Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BKA Trojaner (https://www.trojaner-board.de/108530-bka-trojaner.html)

Tim2012 24.01.2012 12:11
BKA Trojaner
 
Hallo!

Der BKA-Trojaner hat meinen Rechner infiziert. Urplötzlich beim Surfen war er da und legte mein System lahm. Nach kurzem hin und her gelang es mir beim Starten ein Explorer-Fenster zu öffnen. In autostart löschte ich eine Verknüpfung namens "0.005427543242426669.exe" und danach konnte ich wieder normal booten.

Danach machte ich einen Scan mit Malwarebytes, Avira und einen Online-Scan mit ESET. Die entsprechenden Logs habe ich dem Anhang hinzugefügt. Ein wiederholter Scan mit den drei angegebenen Tools brachte jeweils keine weiteren Funde. Malwarebytes hat die gleichnamige Datei zur obigen Verknüpfung entfernt. OTL und Extra befinden sich ebenfalls im Anhang.

Ist der Trojaner dadurch bereits beseitigt?

Danke im Voraus für die Hilfe.

Tim

cosinus 24.01.2012 21:44
Zitat:
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 **w.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
Weswegen soll dein Rechner diverse Adobe-Server nicht erreichen können? :confused:

Tim2012 25.01.2012 00:54
Jugendsünden Alles längst deinstalliert.

Ich benutze schon lange ausschließlich legal erworbene Software.

cosinus 25.01.2012 18:54
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh953cl3s
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh953cl3s
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh953cl3s
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh953cl3s
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh953cl3s
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.11.30 12:31:24 | 000,000,029 | RH-- | M] () - F:\autorun.inf.bmw -- [ NTFS ]
[2009.10.12 23:29:57 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Tim2012 25.01.2012 22:02
OTL Log-Datei 01252012_214659.log:

Code:

All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
F:\autorun.inf.bmw moved successfully.
C:\ProgramData\FullRemove.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: ******
->Temp folder emptied: 2193010500 bytes
->Temporary Internet Files folder emptied: 3440640 bytes
->Java cache emptied: 1867226 bytes
->FireFox cache emptied: 43742088 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 56950 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 12288 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 2.138,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01252012_214659

Files\Folders moved on Reboot...
C:\Users\******\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Hosts hatte ich vorher schon entrümpelt.

Danke bis hierhin. Bin gespannt, wie es weitergeht.

cosinus 26.01.2012 11:40
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Tim2012 26.01.2012 21:46
TDSSKiller-Log:

Code:
21:34:28.0645 0400        TDSS rootkit removing tool 2.7.7.0 Jan 24 2012 16:44:27
21:34:28.0832 0400        ============================================================
21:34:28.0832 0400        Current date / time: 2012/01/26 21:34:28.0832
21:34:28.0832 0400        SystemInfo:
21:34:28.0832 0400       
21:34:28.0832 0400        OS Version: 6.1.7601 ServicePack: 1.0
21:34:28.0832 0400        Product type: Workstation
21:34:28.0832 0400        ComputerName: ALPHA
21:34:28.0832 0400        UserName: *****
21:34:28.0832 0400        Windows directory: C:\Windows
21:34:28.0832 0400        System windows directory: C:\Windows
21:34:28.0832 0400        Running under WOW64
21:34:28.0832 0400        Processor architecture: Intel x64
21:34:28.0832 0400        Number of processors: 8
21:34:28.0832 0400        Page size: 0x1000
21:34:28.0832 0400        Boot type: Normal boot
21:34:28.0832 0400        ============================================================
21:34:30.0314 0400        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:34:30.0439 0400        Initialize success
21:34:41.0699 1388        ============================================================
21:34:41.0699 1388        Scan started
21:34:41.0699 1388        Mode: Manual; SigCheck; TDLFS;
21:34:41.0699 1388        ============================================================
21:34:42.0354 1388        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:34:42.0432 1388        1394ohci - ok
21:34:42.0494 1388        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:34:42.0510 1388        ACPI - ok
21:34:42.0541 1388        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:34:42.0588 1388        AcpiPmi - ok
21:34:42.0635 1388        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:34:42.0666 1388        adp94xx - ok
21:34:42.0697 1388        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:34:42.0728 1388        adpahci - ok
21:34:42.0759 1388        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:34:42.0791 1388        adpu320 - ok
21:34:42.0837 1388        AFD            (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
21:34:42.0915 1388        AFD - ok
21:34:42.0931 1388        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:34:42.0947 1388        agp440 - ok
21:34:43.0009 1388        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:34:43.0025 1388        aliide - ok
21:34:43.0071 1388        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:34:43.0087 1388        amdide - ok
21:34:43.0087 1388        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:34:43.0149 1388        AmdK8 - ok
21:34:43.0165 1388        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:34:43.0227 1388        AmdPPM - ok
21:34:43.0259 1388        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:34:43.0274 1388        amdsata - ok
21:34:43.0290 1388        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:34:43.0321 1388        amdsbs - ok
21:34:43.0321 1388        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:34:43.0337 1388        amdxata - ok
21:34:43.0446 1388        AnyDVD          (a4837260ab5e274d508a52a6da7c9ed1) C:\Windows\system32\Drivers\AnyDVD.sys
21:34:43.0508 1388        AnyDVD - ok
21:34:43.0524 1388        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:34:43.0649 1388        AppID - ok
21:34:43.0649 1388        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:34:43.0664 1388        arc - ok
21:34:43.0664 1388        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:34:43.0680 1388        arcsas - ok
21:34:43.0727 1388        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:34:43.0851 1388        AsyncMac - ok
21:34:43.0867 1388        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:34:43.0883 1388        atapi - ok
21:34:43.0914 1388        AtiHdmiService  (506934df94e3197f4a1bbe8fbeab0ccd) C:\Windows\system32\drivers\AtiHdmi.sys
21:34:43.0929 1388        AtiHdmiService - ok
21:34:44.0039 1388        atikmdag        (2263eafcf5add181b7fd47b78ae6d3e3) C:\Windows\system32\DRIVERS\atikmdag.sys
21:34:44.0210 1388        atikmdag - ok
21:34:44.0257 1388        avgntflt        (b1224e6b086cd6548315b04ab575a23e) C:\Windows\system32\DRIVERS\avgntflt.sys
21:34:44.0273 1388        avgntflt - ok
21:34:44.0304 1388        avipbb          (ed45f12cfa62b83765c9c1496758cc87) C:\Windows\system32\DRIVERS\avipbb.sys
21:34:44.0319 1388        avipbb - ok
21:34:44.0351 1388        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:34:44.0413 1388        b06bdrv - ok
21:34:44.0429 1388        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:34:44.0475 1388        b57nd60a - ok
21:34:44.0491 1388        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:34:44.0569 1388        Beep - ok
21:34:44.0585 1388        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:34:44.0600 1388        blbdrive - ok
21:34:44.0631 1388        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:34:44.0647 1388        bowser - ok
21:34:44.0663 1388        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:34:44.0709 1388        BrFiltLo - ok
21:34:44.0709 1388        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:34:44.0725 1388        BrFiltUp - ok
