Trojaner-Board - Trotz Trojaner-Löschung durch Malwarebytes leitet Google Seiten um

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trotz Trojaner-Löschung durch Malwarebytes leitet Google Seiten um (https://www.trojaner-board.de/106122-trotz-trojaner-loeschung-malwarebytes-leitet-google-seiten-um.html)

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Seccenter::

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {855D5594-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Outdated* {00000000-0000-0000-0000-000000000000}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84869404-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D53A4C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D53C0C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D5E5F4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D60BFC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D6848C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D6ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D773F4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D94DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {860C7BFC-FFA4-00DE-0D24-347CA8A3377C}

AV: F-Secure Internet Security 2011 10.51 *Enabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}

FW: F-Secure Internet Security 2011 10.51 *Enabled* {D4747503-0346-49EB-9262-997542F79BF4}
 

File::

c:\dokumente und einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\BIT5.tmp

c:\dokumente und einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\BIT4.tmp
 

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1509:TCP"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"=-
 

Driver::

zokjjwtvg

cvshvrfxt
 

Netsvc::

zokjjwtvg

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Combofix Logfile:

Code:

ComboFix 11-12-13.02 - xxx 14.12.2011  15:28:06.2.2 - x86

Microsoft Windows XP Home Edition  5.1.2600.2.1252.49.1031.18.1022.632 [GMT 1:00]

ausgeführt von:: c:\dokumente und einstellungen\xxx\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\xxx\Desktop\CFScript.txt

.

FILE ::

"c:\dokumente und einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\BIT4.tmp"

"c:\dokumente und einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\BIT5.tmp"

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_ZOKJJWTVG

-------\Service_zokjjwtvg

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-11-14 bis 2011-12-14  ))))))))))))))))))))))))))))))

.

.

2011-12-13 17:09 . 2011-12-13 17:09        --------        d-----w-        C:\_OTL

2011-12-12 18:47 . 2011-12-12 18:47        --------        d-----w-        c:\programme\ESET

2011-12-11 18:21 . 2011-12-11 18:21        388096        ----a-r-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-12-11 18:21 . 2011-12-11 18:21        --------        d-----w-        c:\programme\Trend Micro

2011-12-11 13:40 . 2011-12-11 13:40        --------        d-----w-        c:\programme\CCleaner

2011-12-10 17:42 . 2011-08-31 16:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-10 17:42 . 2011-12-12 18:44        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-11-27 15:30 . 2011-11-27 15:30        --------        d-----w-        c:\dokumente und einstellungen\Alina\Anwendungsdaten\SunODFPluginforMicrosoftOffice

2011-11-27 15:23 . 2011-11-27 15:23        --------        d-----w-        c:\programme\Sun

2011-11-20 13:25 . 2011-11-20 13:25        361288        ----a-w-        c:\windows\system32\TuneUpDefragService.exe

2011-11-20 12:31 . 1997-01-15 22:21        164352        ----a-w-        c:\programme\Gemeinsame Dateien\Microsoft Shared\PROOF\1031\WTSP61MS.DLL

2011-11-20 12:31 . 1997-01-15 22:14        21504        ----a-w-        c:\programme\Gemeinsame Dateien\Microsoft Shared\PROOF\1031\WTCC61DE.DLL

2011-11-20 12:31 . 1999-06-20 09:26        1486902        ----a-w-        c:\programme\Gemeinsame Dateien\Microsoft Shared\PROOF\1033\MSGR2EN.DLL

2011-11-18 16:58 . 2011-11-18 16:58        --------        d-----w-        c:\windows\system32\custom matrices

2011-11-18 16:58 . 2011-11-18 16:59        --------        d-----w-        c:\windows\system32\C2MP

2011-11-18 16:58 . 2011-11-18 16:58        --------        d-----w-        c:\windows\system32\QuickTime

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 11:02 . 2011-04-13 11:02        5080064        ----a-w-        c:\programme\MusicBee.exe

2011-03-22 10:05 . 2011-03-22 10:05        168960        ----a-w-        c:\programme\Skybound.Gecko.dll

2011-03-05 08:50 . 2011-03-05 08:50        2761216        ----a-w-        c:\programme\MusicBeeIPod.dll

2011-02-28 17:30 . 2011-02-28 17:30        11848        ----a-w-        c:\programme\basswasapi.dll

2011-01-06 23:36 . 2011-01-06 23:36        108544        ----a-w-        c:\programme\tak_deco_lib.dll

2011-01-05 17:27 . 2011-01-05 17:27        28160        ----a-w-        c:\programme\IPhoneConnector.dll

2010-12-18 16:58 . 2010-12-18 16:58        38400        ----a-w-        c:\programme\RemoveDrive.exe

2010-11-30 13:26 . 2010-11-30 13:26        92216        ----a-w-        c:\programme\bass.dll

2010-11-25 18:44 . 2010-11-25 18:44        17472        ----a-w-        c:\programme\bassmix.dll

2010-09-17 12:28 . 2010-09-17 12:28        17472        ----a-w-        c:\programme\basswma.dll

2010-07-31 17:06 . 2010-07-31 17:06        1009664        ----a-w-        c:\programme\aacgain.exe

2010-07-23 15:43 . 2010-07-23 15:43        122992        ----a-w-        c:\programme\mp3gain.exe

2010-02-04 22:31 . 2010-02-04 22:31        655360        ----a-w-        c:\programme\BASS_SFX.dll

2009-12-17 23:07 . 2009-12-17 23:07        29784        ----a-w-        c:\programme\bass_fx.dll

2009-12-16 20:21 . 2009-12-16 20:21        127488        ----a-w-        c:\programme\lossyWAV.exe

2009-12-09 11:40 . 2009-12-09 11:40        25152        ----a-w-        c:\programme\bassflac.dll

2009-12-02 16:37 . 2009-12-02 16:37        17472        ----a-w-        c:\programme\basscd.dll

2009-12-01 15:17 . 2009-12-01 15:17        12352        ----a-w-        c:\programme\bassenc.dll

2009-10-30 09:30 . 2009-10-30 09:30        14336        ----a-w-        c:\programme\bass_wadsp.dll

2009-10-28 13:03 . 2009-10-28 13:03        12488        ----a-w-        c:\programme\bass_alac.dll

2009-08-30 12:53 . 2009-08-30 12:53        159232        ----a-w-        c:\programme\System.Data.SQLite.dll

2009-08-23 10:55 . 2009-08-23 10:55        41472        ----a-w-        c:\programme\icu.net.dll

2009-08-03 10:17 . 2009-08-03 10:17        33624        ----a-w-        c:\programme\bass_ape.dll

2009-07-13 14:50 . 2009-07-13 14:50        28224        ----a-w-        c:\programme\basswv.dll

2009-07-08 05:31 . 2009-07-08 05:31        69632        ----a-w-        c:\programme\zlib.net.dll

2009-05-22 13:55 . 2009-05-22 13:55        21320        ----a-w-        c:\programme\bass_mpc.dll

2009-04-24 10:20 . 2009-04-24 10:20        5960        ----a-w-        c:\programme\bass_ofr.dll

2009-04-02 21:40 . 2009-04-02 21:40        145408        ----a-w-        c:\programme\mpcgain.exe

2008-12-26 11:39 . 2008-12-26 11:39        94208        ----a-w-        c:\programme\Interop.QTOLibrary.dll

2008-12-26 11:39 . 2008-12-26 11:39        32768        ----a-w-        c:\programme\Interop.QTOControlLib.dll

2008-12-26 11:39 . 2008-12-26 11:39        28672        ----a-w-        c:\programme\AxInterop.QTOControlLib.dll

2008-11-14 08:34 . 2008-11-14 08:34        143360        ----a-w-        c:\programme\hdcd.exe

2008-11-03 09:09 . 2008-11-03 09:09        3100672        ----a-w-        c:\programme\mipcore.exe

2008-11-03 09:09 . 2008-11-03 09:09        2408448        ----a-w-        c:\programme\genpuid.exe

2008-11-03 09:09 . 2008-11-03 09:09        188416        ----a-w-        c:\programme\AACTagReader.exe

2008-11-03 09:09 . 2008-11-03 09:09        147456        ----a-w-        c:\programme\libexpat.dll

2008-10-19 10:59 . 2008-10-19 10:59        266240        ----a-w-        c:\programme\metaflac.exe

2008-09-15 19:30 . 2008-09-15 19:30        163840        ----a-w-        c:\programme\VorbisGain.exe

2008-09-15 19:29 . 2008-09-15 19:29        192512        ----a-w-        c:\programme\wvgain.exe

2008-09-02 20:47 . 2008-09-02 20:47        274432        ----a-w-        c:\programme\Interop.WMPLib.dll

2008-08-27 16:00 . 2008-08-27 16:00        141312        ----a-w-        c:\programme\SnarlConnector.dll

