Trojaner-Board
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/Agent.1042480 und setupdralex.exe (Backdoor.Bot) (https://www.trojaner-board.de/107687-tr-agent-1042480-setupdralex-exe-backdoor-bot.html)

cosinus 08.01.2012 02:40
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 16777216
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
MsConfig - StartUpReg: SpybotSD TeaTimer - hkey= - key= - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

dieba 08.01.2012 14:53
Hallo Arne,
hoffentlich gut und lang geschlafen:sleepy:
hier der OTL-Scan:

Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\SpybotSD TeaTimer\ deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: christa
->Temp folder emptied: 631934261 bytes
->Temporary Internet Files folder emptied: 116393240 bytes
->Java cache emptied: 35533129 bytes
->FireFox cache emptied: 91036067 bytes
->Flash cache emptied: 257348 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41620 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: dieter
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1353257 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 205095327 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.032,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01082012_142114

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Gruß, dieba

cosinus 08.01.2012 20:52
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

dieba 08.01.2012 22:00
Hallo Arne,
in http://www.trojaner-board.de/82358-t...entfernen.html steht "alle Programme schließen" vor Ausführung von TDSSKiller. Gehören dazu auch Defender und Antivir-Guard oder nur die "normalen" wie browser und andere Benutzeranwendungen.

Gruß, dieba

cosinus 08.01.2012 22:18
Ja undebedingt auch Virenscanner deaktivieren

dieba 08.01.2012 22:27
Hier das Ergebnis:

Code:
22:03:25.0914 1172        TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
22:03:26.0149 1172        ============================================================
22:03:26.0149 1172        Current date / time: 2012/01/08 22:03:26.0149
22:03:26.0149 1172        SystemInfo:
22:03:26.0149 1172       
22:03:26.0149 1172        OS Version: 6.0.6002 ServicePack: 2.0
22:03:26.0149 1172        Product type: Workstation
22:03:26.0149 1172        ComputerName: FREIZEIT
22:03:26.0164 1172        UserName: christa
22:03:26.0164 1172        Windows directory: C:\Windows
22:03:26.0164 1172        System windows directory: C:\Windows
22:03:26.0164 1172        Processor architecture: Intel x86
22:03:26.0164 1172        Number of processors: 1
22:03:26.0164 1172        Page size: 0x1000
22:03:26.0164 1172        Boot type: Normal boot
22:03:26.0164 1172        ============================================================
22:03:27.0586 1172        Initialize success
22:23:48.0017 3864        ============================================================
22:23:48.0017 3864        Scan started
22:23:48.0017 3864        Mode: Manual; SigCheck; TDLFS;
22:23:48.0017 3864        ============================================================
22:23:49.0579 3864        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
22:23:49.0751 3864        ACPI - ok
22:23:49.0829 3864        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
22:23:49.0861 3864        adp94xx - ok
22:23:49.0986 3864        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
22:23:50.0001 3864        adpahci - ok
22:23:50.0064 3864        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
22:23:50.0079 3864        adpu160m - ok
22:23:50.0126 3864        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
22:23:50.0142 3864        adpu320 - ok
22:23:50.0345 3864        AFD            (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
22:23:50.0439 3864        AFD - ok
22:23:50.0548 3864        AgereSoftModem  (5d97943c128ed756d1b0a08302c1b1f8) C:\Windows\system32\DRIVERS\AGRSM.sys
22:23:50.0861 3864        AgereSoftModem - ok
22:23:51.0064 3864        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
22:23:51.0079 3864        agp440 - ok
22:23:51.0157 3864        AGR1310_60      (0fb81a051fe8ac47c0a54db2f0901b98) C:\Windows\system32\DRIVERS\AGR1310_60.sys
22:23:51.0220 3864        AGR1310_60 - ok
22:23:51.0376 3864        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
22:23:51.0407 3864        aic78xx - ok
22:23:51.0486 3864        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
22:23:51.0517 3864        aliide - ok
22:23:51.0579 3864        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
22:23:51.0611 3864        amdagp - ok
22:23:51.0657 3864        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
22:23:51.0673 3864        amdide - ok
22:23:51.0845 3864        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
22:23:51.0986 3864        AmdK7 - ok
22:23:52.0048 3864        AmdK8          (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
22:23:52.0111 3864        AmdK8 - ok
22:23:52.0298 3864        AR5523 - ok
22:23:52.0361 3864        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
22:23:52.0376 3864        arc - ok
22:23:52.0423 3864        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
22:23:52.0439 3864        arcsas - ok
22:23:52.0532 3864        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
22:23:52.0579 3864        AsyncMac - ok
22:23:52.0720 3864        atapi          (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
22:23:52.0720 3864        atapi - ok
22:23:52.0767 3864        ATHFMWDL - ok
22:23:52.0907 3864        athrusb        (569059302103fbf6774a2ea9c3454910) C:\Windows\system32\DRIVERS\athrusb.sys
22:23:53.0048 3864        athrusb ( UnsignedFile.Multi.Generic ) - warning
22:23:53.0048 3864        athrusb - detected UnsignedFile.Multi.Generic (1)
22:23:53.0267 3864        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
22:23:53.0298 3864        avgio - ok
22:23:53.0423 3864        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
22:23:53.0814 3864        avgntflt - ok
22:23:53.0907 3864        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
22:23:53.0923 3864        avipbb - ok
22:23:54.0126 3864        BDA_Loader_220A (f01462daddcf46f00e84d295c5b8fc0b) C:\Windows\system32\Drivers\BDA_Loader_220A.sys
22:23:54.0189 3864        BDA_Loader_220A ( UnsignedFile.Multi.Generic ) - warning
22:23:54.0189 3864        BDA_Loader_220A - detected UnsignedFile.Multi.Generic (1)
22:23:54.0267 3864        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
22:23:54.0376 3864        Beep - ok
22:23:54.0517 3864        blbdrive - ok
22:23:54.0579 3864        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
22:23:54.0642 3864        bowser - ok
22:23:54.0767 3864        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
22:23:54.0986 3864        BrFiltLo - ok
22:23:55.0126 3864        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
22:23:55.0204 3864        BrFiltUp - ok
22:23:55.0314 3864        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
22:23:55.0454 3864        Brserid - ok
22:23:55.0611 3864        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
22:23:55.0767 3864        BrSerWdm - ok
22:23:55.0814 3864        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
22:23:55.0939 3864        BrUsbMdm - ok
22:23:55.0986 3864        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
22:23:56.0064 3864        BrUsbSer - ok
22:23:56.0236 3864        BthEnum        (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys
22:23:56.0314 3864        BthEnum - ok
22:23:56.0392 3864        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
22:23:56.0532 3864        BTHMODEM - ok
22:23:56.0689 3864        BthPan          (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys
22:23:56.0767 3864        BthPan - ok
22:23:56.0876 3864        BTHPORT        (4a74bbb2b6761789f42a6613479bdb1d) C:\Windows\system32\Drivers\BTHport.sys
22:23:57.0017 3864        BTHPORT - ok
22:23:57.0173 3864        BTHUSB          (1a407f9b707a06f55aa150f9aa072b09) C:\Windows\system32\Drivers\BTHUSB.sys
22:23:57.0251 3864        BTHUSB - ok
22:23:57.0345 3864        Cam5603D        (441373e054f3a42e6074e5a2a125a37a) C:\Windows\system32\Drivers\BisonCam.sys
22:23:57.0423 3864        Cam5603D - ok
22:23:57.0564 3864        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
22:23:57.0642 3864        cdfs - ok
22:23:57.0720 3864        cdrom          (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
22:23:57.0782 3864        cdrom - ok
22:23:57.0845 3864        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
22:23:57.0923 3864        circlass - ok
22:23:58.0064 3864        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
22:23:58.0079 3864        CLFS - ok
22:23:58.0189 3864        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
22:23:58.0236 3864        CmBatt - ok
22:23:58.0392 3864        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
22:23:58.0392 3864        cmdide - ok
22:23:58.0439 3864        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
22:23:58.0454 3864        Compbatt - ok
22:23:58.0486 3864        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
22:23:58.0501 3864        crcdisk - ok
22:23:58.0548 3864        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
22:23:58.0642 3864        Crusoe - ok
22:23:58.0845 3864        CVirtA          (5c706c06c1279952d2cc1a609ca948bf) C:\Windows\system32\DRIVERS\CVirtA.sys
22:23:58.0876 3864        CVirtA - ok
22:23:59.0001 3864        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
22:23:59.0079 3864        DfsC - ok
22:23:59.0298 3864        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
22:23:59.0314 3864        disk - ok
22:23:59.0392 3864        DNE            (2eddbb3ef1dd5a28cb07c149d36e7286) C:\Windows\system32\DRIVERS\dne2000.sys
22:23:59.0439 3864        DNE ( UnsignedFile.Multi.Generic ) - warning
22:23:59.0439 3864        DNE - detected UnsignedFile.Multi.Generic (1)
22:23:59.0626 3864        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
22:23:59.0689 3864        drmkaud - ok
22:23:59.0798 3864        DslMNLwf        (e577b5c4a6be078e5445cdcfb65be7ab) C:\Windows\system32\DRIVERS\dslmnlwf.sys
22:23:59.0814 3864        DslMNLwf - ok
22:23:59.0970 3864        dsltestSp5      (c6b2e10cfe79169c72f0269087b9a603) C:\Windows\system32\Drivers\dsltestSp5.sys
