL2on 25.06.2011 17:13
Windows-Sicherheitscenterdienst kann nicht gestartet werden
 
Hallo liebes Trojanderboard,

mein Problem ist kurz und knackig beschrieben. Nachdem ich einen Virus und/oder Trojaner auf dem Computer hatte, möchte mein Sicherheitscenterdienst nicht mehr starten. Ich habe schon versucht es über "services.msc" wieder hinzubiegen aber das hilft leider nicht weiter und der Dienst beendet sich wieder nach einigen Sekunden.
Zwei Fakten sind jetzt da,
1. Hier ist schätze ich mal mein letzter ausweg was das Problem betrifft und
2. Ich habe für mein Leben gelernt schätze ich mal und werde Montag definitiv in den nächsten Fachhandel rennen und mir eine Antivirussoftware besorgen.

Malwarebytes Log bezüglich des Virus:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Datenbank Version: 6946
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
25.06.2011 16:23:30
mbam-log-2011-06-25 (16-23-30).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 177486
Laufzeit: 7 Minute(n), 0 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\4ECYTQ9SIC (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\W1WIWQ1NPG (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4ECYTQ9SIC (Trojan.FakeAlert.SA) -> Value: 4ECYTQ9SIC -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\Users\***\AppData\Local\Temp\Rbw.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.
c:\Windows\Temp\ffcb5.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.

defogger:
 
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:37 on 25/06/2011 (***)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-

otl:
OTL Logfile:
OTL Logfile:
Code:
OTL logfile created on: 25.06.2011 17:58:12 - Run 1
OTL by OldTimer - Version 3.2.24.1    Folder = C:\Users\Yannnick\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 6,11 Gb Available Physical Memory | 79,58% Memory free
15,36 Gb Paging File | 13,66 Gb Available in Paging File | 88,98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 47,66 Gb Free Space | 40,67% Space Free | Partition Type: NTFS
Drive D: | 4,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 334,47 Gb Total Space | 248,67 Gb Free Space | 74,35% Space Free | Partition Type: NTFS
 
Computer Name: YANNNICK-PC | User Name: Yannnick | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.25 17:46:48 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Yannnick\Desktop\OTL.exe
PRC - [2011.06.16 06:32:36 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011.05.24 20:43:35 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.05.21 08:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.03.15 21:14:07 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.08.10 11:06:16 | 000,975,952 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.08.10 11:06:16 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010.06.29 01:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010.04.13 19:57:58 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.18 06:57:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.01.29 02:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.25 17:46:48 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Yannnick\Desktop\OTL.exe
MOD - [2011.05.21 08:01:00 | 000,200,808 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWOW64\nvinit.dll
MOD - [2010.11.20 14:21:36 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wkscli.dll
MOD - [2010.11.20 14:18:27 | 000,854,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\dbghelp.dll
MOD - [2010.11.20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010.05.27 05:40:44 | 000,267,632 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\sysenv.dll
MOD - [2010.05.27 05:40:28 | 000,120,176 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll
MOD - [2008.11.12 04:16:38 | 000,133,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\XmlLite.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009.11.02 13:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV - [2011.05.24 20:43:35 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.05.21 08:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.03.15 21:22:56 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.10.28 12:14:30 | 000,357,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.29 01:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.06.11 15:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.05.27 05:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.04.13 19:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 06:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.01.29 02:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Stopped] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.05.21 08:01:00 | 000,027,240 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.05.10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.24 10:57:54 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv)
DRV:64bit: - [2011.03.24 10:57:54 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv)
DRV:64bit: - [2011.02.23 16:50:14 | 000,018,232 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
DRV:64bit: - [2011.02.11 19:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.09.22 03:47:10 | 000,243,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.08.24 19:29:32 | 000,057,936 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2010.08.24 19:29:10 | 000,063,568 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2010.07.09 05:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010.06.21 11:45:56 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010.05.15 15:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.04.20 04:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2010.04.13 19:44:22 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.04.13 12:15:04 | 000,135,560 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2010.02.27 01:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.11.02 13:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009.10.22 13:54:24 | 000,040,464 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\76519412.sys -- (76519412)
DRV:64bit: - [2009.10.09 23:30:56 | 000,352,784 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\7651941.sys -- (setup_9.0.0.722_24.06.2011_21-01drv)
DRV:64bit: - [2009.09.25 17:59:46 | 000,157,712 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\76519411.sys -- (76519411)
DRV:64bit: - [2009.09.17 07:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 05:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 05:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 05:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2011.03.24 10:57:54 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv)
DRV - [2011.03.24 10:57:54 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hiergehtslos.de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
 