2008-06-11 10:19 . 2008-06-11 10:19        12864        ----a-w-        c:\programme\bassasio.dll

2008-03-24 13:07 . 2008-03-24 13:07        25152        ----a-w-        c:\programme\bassmidi.dll

2008-02-27 19:49 . 2008-02-27 19:49        8536        ----a-w-        c:\programme\bass_tta.dll

2008-02-27 16:25 . 2008-02-27 16:25        47936        ----a-w-        c:\programme\bass_spx.dll

2006-03-04 02:52 . 2006-03-04 02:52        88576        ----a-w-        c:\programme\OptimFROG.dll

2011-03-18 17:56 . 2011-04-19 10:05        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

(((((((((((((((((((((((((((((   SnapShot@2011-12-13_20.51.41   )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-12-14 14:38 . 2011-12-14 14:38        16384              c:\windows\Temp\Perflib_Perfdata_c74.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccleaner"="c:\programme\CCleaner\CCleaner.exe" [2011-11-28 2682688]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]

"RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15691264]

"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 88203]

"THotkey"="c:\programme\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]

"TPSMain"="TPSMain.exe" [2005-08-03 266240]

"SmoothView"="c:\programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe" [2005-05-13 118784]

"TDispVol"="TDispVol.exe" [2005-09-16 73728]

"IntelZeroConfig"="c:\programme\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]

"IntelWireless"="c:\programme\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]

"F-Secure Manager"="c:\programme\F-Secure\Common\FSM32.EXE" [2011-05-24 201384]

"F-Secure TNB"="c:\programme\F-Secure\FSGUI\TNBUtil.exe" [2011-05-24 1655464]

"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Acrobat Assistant.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk

backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk

backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk

backup=c:\windows\pss\Adobe Reader - Schnellstart.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]

2009-09-05 15:29        385024        ----a-w-        c:\programme\FreePDF_XP\fpassist.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

"TOSCDSPD"=c:\programme\TOSHIBA\TOSCDSPD\toscdspd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"HP Software Update"=d:\hp software update\HPWuSchd2.exe

"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot

"TFncKy"=TFncKy.exe

"V0470Mon.exe"=c:\windows\V0470Mon.exe

"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

"Tvs"=c:\programme\TOSHIBA\Tvs\TvsTray.exe

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"iTunesHelper"="h:\itunes\iTunesHelper.exe"

"DLA"=c:\windows\System32\DLA\DLACTRLW.EXE

"FreePDF Assistant"=c:\programme\FreePDF_XP\fpassist.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"d:\\Digital Imaging\\bin\\hpqtra08.exe"=

"d:\\Digital Imaging\\bin\\hpqste08.exe"=

"d:\\Digital Imaging\\bin\\hpofxm08.exe"=

"d:\\Digital Imaging\\bin\\hposfx08.exe"=

"d:\\Digital Imaging\\bin\\hposid01.exe"=

"d:\\Digital Imaging\\bin\\hpqscnvw.exe"=

"d:\\Digital Imaging\\bin\\hpqkygrp.exe"=

"d:\\Digital Imaging\\bin\\hpqCopy.exe"=

"d:\\Digital Imaging\\bin\\hpfccopy.exe"=

"d:\\Digital Imaging\\bin\\hpzwiz01.exe"=

"d:\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"d:\\Digital Imaging\\Unload\\HpqDIA.exe"=

"d:\\Digital Imaging\\bin\\hpoews01.exe"=

"d:\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

"h:\\iTunes\\iTunes.exe"=

.

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [24.05.2011 20:11 42672]

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [24.05.2011 20:10 82824]

R1 F-Secure HIPS;F-Secure HIPS Driver;c:\programme\F-Secure\HIPS\drivers\fshs.sys [24.05.2011 20:10 72520]

R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [10.12.2011 18:42 366152]

R2 OS Selector;Acronis OS Selector Activator;c:\programme\Acronis\DiskDirector\OSS\reinstall_svc.exe [30.09.2010 14:16 2155848]

R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\programme\F-Secure\Anti-Virus\minifilter\fsgk.sys [24.05.2011 20:09 148632]

R3 FSORSPClient;F-Secure ORSP Client;c:\programme\F-Secure\ORSP Client\fsorsp.exe [24.05.2011 20:10 61088]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10.12.2011 18:42 22216]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [08.08.2009 14:23 133104]

S3 ausens;ausens;c:\windows\system32\drivers\ausens.sys [13.08.2003 13:33 404736]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [08.08.2009 14:23 133104]

S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\KS-959.sys [14.09.2007 12:45 19034]

S3 memcard;PCMCIA-Speicherkartentreiber;c:\windows\system32\drivers\memcard.sys [31.12.2010 10:07 8320]

S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [23.09.2009 15:19 32377]

S3 uafilter;uafilter;c:\windows\system32\drivers\UAFilter.sys [24.09.2009 18:51 9886]

S3 VF0470Vid;Live! Cam Notebook (VF0470);c:\windows\system32\drivers\V0470Vid.sys [13.04.2008 16:29 146368]

.

Inhalt des "geplante Tasks" Ordners

.

2011-12-14 c:\windows\Tasks\1-Klick-Wartung.job

- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 11:45]

.

2011-11-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2009-08-08 13:23]

.

2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2009-08-08 13:23]

.

2011-12-14 c:\windows\Tasks\Scheduled scanning task.job

- c:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2011-05-24 19:09]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

uInternet Connection Wizard,ShellNext = hxxp://www.sonicjapan.co.jp/oem/toshiba/recordnow

IE: Free YouTube Download - c:\dokumente und einstellungen\xxx\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\dokumente und einstellungen\xxx\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

LSP: c:\programme\F-Secure\FSPS\program\FSLSP.DLL

FF - ProfilePath - c:\dokumente und einstellungen\Alina\Anwendungsdaten\Mozilla\Firefox\Profiles\accl5jjq.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2736476&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=386496&p=

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-12-14 15:38

Windows 5.1.2600 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(1804)

c:\windows\system32\Ati2evxx.dll

c:\programme\f-secure\hips\fshook32.dll

c:\programme\F-Secure\FWES\Program\fsdc32.dll

.

- - - - - - - > 'lsass.exe'(208)

c:\programme\f-secure\hips\fshook32.dll

c:\programme\F-Secure\FWES\Program\fsdc32.dll

.

- - - - - - - > 'explorer.exe'(3876)

c:\programme\f-secure\hips\fshook32.dll

c:\programme\F-Secure\Spam Control\fsscoepl.dll

c:\windows\system32\TDispVol.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\TPwrCfg.DLL

c:\windows\system32\TPwrReg.dll

c:\windows\system32\TPSTrace.DLL

.

- - - - - - - > 'csrss.exe'(1548)

c:\programme\F-Secure\FWES\Program\fsdc32.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\programme\Intel\Wireless\Bin\EvtEng.exe

c:\programme\Intel\Wireless\Bin\S24EvMon.exe

c:\windows\system32\Ati2evxx.exe

c:\programme\Synaptics\SynTP\Toshiba.exe

c:\windows\RTHDCPL.EXE

c:\windows\AGRSMMSG.exe

c:\windows\system32\TPSMain.exe

c:\windows\system32\TPSBattM.exe

c:\windows\system32\TDispVol.exe

c:\windows\system32\rundll32.exe

c:\programme\TOSHIBA\ConfigFree\CFSvcs.exe

c:\windows\system32\DVDRAMSV.exe

c:\programme\F-Secure\Anti-Virus\fsgk32st.exe

c:\programme\F-Secure\Anti-Virus\FSGK32.EXE

c:\programme\F-Secure\Common\FSMA32.EXE

c:\programme\F-Secure\Common\FSHDLL32.EXE

c:\programme\Java\jre6\bin\jqs.exe

c:\windows\system32\HPZipm12.exe

c:\programme\Intel\Wireless\Bin\RegSrvc.exe

c:\programme\Toshiba\TOSHIBA Applet\TAPPSRV.exe

c:\windows\System32\TUProgSt.exe

c:\programme\F-Secure\FWES\Program\fsdfwd.exe

c:\programme\F-Secure\Anti-Virus\fssm32.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe

c:\programme\F-Secure\Anti-Virus\fsav32.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-12-14  15:45:23 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-12-14 14:45

ComboFix2.txt  2011-12-13 21:02

.

Vor Suchlauf: 17 Verzeichnis(se), 19.600.646.144 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 19.578.224.640 Bytes frei

.

- - End Of File - - 25A6FC02A6219C625D1BE248D2EFD7C5

--- --- ---

Gruß, Mona123

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Ich kann nicht auf die OSAM Site zugreifen, sie wird von f-secure (das durch den Taskmanager eigentlich deaktiviert ist) blockiert. Gibt es eine Alternative?

Hat sich erledigt, jetzt ging es plötzlich...