22:23:59.0986 3864        dsltestSp5 - ok
22:24:00.0111 3864        DXGKrnl        (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
22:24:00.0173 3864        DXGKrnl - ok
22:24:00.0236 3864        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
22:24:00.0314 3864        E1G60 - ok
22:24:00.0470 3864        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
22:24:00.0501 3864        Ecache - ok
22:24:00.0579 3864        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
22:24:00.0595 3864        elxstor - ok
22:24:00.0720 3864        exfat          (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
22:24:00.0814 3864        exfat - ok
22:24:00.0986 3864        fastfat        (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
22:24:01.0064 3864        fastfat - ok
22:24:01.0157 3864        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
22:24:01.0282 3864        fdc - ok
22:24:01.0439 3864        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
22:24:01.0454 3864        FileInfo - ok
22:24:01.0501 3864        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
22:24:01.0548 3864        Filetrace - ok
22:24:01.0611 3864        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
22:24:01.0673 3864        flpydisk - ok
22:24:01.0814 3864        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
22:24:01.0829 3864        FltMgr - ok
22:24:01.0923 3864        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
22:24:01.0954 3864        Fs_Rec - ok
22:24:02.0001 3864        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
22:24:02.0017 3864        gagp30kx - ok
22:24:02.0157 3864        grmnusb        (d956358054e99e6ffac69cd87e893a89) C:\Windows\system32\drivers\grmnusb.sys
22:24:02.0204 3864        grmnusb - ok
22:24:02.0407 3864        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
22:24:02.0486 3864        HdAudAddService - ok
22:24:02.0626 3864        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
22:24:02.0720 3864        HDAudBus - ok
22:24:02.0939 3864        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
22:24:03.0048 3864        HidBth - ok
22:24:03.0095 3864        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
22:24:03.0157 3864        HidIr - ok
22:24:03.0236 3864        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
22:24:03.0282 3864        HidUsb - ok
22:24:03.0548 3864        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
22:24:03.0564 3864        HpCISSs - ok
22:24:03.0642 3864        HTTP            (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
22:24:03.0751 3864        HTTP - ok
22:24:03.0892 3864        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
22:24:03.0892 3864        i2omp - ok
22:24:03.0986 3864        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
22:24:04.0048 3864        i8042prt - ok
22:24:04.0204 3864        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
22:24:04.0220 3864        iaStorV - ok
22:24:04.0282 3864        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
22:24:04.0282 3864        iirsp - ok
22:24:04.0423 3864        IntcAzAudAddService (c61b3b87f3856cef0c9f204028c6860d) C:\Windows\system32\drivers\RTKVHDA.sys
22:24:04.0517 3864        IntcAzAudAddService - ok
22:24:04.0689 3864        intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
22:24:04.0720 3864        intelide - ok
22:24:04.0782 3864        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
22:24:04.0892 3864        intelppm - ok
22:24:04.0986 3864        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:24:05.0017 3864        IpFilterDriver - ok
22:24:05.0048 3864        IpInIp - ok
22:24:05.0173 3864        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
22:24:05.0251 3864        IPMIDRV - ok
22:24:05.0298 3864        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
22:24:05.0329 3864        IPNAT - ok
22:24:05.0392 3864        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
22:24:05.0407 3864        IRENUM - ok
22:24:05.0548 3864        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
22:24:05.0564 3864        isapnp - ok
22:24:05.0642 3864        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
22:24:05.0657 3864        iScsiPrt - ok
22:24:05.0704 3864        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
22:24:05.0704 3864        iteatapi - ok
22:24:05.0751 3864        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
22:24:05.0767 3864        iteraid - ok
22:24:05.0829 3864        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
22:24:05.0845 3864        kbdclass - ok
22:24:05.0986 3864        kbdhid          (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
22:24:06.0064 3864        kbdhid - ok
22:24:06.0142 3864        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
22:24:06.0189 3864        KSecDD - ok
22:24:06.0251 3864        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
22:24:06.0314 3864        lltdio - ok
22:24:06.0470 3864        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
22:24:06.0486 3864        LSI_FC - ok
22:24:06.0517 3864        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
22:24:06.0532 3864        LSI_SAS - ok
22:24:06.0595 3864        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
22:24:06.0611 3864        LSI_SCSI - ok
22:24:06.0673 3864        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
22:24:06.0720 3864        luafv - ok
22:24:06.0892 3864        MDC8021X        (8fee53c104223973ed9919936d9cd156) C:\Windows\system32\DRIVERS\mdc8021x.sys
22:24:06.0907 3864        MDC8021X ( UnsignedFile.Multi.Generic ) - warning
22:24:06.0907 3864        MDC8021X - detected UnsignedFile.Multi.Generic (1)
22:24:06.0986 3864        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
22:24:07.0001 3864        megasas - ok
22:24:07.0064 3864        MGHwCtrl        (25a4177b8abf458691138f0c9684e70f) C:\Windows\system32\drivers\MGHwCtrl.sys
22:24:07.0079 3864        MGHwCtrl ( UnsignedFile.Multi.Generic ) - warning
22:24:07.0079 3864        MGHwCtrl - detected UnsignedFile.Multi.Generic (1)
22:24:07.0251 3864        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
22:24:07.0329 3864        Modem - ok
22:24:07.0423 3864        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
22:24:07.0501 3864        monitor - ok
22:24:07.0595 3864        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
22:24:07.0611 3864        mouclass - ok
22:24:07.0736 3864        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
22:24:07.0814 3864        mouhid - ok
22:24:07.0876 3864        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
22:24:07.0907 3864        MountMgr - ok
22:24:07.0986 3864        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
22:24:08.0017 3864        mpio - ok
22:24:08.0142 3864        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
22:24:08.0204 3864        mpsdrv - ok
22:24:08.0267 3864        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
22:24:08.0298 3864        Mraid35x - ok
22:24:08.0361 3864        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
22:24:08.0439 3864        MRxDAV - ok
22:24:08.0798 3864        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
22:24:08.0861 3864        mrxsmb - ok
22:24:08.0954 3864        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:24:09.0017 3864        mrxsmb10 - ok
22:24:09.0111 3864        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:24:09.0157 3864        mrxsmb20 - ok
22:24:09.0267 3864        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
22:24:09.0282 3864        msahci - ok
22:24:09.0329 3864        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
22:24:09.0361 3864        msdsm - ok
22:24:09.0486 3864        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
22:24:09.0548 3864        Msfs - ok
22:24:09.0689 3864        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
22:24:09.0720 3864        msisadrv - ok
22:24:09.0845 3864        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
22:24:09.0939 3864        MSKSSRV - ok
22:24:10.0017 3864        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
22:24:10.0095 3864        MSPCLOCK - ok
22:24:10.0236 3864        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
22:24:10.0314 3864        MSPQM - ok
22:24:10.0407 3864        MsRPC          (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