21:34:44.0756 1388        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:34:44.0787 1388        Brserid - ok
21:34:44.0787 1388        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:34:44.0819 1388        BrSerWdm - ok
21:34:44.0819 1388        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:34:44.0850 1388        BrUsbMdm - ok
21:34:44.0850 1388        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:34:44.0865 1388        BrUsbSer - ok
21:34:44.0881 1388        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:34:44.0912 1388        BTHMODEM - ok
21:34:44.0928 1388        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:34:44.0959 1388        cdfs - ok
21:34:44.0990 1388        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
21:34:45.0006 1388        cdrom - ok
21:34:45.0037 1388        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:34:45.0068 1388        circlass - ok
21:34:45.0084 1388        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:34:45.0115 1388        CLFS - ok
21:34:45.0131 1388        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:34:45.0146 1388        CmBatt - ok
21:34:45.0177 1388        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:34:45.0177 1388        cmdide - ok
21:34:45.0209 1388        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:34:45.0240 1388        CNG - ok
21:34:45.0255 1388        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:34:45.0271 1388        Compbatt - ok
21:34:45.0302 1388        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:34:45.0349 1388        CompositeBus - ok
21:34:45.0349 1388        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:34:45.0380 1388        crcdisk - ok
21:34:45.0411 1388        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:34:45.0443 1388        DfsC - ok
21:34:45.0458 1388        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:34:45.0489 1388        discache - ok
21:34:45.0521 1388        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:34:45.0521 1388        Disk - ok
21:34:45.0536 1388        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:34:45.0567 1388        drmkaud - ok
21:34:45.0583 1388        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:34:45.0630 1388        DXGKrnl - ok
21:34:45.0677 1388        e1kexpress      (52a482dc61f24b498c8268866b90bb44) C:\Windows\system32\DRIVERS\e1k62x64.sys
21:34:45.0692 1388        e1kexpress - ok
21:34:45.0770 1388        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:34:45.0879 1388        ebdrv - ok
21:34:45.0942 1388        ElbyCDFL        (9387a484d31209d7fc3f795a787294db) C:\Windows\system32\Drivers\ElbyCDFL.sys
21:34:45.0957 1388        ElbyCDFL - ok
21:34:45.0989 1388        ElbyCDIO        (a05fc7eca0966ebb70e4d17b855a853b) C:\Windows\system32\Drivers\ElbyCDIO.sys
21:34:46.0004 1388        ElbyCDIO - ok
21:34:46.0020 1388        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:34:46.0051 1388        elxstor - ok
21:34:46.0067 1388        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:34:46.0113 1388        ErrDev - ok
21:34:46.0129 1388        EST_BusEnum - ok
21:34:46.0160 1388        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:34:46.0207 1388        exfat - ok
21:34:46.0223 1388        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:34:46.0254 1388        fastfat - ok
21:34:46.0269 1388        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:34:46.0285 1388        fdc - ok
21:34:46.0301 1388        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:34:46.0316 1388        FileInfo - ok
21:34:46.0332 1388        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:34:46.0379 1388        Filetrace - ok
21:34:46.0379 1388        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:34:46.0394 1388        flpydisk - ok
21:34:46.0410 1388        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:34:46.0441 1388        FltMgr - ok
21:34:46.0472 1388        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:34:46.0488 1388        FsDepends - ok
21:34:46.0488 1388        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
21:34:46.0503 1388        Fs_Rec - ok
21:34:46.0519 1388        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:34:46.0550 1388        fvevol - ok
21:34:46.0550 1388        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:34:46.0566 1388        gagp30kx - ok
21:34:46.0613 1388        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:34:46.0659 1388        hcw85cir - ok
21:34:46.0691 1388        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:34:46.0722 1388        HdAudAddService - ok
21:34:46.0753 1388        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:34:46.0784 1388        HDAudBus - ok
21:34:46.0800 1388        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:34:46.0815 1388        HidBatt - ok
21:34:46.0815 1388        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:34:46.0847 1388        HidBth - ok
21:34:46.0862 1388        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:34:46.0878 1388        HidIr - ok
21:34:46.0909 1388        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:34:46.0925 1388        HidUsb - ok
21:34:46.0971 1388        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:34:46.0987 1388        HpSAMD - ok