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.06.22 15:47:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.06.22 16:19:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.06.14 13:54:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2011.06.14 13:54:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yannnick\AppData\Roaming\mozilla\Extensions
[2011.06.14 13:54:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yannnick\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.06.12 14:18:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yannnick\AppData\Roaming\mozilla\Firefox\Profiles\dppj49sm.default\extensions
[2011.05.26 18:39:00 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Yannnick\AppData\Roaming\mozilla\Firefox\Profiles\dppj49sm.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.22 15:47:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.05.29 18:34:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.05.22 18:21:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011.06.19 14:26:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\YANNNICK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DPPJ49SM.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.06.16 06:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Yannnick\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Yannnick\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.11.21 19:26:21 | 000,000,057 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\Shell\AutoRun\command - "" = D:\OblivionLauncher.exe -- [2006.02.27 16:17:52 | 001,662,976 | R--- | M] (Bethesda Softworks)
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRunCD.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.25 17:46:48 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\Yannnick\Desktop\OTL.exe
[2011.06.25 17:13:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.06.25 17:13:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.06.25 17:13:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.06.25 16:44:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 2
[2011.06.25 16:44:15 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\IObit
[2011.06.25 16:04:38 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\Malwarebytes
[2011.06.25 16:04:35 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.06.25 16:04:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.06.25 16:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.25 16:04:31 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.06.25 16:04:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.06.25 15:55:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2011.06.25 15:54:54 | 000,352,784 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\7651941.sys
[2011.06.25 15:54:54 | 000,157,712 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\76519411.sys
[2011.06.25 15:54:54 | 000,040,464 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\76519412.sys
[2011.06.24 18:35:01 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\Desktop\Cinema 4d
[2011.06.21 23:29:51 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\TS3Client
[2011.06.21 23:29:45 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2011.06.21 23:29:44 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Local\TeamSpeak 3 Client
[2011.06.21 22:57:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\NV
[2011.06.21 22:57:32 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\NV
[2011.06.21 22:56:36 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2011.06.21 22:56:07 | 003,040,872 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll
[2011.06.21 22:56:07 | 000,807,528 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nv3dappshext.dll
[2011.06.21 22:56:07 | 000,326,760 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhotkey.dll
[2011.06.21 22:56:07 | 000,061,544 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll
[2011.06.21 22:56:07 | 000,053,864 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nv3dappshextr.dll
[2011.06.21 22:56:06 | 006,300,776 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll
[2011.06.21 22:56:06 | 002,560,616 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll
[2011.06.21 22:56:05 | 000,739,432 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\easyupdatusapiu64.dll
[2011.06.21 22:56:05 | 000,117,864 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll
[2011.06.21 22:55:56 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2011.06.21 22:53:51 | 022,286,952 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2011.06.21 22:53:51 | 018,583,144 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2011.06.21 22:53:51 | 016,456,296 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2011.06.21 22:53:51 | 015,223,912 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2011.06.21 22:53:51 | 013,011,560 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2011.06.21 22:53:51 | 011,992,680 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll
[2011.06.21 22:53:51 | 008,863,336 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2011.06.21 22:53:51 | 007,123,560 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2011.06.21 22:53:51 | 006,555,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll
[2011.06.21 22:53:51 | 005,301,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2011.06.21 22:53:51 | 002,943,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2011.06.21 22:53:51 | 002,804,328 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2011.06.21 22:53:51 | 002,644,584 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll
[2011.06.21 22:53:51 | 002,335,848 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll
[2011.06.21 22:53:51 | 002,212,968 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll
[2011.06.21 22:53:51 | 002,082,408 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll
[2011.06.21 22:53:51 | 001,496,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6420150.dll
[2011.06.21 22:53:51 | 001,427,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco642090.dll
[2011.06.21 22:53:51 | 000,833,640 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll
[2011.06.21 22:53:51 | 000,694,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll
[2011.06.21 22:53:51 | 000,366,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoptimusmft.dll
[2011.06.21 22:53:51 | 000,362,600 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdecodemft.dll
[2011.06.21 22:53:51 | 000,326,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoptimusmft.dll
[2011.06.21 22:53:51 | 000,300,136 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvdecodemft.dll
[2011.06.21 22:53:51 | 000,239,720 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll
[2011.06.21 22:53:51 | 000,200,808 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll
[2011.06.21 22:53:51 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011.06.21 22:53:51 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011.06.21 22:53:51 | 000,027,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvpciflt.sys
[2011.06.21 22:53:51 | 000,012,392 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvBridge.kmd
[2011.06.21 16:07:55 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ
[2011.06.21 16:07:54 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\Documents\VirtualDJ
[2011.06.21 16:07:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VirtualDJ
[2011.06.19 14:26:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.06.18 17:44:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager
[2011.06.16 20:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks
[2011.06.16 20:05:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bethesda Softworks
[2011.06.16 20:05:29 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Local\Oblivion
[2011.06.15 16:07:47 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.06.15 16:07:46 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011.06.15 16:07:46 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.06.15 16:07:46 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.06.15 16:07:41 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2011.06.14 13:54:05 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\Thunderbird
[2011.06.14 13:54:05 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Local\Thunderbird
[2011.06.14 13:54:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird
[2011.06.14 13:54:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2011.06.10 19:38:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.06.10 19:37:57 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2011.06.10 19:37:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011.06.10 19:37:57 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2011.06.08 14:59:54 | 000,178,800 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2011.06.08 14:56:48 | 000,000,000 | -H-D | C] -- C:\ProgramData\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
[2011.06.08 14:38:48 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Local\Downloaded Installations
[2011.06.07 15:24:10 | 000,000,000 | ---D | C] -- C:\ProgramData\PopCap Games
[2011.06.06 22:01:10 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\Desktop\Musik
[2011.06.05 23:40:19 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.06.01 14:24:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Western Digital Corporation
[2011.05.29 21:58:21 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\OpenOffice.org
[2011.05.29 18:35:06 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011.05.29 18:34:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2011.05.28 19:04:16 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonBJ
[2011.05.28 18:31:24 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Roaming\gtk-2.0
[2011.05.28 18:31:24 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\.thumbnails
[2011.05.28 18:30:13 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\Documents\gegl-0.0
[2011.05.28 18:30:13 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\.gimp-2.6
[2011.05.28 18:30:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP
[2011.05.28 18:30:03 | 000,000,000 | ---D | C] -- C:\Programme\GIMP-2.0
[2011.05.26 18:38:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Plasmoo
[2011.05.26 18:38:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2011.05.26 18:38:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2011.05.26 18:38:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2011.05.26 18:36:27 | 000,000,000 | ---D | C] -- C:\Users\Yannnick\AppData\Local\Diagnostics
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.25 17:58:27 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.25 17:58:27 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.25 17:51:15 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Zlildhmurb.job
[2011.06.25 17:51:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.25 17:51:05 | 1888,518,143 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.25 17:46:48 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Yannnick\Desktop\OTL.exe
[2011.06.25 17:36:10 | 000,000,000 | ---- | M] () -- C:\Users\Yannnick\defogger_reenable
[2011.06.25 17:35:30 | 000,050,477 | ---- | M] () -- C:\Users\Yannnick\Desktop\Defogger.exe
[2011.06.25 17:13:11 | 000,001,262 | ---- | M] () -- C:\Users\Yannnick\Desktop\Spybot - Search & Destroy.lnk
[2011.06.25 16:38:08 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011.06.25 16:34:50 | 000,664,634 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.06.25 16:34:50 | 000,624,776 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.06.25 16:34:50 | 000,134,770 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.06.25 16:34:50 | 000,110,414 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.06.25 16:03:37 | 001,555,756 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.24 20:31:56 | 000,163,840 | RHS- | M] () -- C:\Windows\SysWow64\NOISE1.dll
[2011.06.24 18:38:31 | 000,234,536 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.06.24 18:38:31 | 000,234,536 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.06.24 14:21:36 | 000,234,536 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.06.21 22:55:16 | 000,292,952 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.06.18 19:44:58 | 000,000,023 | ---- | M] () -- C:\Windows\BlendSettings.ini
[2011.06.15 16:12:34 | 001,548,682 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.06.15 16:01:39 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.06.12 16:45:27 | 000,000,465 | R--- | M] () -- C:\Users\Yannnick\Desktop\Video.con
[2011.06.08 14:59:54 | 000,178,800 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2011.06.08 14:38:52 | 000,006,936 | ---- | M] () -- C:\Windows\SysWow64\ealregsnapshot1.reg
[2011.05.31 20:02:55 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,025,912 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.05.28 19:10:19 | 000,003,355 | ---- | M] () -- C:\Users\Yannnick\.recently-used.xbel
 
========== Files Created - No Company Name ==========
 
[2011.06.25 17:36:10 | 000,000,000 | ---- | C] () -- C:\Users\Yannnick\defogger_reenable
[2011.06.25 17:35:29 | 000,050,477 | ---- | C] () -- C:\Users\Yannnick\Desktop\Defogger.exe
[2011.06.25 17:13:11 | 000,001,262 | ---- | C] () -- C:\Users\Yannnick\Desktop\Spybot - Search & Destroy.lnk
[2011.06.25 16:44:15 | 000,032,136 | ---- | C] () -- C:\Windows\SysNative\SmartDefragBootTime.exe
[2011.06.25 16:44:15 | 000,018,232 | ---- | C] () -- C:\Windows\SysNative\drivers\SmartDefragDriver.sys
[2011.06.25 16:04:14 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011.06.24 20:31:56 | 000,163,840 | RHS- | C] () -- C:\Windows\SysWow64\NOISE1.dll
[2011.06.24 20:31:56 | 000,000,304 | -HS- | C] () -- C:\Windows\tasks\Zlildhmurb.job
[2011.06.24 15:14:18 | 000,000,465 | R--- | C] () -- C:\Users\Yannnick\Desktop\Video.con
[2011.06.21 22:56:07 | 001,283,212 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin
[2011.06.21 22:53:51 | 000,007,384 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2011.06.16 20:34:18 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2011.06.08 14:38:52 | 000,006,936 | ---- | C] () -- C:\Windows\SysWow64\ealregsnapshot1.reg
[2011.05.31 20:02:55 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.05.28 19:10:19 | 000,003,355 | ---- | C] () -- C:\Users\Yannnick\.recently-used.xbel
[2011.05.24 20:22:53 | 000,000,331 | ---- | C] () -- C:\Windows\game.ini
[2011.05.22 20:18:47 | 000,073,216 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2011.05.21 16:30:46 | 000,000,096 | ---- | C] () -- C:\Users\Yannnick\AppData\Local\fusioncache.dat
[2011.05.21 11:43:22 | 001,555,756 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.05.21 11:40:48 | 000,234,536 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.05.21 11:40:47 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.05.21 11:40:47 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.05.21 11:01:25 | 002,340,992 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2011.05.21 11:01:25 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2011.05.21 11:01:25 | 000,018,048 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2011.05.21 11:01:25 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2011.05.21 11:01:25 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2011.05.20 18:02:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.04.17 21:57:54 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2011.03.15 21:14:12 | 000,206,208 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2011.03.15 21:14:12 | 000,113,264 | ---- | C] () -- C:\Windows\FixUVC.exe
[2011.03.15 21:14:12 | 000,000,321 | ---- | C] () -- C:\Windows\PidList_C.ini
[2011.02.11 19:15:08 | 000,874,048 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2010.11.17 15:30:01 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2010.11.17 14:56:27 | 000,017,920 | ---- | C] () -- C:\Windows\SysWow64\rpcnetp.dll
[2010.11.17 14:55:51 | 000,017,920 | ---- | C] () -- C:\Windows\SysWow64\rpcnetp.exe
[2010.11.17 14:48:14 | 000,104,796 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2010.11.17 14:48:11 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011.05.22 17:09:28 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.05.28 19:10:19 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\gtk-2.0
[2011.06.25 16:44:15 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\IObit
[2011.05.21 13:39:44 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\Leadertech
[2011.05.29 21:58:21 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\OpenOffice.org
[2011.05.22 20:41:35 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\Publish Providers
[2011.05.20 19:44:38 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\Simfy
[2011.05.23 13:33:58 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\Sony
[2011.05.22 21:21:30 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\TeamViewer
[2011.06.14 13:54:06 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\Thunderbird
[2011.06.21 23:32:06 | 000,000,000 | ---D | M] -- C:\Users\Yannnick\AppData\Roaming\TS3Client
[2009.07.14 07:08:49 | 000,029,106 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.06.25 17:51:15 | 000,000,304 | -HS- | M] () -- C:\Windows\Tasks\Zlildhmurb.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:05EE1EEF