22:24:10.0439 3864        MsRPC - ok
22:24:10.0532 3864        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
22:24:10.0548 3864        mssmbios - ok
22:24:10.0689 3864        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
22:24:10.0736 3864        MSTEE - ok
22:24:10.0845 3864        Mup            (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
22:24:10.0861 3864        Mup - ok
22:24:10.0954 3864        NativeWifiP    (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
22:24:10.0986 3864        NativeWifiP - ok
22:24:11.0142 3864        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
22:24:11.0204 3864        NDIS - ok
22:24:11.0282 3864        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
22:24:11.0361 3864        NdisTapi - ok
22:24:11.0439 3864        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
22:24:11.0517 3864        Ndisuio - ok
22:24:11.0657 3864        NdisWan        (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
22:24:11.0736 3864        NdisWan - ok
22:24:11.0814 3864        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
22:24:11.0861 3864        NDProxy - ok
22:24:11.0970 3864        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
22:24:12.0017 3864        NetBIOS - ok
22:24:12.0157 3864        netbt          (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
22:24:12.0204 3864        netbt - ok
22:24:12.0314 3864        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
22:24:12.0329 3864        nfrd960 - ok
22:24:12.0423 3864        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
22:24:12.0470 3864        Npfs - ok
22:24:12.0579 3864        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
22:24:12.0626 3864        nsiproxy - ok
22:24:12.0767 3864        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
22:24:12.0829 3864        Ntfs - ok
22:24:12.0986 3864        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
22:24:13.0111 3864        ntrigdigi - ok
22:24:13.0157 3864        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
22:24:13.0189 3864        Null - ok
22:24:13.0220 3864        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
22:24:13.0236 3864        nvraid - ok
22:24:13.0267 3864        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
22:24:13.0282 3864        nvstor - ok
22:24:13.0329 3864        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
22:24:13.0345 3864        nv_agp - ok
22:24:13.0439 3864        NwlnkFlt - ok
22:24:13.0470 3864        NwlnkFwd - ok
22:24:13.0532 3864        O2MDRDR        (a874f4e22d116bf5701db6dd8bcb1d27) C:\Windows\system32\DRIVERS\o2media.sys
22:24:13.0579 3864        O2MDRDR - ok
22:24:13.0626 3864        O2SDRDR        (55153f3f852c4bc0e050a65f5d914c01) C:\Windows\system32\DRIVERS\o2sd.sys
22:24:13.0642 3864        O2SDRDR - ok
22:24:13.0720 3864        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
22:24:13.0751 3864        ohci1394 - ok
22:24:13.0986 3864        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
22:24:14.0032 3864        Parport - ok
22:24:14.0111 3864        partmgr        (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
22:24:14.0111 3864        partmgr - ok
22:24:14.0157 3864        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
22:24:14.0204 3864        Parvdm - ok
22:24:14.0282 3864        pci            (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
22:24:14.0298 3864        pci - ok
22:24:14.0439 3864        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
22:24:14.0454 3864        pciide - ok
22:24:14.0532 3864        pcmcia          (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys
22:24:14.0548 3864        pcmcia - ok
22:24:14.0657 3864        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
22:24:14.0798 3864        PEAUTH - ok
22:24:15.0017 3864        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
22:24:15.0032 3864        PptpMiniport - ok
22:24:15.0095 3864        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
22:24:15.0157 3864        Processor - ok
22:24:15.0282 3864        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
22:24:15.0314 3864        PSched - ok
22:24:15.0454 3864        PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\Windows\system32\Drivers\PxHelp20.sys
22:24:15.0454 3864        PxHelp20 - ok
22:24:15.0548 3864        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
22:24:15.0595 3864        ql2300 - ok
22:24:15.0720 3864        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
22:24:15.0736 3864        ql40xx - ok
22:24:15.0798 3864        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
22:24:15.0829 3864        QWAVEdrv - ok
22:24:15.0970 3864        R300            (e52b7a5010011c29063684cac1a6bbf0) C:\Windows\system32\DRIVERS\atikmdag.sys
22:24:16.0189 3864        R300 - ok
22:24:16.0314 3864        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
22:24:16.0376 3864        RasAcd - ok
22:24:16.0439 3864        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
22:24:16.0486 3864        Rasl2tp - ok
22:24:16.0642 3864        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
22:24:16.0704 3864        RasPppoe - ok
22:24:16.0798 3864        RasSstp        (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
22:24:16.0829 3864        RasSstp - ok
22:24:16.0907 3864        rdbss          (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
22:24:16.0939 3864        rdbss - ok
22:24:17.0064 3864        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
22:24:17.0142 3864        RDPCDD - ok
22:24:17.0236 3864        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
22:24:17.0361 3864        rdpdr - ok
22:24:17.0392 3864        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
22:24:17.0423 3864        RDPENCDD - ok
22:24:17.0501 3864        RDPWD          (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
22:24:17.0548 3864        RDPWD - ok
22:24:17.0720 3864        RFCOMM          (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys
22:24:17.0782 3864        RFCOMM - ok
22:24:17.0876 3864        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
22:24:17.0907 3864        rspndr - ok
22:24:18.0064 3864        rt61x86        (25c699c801685c69557c60f6da01d90a) C:\Windows\system32\DRIVERS\netr61.sys
22:24:18.0126 3864        rt61x86 - ok
22:24:18.0314 3864        SANDRA          (230fd3749904ca045ea5ec0aa14006e9) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP1\WNt500x86\Sandra.sys
22:24:18.0329 3864        SANDRA - ok
22:24:18.0501 3864        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
22:24:18.0517 3864        sbp2port - ok
22:24:18.0595 3864        sdbus          (4339a2585708c7d9b0c0ce5aad3dd6ff) C:\Windows\system32\DRIVERS\sdbus.sys
22:24:18.0689 3864        sdbus - ok
22:24:18.0751 3864        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
22:24:18.0861 3864        secdrv - ok
22:24:19.0017 3864        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
22:24:19.0126 3864        Serenum - ok
22:24:19.0173 3864        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
22:24:19.0267 3864        Serial - ok
22:24:19.0329 3864        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
22:24:19.0376 3864        sermouse - ok
22:24:19.0532 3864        sffdisk        (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
22:24:19.0657 3864        sffdisk - ok
22:24:19.0704 3864        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
22:24:19.0751 3864        sffp_mmc - ok
22:24:19.0798 3864        sffp_sd        (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
22:24:19.0845 3864        sffp_sd - ok
22:24:19.0907 3864        sfloppy        (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys
22:24:19.0939 3864        sfloppy - ok
22:24:20.0079 3864        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
22:24:20.0095 3864        sisagp - ok
22:24:20.0142 3864        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
22:24:20.0157 3864        SiSRaid2 - ok
22:24:20.0189 3864        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
22:24:20.0204 3864        SiSRaid4 - ok
22:24:20.0298 3864        Smb            (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
22:24:20.0314 3864        Smb - ok
22:24:20.0392 3864        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
22:24:20.0407 3864        spldr - ok
22:24:20.0579 3864        srv            (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
