Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   winsvc.exe - Laptop befallen - Auf USB- Stick nur noch Verknüpfungen (https://www.trojaner-board.de/104692-winsvc-exe-laptop-befallen-usb-stick-nur-noch-verknuepfungen.html)

chrisstar1 01.11.2011 22:03
winsvc.exe - Laptop befallen - Auf USB- Stick nur noch Verknüpfungen
 
Hallo,

ich habe folgendes Problem: Ein Kumpel von mir wollte Bilder von unserem letzten Ausflug haben und hat mich gebeten ihm die auf USB- Stick zu machen. Hab ich auch getan und gab ihm den Stick. Er kam daraufhin zurück und sagte er könne die Bilder nicht öffen, da das nur Verknüpfungen sein.
Hab ihm dann gesagt: "Naja, dann lass mich mal schauen". USB- Stick bei mir eingesteckt und siehe da, nur Verknüpfungen von den Ordnern, die eigentlich die Bilder enthalten sollten. Ordner ließen sich nicht öffnen, Wenn überhaupt, dann waren sie leer. Ein Rechtsklick auf Eigenschaften (von USB- Stick) zeigte mir, dass der Speicher belegt war.

Nach einigem Googlen bin ich darauf gekommen (u.a. auch hier), dass es sich wohl um einen Virus handelt. Daraufhin habe ich Avira gestartet und laufen lassen. Ergebnis nach 2 Stunden --> nichts.

Habe dann mal den Quickscan von bitdefender gemacht. Daraufhin wurde mir der Virus "winsvc.exe" angezeigt. Logfile findet sich weiter unten.
Nun wollte ich die "große" Version von bitdefender installieren, allerdings scheitert er am Download für die Virendefinitionsdateien (habe hier extrem schlechtes Internet). Bin wie hier beschrieben nach Anleitung vorgegangen (Antivir aus, Firewall aus, IE benutzt (nutze sonst Chrome), Chrome geschlossen). Dasselbe Problem bei ESET (er sagt nur "unexpected error 2002"). Deswegen wende ich mich nun an euch.

Ich schätze dass der USB- Stick mittlerweile Clean ist, denn ich habe ihn formatiert (vorher habe ich den Prozess winsvc.exe beendet) und konnte die Dateien dann aufspielen uns sie waren auch da. Dann zum Kollegen gegangen um zu schauen ob das bei ihm klappt. Also bei ihm winsvc.exe geschlossen und USB- Stick rein, danach dann die Bilder auf seinen Rechner kopiert, alles ohne Probleme.

Allerdings hat es mein Handy erwischt. Das war während des Einsteckens des infizierten USB- Sticks am PC. Auch hier taucht dasselbe Phänomen auf, dass die Dateien zwar noch auf dem Handy sind (ich kann über das Handy darauf zugreifen), aber sie lassen sich nicht mehr über den PC abrufen.
Da dort doch einige wichtige Dinge drauf sind, möchte ich den Speicher nur sehr sehr ungern formatieren (microSD Karte). Eine Frage, ist der Telefonspeicher auch betroffen? Ich hoffe nicht, denn diesen kann ich im Explorer nicht sehen (konnte ich vorher auch schon nicht).

Deswegen hoffe ich, dass mir hier jemand helfen kann.

Code:
QuickScan Beta 32-bit v0.9.9.99
-------------------------------
Überprüfungsdatum:  Tue Nov 01 19:04:28 2011
Computer ID: B28E8ED7



1 infizierte Datei gefunden!
----------------------------

C:\Users\Christian\M-1-52-5782-8752-5245\winsvc.exe --> Trojan.Generic.KD.389661
  --> HKCU\Software\Microsoft\Windows\CurrentVersion\Run\"Microsoft® Windows Update"
  --> Vorgang winsvc.exe (1156)



Prozesse
--------
            Avira Free Antivirus                    3336    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
            Betriebssystem Microsoft® Windows®      2820    C:\Windows\SysWOW64\rundll32.exe
            ClickClean.exe                          4880    C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\ClickClean.exe
            flux.exe                                5616    C:\Users\Christian\Local Settings\Apps\F.lux\flux.exe
            FRITZ!DSL                                4116    C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
            FRITZ!DSL Startcenter                    4500    C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
            Google Chrome                            4712    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            6020    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            1164    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            1184    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            6056    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            1940    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            2716    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            3276    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            6124    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            3424    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            3796    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            3968    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            4112    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            4416    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            6136    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            4840    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            4852    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5352    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5396    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5424    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5508    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5532    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5560    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5564    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5848    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            5884    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Google Chrome                            6008    C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
            Intel PROSet\Wireless Bluetooth          4540    C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
            PaperPort                                4828    C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
            PCCompanionInfo.exe                      3496    C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe
            PhraseExpress                            3296    C:\Program Files (x86)\PhraseExpress\phraseexpress.exe
            Sony Ericsson PC Companion              1608    C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
            USB 3.0 Monitor                          160    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
            winsvc.exe                              1156    C:\Users\Christian\M-1-52-5782-8752-5245\winsvc.exe


Netzwerkaktivität
-----------------
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 74.125.232.118
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 69.171.227.46
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 80.239.230.169
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 69.171.228.40
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 74.125.232.113
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 74.125.232.113
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 74.125.232.113
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 74.125.232.116
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 81.95.148.66
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 83.145.197.2
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 209.85.169.95
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 81.95.148.66
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 2.21.15.139
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 74.86.64.162
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 92.122.253.55
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 209.85.148.96
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.45.15.65
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.45.15.65
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.45.15.65
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.45.15.65
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.45.15.65
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.45.15.65
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 209.85.169.120
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 209.85.169.120
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 66.235.142.24
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 212.223.100.174
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 74.125.232.136
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 92.122.253.55
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 212.223.100.174
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 213.248.111.248
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 74.125.232.133
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 74.125.232.133
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 74.125.232.133
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.40.33.215
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.93.13.14
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.93.13.14
Vorgang chrome.exe (5560) verbunden mit Anschluss 443 (HTTP over SSL) --> 209.85.169.95
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 74.125.232.124
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.93.13.14
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.93.13.14
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.93.13.14
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 188.93.13.14
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 193.46.63.108
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 91.199.104.31
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 91.199.104.31
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 91.199.104.31
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 83.145.197.2
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 91.199.104.31
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 91.199.104.31
Vorgang chrome.exe (5560) verbunden mit Anschluss 80 (HTTP) --> 91.199.104.31



Autoruns und kritische Dateien
------------------------------
            Avira Free Antivirus                    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
            Betriebssystem Microsoft® Windows®      C:\Windows\system32\userinit.exe
            NVIDIA D3D shim drivers                  C:\Windows\SysWOW64\nvinit.dll
            Sony Ericsson PC Companion              C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
            Startup Launcher                        C:\Program Files (x86)\r2 Studios\Startup Delayer\Startup Launcher.exe
            winsvc.exe                              C:\Users\Christian\M-1-52-5782-8752-5245\winsvc.exe
(verifiziert) Google Update                            C:\Users\Christian\AppData\Local\Google\Update\GoogleUpdate.exe


Browser Plugins
---------------
            AVM Products                            C:\Program Files (x86)\FRITZ!DSL\\sarah.dll
            Betriebssystem Microsoft® Windows®      C:\Windows\system32\MSWSOCK.DLL
            BitDefender QuickScan                    C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\npqscan.dll
            Chrome IE Tab                            C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd\2.5.24.1_0\plugin\blackfishietab.dll
            ClickClean.exe                          C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\ClickClean.exe
            Flash® Player Installer/Uninstaller      C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
            Google Update                            C:\Users\Christian\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
            ICQ                                      C:\Program Files (x86)\ICQ7.5\ICQ.exe
            InstallShield Update Service            C:\Windows\Downloaded Program Files\isusweb.dll
            Media Go Detector                        C:\Program Files (x86)\Sony\Media Go\npmediago.dll
            Microsoft® Windows® Operating System    C:\Windows\system32\NLAapi.dll
            Microsoft® Windows® Operating System    C:\Windows\system32\wshbth.dll
            Mixesoft Click&Clean Plug-In            C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\npccch32.dll
            NETELLER app                            c:\program files (x86)\neteller app\plugins\ie\neteller.dll
            NVIDIA 3D Vision                        C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
            NVIDIA 3D VISION                        C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
            PDF-XChange Viewer                      C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
            PlayStation(R)Network Downloader Check  C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll
            System Requirements Lab                  C:\Windows\Downloaded Program Files\sysreqlab_nvd.dll
            Windows® Internet Explorer              C:\Windows\SysWOW64\ieframe.dll
(verifiziert) Betriebssystem Microsoft® Windows®      C:\Windows\system32\napinsp.dll
(verifiziert) Betriebssystem Microsoft® Windows®      C:\Windows\system32\pnrpnsp.dll
(verifiziert) InstallShield Update Service            C:\Windows\Downloaded Program Files\dwusplay.dll
(verifiziert) InstallShield Update Service            C:\Windows\Downloaded Program Files\dwusplay.exe
(verifiziert) Microsoft® Windows® Operating System    C:\Windows\System32\winrnr.dll
(verifiziert) NPSWF32.dll                              C:\Windows\system32\Macromed\Flash\NPSWF32.dll