< End of report >
--- --- ---

--- --- ---


otl extra:
OTL Logfile:
OTL Logfile:
Code:
OTL Extras logfile created on: 25.06.2011 17:58:12 - Run 1
OTL by OldTimer - Version 3.2.24.1    Folder = C:\Users\Yannnick\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 6,11 Gb Available Physical Memory | 79,58% Memory free
15,36 Gb Paging File | 13,66 Gb Available in Paging File | 88,98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 47,66 Gb Free Space | 40,67% Space Free | Partition Type: NTFS
Drive D: | 4,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 334,47 Gb Total Space | 248,67 Gb Free Space | 74,35% Space Free | Partition Type: NTFS
 
Computer Name: YANNNICK-PC | User Name: Yannnick | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{28D73032-5DAA-4F83-B154-85105DBCCB92}" = iTunes
"{2E0DCF0F-7754-11E0-BFE1-0013D3D69929}" = Vegas Pro 10.0 (64-bit)
"{348207D1-7754-11E0-9BC0-0013D3D69929}" = MSVCRT Redists
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Überwachungstool für die Intel® Turbo-Boost-Technik
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.3.5
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.3.5
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Elantech" = ETDWare PS/2-x64 7.0.6.5_WHQL
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"sp6" = Logitech SetPoint 6.22
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR 4.00 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{19192A84-6172-4312-A661-D8F9A34585AB}" = VirtualDJ Home FREE
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 26
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{674C4CFD-FC45-921A-95A3-6F473BA050F9}" = simfy
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.5 MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}" = Acer Crystal Eye webcam Ver:1.1.199.107
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"1489-3350-5074-6281" = JDownloader 0.9
"Acer Screensaver" = Acer ScreenSaver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AutoHotkey" = AutoHotkey 1.0.48.05
"Crysis WARHEAD(R)" = Crysis WARHEAD(R)
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 8.0.1 Home Edition
"Fraps" = Fraps (remove only)
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.38.517
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"Mozilla Firefox 5.0 (x86 de)" = Mozilla Firefox 5.0 (x86 de)
"Mozilla Thunderbird (3.1.10)" = Mozilla Thunderbird (3.1.10)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"Oblivion mod manager_is1" = Oblivion mod manager 1.1.9
"PunkBusterSvc" = PunkBuster Services
"Simfy" = simfy
"Smart Defrag 2_is1" = Smart Defrag 2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"WinLiveSuite" = Windows Live Essentials
"Xfire" = Xfire (remove only)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 09.06.2011 12:53:31 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 10.06.2011 12:06:43 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 11.06.2011 14:40:02 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 14.06.2011 08:06:42 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 14.06.2011 10:03:58 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 15.06.2011 10:08:05 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 15.06.2011 10:08:30 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 15.06.2011 10:11:55 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 16.06.2011 14:05:54 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
Error - 16.06.2011 14:05:54 | Computer Name = Yannnick-PC | Source = System Restore | ID = 8193
Description =
 
[ System Events ]
Error - 19.06.2011 08:21:25 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 19.06.2011 14:20:30 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 21.06.2011 08:48:14 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 21.06.2011 16:56:12 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 21.06.2011 16:58:32 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 22.06.2011 09:39:50 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 22.06.2011 10:03:02 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 22.06.2011 10:21:06 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 22.06.2011 13:13:02 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10016
Description =
 
Error - 22.06.2011 13:13:52 | Computer Name = Yannnick-PC | Source = DCOM | ID = 10010
Description =
 
 
< End of report >
--- --- ---

--- --- ---


Vielen Dank im Voraus und einen schönen Samstag wünsche ich!

Liebe Grüße, Leon

Ps: Wie solle ich die Logs am besten posten, oder wie habt Ihr es am liebsten?

cosinus 25.06.2011 17:31
Zitat:
Art des Suchlaufs: Quick-Scan
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

MrL2on 25.06.2011 18:15
So, hier noch einmal der vollständige Durchlauf

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Datenbank Version: 6946
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
25.06.2011 16:53:06
mbam-log-2011-06-25 (16-53-06).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\
Durchsuchte Objekte: 115871
Laufzeit: 19 Minute(n), 9 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Liebe Grüße, Leon

MrL2on 25.06.2011 19:23
Oh ergänzend dazu wollte ich nur noch kurz anmerken das sich mister google redirect auch noch zu erkennen gegeben hat ;)

cosinus 25.06.2011 20:56
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.11.21 19:26:21 | 000,000,057 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\Shell\AutoRun\command - "" = D:\OblivionLauncher.exe -- [2006.02.27 16:17:52 | 001,662,976 | R--- | M] (Bethesda Softworks)
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRunCD.exe
[2011.06.25 17:51:15 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Zlildhmurb.job
[2011.06.24 20:31:56 | 000,163,840 | RHS- | C] () -- C:\Windows\SysWow64\NOISE1.dll
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:05EE1EEF

:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

MrL2on 25.06.2011 21:16
Okay, du hast einen Menschen gerade sehr sehr glücklich gemacht!

Ich sah mein neues notebook schon platt...

Verdammt, das ist echt klasse von dir das du so schnell helfen konntest, Ich danke dir vielmals!
scheint alles zu funktionieren, Dienste lassen sich starten und beenden sich auch nicht wieder sowie google ;).

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun
File move failed. D:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ not found.
File move failed. D:\OblivionLauncher.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
File D:\AutoRunCD.exe not found.
C:\Windows\Tasks\Zlildhmurb.job moved successfully.
C:\Windows\SysWOW64\NOISE1.dll moved successfully.
ADS C:\ProgramData\Temp:05EE1EEF deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.24.1 log created on 06252011_220624
Files\Folders moved on Reboot...
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\OblivionLauncher.exe scheduled to be moved on reboot.
Registry entries deleted on Reboot...

muss ich abschliessend noch was wissen und kann ich den defogger wieder benutzen ?

Liebe Grüße und tausend Dank, Leon

cosinus 25.06.2011 21:22
Bitte die Logs nicht in TABLE-Tags sondern in CODE-Tags posten! Wie kommst du auf TABLE? :wtf:

MrL2on 25.06.2011 21:33
Yes Sir

Code:
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. D:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ccdb175-4f35-11e0-bf24-806e6f6e6963}\ not found.
File move failed. D:\OblivionLauncher.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
File D:\AutoRunCD.exe not found.
C:\Windows\Tasks\Zlildhmurb.job moved successfully.
C:\Windows\SysWOW64\NOISE1.dll moved successfully.
ADS C:\ProgramData\Temp:05EE1EEF deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.24.1 log created on 06252011_220624

Files\Folders moved on Reboot...
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\OblivionLauncher.exe scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 26.06.2011 11:39
Ich brauch den Quarantäneordner von OTL. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner MovedFiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

MrL2on 26.06.2011 13:30
Ist hochgeladen und sollte nun zu finden sein!