22:24:20.0611 3864        srv - ok
22:24:20.0704 3864        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
22:24:20.0751 3864        srv2 - ok
22:24:20.0892 3864        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
22:24:20.0907 3864        srvnet - ok
22:24:21.0001 3864        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
22:24:21.0001 3864        ssmdrv - ok
22:24:21.0095 3864        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
22:24:21.0111 3864        swenum - ok
22:24:21.0251 3864        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
22:24:21.0251 3864        Symc8xx - ok
22:24:21.0314 3864        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
22:24:21.0314 3864        Sym_hi - ok
22:24:21.0361 3864        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
22:24:21.0376 3864        Sym_u3 - ok
22:24:21.0517 3864        Tcpip          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
22:24:21.0642 3864        Tcpip - ok
22:24:21.0782 3864        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
22:24:21.0923 3864        Tcpip6 - ok
22:24:22.0017 3864        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
22:24:22.0126 3864        tcpipreg - ok
22:24:22.0267 3864        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
22:24:22.0329 3864        TDPIPE - ok
22:24:22.0407 3864        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
22:24:22.0454 3864        TDTCP - ok
22:24:22.0532 3864        tdx            (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
22:24:22.0564 3864        tdx - ok
22:24:22.0626 3864        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
22:24:22.0642 3864        TermDD - ok
22:24:22.0829 3864        tosrfbd        (ce378f952a16fbfe355126d90d8f42e8) C:\Windows\system32\DRIVERS\tosrfbd.sys
22:24:22.0876 3864        tosrfbd - ok
22:24:22.0939 3864        Tosrfcom        (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\Windows\system32\drivers\Tosrfcom.sys
22:24:22.0970 3864        Tosrfcom - ok
22:24:23.0032 3864        Tosrfhid        (28099a4e52148319afa685d93a2244d0) C:\Windows\system32\DRIVERS\Tosrfhid.sys
22:24:23.0095 3864        Tosrfhid - ok
22:24:23.0236 3864        Tosrfusb        (20cc46c5d3326122e1a0a8c9dad00e0d) C:\Windows\system32\DRIVERS\tosrfusb.sys
22:24:23.0314 3864        Tosrfusb - ok
22:24:23.0407 3864        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
22:24:23.0486 3864        tssecsrv - ok
22:24:23.0564 3864        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
22:24:23.0626 3864        tunmp - ok
22:24:23.0767 3864        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
22:24:23.0798 3864        tunnel - ok
22:24:23.0876 3864        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
22:24:23.0892 3864        uagp35 - ok
22:24:24.0001 3864        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
22:24:24.0095 3864        udfs - ok
22:24:24.0251 3864        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
22:24:24.0282 3864        uliagpkx - ok
22:24:24.0329 3864        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
22:24:24.0361 3864        uliahci - ok
22:24:24.0423 3864        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
22:24:24.0439 3864        UlSata - ok
22:24:24.0486 3864        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
22:24:24.0501 3864        ulsata2 - ok
22:24:24.0595 3864        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
22:24:24.0626 3864        umbus - ok
22:24:24.0767 3864        usbccgp        (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\drivers\usbccgp.sys
22:24:24.0861 3864        usbccgp - ok
22:24:24.0939 3864        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
22:24:25.0001 3864        usbcir - ok
22:24:25.0095 3864        usbehci        (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
22:24:25.0111 3864        usbehci - ok
22:24:25.0204 3864        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
22:24:25.0251 3864        usbhub - ok
22:24:25.0329 3864        usbohci        (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
22:24:25.0361 3864        usbohci - ok
22:24:25.0423 3864        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
22:24:25.0486 3864        usbprint - ok
22:24:25.0611 3864        USBSTOR        (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:24:25.0642 3864        USBSTOR - ok
22:24:25.0720 3864        usbuhci        (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
22:24:25.0767 3864        usbuhci - ok
22:24:25.0876 3864        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
22:24:25.0923 3864        vga - ok
22:24:25.0986 3864        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
22:24:26.0032 3864        VgaSave - ok
22:24:26.0157 3864        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
22:24:26.0173 3864        viaagp - ok
22:24:26.0236 3864        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
22:24:26.0345 3864        ViaC7 - ok
22:24:26.0407 3864        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
22:24:26.0423 3864        viaide - ok
22:24:26.0486 3864        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
22:24:26.0501 3864        volmgr - ok
22:24:26.0642 3864        volmgrx        (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
22:24:26.0673 3864        volmgrx - ok
22:24:26.0767 3864        volsnap        (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
22:24:26.0782 3864        volsnap - ok
22:24:26.0892 3864        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
22:24:26.0907 3864        vsmraid - ok
22:24:27.0079 3864        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
22:24:27.0220 3864        WacomPen - ok
22:24:27.0282 3864        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
22:24:27.0314 3864        Wanarp - ok
22:24:27.0329 3864        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
22:24:27.0345 3864        Wanarpv6 - ok
22:24:27.0423 3864        wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\Windows\system32\DRIVERS\wanatw4.sys
22:24:27.0470 3864        wanatw - ok
22:24:27.0611 3864        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
22:24:27.0626 3864        Wd - ok
22:24:27.0689 3864        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
22:24:27.0720 3864        Wdf01000 - ok
22:24:27.0892 3864        WmiAcpi        (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
22:24:27.0970 3864        WmiAcpi - ok
22:24:28.0142 3864        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
22:24:28.0204 3864        WpdUsb - ok
22:24:28.0267 3864        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
22:24:28.0314 3864        ws2ifsl - ok
22:24:28.0423 3864        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
22:24:28.0470 3864        WUDFRd - ok
22:24:28.0579 3864        MBR (0x1B8)    (95a73b4cdf11ada3a91d4f313293dfd6) \Device\Harddisk0\DR0
22:24:28.0907 3864        \Device\Harddisk0\DR0 - ok
22:24:28.0923 3864        Boot (0x1200)  (560e7be9b30f7e4619c1eef87454266b) \Device\Harddisk0\DR0\Partition0
22:24:28.0923 3864        \Device\Harddisk0\DR0\Partition0 - ok
22:24:28.0923 3864        ============================================================
22:24:28.0923 3864        Scan finished
22:24:28.0923 3864        ============================================================
22:24:28.0954 1472        Detected object count: 5
22:24:28.0954 1472        Actual detected object count: 5
22:24:59.0517 1472        athrusb ( UnsignedFile.Multi.Generic ) - skipped by user
22:24:59.0517 1472        athrusb ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:24:59.0532 1472        BDA_Loader_220A ( UnsignedFile.Multi.Generic ) - skipped by user
22:24:59.0532 1472        BDA_Loader_220A ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:24:59.0532 1472        DNE ( UnsignedFile.Multi.Generic ) - skipped by user
22:24:59.0532 1472        DNE ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:24:59.0548 1472        MDC8021X ( UnsignedFile.Multi.Generic ) - skipped by user
22:24:59.0548 1472        MDC8021X ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:24:59.0548 1472        MGHwCtrl ( UnsignedFile.Multi.Generic ) - skipped by user
22:24:59.0548 1472        MGHwCtrl ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 08.01.2012 22:31
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