GMER:

Zitat:

GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit quick scan 2011-12-14 17:41:32
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 HTS541080G9SA00 rev.MB4OC60D
Running: i4fggwsf.exe; Driver: C:\DOKUME~1\Alina\LOKALE~1\Temp\pwrdipow.sys

---- System - GMER 1.0.15 ----

Code fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation) IoCreateDevice

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \Driver\Tcpip \Device\Ip fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
Device \Driver\Tcpip \Device\Tcp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
Device \Driver\Tcpip \Device\Udp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
Device \Driver\Tcpip \Device\RawIp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

---- Threads - GMER 1.0.15 ----

Thread System [4:500] 86E58161
Thread System [4:1124] 86120C30

---- EOF - GMER 1.0.15 ----

OSAM:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 17:25:45 on 14.12.2011
 

OS: Windows XP Home Edition Service Pack 2 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 6.00.2900.2180
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"NokiaConnectionManager" - "Nokia" - E:\NOKIAP~1\CONNEC~1.CPL
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AEGIS Protocol (IEEE 802.1x) v3.4.9.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"ausens" (ausens) - "Sensaura Ltd" - C:\WINDOWS\System32\drivers\ausens.sys

"Bluetooth ACPI from TOSHIBA" (tosrfec) - "TOSHIBA Corporation" - C:\WINDOWS\System32\DRIVERS\tosrfec.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"DLABOIOM" (DLABOIOM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLABOIOM.SYS

"DLACDBHM" (DLACDBHM) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DLACDBHM.SYS

"DLADResN" (DLADResN) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLADResN.SYS

"DLAIFS_M" (DLAIFS_M) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAIFS_M.SYS

"DLAOPIOM" (DLAOPIOM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAOPIOM.SYS

"DLAPoolM" (DLAPoolM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAPoolM.SYS

"DLARTL_N" (DLARTL_N) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DLARTL_N.SYS

"DLAUDFAM" (DLAUDFAM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAUDFAM.SYS

"DLAUDF_M" (DLAUDF_M) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAUDF_M.SYS

"DRVMCDB" (DRVMCDB) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DRVMCDB.SYS

"DRVNDDM" (DRVNDDM) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DRVNDDM.SYS

"F-Secure Firewall Driver" (FSFW) - "F-Secure Corporation" - C:\WINDOWS\System32\drivers\fsdfw.sys

"F-Secure Gatekeeper" (F-Secure Gatekeeper) - "F-Secure Corporation" - C:\Programme\F-Secure\Anti-Virus\minifilter\fsgk.sys

"F-Secure HIPS Driver" (F-Secure HIPS) - "F-Secure Corporation" - C:\Programme\F-Secure\HIPS\drivers\fshs.sys

"fsbts" (fsbts) - "F-Secure Corporation" - C:\WINDOWS\System32\Drivers\fsbts.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"Kingsun KS-959 USB Infrared Adapter" (KS-959) - "Kingsun Corporation" - C:\WINDOWS\System32\DRIVERS\KS-959.sys

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys

"mbr" (mbr) - ? - C:\DOKUME~1\Alina\LOKALE~1\Temp\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"meiudf" (meiudf) - "Matsushita Electric Industrial Co.,Ltd." - C:\WINDOWS\System32\Drivers\meiudf.sys

"NSNDIS5 NDIS Protocol Driver" (NSNDIS5) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\NSNDIS5.SYS

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PRODIGY" (PRODIGY) - "B-phreaks" - C:\WINDOWS\System32\Drivers\PRODIGY.SYS

"Prolific2 Serial port driver" (Ser2pl) - ? - C:\WINDOWS\System32\DRIVERS\ser2pl.sys  (File not found)

"pwrdipow" (pwrdipow) - ? - C:\DOKUME~1\Alina\LOKALE~1\Temp\pwrdipow.sys  (Hidden registry entry, rootkit activity | File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"Toshiba Mobile PC Service" (TVALD) - "Toshiba Corporation" - C:\WINDOWS\System32\DRIVERS\NBSMI.sys

"TOSHIBA Network Device Usermode I/O Protocol" (Netdevio) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\netdevio.sys

"TOSHIBA Virtual Sound with SRS technologies" (Tvs) - "TOSHIBA Corporation" - C:\WINDOWS\System32\DRIVERS\Tvs.sys

"uafilter" (uafilter) - "SONIX Technology Co., LTD" - C:\WINDOWS\System32\DRIVERS\uafilter.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"WLAN-Transport" (s24trans) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\s24trans.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\WINDOWS\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5} "dBpoweramp Music Converter" - ? -   (File not found | COM-object registry key not found)

{2E5AC2E0-406D-11D4-86B3-FA5861508E25} "DFMInfoTip Object" - "M.Dev Software" - D:\Progs\ZIPGEN~1\zgtips.dll

{5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\WINDOWS\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\WINDOWS\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\WINDOWS\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - H:\iTunes\iTunesMiniPlayer.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{D0FAC080-AE1A-11ce-8016-CE90976DC901} "Picture Publisher File Viewer" - ? - C:\WINDOWS\system32\ppiv30.dll  (File found, but it contains no detailed information)

{E8D43C7E-EFA1-41A2-9AD9-0CFECD1678B7} "SafeErase" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "Shell Extensions for RealOne Player" - ? -   (File not found | COM-object registry key not found)

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2009\DseShExt-x86.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

{FE8D01BF-610A-4261-9C6E-32D65A42C907} "ZipGenius DnD Extract handler" - "M.Dev Software" - D:\Progs\ZIPGEN~1\ZGDRAG~1.DLL

{310A0C95-EA11-42AE-A8E4-53E69E650310} "ZipGenius Drag and Drop handler" - "M.Dev Software" - D:\Progs\ZIPGEN~1\DROPHA~1.DLL

{C169E5F0-E2B3-41F3-B81A-7BA529CBE193} "ZipGenius Shell Extension" - "M.Dev Software" - D:\Progs\ZIPGEN~1\contmenu.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay" - ? - C:\Programme\Internet Explorer\Signup\ToshibaGotoEbay.exe  (File found, but it contains no detailed information)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} "Java Plug-in 1.5.0_04" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{265EEE8E-3228-44D3-AEA5-F7FDF5860049} "Browsing Protection Toolbar" - "F-Secure Corporation" - C:\Programme\F-Secure\NRS\iescript\baselitmus.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{C6867EB7-8350-4856-877F-93CF8AE3DC9C} "Browsing Protection Class" - "F-Secure Corporation" - C:\Programme\F-Secure\NRS\iescript\baselitmus.dll

{5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"ccleaner" - "Piriform Ltd" - "C:\Programme\CCleaner\CCleaner.exe" /AUTO

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"AGRSMMSG" - "Agere Systems" - AGRSMMSG.exe

"F-Secure Manager" - "F-Secure Corporation" - "C:\Programme\F-Secure\Common\FSM32.EXE" /splash

"F-Secure TNB" - "F-Secure Corporation" - "C:\Programme\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW

"IntelWireless" - "Intel Corporation" - "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

"IntelZeroConfig" - "Intel Corporation" - "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"SmoothView" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe

"TDispVol" - "TOSHIBA Corporation" - TDispVol.exe

"THotkey" - "TOSHIBA" - C:\Programme\Toshiba\Toshiba Applet\thotkey.exe

"TPSMain" - "TOSHIBA Corporation" - TPSMain.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"HP Standard TCP/IP Port" - "Hewlett Packard" - C:\WINDOWS\system32\HpTcpMon.dll

"PDF Port" - "Adobe Systems Incorporated." - C:\WINDOWS\system32\pdfports.dll

"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)

"Toshiba Bluetooth Monitor" - "Toshiba America Business Solutions, Inc." - C:\WINDOWS\system32\tbtmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Acronis OS Selector Activator" (OS Selector) - ? - C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe  (File found, but it contains no detailed information)

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"ConfigFree Service" (CFSvcs) - "TOSHIBA CORPORATION" - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe

"DVD-RAM_Service" (DVD-RAM_Service) - "Matsushita Electric Industrial Co., Ltd." - C:\WINDOWS\system32\DVDRAMSV.exe

"F-Secure Anti-Virus Firewall Daemon" (FSDFWD) - "F-Secure Corporation" - C:\Programme\F-Secure\FWES\Program\fsdfwd.exe

"F-Secure Management Agent" (FSMA) - "F-Secure Corporation" - C:\Programme\F-Secure\Common\FSMA32.EXE

"F-Secure ORSP Client" (FSORSPClient) - "F-Secure Corporation" - C:\Programme\F-Secure\ORSP Client\fsorsp.exe

"FSGKHS" (F-Secure Gatekeeper Handler Starter) - "F-Secure Corporation" - C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\EvtEng.exe

"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe

"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe

"PACSPTISVR" (PACSPTISVR) - ? - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe

"Pml Driver HPZ12" (Pml Driver HPZ12) - "HP" - C:\WINDOWS\system32\HPZipm12.exe

"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe

"TOSHIBA Application Service" (TAPPSRV) - "TOSHIBA Corp." - C:\Programme\Toshiba\TOSHIBA Applet\TAPPSRV.exe

"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - C:\WINDOWS\System32\TuneUpDefragService.exe

"TuneUp Program Statistics Service" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - C:\WINDOWS\System32\TUProgSt.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - ? - C:\Programme\Bonjour\mdnsNSP.dll  (File not found)

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"F-Secure Protocol Scanner" - "F-Secure Corporation" - C:\Programme\F-Secure\FSPS\program\FSLSP.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index[/QUOTE]

aswMBR:

Zitat:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-12-14 17:27:31
-----------------------------
17:27:31.609 OS Version: Windows 5.1.2600 Service Pack 2
17:27:31.609 Number of processors: 2 586 0xE08
17:27:31.609 ComputerName: TOSHIBA UserName: Alina
17:27:32.062 Initialize success
17:29:48.500 AVAST engine defs: 11121401
17:30:39.843 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
17:30:39.843 Disk 0 Vendor: HTS541080G9SA00 MB4OC60D Size: 76319MB BusType: 3
17:30:39.859 Disk 1 \Device\Harddisk1\SR0 -> \Device\SdBus-0
17:30:39.859 Disk 1 Vendor: Size: 122MB BusType: 0
17:30:41.875 Disk 0 MBR read successfully
17:30:41.875 Disk 0 MBR scan
17:30:41.906 Disk 0 Windows XP default MBR code
17:30:41.921 Disk 0 scanning sectors +156296385
17:30:41.953 Disk 0 scanning C:\WINDOWS\system32\drivers
17:30:50.390 Service scanning
17:30:50.718 Service ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys **LOCKED** 32
17:30:51.406 Modules scanning
17:30:57.125 Disk 0 trace - called modules:
17:30:57.156 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys >>UNKNOWN [0x86164de9]<<
17:30:57.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f35ab8]
17:30:57.156 3 CLASSPNP.SYS[f769705b] -> nt!IofCallDriver -> \Device\00000087[0x86f389e8]
17:30:57.156 5 ACPI.sys[f75ec620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86f7bd98]
17:30:57.562 AVAST engine scan C:\WINDOWS
17:31:03.703 AVAST engine scan C:\WINDOWS\system32
17:33:08.562 AVAST engine scan C:\WINDOWS\system32\drivers
17:33:20.281 AVAST engine scan C:\Dokumente und Einstellungen\Alina
17:35:20.281 AVAST engine scan C:\Dokumente und Einstellungen\All Users
17:36:04.453 Scan finished successfully
17:36:52.375 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Alina\Desktop\MBR.dat"
17:36:52.375 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Alina\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Malwarebytes:

Zitat:

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8373

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

15.12.2011 11:04:25
mbam-log-2011-12-15 (11-04-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|H:\|)
Durchsuchte Objekte: 316283
Laufzeit: 1 Stunde(n), 16 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SuperAntiSpyware:

Zitat:

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 12/15/2011 at 02:28 PM

Application Version : 5.0.1142

Core Rules Database Version : 8054
Trace Rules Database Version: 5866

Scan type : Complete Scan
Total Scan Time : 03:17:05

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 2 (Build 5.01.2600)
Administrator

Memory items scanned : 594
Memory threats detected : 0
Registry items scanned : 38602
Registry threats detected : 0
File items scanned : 101952
File threats detected : 34

Trojan.Agent/Gen-SoftonicDownloader
D:\EIGENE DATEIEN\DOWNLOADS\SOFTONICDOWNLOADER_FUER_FREE-YOUTUBE-TO-MP3-CONVERTER.EXE
H:\BA_EXDEIGENEDATEIEN\EIGENE DATEIEN\DOWNLOADS\SOFTONICDOWNLOADER_FUER_FREERIP-MP3.EXE
H:\BA_EXDEIGENEDATEIEN\EIGENE DATEIEN\DOWNLOADS\SOFTONICDOWNLOADER_FUER_MAGIX-VIDEO-DELUXE.EXE

Adware.Tracking Cookie
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@komtrack[2].txt [ Cookie:gerd@komtrack.com/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@data.coremetrics[1].txt [ Cookie:gerd@data.coremetrics.com/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@as1.falkag[2].txt [ Cookie:gerd@as1.falkag.de/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@as-eu.falkag[2].txt [ Cookie:gerd@as-eu.falkag.net/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@mediavantage[2].txt [ Cookie:gerd@mediavantage.de/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@1068860078[1].txt [ Cookie:gerd@www.googleadservices.com/pagead/conversion/1068860078/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@adopt.euroclick[2].txt [ Cookie:gerd@adopt.euroclick.com/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@tacoda[1].txt [ Cookie:gerd@tacoda.net/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@serving-sys[2].txt [ Cookie:gerd@serving-sys.com/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@1071038314[1].txt [ Cookie:gerd@www.googleadservices.com/pagead/conversion/1071038314/ ]
C:\DOKUMENTE UND EINSTELLUNGEN\GERD\Cookies\gerd@nextag[2].txt [ Cookie:gerd@nextag.com/ ]
de.sitestat.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
stats.e-domizil.de [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.keywordmax.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.zedo.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.adopt.euroclick.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.tacoda.net [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.tacoda.net [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.regalinteractive.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\DOKUMENTE UND EINSTELLUNGEN\GERD\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\AL0NVOEE.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-FraudPack
C:\PROGRAMME\BBPLUGIN\FLASHBACK.DLL
C:\PROGRAMME\BBPLUGIN\INTERFERENCE.DLL
C:\PROGRAMME\BBPLUGIN\LIGHTSHOW.DLL
C:\PROGRAMME\BBPLUGIN\THERING.DLL
C:\PROGRAMME\BBPLUGIN\VITRUVE.DLL
C:\PROGRAMME\BBPLUGIN\VORTEX.DLL

ESET:

Zitat:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dca05f494ed42f42bc6130024deb5de5
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-12-12 11:04:21
# local_time=2011-12-13 12:04:21 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 91824 91824 0 0
# compatibility_mode=2304 16777175 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 3874 3874 0 0
# scanned=107241
# found=10
# cleaned=0
# scan_time=15152
C:\Dokumente und Einstellungen\Alina\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\33\706cf3e1-5c8ca1d9 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Dokumente und Einstellungen\Alina\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\34\37db3fe2-23275442 Java/TrojanDownloader.Agent.ME trojan (unable to clean) 00000000000000000000000000000000 I
D:\Eigene Dateien\Downloads\avi.codec.pack.pro.v2.4.0.setup.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I
D:\Eigene Dateien\Downloads\SoftonicDownloader_fuer_free-youtube-to-mp3-converter.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
E:\Nicht verwendete Desktopverknüpfungen\freeripmp3-setup.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\ps_radio2015.exe a variant of Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader43050.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader64733.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader_fuer_freerip-mp3.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader_fuer_magix-video-deluxe.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dca05f494ed42f42bc6130024deb5de5
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-12-15 05:49:21
# local_time=2011-12-15 06:49:21 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 332575 332575 0 0
# compatibility_mode=2304 16777175 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 244625 244625 0 0
# scanned=105187
# found=8
# cleaned=0
# scan_time=14701
D:\Eigene Dateien\Downloads\avi.codec.pack.pro.v2.4.0.setup.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I
D:\Eigene Dateien\Downloads\SoftonicDownloader_fuer_free-youtube-to-mp3-converter.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
E:\Nicht verwendete Desktopverknüpfungen\freeripmp3-setup.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\ps_radio2015.exe a variant of Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader43050.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader64733.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader_fuer_freerip-mp3.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
H:\BA_exdeigenedateien\Eigene Dateien\Downloads\SoftonicDownloader_fuer_magix-video-deluxe.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I

Gruß, Mona123

Den Softonic-Mpll bitte entsorgen :pfui:
Und lass in Zukunft die Finger von Softonic.
Die Funde mit SASW ebenfalls alle entfernen.

Rechner soweit wieder im Lot?

Was ist Softonic-Mpll?

Ist ein Tippfehler. Sollte Müll heißen. Das P ist nunmal direkt neben dem Ü :balla:

Haha, hab mich schon geschämt weil ich nicht mal weiß, was eine mpll ist...

Google leitet nicht mehr weiter, aber momentan werden Seiten immer mal wieder seltsam angezeigt (eher wie ein Script...). Ich lasse mal SuperAntiSpyware zu Ende arbeiten und schaue dann nochmal nach.

Gruß,
Mona123

Hm, anscheinend hab ich was übersehen.
Mach bitte nochmal ein neues Log mit dem TDSS-Killer.