cosinus 26.06.2011 14:11
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

MrL2on 28.06.2011 15:52
Code:
2011/06/28 16:50:28.0131 3756        TDSS rootkit removing tool 2.5.7.0 Jun 28 2011 13:21:55
2011/06/28 16:50:28.0340 3756        ================================================================================
2011/06/28 16:50:28.0341 3756        SystemInfo:
2011/06/28 16:50:28.0341 3756       
2011/06/28 16:50:28.0341 3756        OS Version: 6.1.7601 ServicePack: 1.0
2011/06/28 16:50:28.0341 3756        Product type: Workstation
2011/06/28 16:50:28.0341 3756        ComputerName: YANNNICK-PC
2011/06/28 16:50:28.0341 3756        UserName: Yannnick
2011/06/28 16:50:28.0341 3756        Windows directory: C:\Windows
2011/06/28 16:50:28.0341 3756        System windows directory: C:\Windows
2011/06/28 16:50:28.0341 3756        Running under WOW64
2011/06/28 16:50:28.0341 3756        Processor architecture: Intel x64
2011/06/28 16:50:28.0341 3756        Number of processors: 4
2011/06/28 16:50:28.0341 3756        Page size: 0x1000
2011/06/28 16:50:28.0341 3756        Boot type: Normal boot
2011/06/28 16:50:28.0341 3756        ================================================================================
2011/06/28 16:50:28.0950 3756        Initialize success
2011/06/28 16:50:33.0041 4508        ================================================================================
2011/06/28 16:50:33.0041 4508        Scan started
2011/06/28 16:50:33.0041 4508        Mode: Manual;
2011/06/28 16:50:33.0041 4508        ================================================================================
2011/06/28 16:50:33.0551 4508        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
2011/06/28 16:50:33.0686 4508        76519411        (6c5461eeb3ffa1b1dcf9a07f8c3b3afe) C:\Windows\system32\DRIVERS\76519411.sys
2011/06/28 16:50:33.0807 4508        76519412        (3ec7dfda521b4fb22ce9f76df15db099) C:\Windows\system32\DRIVERS\76519412.sys
2011/06/28 16:50:33.0922 4508        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
2011/06/28 16:50:34.0033 4508        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
2011/06/28 16:50:34.0155 4508        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/06/28 16:50:34.0285 4508        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/06/28 16:50:34.0400 4508        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/06/28 16:50:34.0531 4508        AFD            (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
2011/06/28 16:50:34.0658 4508        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
2011/06/28 16:50:34.0770 4508        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
2011/06/28 16:50:34.0882 4508        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
2011/06/28 16:50:35.0007 4508        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/06/28 16:50:35.0120 4508        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/06/28 16:50:35.0214 4508        amdsata        (6ec6d772eae38dc17c14aed9b178d24b) C:\Windows\system32\drivers\amdsata.sys
2011/06/28 16:50:35.0328 4508        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/06/28 16:50:35.0426 4508        amdxata        (1142a21db581a84ea5597b03a26ebaa0) C:\Windows\system32\drivers\amdxata.sys
2011/06/28 16:50:35.0536 4508        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
2011/06/28 16:50:35.0677 4508        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/06/28 16:50:35.0790 4508        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/06/28 16:50:35.0912 4508        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/28 16:50:36.0016 4508        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
2011/06/28 16:50:36.0166 4508        athr            (e642491f64e58cd5bc8fb8b347dcf65f) C:\Windows\system32\DRIVERS\athrx.sys
2011/06/28 16:50:36.0367 4508        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/06/28 16:50:36.0514 4508        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/06/28 16:50:36.0787 4508        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/06/28 16:50:36.0921 4508        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/06/28 16:50:37.0050 4508        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/28 16:50:37.0172 4508        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/06/28 16:50:37.0283 4508        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/06/28 16:50:37.0416 4508        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/06/28 16:50:37.0528 4508        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/06/28 16:50:37.0650 4508        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/06/28 16:50:37.0773 4508        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/06/28 16:50:37.0898 4508        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/06/28 16:50:38.0033 4508        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/28 16:50:38.0167 4508        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
2011/06/28 16:50:38.0306 4508        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/06/28 16:50:38.0418 4508        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/06/28 16:50:38.0559 4508        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/28 16:50:38.0631 4508        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
2011/06/28 16:50:38.0736 4508        CNG            (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
2011/06/28 16:50:38.0877 4508        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/28 16:50:38.0998 4508        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
2011/06/28 16:50:39.0124 4508        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/06/28 16:50:39.0258 4508        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
2011/06/28 16:50:39.0368 4508        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/06/28 16:50:39.0480 4508        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/06/28 16:50:39.0599 4508        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/06/28 16:50:39.0783 4508        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/28 16:50:39.0942 4508        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/06/28 16:50:40.0172 4508        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/06/28 16:50:40.0312 4508        epmntdrv        (9eafb3b3b60b8ad958985152a9309aca) C:\Windows\system32\epmntdrv.sys
2011/06/28 16:50:40.0441 4508        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
2011/06/28 16:50:40.0568 4508        ETD            (0975bf32399a24117e317b5bf1d5d0aa) C:\Windows\system32\DRIVERS\ETD.sys
2011/06/28 16:50:40.0678 4508        EuGdiDrv        (fb949ed2c93c878a189039f3d7730942) C:\Windows\system32\EuGdiDrv.sys
2011/06/28 16:50:40.0766 4508        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/06/28 16:50:40.0798 4508        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/06/28 16:50:40.0937 4508        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/28 16:50:41.0053 4508        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/06/28 16:50:41.0074 4508        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/06/28 16:50:41.0217 4508        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/28 16:50:41.0338 4508        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
2011/06/28 16:50:41.0458 4508        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/06/28 16:50:41.0547 4508        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/28 16:50:41.0677 4508        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/06/28 16:50:41.0772 4508        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/06/28 16:50:41.0911 4508        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/06/28 16:50:42.0044 4508        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/06/28 16:50:42.0181 4508        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
2011/06/28 16:50:42.0364 4508        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
2011/06/28 16:50:42.0552 4508        HECIx64        (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
2011/06/28 16:50:42.0701 4508        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/06/28 16:50:42.0836 4508        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/06/28 16:50:42.0972 4508        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/06/28 16:50:43.0133 4508        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/28 16:50:43.0281 4508        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
2011/06/28 16:50:43.0442 4508        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
2011/06/28 16:50:43.0600 4508        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
2011/06/28 16:50:43.0758 4508        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
2011/06/28 16:50:43.0899 4508        iaStor          (1384872112e8e7fd5786eceb8bddf4c9) C:\Windows\system32\DRIVERS\iaStor.sys
2011/06/28 16:50:44.0080 4508        iaStorV        (3df4395a7cf8b7a72a5f4606366b8c2d) C:\Windows\system32\drivers\iaStorV.sys
2011/06/28 16:50:44.0458 4508        igfx            (c6238c6abd6ac99f5d152da4e9439a3d) C:\Windows\system32\DRIVERS\igdkmd64.sys
2011/06/28 16:50:44.0788 4508        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/06/28 16:50:44.0927 4508        Impcd          (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys
2011/06/28 16:50:45.0101 4508        IntcAzAudAddService (235362d403d9d677514649d88db31914) C:\Windows\system32\drivers\RTKVHD64.sys
2011/06/28 16:50:45.0246 4508        IntcDAud        (03c74719d48056a1078f3a51ceb76baa) C:\Windows\system32\DRIVERS\IntcDAud.sys
2011/06/28 16:50:45.0377 4508        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
2011/06/28 16:50:45.0500 4508        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/28 16:50:45.0636 4508        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/06/28 16:50:45.0770 4508        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
2011/06/28 16:50:45.0895 4508        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/06/28 16:50:46.0055 4508        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/06/28 16:50:46.0184 4508        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
2011/06/28 16:50:46.0307 4508        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
2011/06/28 16:50:46.0458 4508        k57nd60a        (37e053a2cf8f0082b689ed74106e0cec) C:\Windows\system32\DRIVERS\k57nd60a.sys
2011/06/28 16:50:46.0600 4508        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/28 16:50:46.0739 4508        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/28 16:50:46.0880 4508        KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/28 16:50:47.0020 4508        KSecPkg        (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
2011/06/28 16:50:47.0163 4508        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/06/28 16:50:47.0349 4508        LHidFilt        (24e09882ba51b9830ae029888a3aaf18) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2011/06/28 16:50:47.0486 4508        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/28 16:50:47.0650 4508        LMouFilt        (2f94325d8c10e2b715f3d753c2422aac) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2011/06/28 16:50:47.0815 4508        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/06/28 16:50:47.0963 4508        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/06/28 16:50:48.0120 4508        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/06/28 16:50:48.0278 4508        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/06/28 16:50:48.0409 4508        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/06/28 16:50:48.0537 4508        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/06/28 16:50:48.0679 4508        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/06/28 16:50:48.0823 4508        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/06/28 16:50:48.0974 4508        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/28 16:50:49.0109 4508        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
2011/06/28 16:50:49.0248 4508        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/28 16:50:49.0377 4508        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
2011/06/28 16:50:49.0521 4508        MpFilter        (e6ba8e5a4a871899e23d64573ef58ee9) C:\Windows\system32\DRIVERS\MpFilter.sys
2011/06/28 16:50:49.0638 4508        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
2011/06/28 16:50:49.0787 4508        MpNWMon        (98b09a4f2c462441030b83a80a3f6fb3) C:\Windows\system32\DRIVERS\MpNWMon.sys
2011/06/28 16:50:49.0923 4508        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/28 16:50:50.0072 4508        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
2011/06/28 16:50:50.0203 4508        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/28 16:50:50.0344 4508        mrxsmb10        (2086d463bd371d8a37d153897430916d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/28 16:50:50.0484 4508        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/28 16:50:50.0615 4508        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
2011/06/28 16:50:50.0768 4508        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