dieba 08.01.2012 23:23
Hallo Arne,
musste erst noch mal neu booten (wegen Fehlermeldung) und war noch irritiert, weil nach Anklicken von "Herunterfahren..." erst die Auswahl "Updates installieren und ..." erschien, habe dann nur "Neustart" gewählt. Augenscheinlich hat MS gerade updates bereitgestellt.
Hier das Ergebnis von Combofix:

Code:
ComboFix 12-01-07.03 - christa 08.01.2012  22:41:58.1.1 - x86
Microsoft® Windows Vista™ Home Basic  6.0.6002.2.1252.49.1031.18.895.321 [GMT 1:00]
ausgeführt von:: c:\users\christa\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\christa\AppData\Roaming\mIRC\logs\status.log
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-08 bis 2012-01-08  ))))))))))))))))))))))))))))))
.
.
2012-01-08 13:21 . 2012-01-08 13:21        --------        d-----w-        C:\_OTL
2012-01-07 10:16 . 2012-01-07 10:16        --------        d-----w-        c:\program files\ESET
2012-01-06 09:32 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{98BC21DA-1D0E-4936-9383-B6B6033225D7}\mpengine.dll
2012-01-04 20:10 . 2012-01-04 20:10        --------        d-----w-        c:\program files\7-Zip
2012-01-04 17:10 . 2012-01-04 17:11        --------        d-----w-        c:\users\christa\!!Systemänderungen
2012-01-04 11:33 . 2012-01-04 11:33        626688        ----a-w-        c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-04 11:33 . 2012-01-04 11:33        548864        ----a-w-        c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-04 11:33 . 2012-01-04 11:33        479232        ----a-w-        c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-04 11:33 . 2012-01-04 11:33        43992        ----a-w-        c:\program files\Mozilla Firefox\mozutils.dll
2012-01-03 19:13 . 2012-01-03 19:13        --------        d-----w-        c:\users\christa\AppData\Roaming\JAM Software
2012-01-03 19:13 . 2012-01-03 19:13        --------        d-----w-        c:\program files\JAM Software
2012-01-02 20:41 . 2012-01-02 20:41        --------        d-----w-        c:\program files\Belarc
2012-01-01 14:51 . 2008-10-27 09:04        514384        ----a-w-        c:\windows\system32\XAudio2_3.dll
2012-01-01 14:31 . 2012-01-01 14:31        --------        d-----w-        c:\program files\SiSoftware
2011-12-22 19:50 . 2011-12-22 19:50        --------        d-----w-        c:\program files\MSECache
2011-12-16 13:14 . 2011-11-03 22:31        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-12-15 18:07 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-12-15 18:07 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-12-15 18:07 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll
2011-12-15 18:07 . 2011-11-23 13:37        2043904        ----a-w-        c:\windows\system32\win32k.sys
2011-12-15 18:07 . 2011-11-08 12:10        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2011-12-15 18:07 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll
2011-12-15 18:07 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-25 18:33 . 2011-05-21 08:55        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-10 14:24 . 2011-11-29 23:06        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-04 11:33 . 2011-04-03 17:34        121816        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 4317184]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-30 281768]
.
c:\users\christa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2007-11-15 1085440]
.
c:\users\christa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\~Disabled
DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2007-11-15 1085440]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\~Disabled
PDFCreator.lnk - c:\program files\PDFCreator\PDFCreator.exe [2010-6-7 3084288]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2007-11-15 1085440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^phase-6 Reminder.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
backup=c:\windows\pss\phase-6 Reminder.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
REM [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
REM [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-12-24 16:50        981680        ----a-w-        c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-04-05 21:31        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=REM "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"swg"=REM c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 37632283
*Deregistered* - 37632283
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
bthsvcs        REG_MULTI_SZ          BthServ
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]
.
2012-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-07 19:07]
.
2012-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-07 19:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.juelich.de/
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Öffnen mit WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\christa\AppData\Roaming\Mozilla\Firefox\Profiles\8p6t23gq.default\
FF - prefs.js: browser.search.selectedEngine - Google Deutschland
FF - prefs.js: browser.startup.homepage - hxxp://www.juelich.de/stabue/
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
HKLM_ActiveSetup-ccc-core-static - msiexec
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-08 22:53
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2012-01-08  23:01:29
ComboFix-quarantined-files.txt  2012-01-08 22:01
.
Vor Suchlauf: 10 Verzeichnis(se), 54.135.246.848 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 54.057.295.872 Bytes frei
.
- - End Of File - - 5597650A0972F0CC23F3B5B299F07E74