Die Weiterleitung ist leider wieder aktiv.
Hier ist das Log:

Zitat:

15:59:37.0546 3936 TDSS rootkit removing tool 2.6.23.0 Dec 13 2011 10:39:31
15:59:37.0734 3936 ============================================================
15:59:37.0734 3936 Current date / time: 2011/12/16 15:59:37.0734
15:59:37.0734 3936 SystemInfo:
15:59:37.0734 3936
15:59:37.0734 3936 OS Version: 5.1.2600 ServicePack: 2.0
15:59:37.0734 3936 Product type: Workstation
15:59:37.0734 3936 ComputerName: TOSHIBA
15:59:37.0734 3936 UserName: Alina
15:59:37.0734 3936 Windows directory: C:\WINDOWS
15:59:37.0734 3936 System windows directory: C:\WINDOWS
15:59:37.0734 3936 Processor architecture: Intel x86
15:59:37.0734 3936 Number of processors: 2
15:59:37.0734 3936 Page size: 0x1000
15:59:37.0734 3936 Boot type: Normal boot
15:59:37.0734 3936 ============================================================
15:59:39.0546 3936 Initialize success
15:59:55.0687 2976 ============================================================
15:59:55.0687 2976 Scan started
15:59:55.0687 2976 Mode: Manual; SigCheck; TDLFS;
15:59:55.0687 2976 ============================================================
15:59:56.0156 2976 Abiosdsk - ok
15:59:56.0171 2976 abp480n5 - ok
15:59:56.0203 2976 ACPI (7c8e7b37a15b6fbbc46c44cb9271712e) C:\WINDOWS\system32\DRIVERS\ACPI.sys
15:59:56.0203 2976 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5: 7c8e7b37a15b6fbbc46c44cb9271712e, Fake md5: 94b4741d2cf9ed38140b831293d1601a
15:59:56.0203 2976 ACPI ( Virus.Win32.Rloader.a ) - infected
15:59:56.0203 2976 ACPI - detected Virus.Win32.Rloader.a (0)
15:59:56.0218 2976 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
15:59:57.0421 2976 ACPIEC - ok
15:59:57.0546 2976 adpu160m - ok
15:59:57.0609 2976 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
15:59:58.0328 2976 aec - ok
15:59:58.0656 2976 AegisP (12dafd934641dcf61e446313bc261ec2) C:\WINDOWS\system32\DRIVERS\AegisP.sys
15:59:58.0937 2976 AegisP ( UnsignedFile.Multi.Generic ) - warning
15:59:58.0937 2976 AegisP - detected UnsignedFile.Multi.Generic (1)
15:59:59.0078 2976 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
15:59:59.0328 2976 AFD - ok
15:59:59.0406 2976 AgereSoftModem (b3192376c7a3814b5341efc2202022f8) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
15:59:59.0875 2976 AgereSoftModem - ok
16:00:00.0000 2976 Aha154x - ok
16:00:00.0031 2976 aic78u2 - ok
16:00:00.0093 2976 aic78xx - ok
16:00:00.0109 2976 AliIde - ok
16:00:00.0125 2976 amsint - ok
16:00:00.0281 2976 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
16:00:01.0046 2976 Arp1394 - ok
16:00:01.0390 2976 asc - ok
16:00:01.0609 2976 asc3350p - ok
16:00:01.0937 2976 asc3550 - ok
16:00:02.0140 2976 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:00:03.0125 2976 AsyncMac - ok
16:00:03.0750 2976 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
16:00:04.0859 2976 atapi - ok
16:00:05.0078 2976 Atdisk - ok
16:00:06.0031 2976 ati2mtag (221f0a33229cce7bf2f7640d3bb8845d) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
16:00:07.0937 2976 ati2mtag - ok
16:00:08.0328 2976 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:00:08.0968 2976 Atmarpc - ok
16:00:09.0515 2976 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:00:09.0812 2976 audstub - ok
16:00:10.0296 2976 ausens (a9355a51698f6901b362ef738b15631d) C:\WINDOWS\system32\drivers\ausens.sys
16:00:10.0906 2976 ausens ( UnsignedFile.Multi.Generic ) - warning
16:00:10.0906 2976 ausens - detected UnsignedFile.Multi.Generic (1)
16:00:11.0296 2976 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:00:12.0109 2976 Beep - ok
16:00:12.0546 2976 BthEnum (d24b8d1784c68a25060fffbe8ed34b76) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
16:00:13.0093 2976 BthEnum - ok
16:00:13.0546 2976 BTHMODEM (9df0adf74ce1d6371ed60cf92eb1d9a6) C:\WINDOWS\system32\DRIVERS\bthmodem.sys
16:00:14.0015 2976 BTHMODEM - ok
16:00:14.0390 2976 BthPan (10355270be12641b9764235da39dcf0f) C:\WINDOWS\system32\DRIVERS\bthpan.sys
16:00:14.0937 2976 BthPan - ok
16:00:15.0218 2976 BTHPORT (3a7a07b55adc58e2001537eb6e0a980d) C:\WINDOWS\system32\Drivers\BTHport.sys
16:00:15.0671 2976 BTHPORT - ok
16:00:15.0921 2976 BTHUSB (f06d4cb9918b462a84d9ac00027efc30) C:\WINDOWS\system32\Drivers\BTHUSB.sys
16:00:16.0171 2976 BTHUSB - ok
16:00:16.0171 2976 catchme - ok
16:00:16.0421 2976 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:00:16.0687 2976 cbidf2k - ok
16:00:16.0718 2976 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
16:00:16.0906 2976 CCDECODE - ok
16:00:17.0312 2976 cd20xrnt - ok
16:00:17.0406 2976 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:00:17.0656 2976 Cdaudio - ok
16:00:17.0828 2976 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
16:00:18.0093 2976 Cdfs - ok
16:00:18.0234 2976 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:00:18.0484 2976 Cdrom - ok
16:00:18.0656 2976 Changer - ok
16:00:18.0734 2976 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
16:00:19.0000 2976 CmBatt - ok
16:00:19.0093 2976 CmdIde - ok
16:00:19.0312 2976 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
16:00:19.0578 2976 Compbatt - ok
16:00:19.0875 2976 Cpqarray - ok
16:00:19.0921 2976 dac2w2k - ok
16:00:19.0937 2976 dac960nt - ok
16:00:20.0031 2976 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
16:00:20.0265 2976 Disk - ok
16:00:20.0500 2976 DLABOIOM (ee4325becef51b8c32b4329097e4f301) C:\WINDOWS\system32\DLA\DLABOIOM.SYS
16:00:20.0656 2976 DLABOIOM ( UnsignedFile.Multi.Generic ) - warning
16:00:20.0656 2976 DLABOIOM - detected UnsignedFile.Multi.Generic (1)
16:00:20.0906 2976 DLACDBHM (d979bebcf7edcc9c9ee1857d1a68c67b) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
16:00:21.0000 2976 DLACDBHM ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0000 2976 DLACDBHM - detected UnsignedFile.Multi.Generic (1)
16:00:21.0015 2976 DLADResN (f17cfeb7f7e90496931523e5ba11d399) C:\WINDOWS\system32\DLA\DLADResN.SYS
16:00:21.0093 2976 DLADResN ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0093 2976 DLADResN - detected UnsignedFile.Multi.Generic (1)
16:00:21.0109 2976 DLAIFS_M (752376e109a090970bfa9722f0f40b03) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
16:00:21.0234 2976 DLAIFS_M ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0234 2976 DLAIFS_M - detected UnsignedFile.Multi.Generic (1)
16:00:21.0296 2976 DLAOPIOM (62ee7902e74b90bf1ccc4643fc6c07a7) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
16:00:21.0406 2976 DLAOPIOM ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0406 2976 DLAOPIOM - detected UnsignedFile.Multi.Generic (1)
16:00:21.0484 2976 DLAPoolM (5c220124c5afeaee84a9bb89d685c17b) C:\WINDOWS\system32\DLA\DLAPoolM.SYS
16:00:21.0578 2976 DLAPoolM ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0578 2976 DLAPoolM - detected UnsignedFile.Multi.Generic (1)
16:00:21.0609 2976 DLARTL_N (7ee0852ae8907689df25049dcd2342e8) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
16:00:21.0687 2976 DLARTL_N ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0687 2976 DLARTL_N - detected UnsignedFile.Multi.Generic (1)
16:00:21.0718 2976 DLAUDFAM (4ebb78d9bbf072119363b35b9b3e518f) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
16:00:21.0890 2976 DLAUDFAM ( UnsignedFile.Multi.Generic ) - warning
16:00:21.0890 2976 DLAUDFAM - detected UnsignedFile.Multi.Generic (1)
16:00:21.0984 2976 DLAUDF_M (333b770e52d2cea7bd86391120466e43) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
16:00:22.0125 2976 DLAUDF_M ( UnsignedFile.Multi.Generic ) - warning
16:00:22.0125 2976 DLAUDF_M - detected UnsignedFile.Multi.Generic (1)
16:00:22.0187 2976 dmboot (5789b83ba87fc84c3568cf86cacef8ce) C:\WINDOWS\system32\drivers\dmboot.sys
16:00:22.0421 2976 dmboot - ok
16:00:22.0453 2976 dmio (084eb0a50a4f7b4705c8a57f234e5291) C:\WINDOWS\system32\drivers\dmio.sys
16:00:22.0671 2976 dmio - ok
16:00:22.0703 2976 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:00:22.0890 2976 dmload - ok
16:00:23.0046 2976 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
16:00:23.0328 2976 DMusic - ok
16:00:23.0343 2976 dpti2o - ok
16:00:23.0375 2976 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
16:00:23.0531 2976 drmkaud - ok