Überprüfen
----------
MD5: 94f7fb13639ab59fd622d68243758dc8  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
MD5: 2fe359edeb34efcf42574752f8aebd3f  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
MD5: 4f6ae546bb04d0715e41c5b7ba221137  C:\Program Files (x86)\Avira\AntiVir Desktop\avipc.dll
MD5: 9f315439a391c9ecae33e93351286cb1  c:\program files (x86)\avira\antivir desktop\ccgen.dll
MD5: c8f17fe9f2012a982623e6754935befc  c:\program files (x86)\avira\antivir desktop\ccgenrc.dll
MD5: 915c780bf2b2d2272362be65b469c289  c:\program files (x86)\avira\antivir desktop\ccgrdrc.dll
MD5: 32321fc470e39da662d9dc536772d7cd  c:\program files (x86)\avira\antivir desktop\ccgrdw.dll
MD5: b7080aaaa8dfcaa0f777939ce2d09eef  c:\program files (x86)\avira\antivir desktop\ccguard.dll
MD5: 38fc77b130374f9fa911429e93845f92  c:\program files (x86)\avira\antivir desktop\cclic.dll
MD5: d4df261c439e4276437ba2640bb8cd96  c:\program files (x86)\avira\antivir desktop\cclicrc.dll
MD5: 350c7e3945128f5f7623760b715b05db  c:\program files (x86)\avira\antivir desktop\ccmainrc.dll
MD5: 2f4be8dae6297a3fc25370bb9d56c9e4  c:\program files (x86)\avira\antivir desktop\ccmsg.dll
MD5: 3f8cfa2e4d40b5426cbaa735f1602401  c:\program files (x86)\avira\antivir desktop\ccmsgrc.dll
MD5: 645e99711fe69d22118e97016bddae07  c:\program files (x86)\avira\antivir desktop\ccupdate.dll
MD5: 4d3e38297ffd95ffbbb94db7ee2be0eb  c:\program files (x86)\avira\antivir desktop\ccupdrc.dll
MD5: e364ac17d2e9a71f792fb5786a97af3d  c:\program files (x86)\avira\antivir desktop\ccwgrd.dll
MD5: 8df299b20a01f873839791e0b024a462  C:\Program Files (x86)\Avira\AntiVir Desktop\ccwkrlib.dll
MD5: aeaa38ce084d30245a9167c7be8f067b  c:\program files (x86)\avira\antivir desktop\cfglib.dll
MD5: a52c620c9f2a7b2646dcad5cd16779c9  c:\program files (x86)\avira\antivir desktop\gpipc.dll
MD5: 07b994b850da417e49c92e75d7035f40  C:\Program Files (x86)\Avira\AntiVir Desktop\grdcore.dll
MD5: 5ebab958d148b194882126a0d0ea7aba  C:\Program Files (x86)\Avira\AntiVir Desktop\rcimage.dll
MD5: a122d68ea2541453f787f341877cb40b  C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
MD5: 1264f787e46dc572fa274ca09b446e01  C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
MD5: cb992ae1506985d9167e85883b4c3240  C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
MD5: 45d2c78c5d0ce973fe5178a153231c03  C:\Program Files (x86)\FRITZ!DSL\\sarah.dll
MD5: ac7a7d8fda3c8e26a47c3fc667f38a8c  C:\Program Files (x86)\FRITZ!DSL\avmcsock.dll
MD5: ed9d9816fc385d769f42a6d361f8d39f  C:\Program Files (x86)\FRITZ!DSL\avmufc.dll
MD5: a93af436cf15bf30b58080c8342d9d89  C:\Program Files (x86)\FRITZ!DSL\block.dll
MD5: 49113fd438bf8b8d996c556d28da04de  C:\Program Files (x86)\FRITZ!DSL\fireapi.dll
MD5: 0c48382e03c02c9e7193b7b6056082b2  C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
MD5: 9c9c92fa9cb84b4906ac9ff41a14e579  C:\Program Files (x86)\FRITZ!DSL\igdapi.dll
MD5: e28602c9e17b0ddce9f5deb3b3e2a635  C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
MD5: 45d2c78c5d0ce973fe5178a153231c03  C:\Program Files (x86)\FRITZ!DSL\sarah.dll
MD5: d8839b9f39734e2a2cfee565718e6948  C:\Program Files (x86)\FRITZ!DSL\SHFOLDER.dll
MD5: cce2674b3c5a6bbeca6c519ed8650ace  C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
MD5: 52bd070dbad4d2065059e0ed032b9a5c  C:\Program Files (x86)\ICQ7.5\ICQ.exe
MD5: 8de9258dc72e476afa2f665045647560  C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
MD5: 093b1b419ef25b15d3a1ca6953f41afb  C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
MD5: 03a7341e94acd92e0831336d4f3ace92  C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
MD5: a2ebf384ed105fed7d05c5465500ef2e  C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
MD5: 7f32d4c47a50e7223491e8fb9359907d  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
MD5: 2c16648a12999ae69a9ebf41974b0ba2  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
MD5: a1659e4d08fe8d0f0bc61960d8c0369e  C:\Program Files (x86)\Internet Explorer\ieproxy.dll
MD5: 3612108d36ea74f6f9fc5005e88e353b  c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
MD5: 5b0a0e295aa93737d80e1bce447086b8  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
MD5: 2aae889742376edc5c3203dfb74f28fd  C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
MD5: 38b11f58ec6a8417c09aac6dd033f7dd  c:\program files (x86)\neteller app\plugins\ie\neteller.dll
MD5: cff7b34d91fcc4b05e61a8ebf5987b12  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
MD5: 7fea176d89ef2063128e6d906c9e1f11  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
MD5: 6086b60f2e36d06a063cb07ed0524332  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
MD5: 6477c69fc49d97c7bf406d27e81fc17f  C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
MD5: feb4ac00cc3968dc93e103dac8e3fadd  C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvd3d9wrap.dll
MD5: c501d379a20185516ab294e9da2beca0  C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dll
MD5: e7818cd4fb51284c948d68a7a85a69b8  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
MD5: 8c1f87f5fdd92229d1754b98f073913f  C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
MD5: 4cb535b1bfa96ed1d2b4eae6d89d4394  C:\Program Files (x86)\PhraseExpress\pexkey.dll
MD5: 063ed4127cd92d5e5fbc0a071292941d  C:\Program Files (x86)\PhraseExpress\pexlang.dll
MD5: 522a589c69984c74983c4c1bacd37ced  C:\Program Files (x86)\PhraseExpress\phraseexpress.exe
MD5: 834f8aa6d33c2107e6174fb9440da4be  C:\Program Files (x86)\r2 Studios\Startup Delayer\Startup Launcher.exe
MD5: 1f36981c4deeaa88858317c1642ce160  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll
MD5: 9d51ea92a612b37e76e5e4621650c50a  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
MD5: 129fe8fa98ce27e7dba09201de48a28c  C:\Program Files (x86)\ScanSoft\PaperPort\BindRes.dll
MD5: e2bf206e5164569500742637b5459402  C:\Program Files (x86)\ScanSoft\PaperPort\blicectr.dll
MD5: 5a514496366b77d6a2e3ad66d9fd9d4b  C:\Program Files (x86)\ScanSoft\PaperPort\MaxRes.dll
MD5: 57c13c4390d5a294ec0b1ffffdd23c3d  C:\Program Files (x86)\ScanSoft\PaperPort\PPRecDiag.dll
MD5: 27249f2a900032f3c2dfab8de8f16399  C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
MD5: 1a3009363af0066b28fa144eaa3a2634  C:\Program Files (x86)\ScanSoft\PaperPort\XMAXUTIL.dll
MD5: 4f5c332407454f04696c06fa72cc6395  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\BackupRestore.dll
MD5: 9097ad3f2472cefc658cdbfa5c581e11  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\bvrpctln.dll
MD5: 39ff5a661eb78c87e7eae0aa2dcd62f5  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\ContactSetup.dll
MD5: 108d793552771456a987f2d8b36572bc  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\Device.dll
MD5: f3f0e856c8b9c9511d00564b0a320a17  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\DeviceIO.dll
MD5: 8cf491a6753b831b2f638264eaaddd72  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\DownloadManager.dll
MD5: 0a558793abe366fc82c1682df2bfb724  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\MExplorer.dll
MD5: 535084bd9bff2f3d3b3691f26f704c17  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\NewUI.dll
MD5: fa8898b27bbef593104326239baa02f8  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.dll
MD5: 7fbd299f14615e1cbc3bb48fb4061fb4  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
MD5: ff2f087a24373fe1c6f756b99b6d5936  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe
MD5: 1a623f2b69e1f182f995f963c55db935  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
MD5: 6f1583b46db94b66de3972b898b71e9c  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PhoneUpdate.dll
MD5: 48377bbda14de60c4cd9ee720bf9d36a  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PluginManager.dll
MD5: d38020f9aa3428e7e1023da19bc30174  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\Report.dll
MD5: 2438a67b449581456da8b95d9edbb71b  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\SonyEricssonMTPExt.dll
MD5: 187180af98852a8c78bef6dae3185119  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\sqlite3.dll
MD5: e0c8f024add1c947a6aa571e65817878  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\Statistics.dll
MD5: 91855b21178eb39f6a628ea8a4eb2e33  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\TMonitorAPI.dll
MD5: b9370923c8e65daa6df25de5c354384a  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\VObject.dll
MD5: a68d308c6e0a91907ebe3dcb91c479af  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\WebServices.dll
MD5: 6d251326609149b742d617735999068c  C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\WUNPACLN.dll
MD5: f9ad6b49d9112cef665762783c96eac0  C:\Program Files (x86)\Sony\Media Go\npmediago.dll
MD5: 54bf6ebc262df04712ac4eb18ad8b9cc  C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll
MD5: ce292c4c10b8db6070f262ea2733f0dc  C:\Program Files (x86)\Windows Portable Devices\SqmApi.dll
MD5: 9276f4d4109fc349925d28e00e533146  C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
MD5: 19eff704cd16dd0429e128431f1dd631  C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
MD5: f8f610093e1d7fdfa477fc34d15d5c60  C:\Program Files\Intel\WiFi\bin\EvtEng.exe
MD5: f6ea50dbc391f04ca49427010657ccb3  C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
MD5: 27a547b061c44d72afa6c1e71665d4a5  c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
MD5: 95dc808a9a177f575de9fd49f7d97312  C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x64\msvsmon.exe
MD5: a63bbc7edf1213cba5cdba8d5eba5acf  C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
MD5: d1e343bc00136ce03c4d403194d06a80  C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
MD5: 09522d52225193f41a092236b6790f60  C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
MD5: a9f3bfc9345f49614d5859ec95b9e994  C:\Program Files\Windows Media Player\wmpnetwk.exe
MD5: 4ce93deb44ca702cae4f0cc27836f47e  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\avcodec-53.dll
MD5: 9f530de4dccd807f74ff630bf47423c3  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\avformat-53.dll
MD5: 3c417f8d9dcb1cb06441816123be1bd8  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\avutil-51.dll
MD5: 0e003503cadb9c4adc0981c282861d70  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\chrome.dll
MD5: 0a98c00d657ce2482a368722f6afbca7  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\gcswf32.dll
MD5: 4eb23752b9b2675f43662314d8cc248e  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\icudt.dll
MD5: 40e8dc92b82cd727cbecbbfd1cb118b4  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\libegl.dll
MD5: e66bd51a4c3e25919b321565e6c97990  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\libglesv2.dll
MD5: d845fb225b27b996b35f66b2c8f368df  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\pdf.dll
MD5: 6fa530875fd2ac4d82b826ef319b9640  C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll
MD5: 1ea4588169c62d46a5ef5062920d50a9  C:\Users\Christian\AppData\Local\Google\Chrome\Application\chrome.exe
MD5: 015de283808514b9a71c13c079d1f280  C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\ClickClean.exe
MD5: 44cd2dcd433be46155317c4d538a63a1  C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\npccch32.dll
MD5: f4a569f89a90205a095965ae628625e1  C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\plugin\npqscan.dll
MD5: 37ffc85604d76fc7eb44e256dbfcb802  C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd\2.5.24.1_0\plugin\blackfishietab.dll
MD5: 8c2044169be2224c8a7cb8e81e7581af  C:\Users\Christian\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
MD5: a1f86a5a0da1bec12b7dd19c6234bb15  C:\Users\Christian\Local Settings\Apps\F.lux\flux.exe
MD5: a3002d65e536cd723d1bac1e08c3e311  C:\Users\Christian\M-1-52-5782-8752-5245\winsvc.exe
MD5: 368b2bee3f88bfb883d2c74a258de6f6  C:\Windows\AppPatch\AcLayers.DLL
MD5: 6d7de520d8aa80a243347becd401eb54  C:\Windows\AppPatch\AcWow64.DLL
MD5: f1cd64dd3702bdcdfb0531bb21c6befc  C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
MD5: 3f4413dcd8d3bbabf08f68f25e6d60e1  C:\Windows\Downloaded Program Files\isusweb.dll
MD5: c4002b6b41975f057d98c439030cea07  C:\Windows\ehome\ehRecvr.exe
MD5: 332feab1435662fc6c672e25beb37be3  C:\Windows\Explorer.exe
MD5: 5988fc40f8db5b0739cd1e3a5d0d78bd  C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
MD5: a8b7f3818ab65695e3a0bb3279f6dce6  C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
MD5: 773212b2aaa24c1e31f10246b15b276c  C:\Windows\servicing\TrustedInstaller.exe
MD5: f6f213095d33ed25c57721c19289d9cf  C:\Windows\system32\aac_parser.ax
MD5: 82b0b872a489541980f3334a6330399f  C:\Windows\system32\ac3DX.ax
MD5: 37ce7a79d901235504f9add99a7ac177  C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
MD5: 7a044b0746d957bfd7aae18cfd8422c5  C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
MD5: 0a12d948b2cc7fbb01e28daa5e7c01ea  C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
MD5: cb4863f2bd46aa02d954b86b56a149da  C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
MD5: 2cae4ed96aa903578452b85e5383940c  C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
MD5: e96170a923a69711b4d08e885f05d889  C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
MD5: 44ca750001f0db8c308d1ca4abd0f8e5  C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
MD5: 15df9eb8daba744e4d0e9b117f760f49  C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
MD5: a2385b02cb492131af6f79959a42a93f  C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
MD5: 3ad0832e8e29fbe9bd722e3354dd4f57  C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
MD5: 88dc1714e38d4eb41a4378aab98e753b  C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
MD5: a1d4deb5176c96b1a80715f6a1fdfb4f  C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
MD5: b302a1630e5aea2d830b76bbcd761d72  C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
MD5: 22f767bb3b704f79363999bd4a49e68e  C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
MD5: 00b83152f99e846fefb139c574cd4a96  C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