cosinus 09.01.2012 11:07
Zitat:
c:\users\christa\!!Systemänderungen
Was ist das für ein Ordner?

dieba 09.01.2012 11:42
Hallo Arne,
bin nicht mehr ganz so jung (68) und merkfähig, führe deshalb bei solchen Sachen möglichst Buch. !!Systemänderungen ("!!" wegen schneller Auffindbarkeit) enthält momentan genau eine Datei NachCrash20120101.txt, Inhalt siehe unten. Was mich irritiert, ist, dass bis gerade (mehr als 10 min nach logon) der Rechner mit plattenzugriff so blockiert war, dass Eingabe hier für mehrere Sekunden blockiert/verzögert wurde, starten des Task-Managers fast 1 min brauchte und das anschließende starten des Resourcenmonitors daraus noch viel länger, während dessen die Darstellung im Taskmonitor einfror. Dachte schon, das System wäre eingefroren, bis es dann weiterging. Jetzt läuft alles halbwegs passabel.

Code:
Dienste geändert:
        superfetch                                        aut. ->        deakt.
        Windows Verwaltungsinstr.                aut. ->        manuell

autoruns Änderungen (deaktiviert):
        Logon                CNAP2 Launcher, MGSysCtrl        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVerion\Run]
                        ~Disabled (PDFCreator)                [C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
                        ~Disabled (DSL-Manager)                [C:\Users\christa\AppData\Roaming\Microsoft\Windows\Start Menu
                                                                        \Programs\Startup\AutorunsDisabled]
        Services        WMPNetworkSvc                        [HKLM\System\CurrentControlSet\Services]
                        SandraAgentSrv                        [HKLM\System\CurrentControlSet\Services]

dieba 09.01.2012 12:05
Nachtrag:
habe gerade mal in die Ereignisanzeige geschaut (1.Mal!). Zeigt nach Starten "kritisch" und 2x"Fehler" an.
Code:
Ereignis 100
Windows wurde gestartet:
    Startdauer                :                :        162473ms
    Beeinträchtigung                :        false
    Vorfallzeit (UTC)        :        09.01.2012 10:09:48
Ereignis 400:
Informationen zum Systemleistungs-Überwachungsereignis:
    Szenario                :        Systemreaktionsverhalten
    Analyseergebnis                :        Die Analyse war erfolgreich, und es wurden Fehlerursachen gefunden.
    Vorfallzeit (UTC)        :        09.01.2012 10:20:23
Ereignis 400:
Dieser Prozess führt zu viele Datenträgeraktivitäten aus beeinflusst die Leistung von Windows:
    Dateiname                :        \Windows\System32\msiexec.exe
    Anzeigename                :        Windows® Installer
    Version                :        4.5.6002.18005 (lh_sp2rtm.090410-1830)
    Threadzeit                :        198ms
    Blockierte Zeit                :        54ms
    Vorfallzeit (UTC)        :        09.01.2012 10:20:23

und noch zwei nachfolgende "Warnings":
Dieser Prozess führt zu viele Datenträgeraktivitäten aus beeinflusst die Leistung von Windows:
    Dateiname                :        \Device\HarddiskVolume1\Windows\System32\SearchIndexer.exe
    Anzeigename                :        Microsoft Windows Search-Indexerstellung
    Version                :        7.00.6002.18005 (lh_sp2rtm.090410-1830)
    Threadzeit                :        198ms
    Blockierte Zeit                :        30ms
    Vorfallzeit (UTC)        :        09.01.2012 10:20:23
Dieser Prozess führt zu viele Datenträgeraktivitäten aus beeinflusst die Leistung von Windows:
    Dateiname                :        \Device\HarddiskVolume1\Program Files\Avira\AntiVir Desktop\avguard.exe
    Anzeigename                :        Antivirus On-Access Service
    Version                :        10.00.01.59
    Threadzeit                :        198ms
    Blockierte Zeit                :        25ms
    Vorfallzeit (UTC)        :        09.01.2012 10:20:23

cosinus 09.01.2012 15:33
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

dieba 09.01.2012 21:49
Guten Abend, Arne,

auf zum nächsten Schritt - scheint ja was hartnäckigeres zu sein. Zwischendurch schon mal vielen Dank für die Bemühungen!

GMER Scan:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-09 21:02:19
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK1234GAX rev.AC001A
Running: 3c5dcupk.exe; Driver: C:\Users\christa\AppData\Local\Temp\ugloypob.sys


---- System - GMER 1.0.15 ----

SSDT            8A27C076                                                                                        ZwCreateSection
SSDT            8A27C07B                                                                                        ZwSetContextThread
SSDT            8A27C017                                                                                        ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!KeSetEvent + 215                                                                    81EB2998 4 Bytes  [76, C0, 27, 8A]
.text          ntkrnlpa.exe!KeSetEvent + 56D                                                                    81EB2CF0 4 Bytes  [7B, C0, 27, 8A]
.text          ntkrnlpa.exe!KeSetEvent + 621                                                                    81EB2DA4 4 Bytes  [17, C0, 27, 8A] {POP SS; SHL BYTE [EDI], 0x8a}

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[1980] @ C:\Windows\system32\ole32.dll [msvcrt.dll!free]                  [7226F3FB] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                        fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0013d382bfb8                     
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0013d382bfb8 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
und OSAM Scan:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:27:52 on 09.01.2012