21:34:47.0049 1388        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:34:47.0127 1388        HTTP - ok
21:34:47.0174 1388        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:34:47.0174 1388        hwpolicy - ok
21:34:47.0190 1388        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:34:47.0205 1388        i8042prt - ok
21:34:47.0237 1388        iaStor          (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys
21:34:47.0237 1388        iaStor - ok
21:34:47.0268 1388        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:34:47.0283 1388        iaStorV - ok
21:34:47.0330 1388        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:34:47.0346 1388        iirsp - ok
21:34:47.0424 1388        IntcAzAudAddService (135856ac71116ccff05ed8481745241b) C:\Windows\system32\drivers\RTKVHD64.sys
21:34:47.0486 1388        IntcAzAudAddService - ok
21:34:47.0517 1388        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:34:47.0533 1388        intelide - ok
21:34:47.0549 1388        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:34:47.0564 1388        intelppm - ok
21:34:47.0595 1388        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:34:47.0642 1388        IpFilterDriver - ok
21:34:47.0673 1388        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:34:47.0705 1388        IPMIDRV - ok
21:34:47.0720 1388        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:34:47.0767 1388        IPNAT - ok
21:34:47.0798 1388        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:34:47.0845 1388        IRENUM - ok
21:34:47.0876 1388        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:34:47.0892 1388        isapnp - ok
21:34:47.0923 1388        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:34:47.0954 1388        iScsiPrt - ok
21:34:48.0001 1388        JRAID          (2224abc439d115a44edb5630a92c1d7e) C:\Windows\system32\DRIVERS\jraid.sys
21:34:48.0017 1388        JRAID - ok
21:34:48.0048 1388        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:34:48.0063 1388        kbdclass - ok
21:34:48.0079 1388        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:34:48.0095 1388        kbdhid - ok
21:34:48.0126 1388        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:34:48.0141 1388        KSecDD - ok
21:34:48.0157 1388        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:34:48.0188 1388        KSecPkg - ok
21:34:48.0204 1388        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:34:48.0266 1388        ksthunk - ok
21:34:48.0297 1388        lfsfilt        (3b3029ee01efe3d064fac9855fd08312) C:\Windows\system32\DRIVERS\lfsfilt.sys
21:34:48.0329 1388        lfsfilt - ok
21:34:48.0344 1388        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:34:48.0375 1388        lltdio - ok
21:34:48.0407 1388        lpx            (98e1cb1ffc2b84f06deb20bbaf5d3c6d) C:\Windows\system32\DRIVERS\lpx.sys
21:34:48.0407 1388        lpx - ok
21:34:48.0438 1388        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:34:48.0438 1388        LSI_FC - ok
21:34:48.0453 1388        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:34:48.0469 1388        LSI_SAS - ok
21:34:48.0469 1388        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:34:48.0485 1388        LSI_SAS2 - ok
21:34:48.0485 1388        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:34:48.0500 1388        LSI_SCSI - ok
21:34:48.0516 1388        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:34:48.0547 1388        luafv - ok
21:34:48.0563 1388        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:34:48.0563 1388        megasas - ok
21:34:48.0578 1388        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:34:48.0594 1388        MegaSR - ok
21:34:48.0609 1388        MEMSWEEP2 - ok
21:34:48.0641 1388        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:34:48.0687 1388        Modem - ok
21:34:48.0703 1388        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:34:48.0719 1388        monitor - ok
21:34:48.0750 1388        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:34:48.0750 1388        mouclass - ok
21:34:48.0765 1388        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:34:48.0781 1388        mouhid - ok
21:34:48.0797 1388        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:34:48.0797 1388        mountmgr - ok
21:34:48.0828 1388        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:34:48.0843 1388        mpio - ok
21:34:48.0843 1388        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:34:48.0890 1388        mpsdrv - ok
21:34:48.0906 1388        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:34:48.0968 1388        MRxDAV - ok
21:34:48.0984 1388        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:34:49.0015 1388        mrxsmb - ok
21:34:49.0031 1388        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:34:49.0046 1388        mrxsmb10 - ok
21:34:49.0077 1388        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:34:49.0077 1388        mrxsmb20 - ok
21:34:49.0109 1388        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:34:49.0124 1388        msahci - ok
21:34:49.0140 1388        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:34:49.0155 1388        msdsm - ok