MD5: 50035c36acee069d0c209288208626d9  C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
MD5: cdf677ad479fa99f2e4d9766b83ef53c  C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
MD5: 12c34c7325b74e8347e8db75279a8f3f  C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
MD5: 96324ed3218133a13fff82055afac733  C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
MD5: a7bdf88a46bcc218b73e383e6547ba5f  C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
MD5: 573c70d7076f2f101752a727db7c2280  C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
MD5: 29b01d02e9ff3d8a63f8747b50a5a1a3  C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
MD5: 0cc90316b34118e3b8af760d92c262a4  C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
MD5: 6f399c3e562c4e69df96039743a7aa26  C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
MD5: f3b94e04053c2483a6fecf953d6661d6  C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
MD5: c6942a18444bfffc3cceca69a7e1879c  C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
MD5: f47e08b025ae376ef1342fc9ecfecdf1  C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
MD5: 8a13e14b68e00ac2cb67420396d8a1c5  C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
MD5: 863f793d15b4026b1a5fdeca873d4d84  C:\Windows\system32\apphelp.dll
MD5: 088cf5b6380fb9002f2a4246f812225d  C:\Windows\system32\asycfilt.dll
MD5: c940f2f5c60b3727c5f18840735b229c  C:\Windows\system32\AUDIOSES.DLL
MD5: 84957d0ce4ff261b0081679eb9c0c006  C:\Windows\system32\AVCDX.ax
MD5: dceabba22e12cc44c2e7785c0eb9c6e3  C:\Windows\system32\AVIFIL32.dll
MD5: 45760eecc8b74b251171be4f247f17cb  C:\Windows\system32\BROWCLI.DLL
MD5: e3d5e244807ad655787fcd25477cc1bc  C:\Windows\system32\bthprops.cpl
MD5: 7a6986dd659b96398a11af5173892715  C:\Windows\system32\Cabinet.dll
MD5: ad7b9c14083b52bc532fba5948342b98  C:\Windows\system32\cmd.exe
MD5: 6fbaa0f8e9f6552ccefd6bcf5a2e1060  C:\Windows\system32\CoreAAC.ax
MD5: 4e5fe39c1076d115ec8bfcfe14d75b80  C:\Windows\system32\credssp.dll
MD5: a585bebf7d054bd9618eda0922d5484a  C:\Windows\system32\cryptsvc.dll
MD5: 465bea35f7ed4a4a57686dea7ea10f47  C:\Windows\system32\cscapi.dll
MD5: 35cede6439ff0d8903223a0817ffe46c  C:\Windows\system32\d2d1.dll
MD5: 2de90400a63818fa38c4c5c9adb166bf  C:\Windows\system32\d3d10_1.dll
MD5: 9c36a3ca80f9b204c670336d344f5df8  C:\Windows\system32\d3d10_1core.dll
MD5: 78b7a3bda25c90daa50d36a56a8d1351  C:\Windows\system32\D3D10Warp.dll
MD5: 6ef5f3f18413c367195f06e503ab86a6  C:\Windows\system32\d3d9.dll
MD5: 1c9b45e87528b8bb8cfa884ea0099a85  C:\Windows\system32\D3DCOMPILER_43.dll
MD5: 86e39e9161c3d930d93822f1563c280d  C:\Windows\system32\d3dx9_43.dll
MD5: 284b59d7b56fc76c80e622ab856b1fab  C:\Windows\System32\davclnt.dll
MD5: 162d247e995eaebf3ef4289069e1111c  C:\Windows\system32\DEVRTL.dll
MD5: e9e01eb683c132f7fa27cd607b8a2b63  C:\Windows\system32\dhcpcore.dll
MD5: 62c08c8fe06eba769e1e7bc98ae47234  C:\Windows\system32\DiracSplitter.ax
MD5: b40420876b9288e0a1c8cca8a84e5dc9  C:\Windows\system32\DNSAPI.dll
MD5: 0a5c7253183a6f956d10a3a4bbc96288  C:\Windows\system32\DWrite.dll
MD5: 0411b7958c524bb2e91ee1b3035fe321  C:\Windows\system32\dxgi.dll
MD5: 1060d60cca69a8136a87dbe3c8f4a467  C:\Windows\system32\EhStorAPI.dll
MD5: 8b88ebbb05a0e56b7dcc708498c02b3e  C:\Windows\system32\explorer.exe
MD5: e2a17bcc08d92f42e08af6ba2f93aba7  C:\Windows\system32\explorerframe.dll
MD5: f8bef2a3a77a22880bce13382d9302ce  C:\Windows\system32\FLACDX.ax
MD5: 8453687a045c926f0291301ebaf50370  C:\Windows\system32\flvDX.dll
MD5: 03a03a453f1aaae0c73aaaf895321c7a  C:\Windows\System32\fwpuclnt.dll
MD5: f0f079a8a947fcfbf8275be7ec1a35ae  C:\Windows\system32\ieframe.DLL
MD5: 574757e0f6e4a2da1aad6502faa967ed  C:\Windows\system32\igdumd32.dll
MD5: f1b15f60024bdbfc23fd6f00e7fdd4f2  C:\Windows\system32\igdumdx32.dll
MD5: a6f09e5669d9a19035f6d942caa15882  C:\Windows\system32\IMM32.DLL
MD5: a90dc9abd65db1a8902f361103029952  C:\Windows\system32\IPHLPAPI.DLL
MD5: 8ea53101ff2b15bdff934b62a8fb326d  C:\Windows\system32\LOGONCLI.DLL
MD5: 8bc9db92c4b2f3be89185beab2afc1f6  C:\Windows\system32\MAPI32.DLL
MD5: a5408051b49a1bfd3c3ed889a318cc42  C:\Windows\system32\MatroskaDX.ax
MD5: 4af4b6e8a4d185b75122773562d25975  C:\Windows\system32\MFC100DEU.DLL
MD5: f32077df74efd435a1dcdf415e189df1  C:\Windows\system32\mfc100u.dll
MD5: dc6612a9ee015a36ba2a27bc9cc12537  C:\Windows\system32\MFC42.DLL
MD5: 1fd3f9722119bdf7b8cff0ecd1e84ea6  C:\Windows\system32\MFC71.DLL
MD5: c94d9d5b96d385586063093baad8f206  C:\Windows\system32\MFC71DEU.DLL
MD5: 243974ec02f7ae49e4179c54624143ab  C:\Windows\system32\MMDevAPI.DLL
MD5: 4cb18f87c6bcf550ef48632935c80b5f  C:\Windows\system32\MPCDx.ax
MD5: 7f8678c59f188528d60104e697c2361e  C:\Windows\system32\mscms.dll
MD5: 21d8f42d54598b73c2e1a9571399113b  C:\Windows\system32\msfDX.dll
MD5: eee470f2a771fc0b543bdeef74fceca0  C:\Windows\system32\msiexec.exe
MD5: 35aae2e841aa1a949775168e119482c9  C:\Windows\system32\msls31.dll
MD5: e3c817f7fe44cc870ecdbcbc3ea36132  C:\Windows\system32\MSVCP100.dll
MD5: bf38660a9125935658cfa3e53fdc7d65  C:\Windows\system32\MSVCR100.dll
MD5: c335ec1182ac10b188705554e0bc1186  C:\Windows\system32\MSVFW32.dll
MD5: 8999b8631c7fd9f7f9ec3cafd953ba24  C:\Windows\system32\MSWSOCK.DLL
MD5: 4205ca4cd43e725db9ff02b0a588a8c6  C:\Windows\System32\msxml3.dll
MD5: 269d867585cda04d3972a39f3694e7df  C:\Windows\System32\msxml6.dll
MD5: e4b6b932b6e5ce386627ceea2a0a0f4c  C:\Windows\system32\nbDX.dll
MD5: 8ce1a6d16b9077e91e192499eb611c5f  C:\Windows\system32\NETAPI32.DLL
MD5: 20b3934db73eaba2b49b7177873cb81f  C:\Windows\system32\netutils.dll
MD5: 3d57ffbad3ed16b63de3879bab0fb56f  C:\Windows\system32\NetworkExplorer.dll
MD5: 104a1070e90f1c530328e69b49718841  C:\Windows\system32\NLAapi.dll
MD5: d7b7159bc8374e87d8c45a30377a3440  C:\Windows\System32\ntlanman.dll
MD5: eb77db354791a5932ca559b6f6374e95  C:\Windows\system32\ntshrui.dll
MD5: cdb029db496a0d9a3f1a422824b7b8fa  C:\Windows\system32\nvapi.dll
MD5: 6e58693ccb1c92109b099cbe4ad7696f  C:\Windows\system32\nvd3dum.dll
MD5: e7bcf8e0e4537108923d5e7599724c81  C:\Windows\system32\nvumdshim.dll
MD5: 7d34af98a706230cc2dedfe0cabf87ab  C:\Windows\system32\ODBC32.dll
MD5: 8e01332cc4b68bc6b5b7effe374442aa  C:\Windows\system32\OLEACC.dll
MD5: 703ffd301ab900b047337c5d40fd6f96  C:\Windows\system32\olepro32.dll
MD5: 414bba67a3ded1d28437eb66aeb8a720  C:\Windows\system32\pla.dll
MD5: e98278865e8daba21cfe5fe4be34210a  C:\Windows\system32\PortableDeviceApi.dll
MD5: 12c45e3cb6d65f73209549e2d02eca7a  C:\Windows\system32\PROPSYS.dll
MD5: dbc02d918fff1cad628acbe0c0eaa8e8  C:\Windows\system32\provsvc.dll
MD5: 48b32991b01ffa2535050d4457f4b6d3  C:\Windows\system32\RealMediaDX.ax
MD5: 102cf6879887bbe846a00c459e6d4abc  C:\Windows\system32\RICHED20.dll
MD5: 624293ccba93b2dd1c062894977e7dcc  C:\Windows\system32\RLAPEDec.ax
MD5: 39396c3c3e4fb46fb3e087d4101a30be  C:\Windows\system32\RLMPCDec.ax
MD5: 00817d79cc4282859e9f5685ba686469  C:\Windows\system32\RLOgg.ax
MD5: d126cd64568b093e6faddadce6fd0a47  C:\Windows\system32\RLSpeexDec.ax
MD5: 8bd08b7bef08cb2f576832e88c70de93  C:\Windows\system32\RLTheoraDec.ax
MD5: e25ed3eca867ee19be516528650e0506  C:\Windows\system32\RLVorbisDec.ax
MD5: d1d39debbe05b9e50c5aeb3ded2dd295  C:\Windows\system32\rnr20.dll
MD5: 5997d769cdb108390dcfaebf442bf816  C:\Windows\system32\RpcRtRemote.dll
MD5: 0915c4db6dbc3bb9e11b7ecbbe4b7159  C:\Windows\system32\rtutils.dll
MD5: 68ecca523ed760aafc03c5d587569859  C:\Windows\system32\SAMCLI.DLL
MD5: 6581b52e133cc6d00661c58968c7e212  C:\Windows\system32\SearchFolder.dll
MD5: 236f286e103fd44bd85fdd93097fd5dd  C:\Windows\system32\SearchIndexer.exe
MD5: a8ce0c7f1d37e0b8082608a148b6b976  C:\Windows\system32\Secur32.dll
MD5: 4ae380f39a0032eab7dd953030b26d28  C:\Windows\system32\sessenv.dll
MD5: be247ae996a9fde007a27b51413a6c79  C:\Windows\System32\shdocvw.dll
MD5: 414da952a35bf5d50192e28263b40577  C:\Windows\System32\shsvcs.dll
MD5: 5ccdcd40e732d54e0f7451ac66ac1c87  C:\Windows\system32\srvcli.dll
MD5: 6a1e8deb746912df47cf651e138401d7  C:\Windows\System32\StructuredQuery.dll
MD5: 919001d2bb17df06ca3f8ac16ad039f6  C:\Windows\system32\SXS.DLL
MD5: 71904b089f4a0d8f6bc46ce52a457836  C:\Windows\system32\TAKDSDecoder.ax
MD5: 6d8bdea7fb2e1a8461acd4970627e95a  C:\Windows\system32\TAKDSDecoder.dll
MD5: 613bf4820361543956909043a265c6ac  C:\Windows\System32\tapisrv.dll
MD5: 6db323f64f10dd6a8d9159dafa97fa41  C:\Windows\system32\TTADSDecoder.ax
MD5: 555c91496e3584b6fc00ca0a1ce899eb  C:\Windows\system32\TTADSSplitter.ax
MD5: d15618a0ff8dbc2c5bf3726bacc75a0b  C:\Windows\system32\USERENV.dll
MD5: 61ac3efdfacfdd3f0f11dd4fd4044223  C:\Windows\system32\userinit.exe
MD5: cfc7d8289d2b5f3cf8d16e2db7f93d4a  C:\Windows\system32\wbem\fastprox.dll
MD5: 704314fd398c81d5f342caa5df7b7f21  C:\Windows\system32\wbemcomn.dll
MD5: 34eee0dfaadb4f691d6d5308a51315dc  C:\Windows\System32\wcncsvc.dll
MD5: d205c24a9d069049fe2df2a1b38726a7  C:\Windows\system32\wdmaud.drv
MD5: a9d880f97530d5b8fee278923349929d  C:\Windows\System32\webclnt.dll
MD5: 02c61d8ad469417f5508225c75de3236  C:\Windows\system32\webio.dll
MD5: 1db71a41daee6b3f8cd0dda8209fa2d5  C:\Windows\system32\WindowsCodecs.dll
MD5: ca9f7888b524d8100b977c81f44c3234  C:\Windows\system32\WINHTTP.dll
MD5: d5aefad57c08349a4393d987df7c715d  C:\Windows\system32\WINMM.dll
MD5: 9e4b0e7472b4ceba9e17f440b8cb0ab8  C:\Windows\system32\WINSPOOL.DRV
MD5: 418e881201583a3039d81f43e39e6c78  C:\Windows\System32\WINSTA.dll
MD5: e5a4a1326a02f8e7b59e6c3270ce7202  C:\Windows\system32\wkscli.dll
MD5: 181f69bc9c406b7fb5c0ade8031630ac  C:\Windows\system32\wpdshext.dll
MD5: ac122407b29378ff9646f03404ac7c54  C:\Windows\system32\wshbth.dll
MD5: 1b91cd34ea3a90ab6a4ef0550174f4cc  C:\Windows\system32\WsmSvc.dll
MD5: 6a6b2ee4565a178035be2a4ff6f2c968  C:\Windows\system32\WTSAPI32.dll
MD5: edf2a5e96bec469da3f64e9bdd386111  C:\Windows\system32\xmllite.dll
MD5: d2958325c1ae1ae37a83334c6229e3bc  C:\Windows\SysWOW64\actxprxy.dll
MD5: 95e2376b3323f062eb562b8586d0f14a  C:\Windows\syswow64\ADVAPI32.dll
MD5: 7a6986dd659b96398a11af5173892715  C:\Windows\SysWOW64\Cabinet.dll
MD5: f436e847fa799ecd75ad8c313673f450  C:\Windows\syswow64\CFGMGR32.dll
MD5: d1de1eafde97be41cf6585027ff3e732  C:\Windows\syswow64\COMDLG32.dll
MD5: 4e5fe39c1076d115ec8bfcfe14d75b80  C:\Windows\SysWOW64\credssp.dll
MD5: 454e292861a4ef1d72f43f42bbaf6917  C:\Windows\syswow64\CRYPT32.dll
MD5: 465bea35f7ed4a4a57686dea7ea10f47  C:\Windows\SysWOW64\cscapi.dll
MD5: 2eeff4502f5e13b1bed4a04ccad64c08  C:\Windows\syswow64\DEVOBJ.dll
MD5: 162d247e995eaebf3ef4289069e1111c  C:\Windows\SysWOW64\DEVRTL.dll
MD5: b40420876b9288e0a1c8cca8a84e5dc9  C:\Windows\SysWOW64\dnsapi.DLL
MD5: d6d3ad7bf1d6f6ce9547613ed5e170a2  C:\Windows\syswow64\GDI32.dll
MD5: f0f079a8a947fcfbf8275be7ec1a35ae  C:\Windows\SysWOW64\ieframe.dll
MD5: 217557259182c86a6d3ade11bc42b74a  C:\Windows\syswow64\iertutil.dll
MD5: b2fd31e20b423335fe3273b4bf95813c  C:\Windows\syswow64\imagehlp.dll
MD5: a6f09e5669d9a19035f6d942caa15882  C:\Windows\syswow64\imm32.dll
MD5: 875e4e0661f3a5994df9e5e3a0a4f96b  C:\Windows\SysWOW64\IoctlSvc.exe
MD5: a90dc9abd65db1a8902f361103029952  C:\Windows\SysWOW64\iphlpapi.DLL
MD5: 3be120ba72475250fa6bfcb3bee6a7f7  C:\Windows\SysWOW64\jscript9.dll
MD5: 99c3f8e9cc59d95666eb8d8a8b4c2beb  C:\Windows\syswow64\kernel32.dll
MD5: 5c2d21c9b6b6175b89bc5d7e3cb979e1  C:\Windows\syswow64\KERNELBASE.dll
MD5: 938f39b50bafe13d6f58c7790682c010  C:\Windows\syswow64\MSASN1.dll
MD5: 04e0cd31a63dfc0d73725a3d1768fb5a  C:\Windows\SysWOW64\mshtml.dll
MD5: 35aae2e841aa1a949775168e119482c9  C:\Windows\SysWOW64\msls31.dll
MD5: 20b3934db73eaba2b49b7177873cb81f  C:\Windows\SysWOW64\netutils.dll
MD5: d124f55b9393c976963407dff51ffa79  C:\Windows\SysWOW64\ntdll.dll
MD5: 530d034baa914fa75568c9052629fb81  C:\Windows\SysWOW64\nvinit.dll
MD5: 928cf7268086631f54c3d8e17238c6dd  C:\Windows\syswow64\ole32.dll
MD5: 8e01332cc4b68bc6b5b7effe374442aa  C:\Windows\SysWOW64\OLEACC.dll
MD5: 6c765e82b57f2e66ce9c54ac238471d9  C:\Windows\syswow64\OLEAUT32.dll
MD5: c5ad8083cf94201f1f8084ecc696a8b7  C:\Windows\syswow64\RPCRT4.dll
MD5: 5997d769cdb108390dcfaebf442bf816  C:\Windows\SysWOW64\RpcRtRemote.dll
MD5: 0915c4db6dbc3bb9e11b7ecbbe4b7159  C:\Windows\SysWOW64\rtutils.dll
MD5: 68ecca523ed760aafc03c5d587569859  C:\Windows\SysWOW64\samcli.dll
MD5: 135f7ac9be35ab1df727faf2e60e92f8  C:\Windows\SysWOW64\schannel.dll
MD5: 10fb16b50affda6d44588f3c445dc273  C:\Windows\syswow64\SETUPAPI.dll
MD5: be247ae996a9fde007a27b51413a6c79  C:\Windows\SysWOW64\SHDOCVW.dll
MD5: 699b9dda17581b8e7f50a0ff05c7e102  C:\Windows\syswow64\SHELL32.dll
MD5: 8cc3c111d653e96f3ea1590891491d71  C:\Windows\syswow64\SHLWAPI.dll
MD5: 5ccdcd40e732d54e0f7451ac66ac1c87  C:\Windows\SysWOW64\srvcli.dll
MD5: 7224d964a6d657374c551c878eb2c386  C:\Windows\syswow64\SspiCli.dll
MD5: 919001d2bb17df06ca3f8ac16ad039f6  C:\Windows\SysWOW64\SXS.DLL
MD5: 3bf5881cb3d3402ade70be9e96e18c67  C:\Windows\syswow64\urlmon.dll
MD5: 5e0db2d8b2750543cd2ebb9ea8e6cdd3  C:\Windows\syswow64\USER32.dll
MD5: 804aaafebb3ad5f49334dd906bcb1de5  C:\Windows\syswow64\USP10.dll
MD5: 1db71a41daee6b3f8cd0dda8209fa2d5  C:\Windows\SysWOW64\WindowsCodecs.dll
MD5: d3788d91530cfa005bd516189a4c676e  C:\Windows\syswow64\WININET.dll
MD5: 2d0d2da87bea7144f2a17f19d0d17e4c  C:\Windows\syswow64\WINTRUST.dll
MD5: e5a4a1326a02f8e7b59e6c3270ce7202  C:\Windows\SysWOW64\wkscli.dll
MD5: a8bb45f9ecad993461e0fef8e2a99152  C:\Windows\syswow64\WLDAP32.dll
MD5: 7ff15a4f092cd4a96055ba69f903e3e9  C:\Windows\syswow64\WS2_32.dll
MD5: 8d25a3bf9d0005d264f105414ae2cde6  C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d4\MSVCP80.dll
MD5: 0ef2917efd6d96e4c9cf121738cf5409  C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d4\MSVCR80.dll
MD5: 8610c33279089d92cc8022d3d97f82d5  C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.5592_none_cbf62b764709d1c9\MFC80.DLL
MD5: bdac1aa64495d0f7e1ff810ebbf1f018  C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll
MD5: 352b3dc62a0d259a82a052238425c872  C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
MD5: 0029eba325f2fc9b6ba46bee33f32a09  C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll


Keine Dateien hochgeladen

Scan beendet - Kommunikation hat 3 Sek. gedauert
übertragene Daten - 0.03 MB gesendet, 1.42 KB empfangen
459 Dateien und Module geprüft - 135 seconds

==============================================================================
Habe aufgrund der Logfile, nach der Anwendung gesucht, allerdings nicht gefunden. Konnte zwar den Ordner "
C:\Users\Christian\M-1-52-5782-8752-5245\" öffnen, allerdings war darin keine Datei (Versteckte Ordner habe ich zuvor sichtbar gemacht) vorhanden.
Ich hoffe, dass mir jemand helfen kann ohne dass ich den kompletten Rechner formatieren muss (ich nutze übrigens Windows 7 - 64 Bit).

Vielen Dank im Voraus!!!

Freundliche Grüße

Christian

cosinus 02.11.2011 10:59
(1.) Attribute korrigieren

Das Handy ist wohl nicht infiziert aber die dort auf der Speicherkarte liegenden Ordner werden Versteckt- und Systemattribute bekommen haben, damit Windows diese in der Standardeinstellung nicht anzeigt.

Lass dir zuerst mal alle Dateien anzeigen => http://www.trojaner-board.de/59624-a...-sichtbar.html
Danach sollte auch alle Ordner wieder angezeigt werden - halbtransparent, da sie noch die Atrribute "versteckt" und "system" tragen

Starte anschließend die Eingabeaufforderung über Start, Alle Programme, Zubehör

Musst in der Eingabeauforderung jeweils für jeden versteckten Ordner diesen Befehl ausführen:

Code:
attrib -s -h "x:ordner" /s /d
x: => Muss angepasst werden, den passenden Buchstaben verwenden
"ordner" muss dann der jew. richtige Ordnername sein

Vgl. diesen Strang => http://www.trojaner-board.de/102950-...traeger-2.html


(2.) MBAM/ESET

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


chrisstar1 02.11.2011 15:56
So,
das mit dem Handy hat schonmal geklappt. :dankeschoen:
Woher weiß ich allerdings, ob der Wurm nicht noch irgendwo auf der Speicherkarte sitzt? Hat sich ja auch über den USB- Stick eingeschleust. Ich möchte nämlich nicht, dass ich dasselbe Problem bekomme, wenn ich das Handy mal an meinen Tower anschließe.
USB- Stick ist Clean, an anderem PC getestet, ohne Zwischenfall.

Allerdings kann ich ESET und die Aktualisierung von MBAM NICHT nutzen(siehe Screenshots)!

http://www.abload.de/img/mbamrrgg.jpg

http://www.abload.de/img/eset6efi.jpg


Deswegen hab ich mal MBAM OHNE vorherige Aktualisierung laufen lassen (logfile am Ende).

Mittlerweile finde ich auch die Datei.
So sieht es in dem Ordner aus:

http://www.abload.de/img/winsvctpm0.jpg

Im Ordner "Logs" ist eine logdatei enthalten.
Darin befindet sich folgender Code:

Code:
2011-11-01 20:20:40 unknown: cmmap_domap: avm_fritz_firewall_service_block: CreateFileMappingGlobal failed - Error 5 (5)
2011-11-01 20:20:40 unknown: cmmap_domap: avm_fritz_firewall_service_block: CreateFileMappingGlobal failed - Error 5 (5)
2011-11-01 20:20:40 unknown: cmmap_domap: avm_fritz_firewall_service_block: CreateFileMappingGlobal failed - Error 5 (5)
Kann ich die Datei einfach löschen, bzw. den Ordner. Ich schätze mal nicht, dass er sich im System ausgebreitet hat. Bzw. die Einträge in der Registry müssten ja auffindbar sein.

Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7622

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

02.11.2011 15:53:08
mbam-log-2011-11-02 (15-53-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 411597
Laufzeit: 50 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Chilipoker (PUP.Casino) -> Not selected for removal.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Poker\chilipoker\_setupcasino_4a50.exe (PUP.Casino) -> Not selected for removal.
c:\Users\christian\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\1FQT8483\testbundle23w_1254[1].exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\christian\AppData\Roaming\desktopicon\ebayshortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.
c:\Users\christian\exe dateien\setupcasino_4a50.exe (PUP.Casino) -> Not selected for removal.
c:\Users\christian\exe dateien\setuppoker_841794_de.exe (PUP.Casino) -> Not selected for removal.
Danke schonmal!

Freundliche Grüße

Christian


Edit 2:

Antivir findet keinen Virus, selbst wenn ich die Datei direkt scannen lasse (Antivir = Schrott?).
Komischerweise findet aber MBAM auch keinen Virus.


http://img88.imageshack.us/img88/8672/antivirklein.jpg

cosinus 02.11.2011 16:02
Bitte beachten und umsetzen => http://www.trojaner-board.de/94344-p...n-pruefen.html

Dann MBAM/ESET nochmal probieren und testen ob die Updates klappen.

chrisstar1 02.11.2011 18:40
Hallo,

also die Aktualisierung von MBAM hat geklappt. Bei ESET funktioniert es allerdings immer noch nicht. Er lädt immer bis 52%, dann kommt lange Zeit nichts und dann kommt dieser unexpected error 2002.
Allerdings hat MBAM den Trojaner jetzt gefunden und gelöscht. :taenzer:

Ich hoffe, dass damit alles wieder behoben ist.
Hier noch die logfile.

Denken Sie, dass ich das Handy problemlos an "nicht befallene" Rechner anschließen kann ohne mir Sorgen zu machen?

Danke nochmals!!!!

Freundliche Grüße

Christian

Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8069

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

02.11.2011 18:29:22
mbam-log-2011-11-02 (18-29-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 411365
Laufzeit: 49 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
c:\Users\christian\m-1-52-5782-8752-5245\winsvc.exe (Trojan.Agent) -> 4648 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Chilipoker (PUP.Casino) -> Not selected for removal.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows Update (Trojan.Agent) -> Value: Microsoft® Windows Update -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Poker\chilipoker\_setupcasino_4a50.exe (PUP.Casino) -> Not selected for removal.
c:\Users\christian\exe dateien\setupcasino_4a50.exe (PUP.Casino) -> Not selected for removal.
c:\Users\christian\exe dateien\setuppoker_841794_de.exe (PUP.Casino) -> Not selected for removal.
c:\Users\christian\m-1-52-5782-8752-5245\winsvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

cosinus 02.11.2011 20:21
Zitat:
Allerdings hat MBAM den Trojaner jetzt gefunden und gelöscht.
Selbst danach und anschließendem Windows-Neustart geht ESET immer noch nicht?

chrisstar1 02.11.2011 23:05
Nein, leider nicht(gerade nochmal getestet - wieder error 2002).
Denken Sie dass der Virus auch so nicht mehr vorhanden ist?
Wie sieht es mit dem Handy aus?

Freundliche Grüße

Christian

cosinus 03.11.2011 09:35
In einem Forum duzt man sich, also lass bitte die "Sie" Anrede.

Auf dem Rechner wird wohl noch mehr sein, aber das Handy wohl nicht betroffen abgesehen von der Speicherkarte, aber das kann so nciht das Handy-OS kompromittieren, deswegen schrieb ich ja auch

Zitat:
Zitat von cosinus
]Das Handy ist wohl nicht infiziert aber die dort auf der Speicherkarte liegenden Ordner werden Versteckt- und Systemattribute bekommen haben, damit Windows diese in der Standardeinstellung nicht anzeigt.


CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

chrisstar1 04.11.2011 00:23
Hallo,

alles klar, dann ab jetzt du :party:

Hier die logfile von OTL:

Code:
OTL logfile created on: 03.11.2011 17:47:32 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Christian\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,92 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 61,28% Memory free
7,83 Gb Paging File | 5,85 Gb Available in Paging File | 74,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 174,92 Gb Free Space | 37,56% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTIANLAPTOP | User Name: Christian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Christian\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
PRC - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
PRC - C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe ()
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Intel Corporation)
PRC - C:\Users\Christian\Local Settings\Apps\F.lux\flux.exe ()
PRC - C:\Program Files (x86)\FRITZ!DSL\StCenter.exe (AVM Berlin)
PRC - C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe (AVM Berlin)
PRC - C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
PRC - C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\MExplorer.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PhoneUpdate.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\Report.dll ()
MOD - C:\Program Files (x86)\PhraseExpress\pexlang.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\TMonitorAPI.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\VObject.dll ()
MOD - C:\Users\Christian\Local Settings\Apps\F.lux\flux.exe ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\sqlite3.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe (Logitech, Inc.)
SRV:64bit: - (EvtEng) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (msvsmon80) -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (Sony Ericsson PCCompanion) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (Bluetooth OBEX Service) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IGDCTRL) -- C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (PLFlash DeviceIoControl Service) -- C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LEqdUsb) -- C:\Windows\SysNative\drivers\LEqdUsb.sys (Logitech, Inc.)
DRV:64bit: - (LHidEqd) -- C:\Windows\SysNative\drivers\LHidEqd.sys (Logitech, Inc.)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (UimBus) -- C:\Windows\SysNative\drivers\uimx64.sys (Windows (R) 2000 DDK provider)
DRV:64bit: - (Uim_IM) -- C:\Windows\SysNative\drivers\Uim_IMx64.sys (Paragon)
DRV:64bit: - (hotcore3) -- C:\Windows\SysNative\drivers\hotcore3.sys (Paragon Software Group)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (btmaux) -- C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (AVPolCIR) -- C:\Windows\SysNative\drivers\AVPolCIR.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (AVerPola) -- C:\Windows\SysNative\drivers\AVerPola.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (AF9035BDA) -- C:\Windows\SysNative\drivers\AF15BDA.sys (ITETech                  )
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (BrSerIf) -- C:\Windows\SysNative\drivers\BrSerIf.sys (Brother Industries Ltd.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Christian\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Christian\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\neteller.desktop@klipfolio: C:\Program Files (x86)\NETELLER app\plugins\Firefox\neteller\ [2011.07.30 16:15:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.07.30 16:24:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.07.30 16:24:35 | 000,000,000 | ---D | M]
 
[2011.07.30 15:53:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\Application\15.0.874.106\pdf.dll
CHR - plugin: Mixesoft Click&Clean Plug-In (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.6.0.0_0\plugin/npccch32.dll
CHR - plugin: BitDefender QuickScan (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.6.0.0_0\plugin/npqscan.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Christian\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Xmarks Bookmark Sync = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\
CHR - Extension: Facebook Emotionenmaschine = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\baidofcbhhfddopoadebjdcmlignfdlf\1.1_0\
CHR - Extension: Turn Off the Lights = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.11_0\
CHR - Extension: WOT = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.3_0\
CHR - Extension: Web2PDFConverter = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkanhckocooacphbnclgcndnpfpoppdk\2.4.4_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.4_0\
CHR - Extension: AdBlock+ = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmimgmjdabgiilljdjfbonifbhiglao\1.1.9.18\
CHR - Extension: Ultimate Chrome Flag = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbpojpfdiliekbbiplijcphappgcgjfn\0.3.7_0\
CHR - Extension: Speed Dial = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpdioedihjhncjafcpgbbjdpbbkikmi\2.1_0\
CHR - Extension: YouTube mp3 = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkonfbfckdamohdkmechhhnnoblpbena\1.0\
CHR - Extension: FB Photo Zoom = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1109.26.1_0\
CHR - Extension: PanicButton = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\faminaibgiklngmfpfbhmokfmnglamcm\0.14_0\
CHR - Extension: Window Expander For YouTube = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkpaakpeehepibjpdmoocdaonognfiog\1.19_0\
CHR - Extension: Deaktivierungs-Add-on von Google Analytics = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fllaojicojecljbmefodhfapmkghcbnh\0.9.0\
CHR - Extension: Mail Checker Plus for Google Mail\u2122 = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gffjhibehnempbkeheiccaincokdjbfe\1.2.3.7_0\
CHR - Extension: Click&Clean = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\7.7.0.0_0\
CHR - Extension: AdBlock = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.4.18_0\
CHR - Extension: Music Video Lyrics for YouTube = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbegdicajmjmehcembhmpijdfdofobbh\1.2.1_0\
CHR - Extension: LastPass = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\1.75.14_0\
CHR - Extension: IE Tab = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd\2.5.24.1_0\
CHR - Extension: goo.gl URL Shortener = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\iblijlcdoidgdpfknkckljiocdbnlagk\0.7.2_0\
CHR - Extension: Forecastfox = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihffmkcfkejomlfnilnmkokcpgclhfeg\2.0.10_0\
CHR - Extension: Auto Replay for YouTube = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\kanbnempkjnhadplbfgdaagijdbdbjeb\1.9.8_0\
CHR - Extension: Watch Live Football World Cup Streaming = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\legocaboiicfjgofnmlgnogcngeokmga\1.41\
CHR - Extension: Smooth Gestures = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.9_0\
CHR - Extension: TrashMail.net for Google Chrome\u2122 = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpkbealomjndjpckajbnpakcoeelbpcf\1.0.3_0\
CHR - Extension: Clickable Links = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mblbciejcodpealifnhfjbdlkedplodp\1.1.2\
CHR - Extension: Google Dictionary (by Google) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja\3.0.1_0\
CHR - Extension: Docs Viewer f\u00FCr PDF/PowerPoint (von Google) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn\3.5_0\
CHR - Extension: AutoZoom = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocdkpkoaonnchdakgkmmcmnihhhgbjch\0.9.8_0\
CHR - Extension: AT_Yulia = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\onomgjhiigbnmhkghhpgdojopdlhddbe\2\
CHR - Extension: Browser Button for AdBlock = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\picdndbpdnapajibahnnogkjofaeooof\0.0.12_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No CLSID value found.
O2 - BHO: (Internet Explorer Form-Fill Plug-In) - {5425B4B8-87F9-4E9C-8B51-8AABA82EBA64} - C:\Program Files (x86)\NETELLER app\plugins\IE\Neteller.dll (NEOVIA Financial® Plc.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [StartupDelayer] C:\Program Files (x86)\r2 Studios\Startup Delayer\Startup Launcher.exe (r2 studios)
O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\Christian\Desktop\PartyPoker.lnk File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\Christian\Desktop\PartyPoker.lnk File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{16F1093F-4602-48E9-925A-28A7DAC20CB2}: NameServer = 172.21.0.2,172.21.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BC551083-B8E3-449B-BC67-3BEF1AD20660}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\Shell - "" = AutoRun
O33 - MountPoints2\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\Shell\AutoRun\command - "" = F:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {0835A5D5-91C3-4ACD-8256-30C23DEBC6F7} - Microsoft Visual Studio 2005 Professional Edition - DEU Service Pack 1 (KB926606)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {AEA17EF2-EF36-485F-8105-3465692A8C7B} - Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB932234)
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.i420 - i420vfw.dll File not found
Drivers32: vidc.yv12 - yv12vfw.dll File not found
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.02 23:53:33 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\MyPhoneExplorer
[2011.11.02 23:36:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
[2011.11.02 23:36:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPhoneExplorer
[2011.11.02 14:06:37 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Malwarebytes
[2011.11.02 14:06:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.11.02 14:06:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.11.02 14:06:10 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.11.02 14:06:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.11.01 22:51:32 | 002,226,176 | ---- | C] (Debenu Pty Ltd) -- C:\Windows\SysWow64\QuickPDFAX0726.dll
[2011.11.01 19:34:32 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\GlarySoft
[2011.11.01 19:30:23 | 000,000,000 | ---D | C] -- C:\Users\Christian\Desktop\PhraseExpress
[2011.11.01 19:13:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.11.01 19:04:03 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\QuickScan
[2011.10.31 18:23:38 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\Sony
[2011.10.31 18:23:24 | 000,000,000 | ---D | C] -- C:\Users\Christian\Podcasts
[2011.10.31 18:23:24 | 000,000,000 | ---D | C] -- C:\Users\Christian\Documents\Media Go
[2011.10.31 18:23:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2011.10.31 18:23:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sony Shared
[2011.10.31 18:22:38 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\Downloaded Installations
[2011.10.31 18:22:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Corporation
[2011.10.31 18:22:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2011.10.31 18:17:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Media Go Install
[2011.10.31 18:17:55 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Sony
[2011.10.31 18:11:50 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Nokia Ovi Suite
[2011.10.31 18:11:48 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Nokia
[2011.10.31 18:11:29 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\NokiaAccount
[2011.10.31 16:41:12 | 000,000,000 | R--D | C] -- C:\Users\Christian\Saved Games
[2011.10.31 16:11:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Ericsson
[2011.10.31 16:11:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony Ericsson
[2011.10.31 16:11:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Ericsson
[2011.10.20 11:35:04 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Avira
[2011.10.20 11:34:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.10.20 11:34:34 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.10.20 11:34:34 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.10.20 11:34:34 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.10.20 11:34:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.10.20 11:34:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2011.10.08 11:58:36 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\Microsoft Games
[2011.10.07 14:09:31 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2011.10.07 14:09:00 | 000,000,000 | ---D | C] -- C:\Users\Christian\Documents\FIFA 12
[2011.10.07 11:23:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FIFA 12
[2011.10.07 11:23:39 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller
[2011.10.05 15:23:42 | 001,883,136 | ---- | C] (Debenu Pty Ltd) -- C:\Windows\SysWow64\QuickPDFAX0717.dll
[2011.10.05 15:23:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adolix
[2011.10.05 15:23:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adolix
[2011.10.04 21:21:58 | 000,000,000 | ---D | C] -- C:\Poker
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.03 17:51:00 | 000,001,136 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1422517653-3478934543-1574387570-1000UA.job
[2011.11.03 15:02:09 | 001,646,190 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.11.03 15:02:09 | 000,711,136 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.03 15:02:09 | 000,662,716 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.11.03 15:02:09 | 000,153,652 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.03 15:02:09 | 000,124,030 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.11.03 13:51:00 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1422517653-3478934543-1574387570-1000Core.job
[2011.11.03 13:31:29 | 000,021,264 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.03 13:31:28 | 000,021,264 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.03 13:22:24 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2011.11.03 13:22:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.03 13:21:56 | 3153,690,624 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.02 23:36:18 | 000,002,061 | ---- | M] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk
[2011.11.02 19:57:26 | 004,546,730 | ---- | M] () -- C:\Users\Christian\Desktop\Praxis_6.pdf
[2011.11.02 19:17:40 | 000,002,350 | ---- | M] () -- C:\Users\Christian\Desktop\chinese-hut-14012837.png
[2011.11.02 19:17:34 | 000,005,508 | ---- | M] () -- C:\Users\Christian\Desktop\130 (1).png
[2011.11.02 19:17:30 | 000,006,089 | ---- | M] () -- C:\Users\Christian\Desktop\130.png
[2011.11.02 19:17:23 | 000,021,433 | ---- | M] () -- C:\Users\Christian\Desktop\foto-chinese-p18224.jpg
[2011.11.02 16:39:15 | 000,057,459 | ---- | M] () -- C:\Users\Christian\Desktop\antivir (Klein).jpg
[2011.11.02 16:15:53 | 000,275,771 | ---- | M] () -- C:\Users\Christian\Desktop\antivir.jpg
[2011.11.02 14:40:23 | 000,167,374 | ---- | M] () -- C:\Users\Christian\Desktop\winsvc.jpg
[2011.11.02 14:18:00 | 000,126,552 | ---- | M] () -- C:\Users\Christian\Desktop\eset.jpg
[2011.11.02 14:17:29 | 000,061,868 | ---- | M] () -- C:\Users\Christian\Desktop\mbam.jpg
[2011.10.31 18:10:01 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf
[2011.10.31 18:09:22 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ccdcmbx64_01009.Wdf
[2011.10.31 15:46:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.10.27 15:45:18 | 000,058,214 | ---- | M] () -- C:\Users\Christian\Desktop\choreo.jpg
[2011.10.20 11:52:42 | 000,720,728 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.10.20 11:28:58 | 000,001,238 | ---- | M] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2011.10.11 14:00:01 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.10.11 14:00:01 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.10.07 14:10:09 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
 