OS: Windows Vista Home Basic Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Computer, Inc." - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - "Borland Software Corporation" - C:\Windows\system32\bdeadmin.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
"LocalCOM.cpl" - "TOSHIBA CORPORATION" - C:\Windows\system32\LocalCOM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Computer, Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AEGIS Protocol (IEEE 802.1x) v2.3.1.10" (MDC8021X) - "Meetinghouse Data Communications" - C:\Windows\System32\DRIVERS\mdc8021x.sys
"Atheros Wireless LAN USB device driver" (athrusb) - "Atheros Communications, Inc." - C:\Windows\System32\DRIVERS\athrusb.sys
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\christa\AppData\Local\Temp\catchme.sys  (File not found)
"Digital-TV Receiver Firmware Loader 6.7.10.0" (BDA_Loader_220A) - "WideView Technology Inc." - C:\Windows\System32\Drivers\BDA_Loader_220A.sys
"dsltestSp5 NDIS Protocol Driver" (dsltestSp5) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\System32\Drivers\dsltestSp5.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MGHwCtrl" (MGHwCtrl) - "Windows (R) 2000 DDK provider" - C:\Windows\system32\drivers\MGHwCtrl.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"SANDRA" (SANDRA) - "SiSoftware" - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP1\WNt500x86\Sandra.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
AutorunsDisabled "AutorunsDisabled" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{6318E0AB-2E93-11D1-B8ED-00608CC9A71F} "VoilaXctl Class" - "Belarc, Inc." - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{71A068F3-2DC9-438D-8944-6B4FF540D2F5} "QContextMenu Class" - "Quinnware" - C:\Program Files\Quintessential Media Player\QMPShell.dll
{71A466B0-65CC-4B41-9043-6090F2C830D3} "QIconHandler Class" - "Quinnware" - C:\Program Files\Quintessential Media Player\QMPShell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{406B5949-7190-4245-91A9-30A17DE16AD0} "Snapfish Activia" - "Snapfish" - C:\Windows\Downloaded Program Files\SnapfishActivia1000.ocx / hxxp://www3.snapfish.de/SnapfishActivia.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
AutorunsDisabled "AutorunsDisabled" - ? -  (File not found | COM-object registry key not found)
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\christa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM Startup" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Toshiba Bluetooth Monitor" - "TOSHIBA CORPORATION." - C:\Windows\system32\tbtmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"DSL-Manager" (TDslMgrService) - "T-Systems Enterprise Services GmbH" - C:\Program Files\DSL-Manager\DslMgrSvc.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"O2Micro Flash Memory" (O2Flash) - "O2Micro International" - C:\Windows\system32\o2flash.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"SCM Driver Daemon" (NishService) - ? - C:\Program Files\System Control Manager\edd.exe  (File found, but it contains no detailed information)
"TOSHIBA Bluetooth Service" (TOSHIBA Bluetooth Service) - "TOSHIBA CORPORATION" - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Noch etwas!: Nach Neustart nach GMER Scan zeigte der Defender nach Einschalten eine kurze Nachricht, die ich mir so schnell nicht merken konnte (sinngemäß "irgendein Programm hat ... geändert"). Unter Verlauf fand ich dann:

Code:
Name          Warnstufe    Ausgeführte Aktion        Datum                  Status
unbekannt    unbekannt    zulassen                    09.01.2012 20:11      erfolgreich

Beschreibung:
Das Verhalten dieses Programms ist potenziell unerwünscht.

Empfehlung:
Lassen Sie dieses entdeckte Element nur zu, wenn Sie dem Programm oder dem Softwareherausgeber vertrauen.

Ressourcen:
regkey:
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ugloypob

file:
C:\Users\christa\AppData\Local\Temp\ugloypob.sys

Kategorie:
Noch nicht klassifiziert
Muss allerdings nicht mit der genannten Meldung zusammenhängen, denn gerade kam nach OSAM Scan und wiedereinschalten von Defender die gleiche Meldung: "ein bekanntes Prrogramm hat ... mpcmdrun.exe ..."

so, jetzt kommt der aswmbr dran. Bis später,

dieba

dieba 09.01.2012 22:34
aswmbr scan:

Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-09 21:53:49
-----------------------------
21:53:49.646    OS Version: Windows 6.0.6002 Service Pack 2
21:53:49.646    Number of processors: 1 586 0x2402
21:53:49.646    ComputerName: FREIZEIT  UserName: christa
21:54:49.319    Initialize success
22:04:31.262    AVAST engine defs: 12010901
22:08:32.558    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
22:08:32.558    Disk 0 Vendor: TOSHIBA_MK1234GAX AC001A Size: 114473MB BusType: 3
22:08:32.590    Disk 0 MBR read successfully
22:08:32.605    Disk 0 MBR scan
22:08:32.949    Disk 0 unknown MBR code
22:08:32.980    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      104006 MB offset 63
22:08:33.090    Disk 0 Partition 2 00    27 Hidden NTFS WinRE MSDOS5.0    10464 MB offset 213005835
22:08:33.152    Disk 0 scanning sectors +234436545
22:08:33.308    Disk 0 scanning C:\Windows\system32\drivers
22:09:04.074    Service scanning
22:09:06.199    Modules scanning
22:09:17.168    Disk 0 trace - called modules:
22:09:17.183    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
22:09:17.183    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x849c25d8]
22:09:17.199    3 CLASSPNP.SYS[861a88b3] -> nt!IofCallDriver -> [0x83a83a10]
22:09:17.199    5 acpi.sys[806166bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x83648528]
22:09:18.855    AVAST engine scan C:\Windows
22:09:27.418    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
22:09:33.543    AVAST engine scan C:\Windows\system32
22:14:28.512    AVAST engine scan C:\Windows\system32\drivers
22:14:46.746    AVAST engine scan C:\Users\christa
22:18:44.481    File: C:\Users\christa\Downloads\route_anzeigen.exe  **INFECTED** Win32:Dropper-JQD [Drp]
22:25:34.341    AVAST engine scan C:\ProgramData
22:27:38.216    Scan finished successfully
22:30:19.716    Disk 0 MBR has been saved successfully to "C:\Users\christa\Desktop\MBR.dat"
22:30:19.716    The log file has been saved successfully to "C:\Users\christa\Desktop\aswMBR.txt"
Gruß, dieba

cosinus 09.01.2012 23:10
ugloypob ist von GMER, ein "random" Name:
Zitat:
Running: 3c5dcupk.exe; Driver: C:\Users\christa\AppData\Local\Temp\ugloypob.sys
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
Anschließend Windows neu starten und ein neues Log mit aswMBR machen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:49 Uhr.
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130