2011/06/28 16:50:50.0919 4508        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/06/28 16:50:51.0097 4508        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/06/28 16:50:51.0259 4508        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
2011/06/28 16:50:51.0454 4508        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/28 16:50:51.0666 4508        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/28 16:50:51.0890 4508        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/06/28 16:50:52.0190 4508        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
2011/06/28 16:50:52.0468 4508        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
2011/06/28 16:50:52.0747 4508        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/06/28 16:50:53.0088 4508        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/06/28 16:50:53.0369 4508        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/06/28 16:50:53.0536 4508        mwlPSDFilter    (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
2011/06/28 16:50:53.0681 4508        mwlPSDNServ    (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
2011/06/28 16:50:53.0837 4508        mwlPSDVDisk    (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
2011/06/28 16:50:54.0007 4508        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/28 16:50:54.0182 4508        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
2011/06/28 16:50:54.0333 4508        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/06/28 16:50:54.0491 4508        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/28 16:50:54.0662 4508        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/28 16:50:54.0807 4508        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/28 16:50:54.0949 4508        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
2011/06/28 16:50:55.0084 4508        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/28 16:50:55.0271 4508        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/28 16:50:55.0526 4508        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/06/28 16:50:55.0797 4508        NisDrv          (3713e8452b88d3e0be095e06b6fbc776) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
2011/06/28 16:50:55.0959 4508        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/06/28 16:50:56.0059 4508        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/28 16:50:56.0191 4508        Ntfs            (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\Windows\system32\drivers\Ntfs.sys
2011/06/28 16:50:56.0358 4508        NTIDrvr        (ee3ba1024594d5d09e314f206b94069e) C:\Windows\system32\drivers\NTIDrvr.sys
2011/06/28 16:50:56.0480 4508        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/06/28 16:50:56.0961 4508        nvlddmkm        (b34e9bfbd9c61048ef6281c3e7ec210a) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/06/28 16:50:57.0107 4508        nvpciflt        (88b625725a297e638b8bc55334d75020) C:\Windows\system32\DRIVERS\nvpciflt.sys
2011/06/28 16:50:57.0218 4508        nvraid          (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\Windows\system32\drivers\nvraid.sys
2011/06/28 16:50:57.0325 4508        nvstor          (f7cd50fe7139f07e77da8ac8033d1832) C:\Windows\system32\drivers\nvstor.sys
2011/06/28 16:50:57.0448 4508        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
2011/06/28 16:50:57.0554 4508        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
2011/06/28 16:50:57.0656 4508        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/06/28 16:50:57.0751 4508        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
2011/06/28 16:50:57.0850 4508        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
2011/06/28 16:50:58.0058 4508        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
2011/06/28 16:50:58.0248 4508        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/06/28 16:50:58.0455 4508        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/06/28 16:50:58.0587 4508        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/06/28 16:50:58.0780 4508        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/28 16:50:58.0864 4508        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/06/28 16:50:58.0985 4508        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/28 16:50:59.0095 4508        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/06/28 16:50:59.0226 4508        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/06/28 16:50:59.0333 4508        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/28 16:50:59.0449 4508        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/28 16:50:59.0572 4508        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/06/28 16:50:59.0704 4508        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/28 16:50:59.0948 4508        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/28 16:51:00.0250 4508        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/28 16:51:00.0509 4508        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/28 16:51:00.0932 4508        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/06/28 16:51:01.0254 4508        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/28 16:51:01.0521 4508        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/28 16:51:01.0976 4508        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/06/28 16:51:02.0277 4508        RDPWD          (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
2011/06/28 16:51:02.0540 4508        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
2011/06/28 16:51:03.0313 4508        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/28 16:51:03.0507 4508        RSUSBSTOR      (0e3dcf76f11dc431b088a2dfd7265cda) C:\Windows\system32\Drivers\RtsUStor.sys
2011/06/28 16:51:03.0737 4508        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
2011/06/28 16:51:03.0915 4508        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
2011/06/28 16:51:04.0080 4508        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/06/28 16:51:04.0210 4508        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/06/28 16:51:04.0322 4508        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/06/28 16:51:04.0441 4508        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/06/28 16:51:04.0621 4508        setup_9.0.0.722_24.06.2011_21-01drv (8423db42808e94847ec4e53efda6bee2) C:\Windows\system32\DRIVERS\7651941.sys
2011/06/28 16:51:04.0719 4508        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
2011/06/28 16:51:04.0816 4508        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/28 16:51:04.0912 4508        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/28 16:51:05.0323 4508        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/06/28 16:51:05.0436 4508        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/06/28 16:51:05.0548 4508        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/06/28 16:51:05.0651 4508        SmartDefragDriver (94ce7845af6a2065b829e0126cd56236) C:\Windows\system32\Drivers\SmartDefragDriver.sys
2011/06/28 16:51:05.0763 4508        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/06/28 16:51:05.0880 4508        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/06/28 16:51:05.0988 4508        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
2011/06/28 16:51:06.0213 4508        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/28 16:51:06.0425 4508        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/28 16:51:06.0598 4508        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/06/28 16:51:06.0726 4508        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
2011/06/28 16:51:06.0883 4508        Tcpip          (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\drivers\tcpip.sys
2011/06/28 16:51:07.0071 4508        TCPIP6          (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/28 16:51:07.0179 4508        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/28 16:51:07.0277 4508        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/06/28 16:51:07.0369 4508        TDTCP          (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/06/28 16:51:07.0478 4508        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/28 16:51:07.0582 4508        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
2011/06/28 16:51:07.0737 4508        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/28 16:51:07.0860 4508        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
2011/06/28 16:51:07.0976 4508        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/28 16:51:08.0081 4508        TurboB          (825e7a1f48fb8bcfba27c178aab4e275) C:\Windows\system32\DRIVERS\TurboB.sys
2011/06/28 16:51:08.0180 4508        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/06/28 16:51:08.0210 4508        UBHelper        (a17d5e1a6df4eab0a480f2c490de4c9d) C:\Windows\system32\drivers\UBHelper.sys
2011/06/28 16:51:08.0262 4508        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/28 16:51:08.0358 4508        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/28 16:51:08.0421 4508        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/28 16:51:08.0558 4508        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/06/28 16:51:08.0658 4508        USBAAPL64      (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
2011/06/28 16:51:08.0894 4508        usbccgp        (481dff26b4dca8f4cbac1f7dce1d6829) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/28 16:51:09.0052 4508        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
2011/06/28 16:51:09.0213 4508        usbehci        (74ee782b1d9c241efe425565854c661c) C:\Windows\system32\drivers\usbehci.sys
2011/06/28 16:51:09.0469 4508        usbhub          (dc96bd9ccb8403251bcf25047573558e) C:\Windows\system32\drivers\usbhub.sys
2011/06/28 16:51:09.0623 4508        usbohci        (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\drivers\usbohci.sys
2011/06/28 16:51:09.0765 4508        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/28 16:51:09.0866 4508        USBSTOR        (d76510cfa0fc09023077f22c2f979d86) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/28 16:51:09.0955 4508        usbuhci        (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\drivers\usbuhci.sys
2011/06/28 16:51:10.0070 4508        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
2011/06/28 16:51:10.0182 4508        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
2011/06/28 16:51:10.0296 4508        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/28 16:51:10.0326 4508        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/06/28 16:51:10.0427 4508        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
2011/06/28 16:51:10.0453 4508        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
2011/06/28 16:51:10.0556 4508        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
2011/06/28 16:51:10.0596 4508        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
2011/06/28 16:51:10.0712 4508        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
2011/06/28 16:51:10.0750 4508        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/06/28 16:51:10.0848 4508        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
2011/06/28 16:51:10.0960 4508        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
2011/06/28 16:51:11.0040 4508        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/06/28 16:51:11.0144 4508        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/28 16:51:11.0158 4508        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/28 16:51:11.0266 4508        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/06/28 16:51:11.0350 4508        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/28 16:51:11.0493 4508        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/06/28 16:51:11.0575 4508        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/06/28 16:51:11.0753 4508        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/06/28 16:51:12.0060 4508        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
2011/06/28 16:51:12.0250 4508        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/28 16:51:12.0356 4508        WSDPrintDevice  (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
2011/06/28 16:51:12.0466 4508        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
2011/06/28 16:51:12.0556 4508        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/28 16:51:12.0613 4508        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/06/28 16:51:12.0636 4508        Boot (0x1200)  (38a643d27b3ca1ddf934c56b3a93060d) \Device\Harddisk0\DR0\Partition0
2011/06/28 16:51:12.0658 4508        Boot (0x1200)  (d69d52738945fe86e672b13f7815d2d9) \Device\Harddisk0\DR0\Partition1
2011/06/28 16:51:12.0677 4508        Boot (0x1200)  (f3991db42286ac17e0cea83a1995d3b3) \Device\Harddisk0\DR0\Partition2
2011/06/28 16:51:12.0681 4508        ================================================================================
2011/06/28 16:51:12.0681 4508        Scan finished
2011/06/28 16:51:12.0682 4508        ================================================================================
2011/06/28 16:51:12.0689 3392        Detected object count: 0
2011/06/28 16:51:12.0689 3392        Actual detected object count: 0