16:00:23.0562 2976 DRVMCDB (fd0f95981fef9073659d8ec58e40aa3c) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
16:00:23.0671 2976 DRVMCDB ( UnsignedFile.Multi.Generic ) - warning
16:00:23.0671 2976 DRVMCDB - detected UnsignedFile.Multi.Generic (1)
16:00:23.0859 2976 DRVNDDM (b4869d320428cdc5ec4d7f5e808e99b5) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
16:00:23.0921 2976 DRVNDDM ( UnsignedFile.Multi.Generic ) - warning
16:00:23.0921 2976 DRVNDDM - detected UnsignedFile.Multi.Generic (1)
16:00:23.0953 2976 E100B (2646883e6dd867cd872d5b51b6036710) C:\WINDOWS\system32\DRIVERS\e100b325.sys
16:00:24.0062 2976 E100B - ok
16:00:24.0218 2976 F-Secure Gatekeeper (29d12e1e45d93b45d2598e2663bbeff4) C:\Programme\F-Secure\Anti-Virus\minifilter\fsgk.sys
16:00:24.0312 2976 F-Secure Gatekeeper - ok
16:00:24.0359 2976 F-Secure HIPS (91fc6a3c01a771a5aa65959a361c22c5) C:\Programme\F-Secure\HIPS\drivers\fshs.sys
16:00:24.0437 2976 F-Secure HIPS - ok
16:00:24.0625 2976 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
16:00:24.0843 2976 Fastfat - ok
16:00:24.0968 2976 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
16:00:25.0218 2976 Fdc - ok
16:00:25.0234 2976 Fips (9e9af89f9b14aa6249065c309ce73bd8) C:\WINDOWS\system32\drivers\Fips.sys
16:00:25.0437 2976 Fips - ok
16:00:25.0531 2976 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
16:00:25.0750 2976 Flpydisk - ok
16:00:25.0765 2976 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
16:00:26.0218 2976 FltMgr - ok
16:00:26.0265 2976 fsbts (343786e182b9c9ae3066e00dec650f50) C:\WINDOWS\system32\Drivers\fsbts.sys
16:00:26.0343 2976 fsbts - ok
16:00:26.0390 2976 FSFW (b7feb06217a421ffd9eee6604e60f903) C:\WINDOWS\system32\drivers\fsdfw.sys
16:00:26.0484 2976 FSFW - ok
16:00:26.0609 2976 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:00:26.0765 2976 Fs_Rec - ok
16:00:26.0796 2976 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:00:27.0062 2976 Ftdisk - ok
16:00:27.0093 2976 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
16:00:27.0171 2976 GEARAspiWDM - ok
16:00:27.0203 2976 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:00:27.0421 2976 Gpc - ok
16:00:27.0546 2976 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:00:27.0734 2976 HDAudBus - ok
16:00:27.0828 2976 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:00:28.0031 2976 HidUsb - ok
16:00:28.0031 2976 hpn - ok
16:00:28.0078 2976 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
16:00:28.0250 2976 HPZid412 - ok
16:00:28.0296 2976 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
16:00:28.0453 2976 HPZipr12 - ok
16:00:28.0562 2976 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
16:00:28.0734 2976 HPZius12 - ok
16:00:28.0796 2976 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
16:00:29.0015 2976 HTTP - ok
16:00:29.0031 2976 i2omgmt - ok
16:00:29.0109 2976 i2omp - ok
16:00:29.0140 2976 i8042prt (7c575018d0413440d75432a78b88c899) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:00:29.0343 2976 i8042prt - ok
16:00:29.0406 2976 ialm (bc1f1ff8d5800398937966cdb0a97fdc) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
16:00:29.0625 2976 ialm - ok
16:00:29.0812 2976 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:00:30.0015 2976 Imapi - ok
16:00:30.0031 2976 ini910u - ok
16:00:30.0218 2976 IntcAzAudAddService (b12a9fc49cd2765a43829d834f518aed) C:\WINDOWS\system32\drivers\RtkHDAud.sys
16:00:30.0531 2976 IntcAzAudAddService - ok
16:00:30.0687 2976 IntelIde - ok
16:00:30.0718 2976 intelppm (c1c2cc1da79c5ee10457ef0a3b8568c7) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:00:30.0968 2976 intelppm - ok
16:00:31.0000 2976 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
16:00:31.0265 2976 Ip6Fw - ok
16:00:31.0281 2976 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:00:31.0515 2976 IpFilterDriver - ok
16:00:31.0687 2976 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:00:31.0890 2976 IpInIp - ok
16:00:31.0921 2976 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:00:32.0343 2976 IpNat - ok
16:00:32.0390 2976 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:00:32.0578 2976 IPSec - ok
16:00:32.0671 2976 irda (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys
16:00:32.0843 2976 irda - ok
16:00:32.0937 2976 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:00:33.0078 2976 IRENUM - ok
16:00:33.0109 2976 isapnp (ce9b7afdf0a3d7dd8d1487262316b959) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:00:33.0312 2976 isapnp - ok
16:00:33.0343 2976 Kbdclass (b128fc0a5cd83f669d5de4b58f77c7d6) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:00:33.0578 2976 Kbdclass - ok
16:00:33.0671 2976 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
16:00:34.0125 2976 kmixer - ok
16:00:34.0234 2976 KS-959 (2ae47a0b7e05e9695f8c19b7d4e3f4c0) C:\WINDOWS\system32\DRIVERS\KS-959.sys
16:00:34.0328 2976 KS-959 ( UnsignedFile.Multi.Generic ) - warning
16:00:34.0328 2976 KS-959 - detected UnsignedFile.Multi.Generic (1)
16:00:34.0359 2976 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
16:00:34.0515 2976 KSecDD - ok
16:00:34.0578 2976 lbrtfdc - ok
16:00:34.0640 2976 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys
16:00:34.0812 2976 MBAMProtector - ok
16:00:35.0000 2976 meiudf (7efac183a25b30fb5d64cc9d484b1eb6) C:\WINDOWS\system32\Drivers\meiudf.sys
16:00:35.0078 2976 meiudf ( UnsignedFile.Multi.Generic ) - warning
16:00:35.0078 2976 meiudf - detected UnsignedFile.Multi.Generic (1)
16:00:35.0156 2976 memcard (8239dc1de1605730b595e2b7db3caf70) C:\WINDOWS\system32\DRIVERS\memcard.sys
16:00:35.0375 2976 memcard - ok
16:00:35.0453 2976 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:00:35.0640 2976 mnmdd - ok
16:00:35.0671 2976 Modem (91a3da4b12f6f1d760463a7f7857f748) C:\WINDOWS\system32\drivers\Modem.sys
16:00:35.0843 2976 Modem - ok
16:00:35.0875 2976 Mouclass (71e15ca47fd947552054afb28536268f) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:00:36.0078 2976 Mouclass - ok
16:00:36.0109 2976 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:00:36.0312 2976 mouhid - ok
16:00:36.0359 2976 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
16:00:36.0562 2976 MountMgr - ok
16:00:36.0671 2976 mraid35x - ok
16:00:36.0718 2976 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:00:37.0156 2976 MRxDAV - ok
16:00:37.0218 2976 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:00:37.0406 2976 MRxSmb - ok
16:00:37.0562 2976 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
16:00:37.0781 2976 Msfs - ok
16:00:37.0875 2976 MSIRCOMM (ee55f5c64417cc369866d7eafe9b07ab) C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
16:00:38.0062 2976 MSIRCOMM - ok
16:00:38.0078 2976 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:00:38.0328 2976 MSKSSRV - ok
16:00:38.0546 2976 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:00:38.0812 2976 MSPCLOCK - ok
16:00:39.0171 2976 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
16:00:39.0453 2976 MSPQM - ok
16:00:39.0718 2976 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:00:39.0937 2976 mssmbios - ok
16:00:39.0968 2976 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
16:00:40.0156 2976 MSTEE - ok
16:00:40.0218 2976 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
16:00:40.0468 2976 Mup - ok
16:00:40.0609 2976 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
16:00:40.0781 2976 NABTSFEC - ok
16:00:40.0812 2976 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
16:00:41.0062 2976 NDIS - ok
16:00:41.0140 2976 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
16:00:41.0343 2976 NdisIP - ok
16:00:41.0359 2976 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:00:41.0562 2976 NdisTapi - ok
16:00:41.0703 2976 Ndisuio (8d3ce6b579cde8d37acc690b67dc2106) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:00:42.0078 2976 Ndisuio - ok
16:00:42.0156 2976 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:00:42.0437 2976 NdisWan - ok
16:00:42.0718 2976 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
16:00:43.0031 2976 NDProxy - ok
16:00:43.0328 2976 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
16:00:43.0671 2976 NetBIOS - ok
16:00:44.0000 2976 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