========== Files Created - No Company Name ==========
 
[2011.11.02 23:36:18 | 000,002,061 | ---- | C] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk
[2011.11.02 19:57:29 | 004,546,730 | ---- | C] () -- C:\Users\Christian\Desktop\Praxis_6.pdf
[2011.11.02 19:17:41 | 000,002,350 | ---- | C] () -- C:\Users\Christian\Desktop\chinese-hut-14012837.png
[2011.11.02 19:17:36 | 000,005,508 | ---- | C] () -- C:\Users\Christian\Desktop\130 (1).png
[2011.11.02 19:17:31 | 000,006,089 | ---- | C] () -- C:\Users\Christian\Desktop\130.png
[2011.11.02 19:17:26 | 000,021,433 | ---- | C] () -- C:\Users\Christian\Desktop\foto-chinese-p18224.jpg
[2011.11.02 16:39:15 | 000,057,459 | ---- | C] () -- C:\Users\Christian\Desktop\antivir (Klein).jpg
[2011.11.02 16:15:53 | 000,275,771 | ---- | C] () -- C:\Users\Christian\Desktop\antivir.jpg
[2011.11.02 14:40:23 | 000,167,374 | ---- | C] () -- C:\Users\Christian\Desktop\winsvc.jpg
[2011.11.02 14:18:00 | 000,126,552 | ---- | C] () -- C:\Users\Christian\Desktop\eset.jpg
[2011.11.02 14:17:29 | 000,061,868 | ---- | C] () -- C:\Users\Christian\Desktop\mbam.jpg
[2011.10.31 18:10:01 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf
[2011.10.31 18:09:22 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ccdcmbx64_01009.Wdf
[2011.10.31 15:46:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.10.27 15:45:26 | 000,058,214 | ---- | C] () -- C:\Users\Christian\Desktop\choreo.jpg
[2011.10.07 14:10:09 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2011.10.07 11:23:44 | 000,001,238 | ---- | C] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2011.10.04 21:22:02 | 000,000,746 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chilipoker.lnk
[2011.09.13 16:14:07 | 000,000,000 | RHS- | C] () -- C:\Windows\FFSSET.BIN
[2011.09.13 16:01:00 | 000,000,256 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2011.09.13 16:01:00 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2011.09.13 16:00:34 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.09.13 16:00:34 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.09.13 15:58:43 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\BrMuSNMP.dll
[2011.09.13 15:58:43 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini
[2011.09.13 15:58:43 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2011.09.13 15:55:37 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini
[2011.08.11 17:55:00 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.08.08 17:28:12 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.07.30 16:36:30 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.07.30 16:12:10 | 000,000,026 | ---- | C] () -- C:\Windows\Irremote.ini
[2011.07.30 15:27:29 | 000,000,306 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.07.30 12:06:48 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.07.30 12:06:47 | 000,206,952 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.07.30 12:06:44 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.05.20 21:35:28 | 000,304,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011.11.02 15:53:08 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Desktopicon
[2011.11.02 23:58:35 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\FRITZ!
[2011.11.01 19:34:32 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\GlarySoft
[2011.10.22 17:47:38 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ICQ
[2011.07.30 14:58:13 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Leadertech
[2011.11.02 23:53:34 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\MyPhoneExplorer
[2011.10.04 12:32:36 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\NETELLER app
[2011.11.03 17:54:53 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\NetSpeedMonitor
[2011.10.31 18:11:48 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Nokia
[2011.10.31 18:11:50 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Nokia Ovi Suite
[2011.07.30 16:36:20 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\OpenCandy
[2011.10.20 16:21:49 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Origin
[2011.10.31 18:11:31 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\PC Suite
[2011.07.30 15:46:28 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\PhraseExpress
[2011.11.01 22:09:15 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\QuickScan
[2011.07.30 19:45:52 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\r2 Studios
[2011.09.13 16:09:03 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ScanSoft
[2011.10.31 18:23:23 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Sony
[2011.08.08 19:05:23 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Synaptics
[2011.11.03 14:38:21 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TeraCopy
[2011.08.16 20:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TerraTec
[2011.07.30 15:53:04 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Toolbars
[2011.07.31 21:19:14 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TrueCrypt
[2011.09.13 16:09:16 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Zeon
[2011.11.03 13:22:24 | 000,000,334 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job
[2011.09.29 16:59:01 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.07.30 14:42:39 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Adobe
[2011.10.20 11:35:04 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Avira
[2011.09.14 10:48:07 | 000,000,000 | R--D | M] -- C:\Users\Christian\AppData\Roaming\Brother
[2011.08.01 16:43:48 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\CyberLink
[2011.11.02 15:53:08 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Desktopicon
[2011.11.02 23:58:35 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\FRITZ!
[2011.11.01 19:34:32 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\GlarySoft
[2011.07.30 14:38:59 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Google Chrome Backup
[2011.10.22 17:47:38 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ICQ
[2011.07.30 11:53:13 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Identities
[2011.07.30 12:00:48 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\InstallShield
[2011.07.30 14:27:10 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Intel
[2011.07.30 14:58:13 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Leadertech
[2011.07.30 14:55:39 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Logishrd
[2011.07.30 14:58:16 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Logitech
[2011.07.30 14:31:00 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Macromedia
[2011.11.02 14:06:37 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Malwarebytes
[2010.11.21 08:16:41 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Media Center Programs
[2011.10.27 15:51:52 | 000,000,000 | --SD | M] -- C:\Users\Christian\AppData\Roaming\Microsoft
[2011.07.30 16:31:57 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Mozilla
[2011.07.30 16:32:08 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Mozilla-Cache
[2011.11.02 23:53:34 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\MyPhoneExplorer
[2011.08.01 16:48:52 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\NCH Software
[2011.08.01 10:20:02 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Nero
[2011.10.04 12:32:36 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\NETELLER app
[2011.11.03 17:54:54 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\NetSpeedMonitor
[2011.10.31 18:11:48 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Nokia
[2011.10.31 18:11:50 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Nokia Ovi Suite
[2011.07.30 16:36:20 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\OpenCandy
[2011.10.20 16:21:49 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Origin
[2011.10.31 18:11:31 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\PC Suite
[2011.07.30 15:46:28 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\PhraseExpress
[2011.11.01 22:09:15 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\QuickScan
[2011.07.30 19:45:52 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\r2 Studios
[2011.09.13 16:14:40 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Reallusion
[2011.09.13 16:09:03 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ScanSoft
[2011.10.31 18:23:23 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Sony
[2011.08.08 19:05:23 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Synaptics
[2011.11.03 14:38:21 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TeraCopy
[2011.08.16 20:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TerraTec
[2011.07.30 15:53:04 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Toolbars
[2011.07.31 21:19:14 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TrueCrypt
[2011.08.29 15:50:56 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\WinRAR
[2011.09.13 16:09:16 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Zeon
 
< %APPDATA%\*.exe /s >
[2011.08.29 15:23:03 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\Christian\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
[2011.06.07 19:58:20 | 005,845,432 | ---- | M] (Uniblue Systems Ltd                                        ) -- C:\Users\Christian\AppData\Roaming\OpenCandy\OpenCandy_B5A65E3CA6D54FB6960071924AB91F5A\driverscanner (9).exe
[2011.07.30 16:36:22 | 000,416,160 | ---- | M] () -- C:\Users\Christian\AppData\Roaming\OpenCandy\OpenCandy_B5A65E3CA6D54FB6960071924AB91F5A\LatestDLMgr.exe
[2011.09.13 16:13:49 | 023,477,764 | ---- | M] (Macrovision Corporation) -- C:\Users\Christian\AppData\Roaming\Reallusion\BSandWBinstaller.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
Ich hoffe, dass du darin nicht schlechtes findest.

Freundliche Grüße

Christian

cosinus 04.11.2011 10:30
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\Shell - "" = AutoRun
O33 - MountPoints2\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\Shell\AutoRun\command - "" = F:\Startme.exe
O2 - BHO: (no name) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No CLSID value found.
[2011.11.01 22:51:32 | 002,226,176 | ---- | C] (Debenu Pty Ltd) -- C:\Windows\SysWow64\QuickPDFAX0726.dll
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

chrisstar1 04.11.2011 15:04
Alles klar, vielen Dank!!!

Kann ich den ersten OTL Code auch an meinen Kollegen weitergeben, damit er mal sein System scannt. (MBAM hat er schon ausgeführt).
ESET geht bei ihm genausowenig (wohnen in einem Studentenwohnheim mit mickrigem Internet).

Hier der Code vom OTL Fix:

Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ff8e516-03b7-11e1-a68c-88532e1c4ec6}\ not found.
File F:\Startme.exe not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ not found.
C:\Windows\SysWOW64\QuickPDFAX0726.dll moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: A002471
 
User: All Users
 
User: Christian
->Temp folder emptied: 723116164 bytes
->Temporary Internet Files folder emptied: 69670677 bytes
->Flash cache emptied: 2310 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: user
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32184 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 1307797 bytes
 
Total Files Cleaned = 757,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 11042011_145542

Files\Folders moved on Reboot...
C:\Users\Christian\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

cosinus 04.11.2011 15:39
Ich brauch den Quarantäneordner von OTL. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner MovedFiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

chrisstar1 06.11.2011 12:56
Habs gepackt und hochgeladen!

cosinus 07.11.2011 09:16
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

chrisstar1 07.11.2011 14:10
Hallo,

der Scan hat nichts gefunden :)
Für mich sind alle Ordner sichtbar. Zumindest habe ich noch kein Fehlen bemerkt, weswegen unhide denke ich erstmal nicht notwendig erscheint.

Hier die logfile von TDSSKiller:

Code:
14:07:54.0481 4568        TDSS rootkit removing tool 2.6.15.0 Nov  3 2011 17:15:49
14:07:56.0483 4568        ============================================================
14:07:56.0483 4568        Current date / time: 2011/11/07 14:07:56.0483
14:07:56.0483 4568        SystemInfo:
14:07:56.0483 4568       
14:07:56.0483 4568        OS Version: 6.1.7601 ServicePack: 1.0
14:07:56.0483 4568        Product type: Workstation
14:07:56.0483 4568        ComputerName: CHRISTIANLAPTOP
14:07:56.0483 4568        UserName: Christian
14:07:56.0483 4568        Windows directory: C:\Windows
14:07:56.0483 4568        System windows directory: C:\Windows
14:07:56.0483 4568        Running under WOW64
14:07:56.0483 4568        Processor architecture: Intel x64
14:07:56.0484 4568        Number of processors: 8
14:07:56.0484 4568        Page size: 0x1000
14:07:56.0484 4568        Boot type: Normal boot
14:07:56.0484 4568        ============================================================
14:07:57.0563 4568        Initialize success
14:08:36.0891 2200        ============================================================
14:08:36.0891 2200        Scan started
14:08:36.0891 2200        Mode: Manual; SigCheck; TDLFS;
14:08:36.0891 2200        ============================================================
14:08:36.0999 2200        1394ohci - ok
14:08:37.0007 2200        ACPI - ok
14:08:37.0014 2200        AcpiPmi - ok
14:08:37.0023 2200        adp94xx - ok
14:08:37.0029 2200        adpahci - ok
14:08:37.0039 2200        adpu320 - ok
14:08:37.0053 2200        AF9035BDA - ok
14:08:37.0067 2200        AFD - ok
14:08:37.0070 2200        agp440 - ok
14:08:37.0074 2200        aliide - ok
14:08:37.0077 2200        amdide - ok
14:08:37.0080 2200        AmdK8 - ok
14:08:37.0083 2200        AmdPPM - ok
14:08:37.0086 2200        amdsata - ok
14:08:37.0089 2200        amdsbs - ok
14:08:37.0093 2200        amdxata - ok
14:08:37.0135 2200        AppID - ok
14:08:37.0151 2200        arc - ok
14:08:37.0153 2200        arcsas - ok
14:08:37.0164 2200        AsyncMac - ok
14:08:37.0167 2200        atapi - ok
14:08:37.0183 2200        AVerPola - ok
14:08:37.0199 2200        avgntflt - ok
14:08:37.0211 2200        avipbb - ok
14:08:37.0215 2200        avkmgr - ok
14:08:37.0218 2200        AVPolCIR - ok
14:08:37.0224 2200        b06bdrv - ok
14:08:37.0235 2200        b57nd60a - ok
14:08:37.0246 2200        Beep - ok
14:08:37.0253 2200        blbdrive - ok
14:08:37.0280 2200        bowser - ok
14:08:37.0289 2200        BrFiltLo - ok
14:08:37.0291 2200        BrFiltUp - ok
14:08:37.0296 2200        Brserid - ok
14:08:37.0298 2200        BrSerIf - ok
14:08:37.0302 2200        BrSerWdm - ok
14:08:37.0304 2200        BrUsbMdm - ok
14:08:37.0306 2200        BrUsbSer - ok
14:08:37.0308 2200        BthEnum - ok
14:08:37.0311 2200        BTHMODEM - ok
14:08:37.0314 2200        BthPan - ok
14:08:37.0316 2200        BTHPORT - ok
14:08:37.0321 2200        BTHUSB - ok
14:08:37.0323 2200        btmaux - ok
14:08:37.0325 2200        btmhsf - ok
14:08:37.0328 2200        cdfs - ok
14:08:37.0331 2200        cdrom - ok
14:08:37.0336 2200        circlass - ok
14:08:37.0338 2200        CLFS - ok
14:08:37.0366 2200        clwvd - ok
14:08:37.0368 2200        CmBatt - ok
14:08:37.0370 2200        cmdide - ok
14:08:37.0373 2200        CNG - ok
14:08:37.0376 2200        Compbatt - ok
14:08:37.0379 2200        CompositeBus - ok
14:08:37.0382 2200        crcdisk - ok
14:08:37.0391 2200        DfsC - ok
14:08:37.0394 2200        discache - ok
14:08:37.0399 2200        Disk - ok
14:08:37.0413 2200        drmkaud - ok
14:08:37.0415 2200        DXGKrnl - ok
14:08:37.0419 2200        ebdrv - ok
14:08:37.0424 2200        elxstor - ok
14:08:37.0426 2200        ErrDev - ok
14:08:37.0435 2200        exfat - ok
14:08:37.0437 2200        fastfat - ok
14:08:37.0441 2200        fdc - ok
14:08:37.0445 2200        FileInfo - ok
14:08:37.0448 2200        Filetrace - ok
14:08:37.0450 2200        flpydisk - ok
14:08:37.0453 2200        FltMgr - ok
14:08:37.0457 2200        FsDepends - ok
14:08:37.0460 2200        Fs_Rec - ok
14:08:37.0463 2200        fvevol - ok
14:08:37.0465 2200        gagp30kx - ok
14:08:37.0469 2200        hcw85cir - ok
14:08:37.0471 2200        HdAudAddService - ok
14:08:37.0474 2200        HDAudBus - ok
14:08:37.0476 2200        HidBatt - ok
14:08:37.0479 2200        HidBth - ok
14:08:37.0482 2200        HidIr - ok
14:08:37.0486 2200        HidUsb - ok
14:08:37.0497 2200        hotcore3 - ok
14:08:37.0499 2200        HpSAMD - ok
14:08:37.0512 2200        HTTP - ok
14:08:37.0514 2200        hwpolicy - ok
14:08:37.0519 2200        i8042prt - ok
14:08:37.0524 2200        iaStorV - ok
14:08:37.0526 2200        iBtFltCoex - ok
14:08:37.0537 2200        igfx - ok
14:08:37.0540 2200        iirsp - ok
14:08:37.0545 2200        IntcAzAudAddService - ok
14:08:37.0553 2200        IntcDAud - ok
14:08:37.0556 2200        intelide - ok
14:08:37.0558 2200        intelppm - ok
14:08:37.0566 2200        IpFilterDriver - ok
14:08:37.0585 2200        IPMIDRV - ok
14:08:37.0599 2200        IPNAT - ok
14:08:37.0603 2200        IRENUM - ok
14:08:37.0609 2200        isapnp - ok
14:08:37.0612 2200        iScsiPrt - ok
14:08:37.0615 2200        kbdclass - ok
14:08:37.0618 2200        kbdhid - ok
14:08:37.0622 2200        KSecDD - ok
14:08:37.0624 2200        KSecPkg - ok
14:08:37.0626 2200        ksthunk - ok
14:08:37.0638 2200        LEqdUsb - ok
14:08:37.0640 2200        LHidEqd - ok
14:08:37.0643 2200        LHidFilt - ok
14:08:37.0646 2200        lltdio - ok
14:08:37.0651 2200        LMouFilt - ok
14:08:37.0659 2200        LSI_FC - ok
14:08:37.0662 2200        LSI_SAS - ok
14:08:37.0664 2200        LSI_SAS2 - ok
14:08:37.0666 2200        LSI_SCSI - ok
14:08:37.0669 2200        luafv - ok
14:08:37.0672 2200        megasas - ok
14:08:37.0675 2200        MegaSR - ok
14:08:37.0678 2200        MEIx64 - ok
14:08:37.0682 2200        Modem - ok
14:08:37.0684 2200        monitor - ok
14:08:37.0687 2200        mouclass - ok
14:08:37.0690 2200        mouhid - ok
14:08:37.0692 2200        mountmgr - ok
14:08:37.0695 2200        mpio - ok
14:08:37.0697 2200        mpsdrv - ok
14:08:37.0700 2200        MRxDAV - ok
14:08:37.0702 2200        mrxsmb - ok
14:08:37.0705 2200        mrxsmb10 - ok
14:08:37.0707 2200        mrxsmb20 - ok
14:08:37.0709 2200        msahci - ok
14:08:37.0712 2200        msdsm - ok
14:08:37.0717 2200        Msfs - ok
14:08:37.0720 2200        mshidkmdf - ok
14:08:37.0722 2200        msisadrv - ok
14:08:37.0727 2200        MSKSSRV - ok
14:08:37.0730 2200        MSPCLOCK - ok
14:08:37.0732 2200        MSPQM - ok
14:08:37.0735 2200        MsRPC - ok
14:08:37.0738 2200        mssmbios - ok
14:08:37.0764 2200        MSTEE - ok
14:08:37.0771 2200        MTConfig - ok
14:08:37.0773 2200        Mup - ok
14:08:37.0793 2200        NativeWifiP - ok
14:08:37.0804 2200        NDIS - ok
14:08:37.0807 2200        NdisCap - ok
14:08:37.0810 2200        NdisTapi - ok
14:08:37.0813 2200        Ndisuio - ok
14:08:37.0815 2200        NdisWan - ok
14:08:37.0828 2200        NDProxy - ok
14:08:37.0834 2200        NetBIOS - ok
14:08:37.0836 2200        NetBT - ok
14:08:37.0854 2200        NETwNs64 - ok
14:08:37.0857 2200        nfrd960 - ok
14:08:37.0879 2200        nmwcd - ok
14:08:37.0883 2200        nmwcdc - ok
14:08:37.0885 2200        Npfs - ok
14:08:37.0889 2200        nsiproxy - ok
14:08:37.0892 2200        Ntfs - ok
14:08:37.0894 2200        Null - ok
14:08:37.0897 2200        nusb3hub - ok
14:08:37.0899 2200        nusb3xhc - ok
14:08:37.0904 2200        nvlddmkm - ok
14:08:37.0907 2200        nvpciflt - ok
14:08:37.0911 2200        nvraid - ok
14:08:37.0914 2200        nvstor - ok
14:08:37.0919 2200        nv_agp - ok
14:08:37.0922 2200        ohci1394 - ok
14:08:37.0928 2200        Parport - ok
14:08:37.0931 2200        partmgr - ok
14:08:37.0935 2200        pccsmcfd - ok
14:08:37.0938 2200        pci - ok
14:08:37.0941 2200        pciide - ok
14:08:37.0943 2200        pcmcia - ok
14:08:37.0945 2200        pcw - ok
14:08:37.0948 2200        PEAUTH - ok
14:08:37.0969 2200        PptpMiniport - ok
14:08:37.0971 2200        Processor - ok
14:08:37.0977 2200        Psched - ok
14:08:37.0980 2200        qicflt - ok
14:08:37.0982 2200        ql2300 - ok
14:08:37.0985 2200        ql40xx - ok
14:08:37.0988 2200        QWAVEdrv - ok
14:08:37.0991 2200        RasAcd - ok
14:08:37.0994 2200        RasAgileVpn - ok
14:08:37.0998 2200        Rasl2tp - ok
14:08:38.0002 2200        RasPppoe - ok
14:08:38.0004 2200        RasSstp - ok
14:08:38.0007 2200        rdbss - ok
14:08:38.0009 2200        rdpbus - ok
14:08:38.0012 2200        RDPCDD - ok
14:08:38.0016 2200        RDPENCDD - ok
14:08:38.0020 2200        RDPREFMP - ok
14:08:38.0022 2200        RDPWD - ok
14:08:38.0025 2200        rdyboost - ok
14:08:38.0032 2200        RFCOMM - ok
14:08:38.0038 2200        rspndr - ok
14:08:38.0040 2200        RTL8167 - ok
14:08:38.0044 2200        sbp2port - ok
14:08:38.0048 2200        scfilter - ok
14:08:38.0053 2200        secdrv - ok
14:08:38.0060 2200        Serenum - ok
14:08:38.0064 2200        Serial - ok
14:08:38.0067 2200        sermouse - ok
14:08:38.0074 2200        sffdisk - ok
14:08:38.0077 2200        sffp_mmc - ok
14:08:38.0079 2200        sffp_sd - ok
14:08:38.0081 2200        sfloppy - ok
14:08:38.0087 2200        SiSRaid2 - ok
14:08:38.0089 2200        SiSRaid4 - ok
14:08:38.0092 2200        Smb - ok
14:08:38.0116 2200        spldr - ok
14:08:38.0125 2200        srv - ok
14:08:38.0127 2200        srv2 - ok
14:08:38.0130 2200        srvnet - ok
14:08:38.0136 2200        stexstor - ok
14:08:38.0141 2200        swenum - ok
14:08:38.0145 2200        SynTP - ok
14:08:38.0152 2200        Tcpip - ok
14:08:38.0155 2200        TCPIP6 - ok
14:08:38.0158 2200        tcpipreg - ok
14:08:38.0162 2200        TDPIPE - ok
14:08:38.0164 2200        TDTCP - ok
14:08:38.0166 2200        tdx - ok
14:08:38.0169 2200        TermDD - ok
14:08:38.0178 2200        truecrypt - ok
14:08:38.0183 2200        tssecsrv - ok
14:08:38.0185 2200        TsUsbFlt - ok
14:08:38.0188 2200        TsUsbGD - ok
14:08:38.0202 2200        tunnel - ok
14:08:38.0204 2200        uagp35 - ok
14:08:38.0207 2200        udfs - ok
14:08:38.0212 2200        UimBus - ok
14:08:38.0217 2200        Uim_IM - ok
14:08:38.0220 2200        uliagpkx - ok
14:08:38.0223 2200        umbus - ok
14:08:38.0226 2200        UmPass - ok
14:08:38.0231 2200        upperdev - ok
14:08:38.0234 2200        usbccgp - ok
14:08:38.0237 2200        usbcir - ok
14:08:38.0239 2200        usbehci - ok
14:08:38.0242 2200        usbhub - ok
14:08:38.0245 2200        usbohci - ok
14:08:38.0250 2200        usbprint - ok
14:08:38.0254 2200        usbscan - ok
14:08:38.0259 2200        usbser - ok
14:08:38.0262 2200        UsbserFilt - ok
14:08:38.0264 2200        USBSTOR - ok
14:08:38.0267 2200        usbuhci - ok
14:08:38.0269 2200        usbvideo - ok
14:08:38.0274 2200        vdrvroot - ok
14:08:38.0278 2200        vga - ok
14:08:38.0280 2200        VgaSave - ok
14:08:38.0283 2200        vhdmp - ok
14:08:38.0285 2200        viaide - ok
14:08:38.0288 2200        volmgr - ok
14:08:38.0290 2200        volmgrx - ok
14:08:38.0293 2200        volsnap - ok
14:08:38.0296 2200        vsmraid - ok
14:08:38.0299 2200        vwifibus - ok
14:08:38.0301 2200        vwififlt - ok
14:08:38.0304 2200        vwifimp - ok
14:08:38.0308 2200        WacomPen - ok
14:08:38.0312 2200        WANARP - ok
14:08:38.0315 2200        Wanarpv6 - ok
14:08:38.0322 2200        Wd - ok
14:08:38.0324 2200        Wdf01000 - ok
14:08:38.0334 2200        WfpLwf - ok
14:08:38.0337 2200        WIMMount - ok
14:08:38.0356 2200        WinUsb - ok
14:08:38.0360 2200        WmiAcpi - ok
14:08:38.0369 2200        ws2ifsl - ok
14:08:38.0374 2200        WSDPrintDevice - ok
14:08:38.0380 2200        WudfPf - ok
14:08:38.0383 2200        WUDFRd - ok
14:08:38.0396 2200        xusb21 - ok
14:08:38.0414 2200        MBR (0x1B8)    (7e234f3bea2eb69d133032ef8612e857) \Device\Harddisk0\DR0
14:08:38.0765 2200        \Device\Harddisk0\DR0 - ok
14:08:38.0771 2200        Boot (0x1200)  (58434028cba4c73a633239ec0b0ad9b7) \Device\Harddisk0\DR0\Partition0
14:08:38.0771 2200        \Device\Harddisk0\DR0\Partition0 - ok
14:08:38.0808 2200        Boot (0x1200)  (1e95a4495de2858b6d4f06a181ce181e) \Device\Harddisk0\DR0\Partition1
14:08:38.0809 2200        \Device\Harddisk0\DR0\Partition1 - ok
14:08:38.0810 2200        ============================================================
14:08:38.0810 2200        Scan finished
14:08:38.0810 2200        ============================================================
14:08:38.0831 6436        Detected object count: 0
14:08:38.0831 6436        Actual detected object count: 0

chrisstar1 07.11.2011 14:12
Das Tool hat nichts gefunden :)

Da ich kein Fehlen von bestimmten Ordnern entdeckt habe, müsste unhide erstmal zu vernachlässigen sein.