cosinus 28.06.2011 16:24
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

MrL2on 28.06.2011 19:53
Also, um es vorneweg zu sagen, combofix hat mein system einmal geradewegs zerschossen. Alles kein Thema, da Wiederherstellungspunkt ja gemacht wurde.
Die registry Pfade wurden alle gelöscht habe ich das gefühl, da ich wenn ich egal welches programm starten wollte, sei es nur ein textdokument erstellen, eine fehlermeldung erhielt.

Hier trotzdem das Log
Code:
ComboFix 11-06-28.02 - Yannnick 28.06.2011  20:34:12.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.7863.6328 [GMT 2:00]
ausgeführt von:: c:\users\Yannnick\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-28 bis 2011-06-28  ))))))))))))))))))))))))))))))
.
.
2011-06-28 18:38 . 2011-06-28 18:38        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-28 14:57 . 2011-06-07 08:10        8873296        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D6500A0E-48C0-43A9-8E14-218997E85503}\mpengine.dll
2011-06-26 17:42 . 2011-06-07 08:10        8873296        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-06-25 20:17 . 2011-06-25 20:17        601424        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F99D28AD-C819-4D61-9ED2-04E8BCEECA7F}\gapaengine.dll
2011-06-25 20:16 . 2011-06-25 20:16        --------        d-----w-        c:\program files (x86)\Microsoft Security Client
2011-06-25 20:16 . 2011-06-25 20:17        --------        d-----w-        c:\program files\Microsoft Security Client
2011-06-25 20:06 . 2011-06-26 12:29        --------        d-----w-        C:\_OTL
2011-06-25 15:13 . 2011-06-25 18:22        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy
2011-06-25 15:13 . 2011-06-25 18:22        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2011-06-25 14:44 . 2011-06-25 14:44        --------        d-----w-        c:\users\Yannnick\AppData\Roaming\IObit
2011-06-25 14:44 . 2011-02-23 14:50        18232        ----a-w-        c:\windows\system32\drivers\SmartDefragDriver.sys
2011-06-25 14:44 . 2011-02-23 14:50        32136        ----a-w-        c:\windows\system32\SmartDefragBootTime.exe
2011-06-25 14:04 . 2011-06-25 14:04        --------        d-----w-        c:\users\Yannnick\AppData\Roaming\Malwarebytes
2011-06-25 14:04 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-06-25 14:04 . 2011-06-25 14:04        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-25 14:04 . 2011-06-25 14:04        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2011-06-25 14:04 . 2011-05-29 07:11        25912        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-25 13:55 . 2011-06-25 14:00        --------        d-----w-        c:\programdata\Kaspersky Lab
2011-06-25 13:54 . 2009-10-22 11:54        40464        ----a-w-        c:\windows\system32\drivers\76519412.sys
2011-06-25 13:54 . 2009-10-09 21:30        352784        ----a-w-        c:\windows\system32\drivers\7651941.sys
2011-06-25 13:54 . 2009-09-25 15:59        157712        ----a-w-        c:\windows\system32\drivers\76519411.sys
2011-06-24 12:31 . 2011-06-07 17:10        8873296        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6295056F-DB90-4648-9BBC-D819995594DB}\mpengine.dll
2011-06-22 13:47 . 2010-01-01 08:00        2106216        ----a-w-        c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 13:47 . 2010-01-01 08:00        1998168        ----a-w-        c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll
2011-06-21 21:29 . 2011-06-21 21:32        --------        d-----w-        c:\users\Yannnick\AppData\Roaming\TS3Client
2011-06-21 21:29 . 2011-06-21 21:29        --------        d-----w-        c:\users\Yannnick\AppData\Local\TeamSpeak 3 Client
2011-06-21 20:57 . 2011-06-22 13:38        --------        d-----w-        c:\windows\SysWow64\NV
2011-06-21 20:57 . 2011-06-22 13:38        --------        d-----w-        c:\windows\system32\NV
2011-06-21 20:55 . 2011-06-21 20:55        --------        d-----w-        c:\programdata\NVIDIA Corporation
2011-06-21 14:07 . 2011-06-21 14:07        --------        d-----w-        c:\program files (x86)\VirtualDJ
2011-06-19 12:26 . 2011-06-19 12:26        --------        d-----w-        c:\program files (x86)\Common Files\Java
2011-06-16 18:05 . 2011-06-16 18:05        --------        d-----w-        c:\program files (x86)\Bethesda Softworks
2011-06-16 18:05 . 2011-06-16 18:05        200836        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
2011-06-16 18:05 . 2005-04-03 21:02        753664        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-06-16 18:05 . 2005-04-03 21:02        69714        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-06-16 18:05 . 2005-04-03 21:01        274432        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-06-16 18:05 . 2005-04-03 21:00        184320        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-06-16 18:05 . 2005-04-03 21:00        63488        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
2011-06-16 18:05 . 2005-04-03 20:59        5632        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-06-16 18:05 . 2011-06-16 18:05        331908        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-06-16 18:05 . 2011-06-18 15:45        --------        d-----w-        c:\users\Yannnick\AppData\Local\Oblivion
2011-06-14 11:54 . 2011-06-24 15:16        --------        d-----w-        c:\users\Yannnick\AppData\Local\Thunderbird
2011-06-14 11:54 . 2011-06-14 11:54        --------        d-----w-        c:\users\Yannnick\AppData\Roaming\Thunderbird
2011-06-14 11:54 . 2011-06-26 12:17        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird
2011-06-10 17:37 . 2011-06-10 17:38        --------        d-----w-        c:\program files\iTunes
2011-06-10 17:37 . 2011-06-10 17:38        --------        d-----w-        c:\program files (x86)\iTunes
2011-06-10 17:37 . 2011-06-10 17:37        --------        d-----w-        c:\program files\iPod
2011-06-08 12:59 . 2011-06-08 12:59        178800        ----a-w-        c:\windows\SysWow64\CmdLineExt_x64.dll
2011-06-08 12:56 . 2011-06-08 12:56        --------        dc----w-        c:\programdata\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2011-06-08 12:38 . 2011-06-08 12:38        6936        ----a-w-        c:\windows\SysWow64\ealregsnapshot1.reg
2011-06-08 12:38 . 2011-06-08 12:38        --------        d-----w-        c:\users\Yannnick\AppData\Local\Downloaded Installations
2011-06-07 13:24 . 2011-06-07 13:24        --------        d-----w-        c:\programdata\PopCap Games
2011-06-07 10:35 . 2011-06-07 10:35        103864        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2011-06-07 10:35 . 2011-06-07 10:35        103864        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2011-06-01 12:24 . 2011-06-01 12:24        --------        d-----w-        c:\program files (x86)\Western Digital Corporation
2011-05-29 19:58 . 2011-05-29 19:58        --------        d-----w-        c:\users\Yannnick\AppData\Roaming\OpenOffice.org
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-27 10:41 . 2011-05-21 19:37        234536        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2011-06-27 10:41 . 2011-05-21 09:40        234536        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2011-06-26 22:18 . 2011-05-21 09:40        234536        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2011-06-15 14:01 . 2011-05-20 17:06        404640        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-05-24 18:43 . 2011-05-21 09:40        75136        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe
2011-05-22 18:18 . 2011-05-22 18:18        73216        ----a-w-        c:\windows\cadkasdeinst01.exe
2011-05-21 20:42 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2011-05-21 20:42 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2011-05-21 13:10 . 2011-05-21 13:10        18960        ----a-w-        c:\windows\system32\drivers\LNonPnP.sys
2011-05-21 11:39 . 2011-05-21 11:39        53248        ----a-r-        c:\users\Yannnick\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-05-21 09:40 . 2011-05-21 09:40        669184        ----a-w-        c:\windows\SysWow64\pbsvc.exe
2011-05-20 15:54 . 2010-06-24 10:33        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-05-10 06:06 . 2011-05-10 06:06        51712        ----a-w-        c:\windows\system32\drivers\usbaapl64.sys
2011-05-10 06:06 . 2011-05-10 06:06        4517664        ----a-w-        c:\windows\system32\usbaaplrc.dll
2011-05-04 02:52 . 2011-05-22 16:21        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2011-04-22 22:15 . 2011-05-25 15:09        27520        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-04-17 19:57 . 2011-04-17 19:57        41872        ----a-w-        c:\windows\SysWow64\xfcodec.dll
2011-04-17 19:57 . 2011-04-17 19:57        27536        ----a-w-        c:\windows\system32\xfcodec64.dll
2011-04-09 07:02 . 2011-05-20 16:15        5562240        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-09 06:58 . 2011-05-20 16:14        142336        ----a-w-        c:\windows\system32\poqexec.exe
2011-04-09 06:02 . 2011-05-20 16:15        3967872        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-20 16:15        3912576        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-20 16:14        123904        ----a-w-        c:\windows\SysWow64\poqexec.exe
2011-04-06 14:26 . 2011-04-06 14:26        96544        ----a-w-        c:\windows\system32\dnssd.dll
2011-04-06 14:26 . 2011-04-06 14:26        69408        ----a-w-        c:\windows\system32\jdns_sd.dll
2011-04-06 14:26 . 2011-04-06 14:26        237856        ----a-w-        c:\windows\system32\dnssdX.dll
2011-04-06 14:26 . 2011-04-06 14:26        119584        ----a-w-        c:\windows\system32\dns-sd.exe
2011-04-06 14:20 . 2011-04-06 14:20        91424        ----a-w-        c:\windows\SysWow64\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20        75040        ----a-w-        c:\windows\SysWow64\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20        197920        ----a-w-        c:\windows\SysWow64\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20        107808        ----a-w-        c:\windows\SysWow64\dns-sd.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 03:40        120176        ----a-w-        c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 bbnibmsk;bbnibmsk;c:\windows\system32\drivers\bbnibmsk.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-03-24 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-03-24 9096]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 76519412;76519412 Boot Guard Driver;c:\windows\system32\DRIVERS\76519412.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x]
S1 76519411;76519411;c:\windows\system32\DRIVERS\76519411.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 setup_9.0.0.722_24.06.2011_21-01drv;setup_9.0.0.722_24.06.2011_21-01drv;c:\windows\system32\DRIVERS\7651941.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-18 2320920]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-29 243232]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 03:42        137584        ----a-w-        c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-22 10920552]
"PLFSetI"="c:\windows\PLFSetI.exe" [2011-03-15 206208]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.hiergehtslos.de
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\Yannnick\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Yannnick\AppData\Roaming\Mozilla\Firefox\Profiles\dppj49sm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-497356011-576416229-1648661835-1002\Software\SecuROM\License information*]
"datasecu"=hex:45,2c,9a,0e,80,d2,aa,c8,18,49,eb,87,98,51,86,58,7e,0d,ea,45,ee,
  fc,b2,99,05,32,d6,a7,da,fa,7e,fd,e1,7d,ce,0a,e8,aa,db,b9,94,07,c7,02,af,62,\
"rkeysecu"=hex:13,f1,2a,77,54,5d,92,76,f3,f3,ba,7d,9b,fc,d6,c3
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-06-28  20:44:47 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-06-28 18:44
.
Vor Suchlauf: 14 Verzeichnis(se), 47.407.161.344 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 47.256.326.144 Bytes frei
.
- - End Of File - - A5F3246319DD731879ECD0AEB6EFCE29