16:00:44.0218 2976 NetBT - ok
16:00:44.0281 2976 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
16:00:44.0406 2976 Netdevio ( UnsignedFile.Multi.Generic ) - warning
16:00:44.0406 2976 Netdevio - detected UnsignedFile.Multi.Generic (1)
16:00:44.0515 2976 NETMDUSB (986acdece933131288f1957dc359865f) C:\WINDOWS\system32\Drivers\NETMDUSB.sys
16:00:44.0812 2976 NETMDUSB - ok
16:00:44.0906 2976 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
16:00:45.0125 2976 NIC1394 - ok
16:00:45.0218 2976 nmwcd (4a8a2aa0706b659175169decf198e9d7) C:\WINDOWS\system32\drivers\ccdcmb.sys
16:00:45.0484 2976 nmwcd - ok
16:00:45.0718 2976 nmwcdc (fd3e61831095ac62e6840d986b5a2016) C:\WINDOWS\system32\drivers\ccdcmbo.sys
16:00:45.0859 2976 nmwcdc - ok
16:00:45.0906 2976 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
16:00:46.0109 2976 Npfs - ok
16:00:46.0156 2976 NSNDIS5 (53f7546e8daefb3a0813f5e19c4613c9) C:\WINDOWS\system32\NSNDIS5.SYS
16:00:46.0281 2976 NSNDIS5 ( UnsignedFile.Multi.Generic ) - warning
16:00:46.0281 2976 NSNDIS5 - detected UnsignedFile.Multi.Generic (1)
16:00:46.0453 2976 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
16:00:47.0125 2976 Ntfs - ok
16:00:47.0390 2976 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:00:47.0656 2976 Null - ok
16:00:47.0687 2976 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:00:47.0890 2976 NwlnkFlt - ok
16:00:47.0921 2976 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:00:48.0156 2976 NwlnkFwd - ok
16:00:48.0296 2976 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:00:48.0515 2976 ohci1394 - ok
16:00:48.0671 2976 Parport (b2f17a2edb5450e61973a037f63a595b) C:\WINDOWS\system32\drivers\Parport.sys
16:00:48.0875 2976 Parport - ok
16:00:48.0890 2976 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
16:00:49.0078 2976 PartMgr - ok
16:00:49.0109 2976 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
16:00:49.0312 2976 ParVdm - ok
16:00:49.0640 2976 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
16:00:49.0781 2976 pccsmcfd - ok
16:00:49.0828 2976 PCI (6fb463e5b243fbd6f3d3c83f914d94fb) C:\WINDOWS\system32\DRIVERS\pci.sys
16:00:50.0031 2976 PCI - ok
16:00:50.0125 2976 PCIDump - ok
16:00:50.0171 2976 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
16:00:50.0406 2976 PCIIde - ok
16:00:50.0421 2976 Pcmcia (e2363f4c1daff89abee5f593e13d8a05) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
16:00:50.0640 2976 Pcmcia - ok
16:00:50.0671 2976 PDCOMP - ok
16:00:50.0687 2976 PDFRAME - ok
16:00:50.0687 2976 PDRELI - ok
16:00:50.0703 2976 PDRFRAME - ok
16:00:50.0718 2976 perc2 - ok
16:00:50.0734 2976 perc2hib - ok
16:00:50.0781 2976 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:00:50.0984 2976 PptpMiniport - ok
16:00:51.0109 2976 PRODIGY (65937a34c9a5741e3030a86905400d91) C:\WINDOWS\system32\Drivers\PRODIGY.SYS
16:00:51.0218 2976 PRODIGY ( UnsignedFile.Multi.Generic ) - warning
16:00:51.0218 2976 PRODIGY - detected UnsignedFile.Multi.Generic (1)
16:00:51.0250 2976 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
16:00:51.0484 2976 PSched - ok
16:00:51.0546 2976 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:00:51.0750 2976 Ptilink - ok
16:00:51.0828 2976 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:00:51.0906 2976 PxHelp20 - ok
16:00:51.0921 2976 ql1080 - ok
16:00:51.0937 2976 Ql10wnt - ok
16:00:51.0953 2976 ql12160 - ok
16:00:51.0968 2976 ql1240 - ok
16:00:51.0968 2976 ql1280 - ok
16:00:52.0000 2976 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:00:52.0187 2976 RasAcd - ok
16:00:52.0234 2976 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
16:00:52.0390 2976 Rasirda - ok
16:00:52.0406 2976 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:00:52.0625 2976 Rasl2tp - ok
16:00:52.0812 2976 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:00:53.0218 2976 RasPppoe - ok
16:00:53.0343 2976 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
16:00:53.0546 2976 Raspti - ok
16:00:53.0609 2976 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:00:54.0078 2976 Rdbss - ok
16:00:54.0125 2976 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:00:54.0312 2976 RDPCDD - ok
16:00:54.0468 2976 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
16:00:54.0890 2976 RDPWD - ok
16:00:54.0921 2976 redbook (aa56702e230860565cb8d43680f57f33) C:\WINDOWS\system32\DRIVERS\redbook.sys
16:00:55.0140 2976 redbook - ok
16:00:55.0187 2976 RFCOMM (99c4b74981a1413f142a3903130088cb) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
16:00:55.0390 2976 RFCOMM - ok
16:00:55.0546 2976 s24trans (1cc074e0d48383d4e9bffc6a26c2a58a) C:\WINDOWS\system32\DRIVERS\s24trans.sys
16:00:55.0718 2976 s24trans ( UnsignedFile.Multi.Generic ) - warning
16:00:55.0718 2976 s24trans - detected UnsignedFile.Multi.Generic (1)
16:00:55.0843 2976 SASDIFSV (39763504067962108505bff25f024345) C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
16:00:55.0937 2976 SASDIFSV - ok
16:00:55.0953 2976 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
16:00:56.0062 2976 SASKUTIL - ok
16:00:56.0203 2976 sdbus (02fc71b020ec8700ee8a46c58bc6f276) C:\WINDOWS\system32\DRIVERS\sdbus.sys
16:00:56.0421 2976 sdbus - ok
16:00:56.0453 2976 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:00:56.0843 2976 Secdrv - ok
16:00:56.0859 2976 Ser2pl - ok
16:00:56.0890 2976 Serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
16:00:57.0093 2976 Serenum - ok
16:00:57.0109 2976 Serial (cd5b9995afcdb466c9efc048d167e3be) C:\WINDOWS\system32\drivers\Serial.sys
16:00:57.0312 2976 Serial - ok
16:00:57.0468 2976 sffdisk (1d9f1bec651815741f088a8fb88e17ee) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
16:00:57.0656 2976 sffdisk - ok
16:00:57.0687 2976 sffp_sd (586499fd312ffd7f78553f408e71682e) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
16:00:57.0953 2976 sffp_sd - ok
16:00:57.0968 2976 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
16:00:58.0171 2976 Sfloppy - ok
16:00:58.0187 2976 Simbad - ok
16:00:58.0234 2976 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
16:00:58.0437 2976 SLIP - ok
16:00:58.0640 2976 snapman (bd3863c139f3380a9f44fb188feefc6e) C:\WINDOWS\system32\DRIVERS\snapman.sys
16:00:58.0734 2976 snapman - ok
16:00:58.0734 2976 Sparrow - ok
16:00:58.0781 2976 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
16:00:59.0203 2976 splitter - ok
16:00:59.0218 2976 sr (e4200cb2f418d8fc4acdd7e38c419d6a) C:\WINDOWS\system32\DRIVERS\sr.sys
16:00:59.0421 2976 sr - ok
16:00:59.0687 2976 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
16:00:59.0843 2976 Srv - ok
16:00:59.0921 2976 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
16:01:00.0156 2976 streamip - ok
16:01:00.0234 2976 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:01:00.0468 2976 swenum - ok
16:01:00.0500 2976 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
16:01:00.0671 2976 swmidi - ok
16:01:00.0687 2976 symc810 - ok
16:01:00.0703 2976 symc8xx - ok
16:01:00.0718 2976 sym_hi - ok
16:01:00.0718 2976 sym_u3 - ok
16:01:00.0750 2976 SynTP (e295fffff3aaf9a6a40b29497901908f) C:\WINDOWS\system32\DRIVERS\SynTP.sys
16:01:01.0015 2976 SynTP - ok
16:01:01.0109 2976 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
16:01:01.0312 2976 sysaudio - ok
16:01:01.0406 2976 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:01:01.0625 2976 Tcpip - ok
16:01:01.0656 2976 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:01:01.0890 2976 TDPIPE - ok
16:01:01.0984 2976 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
16:01:02.0218 2976 TDTCP - ok
16:01:02.0296 2976 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
16:01:02.0671 2976 TermDD - ok
16:01:02.0718 2976 tifm21 (244cfbffdefb77f3df571a8cd108fc06) C:\WINDOWS\system32\drivers\tifm21.sys
16:01:02.0843 2976 tifm21 - ok
16:01:02.0906 2976 TosIde - ok
16:01:02.0968 2976 tosrfec (cc069342ee0eae55b32a0ae99cf6185c) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
16:01:03.0062 2976 tosrfec ( UnsignedFile.Multi.Generic ) - warning
16:01:03.0062 2976 tosrfec - detected UnsignedFile.Multi.Generic (1)
16:01:03.0125 2976 TVALD (676db15ddf2e0ff6ec03068dea428b8b) C:\WINDOWS\system32\DRIVERS\NBSMI.sys