Hier die logfile von TDSSKiller:

Code:
14:07:54.0481 4568        TDSS rootkit removing tool 2.6.15.0 Nov  3 2011 17:15:49
14:07:56.0483 4568        ============================================================
14:07:56.0483 4568        Current date / time: 2011/11/07 14:07:56.0483
14:07:56.0483 4568        SystemInfo:
14:07:56.0483 4568       
14:07:56.0483 4568        OS Version: 6.1.7601 ServicePack: 1.0
14:07:56.0483 4568        Product type: Workstation
14:07:56.0483 4568        ComputerName: CHRISTIANLAPTOP
14:07:56.0483 4568        UserName: Christian
14:07:56.0483 4568        Windows directory: C:\Windows
14:07:56.0483 4568        System windows directory: C:\Windows
14:07:56.0483 4568        Running under WOW64
14:07:56.0483 4568        Processor architecture: Intel x64
14:07:56.0484 4568        Number of processors: 8
14:07:56.0484 4568        Page size: 0x1000
14:07:56.0484 4568        Boot type: Normal boot
14:07:56.0484 4568        ============================================================
14:07:57.0563 4568        Initialize success
14:08:36.0891 2200        ============================================================
14:08:36.0891 2200        Scan started
14:08:36.0891 2200        Mode: Manual; SigCheck; TDLFS;
14:08:36.0891 2200        ============================================================
14:08:36.0999 2200        1394ohci - ok
14:08:37.0007 2200        ACPI - ok
14:08:37.0014 2200        AcpiPmi - ok
14:08:37.0023 2200        adp94xx - ok
14:08:37.0029 2200        adpahci - ok
14:08:37.0039 2200        adpu320 - ok
14:08:37.0053 2200        AF9035BDA - ok
14:08:37.0067 2200        AFD - ok
14:08:37.0070 2200        agp440 - ok
14:08:37.0074 2200        aliide - ok
14:08:37.0077 2200        amdide - ok
14:08:37.0080 2200        AmdK8 - ok
14:08:37.0083 2200        AmdPPM - ok
14:08:37.0086 2200        amdsata - ok
14:08:37.0089 2200        amdsbs - ok
14:08:37.0093 2200        amdxata - ok
14:08:37.0135 2200        AppID - ok
14:08:37.0151 2200        arc - ok
14:08:37.0153 2200        arcsas - ok
14:08:37.0164 2200        AsyncMac - ok
14:08:37.0167 2200        atapi - ok
14:08:37.0183 2200        AVerPola - ok
14:08:37.0199 2200        avgntflt - ok
14:08:37.0211 2200        avipbb - ok
14:08:37.0215 2200        avkmgr - ok
14:08:37.0218 2200        AVPolCIR - ok
14:08:37.0224 2200        b06bdrv - ok
14:08:37.0235 2200        b57nd60a - ok
14:08:37.0246 2200        Beep - ok
14:08:37.0253 2200        blbdrive - ok
14:08:37.0280 2200        bowser - ok
14:08:37.0289 2200        BrFiltLo - ok
14:08:37.0291 2200        BrFiltUp - ok
14:08:37.0296 2200        Brserid - ok
14:08:37.0298 2200        BrSerIf - ok
14:08:37.0302 2200        BrSerWdm - ok
14:08:37.0304 2200        BrUsbMdm - ok
14:08:37.0306 2200        BrUsbSer - ok
14:08:37.0308 2200        BthEnum - ok
14:08:37.0311 2200        BTHMODEM - ok
14:08:37.0314 2200        BthPan - ok
14:08:37.0316 2200        BTHPORT - ok
14:08:37.0321 2200        BTHUSB - ok
14:08:37.0323 2200        btmaux - ok
14:08:37.0325 2200        btmhsf - ok
14:08:37.0328 2200        cdfs - ok
14:08:37.0331 2200        cdrom - ok
14:08:37.0336 2200        circlass - ok
14:08:37.0338 2200        CLFS - ok
14:08:37.0366 2200        clwvd - ok
14:08:37.0368 2200        CmBatt - ok
14:08:37.0370 2200        cmdide - ok
14:08:37.0373 2200        CNG - ok
14:08:37.0376 2200        Compbatt - ok
14:08:37.0379 2200        CompositeBus - ok
14:08:37.0382 2200        crcdisk - ok
14:08:37.0391 2200        DfsC - ok
14:08:37.0394 2200        discache - ok
14:08:37.0399 2200        Disk - ok
14:08:37.0413 2200        drmkaud - ok
14:08:37.0415 2200        DXGKrnl - ok
14:08:37.0419 2200        ebdrv - ok
14:08:37.0424 2200        elxstor - ok
14:08:37.0426 2200        ErrDev - ok
14:08:37.0435 2200        exfat - ok
14:08:37.0437 2200        fastfat - ok
14:08:37.0441 2200        fdc - ok
14:08:37.0445 2200        FileInfo - ok
14:08:37.0448 2200        Filetrace - ok
14:08:37.0450 2200        flpydisk - ok
14:08:37.0453 2200        FltMgr - ok
14:08:37.0457 2200        FsDepends - ok
14:08:37.0460 2200        Fs_Rec - ok
14:08:37.0463 2200        fvevol - ok
14:08:37.0465 2200        gagp30kx - ok
14:08:37.0469 2200        hcw85cir - ok
14:08:37.0471 2200        HdAudAddService - ok
14:08:37.0474 2200        HDAudBus - ok
14:08:37.0476 2200        HidBatt - ok
14:08:37.0479 2200        HidBth - ok
14:08:37.0482 2200        HidIr - ok
14:08:37.0486 2200        HidUsb - ok
14:08:37.0497 2200        hotcore3 - ok
14:08:37.0499 2200        HpSAMD - ok
14:08:37.0512 2200        HTTP - ok
14:08:37.0514 2200        hwpolicy - ok
14:08:37.0519 2200        i8042prt - ok
14:08:37.0524 2200        iaStorV - ok
14:08:37.0526 2200        iBtFltCoex - ok
14:08:37.0537 2200        igfx - ok
14:08:37.0540 2200        iirsp - ok
14:08:37.0545 2200        IntcAzAudAddService - ok
14:08:37.0553 2200        IntcDAud - ok
14:08:37.0556 2200        intelide - ok
14:08:37.0558 2200        intelppm - ok
14:08:37.0566 2200        IpFilterDriver - ok
14:08:37.0585 2200        IPMIDRV - ok
14:08:37.0599 2200        IPNAT - ok
14:08:37.0603 2200        IRENUM - ok
14:08:37.0609 2200        isapnp - ok
14:08:37.0612 2200        iScsiPrt - ok
14:08:37.0615 2200        kbdclass - ok
14:08:37.0618 2200        kbdhid - ok
14:08:37.0622 2200        KSecDD - ok
14:08:37.0624 2200        KSecPkg - ok
14:08:37.0626 2200        ksthunk - ok
14:08:37.0638 2200        LEqdUsb - ok
14:08:37.0640 2200        LHidEqd - ok
14:08:37.0643 2200        LHidFilt - ok
14:08:37.0646 2200        lltdio - ok
14:08:37.0651 2200        LMouFilt - ok
14:08:37.0659 2200        LSI_FC - ok
14:08:37.0662 2200        LSI_SAS - ok
14:08:37.0664 2200        LSI_SAS2 - ok
14:08:37.0666 2200        LSI_SCSI - ok
14:08:37.0669 2200        luafv - ok
14:08:37.0672 2200        megasas - ok
14:08:37.0675 2200        MegaSR - ok
14:08:37.0678 2200        MEIx64 - ok
14:08:37.0682 2200        Modem - ok
14:08:37.0684 2200        monitor - ok
14:08:37.0687 2200        mouclass - ok
14:08:37.0690 2200        mouhid - ok
14:08:37.0692 2200        mountmgr - ok
14:08:37.0695 2200        mpio - ok
14:08:37.0697 2200        mpsdrv - ok
14:08:37.0700 2200        MRxDAV - ok
14:08:37.0702 2200        mrxsmb - ok
14:08:37.0705 2200        mrxsmb10 - ok
14:08:37.0707 2200        mrxsmb20 - ok
14:08:37.0709 2200        msahci - ok
14:08:37.0712 2200        msdsm - ok
14:08:37.0717 2200        Msfs - ok
14:08:37.0720 2200        mshidkmdf - ok
14:08:37.0722 2200        msisadrv - ok
14:08:37.0727 2200        MSKSSRV - ok
14:08:37.0730 2200        MSPCLOCK - ok
14:08:37.0732 2200        MSPQM - ok
14:08:37.0735 2200        MsRPC - ok
14:08:37.0738 2200        mssmbios - ok
14:08:37.0764 2200        MSTEE - ok
14:08:37.0771 2200        MTConfig - ok
14:08:37.0773 2200        Mup - ok
14:08:37.0793 2200        NativeWifiP - ok
14:08:37.0804 2200        NDIS - ok
14:08:37.0807 2200        NdisCap - ok
14:08:37.0810 2200        NdisTapi - ok
14:08:37.0813 2200        Ndisuio - ok
14:08:37.0815 2200        NdisWan - ok
14:08:37.0828 2200        NDProxy - ok
14:08:37.0834 2200        NetBIOS - ok
14:08:37.0836 2200        NetBT - ok
14:08:37.0854 2200        NETwNs64 - ok
14:08:37.0857 2200        nfrd960 - ok
14:08:37.0879 2200        nmwcd - ok
14:08:37.0883 2200        nmwcdc - ok
14:08:37.0885 2200        Npfs - ok
14:08:37.0889 2200        nsiproxy - ok
14:08:37.0892 2200        Ntfs - ok
14:08:37.0894 2200        Null - ok
14:08:37.0897 2200        nusb3hub - ok
14:08:37.0899 2200        nusb3xhc - ok
14:08:37.0904 2200        nvlddmkm - ok
14:08:37.0907 2200        nvpciflt - ok
14:08:37.0911 2200        nvraid - ok
14:08:37.0914 2200        nvstor - ok
14:08:37.0919 2200        nv_agp - ok
14:08:37.0922 2200        ohci1394 - ok
14:08:37.0928 2200        Parport - ok
14:08:37.0931 2200        partmgr - ok
14:08:37.0935 2200        pccsmcfd - ok
14:08:37.0938 2200        pci - ok
14:08:37.0941 2200        pciide - ok
14:08:37.0943 2200        pcmcia - ok
14:08:37.0945 2200        pcw - ok
14:08:37.0948 2200        PEAUTH - ok
14:08:37.0969 2200        PptpMiniport - ok
14:08:37.0971 2200        Processor - ok
14:08:37.0977 2200        Psched - ok
14:08:37.0980 2200        qicflt - ok
14:08:37.0982 2200        ql2300 - ok
14:08:37.0985 2200        ql40xx - ok
14:08:37.0988 2200        QWAVEdrv - ok
14:08:37.0991 2200        RasAcd - ok
14:08:37.0994 2200        RasAgileVpn - ok
14:08:37.0998 2200        Rasl2tp - ok
14:08:38.0002 2200        RasPppoe - ok
14:08:38.0004 2200        RasSstp - ok
14:08:38.0007 2200        rdbss - ok
14:08:38.0009 2200        rdpbus - ok
14:08:38.0012 2200        RDPCDD - ok
14:08:38.0016 2200        RDPENCDD - ok
14:08:38.0020 2200        RDPREFMP - ok
14:08:38.0022 2200        RDPWD - ok
14:08:38.0025 2200        rdyboost - ok
14:08:38.0032 2200        RFCOMM - ok
14:08:38.0038 2200        rspndr - ok
14:08:38.0040 2200        RTL8167 - ok
14:08:38.0044 2200        sbp2port - ok
14:08:38.0048 2200        scfilter - ok
14:08:38.0053 2200        secdrv - ok
14:08:38.0060 2200        Serenum - ok
14:08:38.0064 2200        Serial - ok
14:08:38.0067 2200        sermouse - ok
14:08:38.0074 2200        sffdisk - ok
14:08:38.0077 2200        sffp_mmc - ok
14:08:38.0079 2200        sffp_sd - ok
14:08:38.0081 2200        sfloppy - ok
14:08:38.0087 2200        SiSRaid2 - ok
14:08:38.0089 2200        SiSRaid4 - ok
14:08:38.0092 2200        Smb - ok
14:08:38.0116 2200        spldr - ok
14:08:38.0125 2200        srv - ok
14:08:38.0127 2200        srv2 - ok
14:08:38.0130 2200        srvnet - ok
14:08:38.0136 2200        stexstor - ok
14:08:38.0141 2200        swenum - ok
14:08:38.0145 2200        SynTP - ok
14:08:38.0152 2200        Tcpip - ok
14:08:38.0155 2200        TCPIP6 - ok
14:08:38.0158 2200        tcpipreg - ok
14:08:38.0162 2200        TDPIPE - ok
14:08:38.0164 2200        TDTCP - ok
14:08:38.0166 2200        tdx - ok
14:08:38.0169 2200        TermDD - ok
14:08:38.0178 2200        truecrypt - ok
14:08:38.0183 2200        tssecsrv - ok
14:08:38.0185 2200        TsUsbFlt - ok
14:08:38.0188 2200        TsUsbGD - ok
14:08:38.0202 2200        tunnel - ok
14:08:38.0204 2200        uagp35 - ok
14:08:38.0207 2200        udfs - ok
14:08:38.0212 2200        UimBus - ok
14:08:38.0217 2200        Uim_IM - ok
14:08:38.0220 2200        uliagpkx - ok
14:08:38.0223 2200        umbus - ok
14:08:38.0226 2200        UmPass - ok
14:08:38.0231 2200        upperdev - ok
14:08:38.0234 2200        usbccgp - ok
14:08:38.0237 2200        usbcir - ok
14:08:38.0239 2200        usbehci - ok
14:08:38.0242 2200        usbhub - ok
14:08:38.0245 2200        usbohci - ok
14:08:38.0250 2200        usbprint - ok
14:08:38.0254 2200        usbscan - ok
14:08:38.0259 2200        usbser - ok
14:08:38.0262 2200        UsbserFilt - ok
14:08:38.0264 2200        USBSTOR - ok
14:08:38.0267 2200        usbuhci - ok
14:08:38.0269 2200        usbvideo - ok
14:08:38.0274 2200        vdrvroot - ok
14:08:38.0278 2200        vga - ok
14:08:38.0280 2200        VgaSave - ok
14:08:38.0283 2200        vhdmp - ok
14:08:38.0285 2200        viaide - ok
14:08:38.0288 2200        volmgr - ok
14:08:38.0290 2200        volmgrx - ok
14:08:38.0293 2200        volsnap - ok
14:08:38.0296 2200        vsmraid - ok
14:08:38.0299 2200        vwifibus - ok
14:08:38.0301 2200        vwififlt - ok
14:08:38.0304 2200        vwifimp - ok
14:08:38.0308 2200        WacomPen - ok
14:08:38.0312 2200        WANARP - ok
14:08:38.0315 2200        Wanarpv6 - ok
14:08:38.0322 2200        Wd - ok
14:08:38.0324 2200        Wdf01000 - ok
14:08:38.0334 2200        WfpLwf - ok
14:08:38.0337 2200        WIMMount - ok
14:08:38.0356 2200        WinUsb - ok
14:08:38.0360 2200        WmiAcpi - ok
14:08:38.0369 2200        ws2ifsl - ok
14:08:38.0374 2200        WSDPrintDevice - ok
14:08:38.0380 2200        WudfPf - ok
14:08:38.0383 2200        WUDFRd - ok
14:08:38.0396 2200        xusb21 - ok
14:08:38.0414 2200        MBR (0x1B8)    (7e234f3bea2eb69d133032ef8612e857) \Device\Harddisk0\DR0
14:08:38.0765 2200        \Device\Harddisk0\DR0 - ok
14:08:38.0771 2200        Boot (0x1200)  (58434028cba4c73a633239ec0b0ad9b7) \Device\Harddisk0\DR0\Partition0
14:08:38.0771 2200        \Device\Harddisk0\DR0\Partition0 - ok
14:08:38.0808 2200        Boot (0x1200)  (1e95a4495de2858b6d4f06a181ce181e) \Device\Harddisk0\DR0\Partition1
14:08:38.0809 2200        \Device\Harddisk0\DR0\Partition1 - ok
14:08:38.0810 2200        ============================================================
14:08:38.0810 2200        Scan finished
14:08:38.0810 2200        ============================================================
14:08:38.0831 6436        Detected object count: 0
14:08:38.0831 6436        Actual detected object count: 0

cosinus 07.11.2011 14:37
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

chrisstar1 07.11.2011 16:07
So, hier die log von ComboFix.

Das Programm hat mir "Lock.exe" gelöscht. Das war eine verschlüsselte Textfile von mir. Kann ich die wiederherstellen?