cosinus 28.06.2011 20:35
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

MrL2on 29.06.2011 13:43
Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows 7 Home Premium Edition
Windows Information:                Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer:        Acer
BIOS Manufacturer:                Acer
System Manufacturer:                Acer
System Product Name:                Aspire 5742G
Logical Drives Mask:                0x0000001c

Kernel Drivers (total 203):
  0x02E08000 \SystemRoot\system32\ntoskrnl.exe
  0x033F1000 \SystemRoot\system32\hal.dll
  0x00BCF000 \SystemRoot\system32\kdcom.dll
  0x00CCA000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x00D19000 \SystemRoot\system32\PSHED.dll
  0x00D2D000 \SystemRoot\system32\CLFS.SYS
  0x00C00000 \SystemRoot\system32\CI.dll
  0x00EF7000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x00F9B000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x00E00000 \SystemRoot\system32\drivers\ACPI.sys
  0x00E57000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x00E60000 \SystemRoot\system32\drivers\msisadrv.sys
  0x00E6A000 \SystemRoot\system32\drivers\pci.sys
  0x00E9D000 \SystemRoot\system32\drivers\vdrvroot.sys
  0x00EAA000 \SystemRoot\System32\drivers\partmgr.sys
  0x00EBF000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x00EC8000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x00ED4000 \SystemRoot\system32\drivers\volmgr.sys
  0x00D8B000 \SystemRoot\System32\drivers\volmgrx.sys
  0x00FAA000 \SystemRoot\System32\drivers\mountmgr.sys
  0x010D3000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x012DD000 \SystemRoot\system32\drivers\atapi.sys
  0x012E6000 \SystemRoot\system32\drivers\ataport.SYS
  0x01310000 \SystemRoot\system32\drivers\amdxata.sys
  0x0131B000 \SystemRoot\system32\drivers\fltmgr.sys
  0x01367000 \SystemRoot\system32\drivers\fileinfo.sys
  0x01401000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x0137B000 \SystemRoot\System32\Drivers\msrpc.sys
  0x015A4000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x01000000 \SystemRoot\System32\Drivers\cng.sys
  0x015BF000 \SystemRoot\System32\drivers\pcw.sys
  0x015D0000 \SystemRoot\System32\Drivers\Fs_Rec.sys
  0x0164B000 \SystemRoot\system32\drivers\ndis.sys
  0x0173E000 \SystemRoot\system32\drivers\NETIO.SYS
  0x0179E000 \SystemRoot\System32\Drivers\ksecpkg.sys
  0x01805000 \SystemRoot\System32\drivers\tcpip.sys
  0x01A09000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x01A53000 \SystemRoot\system32\drivers\volsnap.sys
  0x01A9F000 \SystemRoot\System32\Drivers\spldr.sys
  0x01AA7000 \SystemRoot\System32\Drivers\SmartDefragDriver.sys
  0x01AAE000 \SystemRoot\System32\drivers\rdyboost.sys
  0x01AE8000 \SystemRoot\system32\DRIVERS\nvpciflt.sys
  0x01AF2000 \SystemRoot\System32\Drivers\mup.sys
  0x01B04000 \SystemRoot\System32\drivers\hwpolicy.sys
  0x01B0D000 \SystemRoot\System32\DRIVERS\fvevol.sys
  0x01B47000 \SystemRoot\system32\DRIVERS\disk.sys
  0x01B5D000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
  0x01B8D000 \SystemRoot\system32\DRIVERS\76519412.sys
  0x042E6000 \SystemRoot\system32\drivers\cdrom.sys
  0x04310000 \SystemRoot\system32\DRIVERS\MpFilter.sys
  0x04341000 \SystemRoot\system32\DRIVERS\mwlPSDFilter.sys
  0x0434A000 \SystemRoot\system32\DRIVERS\7651941.sys
  0x043A6000 \SystemRoot\System32\Drivers\Null.SYS
  0x043AF000 \SystemRoot\System32\Drivers\Beep.SYS
  0x043B6000 \SystemRoot\System32\drivers\vga.sys
  0x043C4000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x043E9000 \SystemRoot\System32\drivers\watchdog.sys
  0x04000000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x04009000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x04012000 \SystemRoot\system32\drivers\rdprefmp.sys
  0x0401B000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x04026000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x04037000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x04059000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x04066000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x04473000 \SystemRoot\system32\drivers\afd.sys
  0x044FC000 \SystemRoot\system32\DRIVERS\wfplwf.sys
  0x04505000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x0452B000 \SystemRoot\system32\DRIVERS\vwififlt.sys
  0x04541000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x04550000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x0456B000 \SystemRoot\system32\drivers\termdd.sys
  0x0457F000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x045D0000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x045DC000 \SystemRoot\system32\DRIVERS\mwlPSDVDisk.sys
  0x045EF000 \SystemRoot\system32\DRIVERS\mwlPSDNServ.sys
  0x04400000 \SystemRoot\system32\drivers\mssmbios.sys
  0x0440B000 \SystemRoot\System32\drivers\discache.sys
  0x0441A000 \SystemRoot\System32\Drivers\dfsc.sys
  0x04438000 \SystemRoot\system32\DRIVERS\blbdrive.sys
  0x04ACF000 \SystemRoot\system32\DRIVERS\76519411.sys
  0x04A00000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x0F2B2000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x0FF60000 \SystemRoot\System32\Drivers\nvBridge.kmd
  0x04635000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x04729000 \SystemRoot\System32\drivers\dxgmms1.sys
  0x0580A000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
  0x0622D000 \SystemRoot\system32\DRIVERS\HECIx64.sys
  0x0623E000 \SystemRoot\system32\drivers\usbehci.sys
  0x0624F000 \SystemRoot\system32\drivers\USBPORT.SYS
  0x062A5000 \SystemRoot\system32\drivers\HDAudBus.sys
  0x062C9000 \SystemRoot\system32\DRIVERS\k57nd60a.sys
  0x06623000 \SystemRoot\system32\DRIVERS\athrx.sys
  0x06849000 \SystemRoot\system32\DRIVERS\vwifibus.sys
  0x06856000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x0685B000 \SystemRoot\system32\drivers\i8042prt.sys
  0x06879000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x06888000 \SystemRoot\system32\DRIVERS\ETD.sys
  0x068AD000 \SystemRoot\system32\drivers\mouclass.sys
  0x068BC000 \??\C:\Windows\system32\drivers\UBHelper.sys
  0x068C4000 \??\C:\Windows\system32\drivers\NTIDrvr.sys
  0x068CC000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x068D9000 \SystemRoot\system32\DRIVERS\Impcd.sys
  0x06900000 \SystemRoot\system32\drivers\wmiacpi.sys
  0x06909000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x0691F000 \SystemRoot\system32\drivers\CompositeBus.sys
  0x0692F000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
  0x06945000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x06969000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x06975000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x069A4000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x069BF000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x069E0000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x069FA000 \SystemRoot\system32\drivers\swenum.sys
  0x0632A000 \SystemRoot\system32\drivers\ks.sys
  0x06600000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x0636D000 \SystemRoot\system32\drivers\usbhub.sys
  0x063C7000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x06AEF000 \SystemRoot\system32\drivers\RTKVHD64.sys
  0x06D38000 \SystemRoot\system32\drivers\portcls.sys
  0x06D75000 \SystemRoot\system32\drivers\drmk.sys
  0x06D97000 \SystemRoot\system32\drivers\ksthunk.sys
  0x06D9D000 \SystemRoot\system32\DRIVERS\IntcDAud.sys
  0x06A00000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x06A1D000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x06A1F000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x00050000 \SystemRoot\System32\win32k.sys
  0x06A3C000 \SystemRoot\System32\drivers\Dxapi.sys
  0x06A48000 \SystemRoot\System32\Drivers\usbvideo.sys
  0x06A76000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x06A84000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x06A9D000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x06AA6000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0x06ABB000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x06AC8000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0x06ADC000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x06DE8000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x040AB000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x063DC000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
  0x06612000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x005E0000 \SystemRoot\System32\TSDDD.dll
  0x00730000 \SystemRoot\System32\cdd.dll
  0x0476F000 \SystemRoot\system32\drivers\luafv.sys
  0x04792000 \SystemRoot\system32\drivers\WudfPf.sys
  0x047B3000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x0FF65000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x047C8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x047DB000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x06DF6000 \SystemRoot\system32\DRIVERS\TurboB.sys
  0x094E8000 \SystemRoot\system32\drivers\HTTP.sys
  0x095B1000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x095CF000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x09400000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x0942D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x0947B000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x0949F000 \SystemRoot\system32\DRIVERS\MpNWMon.sys
  0x0F200000 \SystemRoot\system32\drivers\peauth.sys
  0x094AF000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x04600000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x094BA000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x04A26000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x082C9000 \SystemRoot\System32\DRIVERS\srv.sys
  0x08361000 \SystemRoot\system32\DRIVERS\NisDrvWFP.sys
  0x77CA0000 \Windows\System32\ntdll.dll
  0x47CA0000 \Windows\System32\smss.exe
  0xFFFC0000 \Windows\System32\apisetschema.dll
  0xFF6F0000 \Windows\System32\autochk.exe
  0xFFE80000 \Windows\System32\wininet.dll
  0xFFCA0000 \Windows\System32\setupapi.dll
  0xFFC50000 \Windows\System32\ws2_32.dll
  0xFFBD0000 \Windows\System32\shlwapi.dll
  0x77E70000 \Windows\System32\normaliz.dll
  0xFFB60000 \Windows\System32\gdi32.dll
  0xFF9E0000 \Windows\System32\urlmon.dll
  0xFF9C0000 \Windows\System32\sechost.dll
  0xFF8F0000 \Windows\System32\usp10.dll
  0xFF8E0000 \Windows\System32\lpk.dll
  0xFF840000 \Windows\System32\clbcatq.dll
  0xFF7C0000 \Windows\System32\difxapi.dll
  0xFF6E0000 \Windows\System32\advapi32.dll
  0xFF480000 \Windows\System32\iertutil.dll
  0xFF370000 \Windows\System32\msctf.dll
  0xFF2D0000 \Windows\System32\comdlg32.dll
  0xFF1F0000 \Windows\System32\oleaut32.dll
  0x77E60000 \Windows\System32\psapi.dll
  0xFF1D0000 \Windows\System32\imagehlp.dll
  0xFF0A0000 \Windows\System32\rpcrt4.dll
  0x77B80000 \Windows\System32\kernel32.dll
  0xFF000000 \Windows\System32\msvcrt.dll
  0xFEDF0000 \Windows\System32\ole32.dll
  0x77A80000 \Windows\System32\user32.dll
  0xFED90000 \Windows\System32\Wldap32.dll
  0xFED60000 \Windows\System32\imm32.dll
  0xFED50000 \Windows\System32\nsi.dll
  0xFDFC0000 \Windows\System32\shell32.dll
  0xFDF50000 \Windows\System32\KernelBase.dll
  0xFDF10000 \Windows\System32\wintrust.dll
  0xFDED0000 \Windows\System32\cfgmgr32.dll
  0xFDEB0000 \Windows\System32\devobj.dll
  0xFDD40000 \Windows\System32\crypt32.dll
  0xFDCA0000 \Windows\System32\comctl32.dll
  0xFDC90000 \Windows\System32\msasn1.dll
  0x761E0000 \Windows\SysWOW64\normaliz.dll