16:01:03.0218 2976 TVALD ( UnsignedFile.Multi.Generic ) - warning
16:01:03.0218 2976 TVALD - detected UnsignedFile.Multi.Generic (1)
16:01:03.0234 2976 Tvs (cc6763889198ef975b143d49789bcfa9) C:\WINDOWS\system32\DRIVERS\Tvs.sys
16:01:03.0328 2976 Tvs ( UnsignedFile.Multi.Generic ) - warning
16:01:03.0328 2976 Tvs - detected UnsignedFile.Multi.Generic (1)
16:01:03.0390 2976 uafilter (08cc6367780fa44bb8e5fd906e5e117b) C:\WINDOWS\system32\DRIVERS\uafilter.sys
16:01:03.0515 2976 uafilter ( UnsignedFile.Multi.Generic ) - warning
16:01:03.0515 2976 uafilter - detected UnsignedFile.Multi.Generic (1)
16:01:03.0703 2976 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
16:01:03.0906 2976 Udfs - ok
16:01:03.0968 2976 ultra - ok
16:01:04.0015 2976 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
16:01:04.0515 2976 Update - ok
16:01:04.0734 2976 upperdev (587e643a4e2ffd9a00f114b057ceb773) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
16:01:04.0875 2976 upperdev - ok
16:01:04.0953 2976 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys
16:01:05.0078 2976 USBAAPL - ok
16:01:05.0125 2976 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
16:01:05.0328 2976 usbaudio - ok
16:01:05.0453 2976 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:01:05.0593 2976 usbccgp - ok
16:01:05.0640 2976 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:01:05.0843 2976 usbehci - ok
16:01:05.0906 2976 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:01:06.0156 2976 usbhub - ok
16:01:06.0187 2976 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:01:06.0390 2976 usbprint - ok
16:01:06.0437 2976 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:01:06.0593 2976 usbscan - ok
16:01:06.0687 2976 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\drivers\usbser.sys
16:01:06.0890 2976 usbser - ok
16:01:06.0968 2976 UsbserFilt (fca6a196d47cb972a0e4adc0db9cd17c) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
16:01:07.0093 2976 UsbserFilt - ok
16:01:07.0125 2976 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:01:07.0328 2976 USBSTOR - ok
16:01:07.0375 2976 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:01:07.0531 2976 usbuhci - ok
16:01:07.0703 2976 VF0470Vid (44d7338e5cc83e5930f6141e2cd1b1c4) C:\WINDOWS\system32\DRIVERS\V0470Vid.sys
16:01:07.0859 2976 VF0470Vid - ok
16:01:07.0937 2976 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
16:01:08.0125 2976 VgaSave - ok
16:01:08.0140 2976 ViaIde - ok
16:01:08.0171 2976 VolSnap (d6888520ff56d72a50437e371ca25fc9) C:\WINDOWS\system32\drivers\VolSnap.sys
16:01:08.0375 2976 VolSnap - ok
16:01:08.0468 2976 w39n51 (b1f126e7e28877106d60e6ff3998d033) C:\WINDOWS\system32\DRIVERS\w39n51.sys
16:01:08.0734 2976 w39n51 - ok
16:01:08.0890 2976 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:01:09.0093 2976 Wanarp - ok
16:01:09.0140 2976 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
16:01:09.0250 2976 Wdf01000 - ok
16:01:09.0265 2976 WDICA - ok
16:01:09.0312 2976 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
16:01:09.0734 2976 wdmaud - ok
16:01:09.0921 2976 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
16:01:10.0078 2976 WpdUsb - ok
16:01:10.0125 2976 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
16:01:10.0328 2976 WSTCODEC - ok
16:01:10.0375 2976 WudfPf (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:01:10.0500 2976 WudfPf - ok
16:01:10.0734 2976 WudfRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:01:10.0875 2976 WudfRd - ok
16:01:10.0921 2976 MBR (0x1B8) (4e800bc56057cadf2fcdfc8f093595dc) \Device\Harddisk0\DR0
16:01:11.0140 2976 \Device\Harddisk0\DR0 - ok
16:01:11.0140 2976 MBR (0x1B8) (739b36f7a373fc81121d831231b6d311) \Device\Harddisk1\DR5
16:01:11.0718 2976 \Device\Harddisk1\DR5 - ok
16:01:11.0734 2976 Boot (0x1200) (c6a44ef92aaeddf1669c8322937b9126) \Device\Harddisk0\DR0\Partition0
16:01:11.0734 2976 \Device\Harddisk0\DR0\Partition0 - ok
16:01:11.0750 2976 Boot (0x1200) (a4200677461316725a44f64b78a15962) \Device\Harddisk0\DR0\Partition1
16:01:11.0750 2976 \Device\Harddisk0\DR0\Partition1 - ok
16:01:11.0765 2976 Boot (0x1200) (182c2d231c46af6b9e7908a6d0fd6970) \Device\Harddisk0\DR0\Partition2
16:01:11.0765 2976 \Device\Harddisk0\DR0\Partition2 - ok
16:01:11.0765 2976 Boot (0x1200) (cb0d0119f10d724403cd4154d1e7185e) \Device\Harddisk0\DR0\Partition3
16:01:11.0765 2976 \Device\Harddisk0\DR0\Partition3 - ok
16:01:11.0781 2976 Boot (0x1200) (bb305a6c3ecb93bd9cdd457b5e183ff8) \Device\Harddisk1\DR5\Partition0
16:01:11.0781 2976 \Device\Harddisk1\DR5\Partition0 - ok
16:01:11.0781 2976 ============================================================
16:01:11.0781 2976 Scan finished
16:01:11.0781 2976 ============================================================
16:01:11.0890 2408 Detected object count: 24
16:01:11.0890 2408 Actual detected object count: 24
16:01:41.0093 2408 ACPI ( Virus.Win32.Rloader.a ) - skipped by user
16:01:41.0093 2408 ACPI ( Virus.Win32.Rloader.a ) - User select action: Skip
16:01:41.0093 2408 AegisP ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 AegisP ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 ausens ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 ausens ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLABOIOM ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLABOIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLACDBHM ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLACDBHM ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLADResN ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLADResN ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLAIFS_M ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLAIFS_M ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLAOPIOM ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLAOPIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLAPoolM ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLAPoolM ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLARTL_N ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0093 2408 DLARTL_N ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0093 2408 DLAUDFAM ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 DLAUDFAM ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 DLAUDF_M ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 DLAUDF_M ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 DRVMCDB ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 DRVMCDB ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 DRVNDDM ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 DRVNDDM ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 KS-959 ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 KS-959 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 meiudf ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 meiudf ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 Netdevio ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 Netdevio ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 NSNDIS5 ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 NSNDIS5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 PRODIGY ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 PRODIGY ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0109 2408 s24trans ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0109 2408 s24trans ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0125 2408 tosrfec ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0125 2408 tosrfec ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0125 2408 TVALD ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0125 2408 TVALD ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0125 2408 Tvs ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0125 2408 Tvs ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:01:41.0125 2408 uafilter ( UnsignedFile.Multi.Generic ) - skipped by user
16:01:41.0125 2408 uafilter ( UnsignedFile.Multi.Generic ) - User select action: Skip

Gruß,
Mona123

Zitat:

16:01:41.0093 2408 ACPI ( Virus.Win32.Rloader.a ) - skipped by user
16:01:41.0093 2408 ACPI ( Virus.Win32.Rloader.a ) - User select action: Skip

Das mit dem TDSS-Killer löschen.
Windows neu starten und ein neues Log mit dem TDSS-Killer machen