Code:
ComboFix 11-11-07.02 - Christian 07.11.2011  15:53:41.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4010.2385 [GMT 1:00]
ausgeführt von:: c:\users\Christian\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\users\Christian\AppData\Roaming\Desktopicon
c:\users\Christian\Lock.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-10-07 bis 2011-11-07  ))))))))))))))))))))))))))))))
.
.
2011-11-07 14:58 . 2011-11-07 14:58        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2011-11-07 14:58 . 2011-11-07 14:58        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-11-04 13:55 . 2011-11-06 10:45        --------        d-----w-        C:\_OTL
2011-11-02 13:06 . 2011-11-02 13:06        --------        d-----w-        c:\users\Christian\AppData\Roaming\Malwarebytes
2011-11-02 13:06 . 2011-11-02 13:06        --------        d-----w-        c:\programdata\Malwarebytes
2011-11-02 13:06 . 2011-11-02 13:06        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2011-11-02 13:06 . 2011-08-31 16:00        25416        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-11-01 18:34 . 2011-11-01 18:34        --------        d-----w-        c:\users\Christian\AppData\Roaming\GlarySoft
2011-11-01 18:13 . 2011-11-01 18:13        --------        d-----w-        c:\program files (x86)\ESET
2011-11-01 18:04 . 2011-11-01 21:09        --------        d-----w-        c:\users\Christian\AppData\Roaming\QuickScan
2011-10-31 17:23 . 2011-10-31 17:23        --------        d-----w-        c:\users\Christian\AppData\Local\Sony
2011-10-31 17:23 . 2011-10-31 17:23        --------        d-----w-        c:\users\Christian\Podcasts
2011-10-31 17:23 . 2011-10-31 17:23        --------        d-----w-        c:\program files (x86)\Common Files\Sony Shared
2011-10-31 17:22 . 2011-10-31 17:22        --------        d-----w-        c:\users\Christian\AppData\Local\Downloaded Installations
2011-10-31 17:22 . 2011-10-31 17:23        --------        d-----w-        c:\program files (x86)\Sony
2011-10-31 17:22 . 2011-10-31 17:22        --------        d-----w-        c:\programdata\Sony Corporation
2011-10-31 17:17 . 2011-10-31 17:23        --------        d-----w-        c:\users\Christian\AppData\Roaming\Sony
2011-10-31 17:17 . 2011-10-31 17:17        --------        d-----w-        c:\program files (x86)\Sony Media Go Install
2011-10-31 17:11 . 2011-10-31 17:11        --------        d-----w-        c:\users\Christian\AppData\Roaming\Nokia Ovi Suite
2011-10-31 17:11 . 2011-10-31 17:11        --------        d-----w-        c:\users\Christian\AppData\Roaming\Nokia
2011-10-31 17:11 . 2011-10-31 17:11        --------        d-----w-        c:\users\Christian\AppData\Local\NokiaAccount
2011-10-31 15:11 . 2011-10-31 15:11        --------        d-----w-        c:\programdata\Sony Ericsson
2011-10-31 15:11 . 2011-10-31 15:11        --------        d-----w-        c:\program files (x86)\Sony Ericsson
2011-10-20 10:36 . 2011-09-06 03:03        3138048        ----a-w-        c:\windows\system32\win32k.sys
2011-10-20 10:35 . 2011-08-17 05:26        613888        ----a-w-        c:\windows\system32\psisdecd.dll
2011-10-20 10:35 . 2011-08-17 05:25        108032        ----a-w-        c:\windows\system32\psisrndr.ax
2011-10-20 10:35 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\SysWow64\psisdecd.dll
2011-10-20 10:35 . 2011-08-17 04:19        75776        ----a-w-        c:\windows\SysWow64\psisrndr.ax
2011-10-20 10:35 . 2011-10-20 10:35        --------        d-----w-        c:\users\Christian\AppData\Roaming\Avira
2011-10-20 10:34 . 2011-08-27 05:37        861696        ----a-w-        c:\windows\system32\oleaut32.dll
2011-10-20 10:34 . 2011-08-27 05:37        331776        ----a-w-        c:\windows\system32\oleacc.dll
2011-10-20 10:34 . 2011-08-27 04:26        571904        ----a-w-        c:\windows\SysWow64\oleaut32.dll
2011-10-20 10:34 . 2011-08-27 04:26        233472        ----a-w-        c:\windows\SysWow64\oleacc.dll
2011-10-20 10:34 . 2011-10-11 13:00        97312        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2011-10-20 10:34 . 2011-10-11 13:00        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2011-10-20 10:34 . 2011-10-11 13:00        130760        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2011-10-20 10:34 . 2011-10-20 10:34        --------        d-----w-        c:\programdata\Avira
2011-10-20 10:34 . 2011-10-20 10:34        --------        d-----w-        c:\program files (x86)\Avira
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-25 11:37 . 2011-08-15 15:30        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-10-25 11:36 . 2011-08-15 15:30        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-10-07 09:52 . 2011-08-15 15:29        1092400        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-09-27 20:18 . 2011-08-28 20:38        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-09-27 20:18 . 2011-08-28 20:38        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-09-27 20:18 . 2011-08-28 20:37        1166144        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-08-29 14:23 . 2011-08-29 14:23        53248        ----a-r-        c:\users\Christian\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2006-05-03 10:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00        107520        --sha-r-        c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Companion"="c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-07-25 433360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartupDelayer"="c:\program files (x86)\r2 Studios\Startup Delayer\Startup Launcher.exe" [2009-03-08 73728]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2010-11-03 983104]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AF9035BDA;Cinergy T-Stick service;c:\windows\system32\DRIVERS\AF15BDA.sys [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2010-11-03 1298496]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-02 340240]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x64\msvsmon.exe [2005-12-09 4476096]
S0 hotcore3;hc3ServiceName;c:\windows\system32\DRIVERS\hotcore3.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-17 98208]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2010-11-03 897088]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files (x86)\FRITZ!DSL\IGDCTRL.EXE [2007-09-04 87344]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S3 AVerPola;AVerMedia USB Polaris Series Capture Service;c:\windows\system32\DRIVERS\AVerPola.sys [x]
S3 AVPolCIR;AVerMedia USB Polaris Series Custom IR Service;c:\windows\system32\DRIVERS\AVPolCIR.sys [x]
S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [x]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 99229976
*Deregistered* - 99229976
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-07 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2011-07-30 09:14]
.
2011-11-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1422517653-3478934543-1574387570-1000Core.job
- c:\users\Christian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-30 13:29]
.
2011-11-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1422517653-3478934543-1574387570-1000UA.job
- c:\users\Christian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-30 13:29]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-12-08 6560360]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-11-30 2186856]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2010-11-03 10228224]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-13 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-13 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-13 417304]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-11-02 1933584]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-06-23 1744152]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-05-21 326760]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2011-01-25 4479648]
"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.dell.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
LSP: c:\program files (x86)\FRITZ!DSL\\sarah.dll
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{16F1093F-4602-48E9-925A-28A7DAC20CB2}: NameServer = 172.21.0.2,172.21.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-11-07  15:59:54
ComboFix-quarantined-files.txt  2011-11-07 14:59
.
Vor Suchlauf: 16 Verzeichnis(se), 186.670.067.712 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 187.174.289.408 Bytes frei
.
- - End Of File - - 535F4211471B68552EEAA905502A7246

cosinus 07.11.2011 18:44
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

chrisstar1 08.11.2011 16:15
Hier die log von avast

Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-08 14:24:39
-----------------------------
14:24:39.434    OS Version: Windows x64 6.1.7601 Service Pack 1
14:24:39.434    Number of processors: 8 586 0x2A07
14:24:39.435    ComputerName: CHRISTIANLAPTOP  UserName: Christian
14:24:41.547    Initialize success
14:26:23.597    AVAST engine defs: 11110801
14:34:00.251    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
14:34:00.260    Disk 0 Vendor: ST9500420AS D005SDM1 Size: 476940MB BusType: 11
14:34:02.296    Disk 0 MBR read successfully
14:34:02.302    Disk 0 MBR scan
14:34:02.331    Disk 0 unknown MBR code
14:34:02.339    Service scanning
14:34:06.987    Modules scanning
14:34:06.993    Disk 0 trace - called modules:
14:34:07.048    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
14:34:07.054    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d39790]
14:34:07.066    3 CLASSPNP.SYS[fffff880019bc43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80049691f0]
14:34:14.505    AVAST engine scan C:\Windows
14:34:14.523    AVAST engine scan C:\Windows\system32
14:34:14.867    AVAST engine scan C:\Windows\system32\drivers
14:34:14.881    AVAST engine scan C:\Users\Christian
14:34:14.895    AVAST engine scan C:\ProgramData
14:34:14.905    Scan finished successfully
16:11:49.449    Disk 0 MBR has been saved successfully to "C:\Users\Christian\Downloads\MBR.dat"
16:11:49.453    The log file has been saved successfully to "C:\Users\Christian\Downloads\aswMBR.txt"

cosinus 08.11.2011 16:16
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

chrisstar1 08.11.2011 18:34
Habe grade keine Festplatte da... die hab ich frühestens wieder am Wochenende...
Wie gefährlich ist denn das Teil und ist es wirklich notwendig?
Die letzten Scans verliefen doch positiv...

cosinus 08.11.2011 20:04
Der MBR ist aber unbekannt und deswegen sollte er gefixt werden

chrisstar1 08.11.2011 21:31
mmh... ok... wie oft "zerschießt" man sich denn sein System damit?
Will nur nicht mein komplettes System kaputt machen...

Freundliche Grüße

Christian

cosinus 09.11.2011 09:45
Ich schrieb ja: in den meisten Fällen geht alles glatt. Aber eine Datensicherung sollte man immer haben, egal ob man am MBR was macht oder nicht. Aber gerade vor solchen Eingriffen kann ein Backups nicht schaden bzw. ist sinnvoll.

chrisstar1 09.11.2011 17:30
So, hab gefixt.
Hier die log

Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-08 14:24:39
-----------------------------
14:24:39.434    OS Version: Windows x64 6.1.7601 Service Pack 1
14:24:39.434    Number of processors: 8 586 0x2A07
14:24:39.435    ComputerName: CHRISTIANLAPTOP  UserName: Christian
14:24:41.547    Initialize success
14:26:23.597    AVAST engine defs: 11110801
14:34:00.251    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
14:34:00.260    Disk 0 Vendor: ST9500420AS D005SDM1 Size: 476940MB BusType: 11
14:34:02.296    Disk 0 MBR read successfully
14:34:02.302    Disk 0 MBR scan
14:34:02.331    Disk 0 unknown MBR code
14:34:02.339    Service scanning
14:34:06.987    Modules scanning
14:34:06.993    Disk 0 trace - called modules:
14:34:07.048    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
14:34:07.054    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d39790]
14:34:07.066    3 CLASSPNP.SYS[fffff880019bc43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80049691f0]
14:34:14.505    AVAST engine scan C:\Windows
14:34:14.523    AVAST engine scan C:\Windows\system32
14:34:14.867    AVAST engine scan C:\Windows\system32\drivers
14:34:14.881    AVAST engine scan C:\Users\Christian
14:34:14.895    AVAST engine scan C:\ProgramData
14:34:14.905    Scan finished successfully
16:11:49.449    Disk 0 MBR has been saved successfully to "C:\Users\Christian\Downloads\MBR.dat"
16:11:49.453    The log file has been saved successfully to "C:\Users\Christian\Downloads\aswMBR.txt"


aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-09 17:27:51
-----------------------------
17:27:51.033    OS Version: Windows x64 6.1.7601 Service Pack 1
17:27:51.033    Number of processors: 8 586 0x2A07
17:27:51.034    ComputerName: CHRISTIANLAPTOP  UserName: Christian
17:27:57.067    Initialize success
17:27:58.370    AVAST engine defs: 11110900
17:28:05.929    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
17:28:05.935    Disk 0 Vendor: ST9500420AS D005SDM1 Size: 476940MB BusType: 11
17:28:08.007    Disk 0 MBR read successfully
17:28:08.014    Disk 0 MBR scan
17:28:08.021    Disk 0 unknown MBR code
17:28:08.027    Service scanning
17:28:13.253    Modules scanning
17:28:13.258    Disk 0 trace - called modules:
17:28:13.270    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
17:28:13.276    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d39790]
17:28:13.281    3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800496a060]
17:28:17.049    AVAST engine scan C:\Windows
17:28:17.066    AVAST engine scan C:\Windows\system32
17:28:17.398    AVAST engine scan C:\Windows\system32\drivers
17:28:17.415    AVAST engine scan C:\Users\Christian
17:28:17.430    AVAST engine scan C:\ProgramData
17:28:17.440    Scan finished successfully
17:28:40.090    Verifying
17:28:50.108    Disk 0 Windows 601 MBR fixed successfully
17:29:07.900    Disk 0 MBR has been saved successfully to "C:\Users\Christian\Downloads\MBR.dat"
17:29:07.926    The log file has been saved successfully to "C:\Users\Christian\Downloads\aswMBR.txt"


aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-09 17:27:51
-----------------------------
17:27:51.033    OS Version: Windows x64 6.1.7601 Service Pack 1
17:27:51.033    Number of processors: 8 586 0x2A07
17:27:51.034    ComputerName: CHRISTIANLAPTOP  UserName: Christian
17:27:57.067    Initialize success
17:27:58.370    AVAST engine defs: 11110900
17:28:05.929    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
17:28:05.935    Disk 0 Vendor: ST9500420AS D005SDM1 Size: 476940MB BusType: 11
17:28:08.007    Disk 0 MBR read successfully
17:28:08.014    Disk 0 MBR scan
17:28:08.021    Disk 0 unknown MBR code
17:28:08.027    Service scanning
17:28:13.253    Modules scanning
17:28:13.258    Disk 0 trace - called modules:
17:28:13.270    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
17:28:13.276    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d39790]
17:28:13.281    3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800496a060]
17:28:17.049    AVAST engine scan C:\Windows
17:28:17.066    AVAST engine scan C:\Windows\system32
17:28:17.398    AVAST engine scan C:\Windows\system32\drivers
17:28:17.415    AVAST engine scan C:\Users\Christian
17:28:17.430    AVAST engine scan C:\ProgramData
17:28:17.440    Scan finished successfully
17:28:40.090    Verifying
17:28:50.108    Disk 0 Windows 601 MBR fixed successfully
17:29:07.900    Disk 0 MBR has been saved successfully to "C:\Users\Christian\Downloads\MBR.dat"
17:29:07.926    The log file has been saved successfully to "C:\Users\Christian\Downloads\aswMBR.txt"
17:29:11.928    Disk 0 MBR has been saved successfully to "C:\Users\Christian\Downloads\MBR.dat"
17:29:11.932    The log file has been saved successfully to "C:\Users\Christian\Downloads\aswMBR.txt"

cosinus 10.11.2011 10:23
Zitat:
17:28:08.021 Disk 0 unknown MBR code
hast du den wirklich gefixt? aswMBR zeigt den immer noch als unbekannt an.

chrisstar1 14.11.2011 21:12
Das Problem war, dass ich mit True Crypt meine Festplatte verschlüsselt habe. Durch den Fix hab ich mir jetzt meinen Rechner geschrottet. Heißt: ich konnte nicht mehr starten, da der Bootloader zerschossen wurde. Zum Glück zwingt True Crypt einen dazu eine Rescue- Disc zu erstellen, so konnte ich ihn retten. Das mit dem Fixen war keine so gute Idee :nono:
Aber trotzdem DANKE für die ganze Hilfe hier!

cosinus 15.11.2011 08:51
Naja, ein Hinweis von dir, du hast deine gesamte Platte mit TC verschlüsselt wäre ebenfalls schön gewesen. Zum Glück hast du die Rescuedisc erstellt.

Zitat:
Das mit dem Fixen war keine so gute Idee
Joa, aber Daten solltest du ja eh vor dem Fix alle sichern für den Fall der Fälle. :pfeiff:

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Alle Zeitangaben in WEZ +1. Es ist jetzt 11:12 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131