Processes (total 84):
      0 System Idle Process
      4 System
    328 C:\Windows\System32\smss.exe
    496 csrss.exe
    576 C:\Windows\System32\wininit.exe
    596 csrss.exe
    640 C:\Windows\System32\services.exe
    656 C:\Windows\System32\lsass.exe
    668 C:\Windows\System32\lsm.exe
    720 C:\Windows\System32\winlogon.exe
    808 C:\Windows\System32\svchost.exe
    872 C:\Windows\System32\nvvsvc.exe
    912 C:\Windows\System32\svchost.exe
    972 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    340 C:\Windows\System32\svchost.exe
    528 C:\Windows\System32\svchost.exe
    384 C:\Windows\System32\svchost.exe
    1068 C:\Windows\System32\audiodg.exe
    1116 C:\Windows\System32\svchost.exe
    1204 C:\Windows\System32\svchost.exe
    1472 C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    1484 C:\Windows\System32\nvvsvc.exe
    1548 C:\Windows\System32\spoolsv.exe
    1568 C:\Windows\System32\taskeng.exe
    1596 C:\Windows\System32\svchost.exe
    1684 C:\Windows\System32\rundll32.exe
    1868 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    2028 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    1244 C:\Program Files (x86)\Launch Manager\dsiwmis.exe
    1284 C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
    1660 C:\Windows\System32\svchost.exe
    1808 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    1368 C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
    1964 C:\Windows\SysWOW64\PnkBstrA.exe
    1652 C:\Windows\System32\svchost.exe
    1364 C:\Program Files\Acer\Acer Updater\UpdaterService.exe
    2064 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    2180 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    2468 C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
    2676 C:\Windows\System32\svchost.exe
    2788 C:\Windows\System32\taskhost.exe
    2852 C:\Windows\System32\dwm.exe
    2876 C:\Windows\explorer.exe
    2764 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    2888 C:\Program Files\Elantech\ETDCtrl.exe
    3084 C:\Windows\PLFSetI.exe
    3100 C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
    3128 C:\Windows\System32\hkcmd.exe
    3152 C:\Windows\System32\igfxsrvc.exe
    3164 C:\Windows\System32\igfxpers.exe
    3244 C:\Program Files\Microsoft Security Client\msseces.exe
    3396 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
    3532 C:\Windows\System32\igfxext.exe
    3724 C:\Windows\System32\wbem\unsecapp.exe
    3792 WmiPrvSE.exe
    3852 C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
    3932 C:\Program Files\Elantech\ETDCtrlHelper.exe
    3996 C:\Program Files\Logitech\SetPointG\SetPointII.exe
    4004 C:\Program Files (x86)\Launch Manager\LManager.exe
    4048 C:\Program Files (x86)\iTunes\iTunesHelper.exe
    4076 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    3252 C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
    3140 C:\Program Files (x86)\Launch Manager\LMworker.exe
    1012 C:\Windows\System32\SearchIndexer.exe
    2736 C:\Program Files\iPod\bin\iPodService.exe
    1432 C:\Program Files\Windows Media Player\wmpnetwk.exe
    3916 C:\Windows\System32\svchost.exe
    4616 dllhost.exe
    4708 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    4580 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
    4892 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    3364 C:\Program Files (x86)\iTunes\iTunes.exe
    4656 C:\Program Files (x86)\simfy\simfy.exe
    4736 C:\Windows\System32\SearchProtocolHost.exe
    3284 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
    756 C:\Windows\System32\conhost.exe
    3524 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
    3272 C:\Windows\System32\conhost.exe
    2480 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    3040 C:\Windows\System32\SearchFilterHost.exe
    2716 dllhost.exe
    5052 dllhost.exe
    3340 C:\Users\Yannnick\Desktop\MBRCheck.exe
    1420 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`86500000  (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000020`d2a6e400  (NTFS)

PhysicalDrive0 Model Number: WDCWD5000BEVT-22A0RT0, Rev: 01.01A01

      Size  Device Name          MBR Status
  --------------------------------------------
    465 GB  \\.\PhysicalDrive0  Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

cosinus 29.06.2011 14:04
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Alle Zeitangaben in WEZ +1. Es ist jetzt 04:51 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131