21:34:49.0171 1388        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:34:49.0202 1388        Msfs - ok
21:34:49.0202 1388        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:34:49.0249 1388        mshidkmdf - ok
21:34:49.0265 1388        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:34:49.0280 1388        msisadrv - ok
21:34:49.0296 1388        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:34:49.0343 1388        MSKSSRV - ok
21:34:49.0358 1388        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:34:49.0374 1388        MSPCLOCK - ok
21:34:49.0389 1388        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:34:49.0421 1388        MSPQM - ok
21:34:49.0467 1388        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:34:49.0499 1388        MsRPC - ok
21:34:49.0530 1388        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:34:49.0530 1388        mssmbios - ok
21:34:49.0545 1388        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:34:49.0577 1388        MSTEE - ok
21:34:49.0608 1388        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:34:49.0655 1388        MTConfig - ok
21:34:49.0670 1388        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:34:49.0701 1388        Mup - ok
21:34:49.0748 1388        mwlPSDFilter    (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
21:34:49.0748 1388        mwlPSDFilter - ok
21:34:49.0873 1388        mwlPSDNServ    (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
21:34:49.0889 1388        mwlPSDNServ - ok
21:34:49.0904 1388        mwlPSDVDisk    (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
21:34:49.0920 1388        mwlPSDVDisk - ok
21:34:49.0967 1388        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:34:50.0029 1388        NativeWifiP - ok
21:34:50.0091 1388        ndasbus        (5f970bb4ad0b39d2400a7af2ca8424fc) C:\Windows\system32\DRIVERS\ndasbus.sys
21:34:50.0107 1388        ndasbus - ok
21:34:50.0185 1388        ndasfat        (52ac76f2ef766c2ee5d7774d53677547) C:\Windows\system32\DRIVERS\ndasfat.sys
21:34:50.0216 1388        ndasfat - ok
21:34:50.0263 1388        ndasscsi        (7f693d973279853a1d1c9435e667868b) C:\Windows\system32\DRIVERS\ndasscsi.sys
21:34:50.0294 1388        ndasscsi - ok
21:34:50.0497 1388        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:34:50.0544 1388        NDIS - ok
21:34:50.0575 1388        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:34:50.0622 1388        NdisCap - ok
21:34:50.0637 1388        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:34:50.0684 1388        NdisTapi - ok
21:34:50.0700 1388        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:34:50.0747 1388        Ndisuio - ok
21:34:50.0778 1388        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:34:50.0809 1388        NdisWan - ok
21:34:50.0840 1388        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:34:50.0871 1388        NDProxy - ok
21:34:50.0887 1388        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:34:50.0918 1388        NetBIOS - ok
21:34:50.0934 1388        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:34:50.0965 1388        NetBT - ok
21:34:51.0012 1388        netr28x        (d66596db0a0739a89c25b590ce36d628) C:\Windows\system32\DRIVERS\netr28x.sys
21:34:51.0043 1388        netr28x - ok
21:34:51.0043 1388        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:34:51.0059 1388        nfrd960 - ok
21:34:51.0090 1388        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:34:51.0121 1388        Npfs - ok
21:34:51.0137 1388        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:34:51.0168 1388        nsiproxy - ok
21:34:51.0215 1388        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:34:51.0277 1388        Ntfs - ok
21:34:51.0293 1388        NTIDrvr        (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
21:34:51.0308 1388        NTIDrvr - ok
21:34:51.0324 1388        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:34:51.0355 1388        Null - ok
21:34:51.0371 1388        NUServer64      (05ed699058671ee1dc0b10e8b1152e92) C:\Windows\system32\DRIVERS\NUServer64.sys
21:34:51.0386 1388        NUServer64 ( UnsignedFile.Multi.Generic ) - warning
21:34:51.0386 1388        NUServer64 - detected UnsignedFile.Multi.Generic (1)
21:34:51.0402 1388        NUS_Bus - ok
21:34:51.0449 1388        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:34:51.0464 1388        nvraid - ok
21:34:51.0495 1388        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:34:51.0511 1388        nvstor - ok
21:34:51.0527 1388        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:34:51.0542 1388        nv_agp - ok
21:34:51.0589 1388        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:34:51.0620 1388        ohci1394 - ok
21:34:51.0667 1388        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:34:51.0683 1388        Parport - ok
21:34:51.0698 1388        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
21:34:51.0729 1388        partmgr - ok
21:34:51.0745 1388        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:34:51.0761 1388        pci - ok
21:34:51.0776 1388        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:34:51.0792 1388        pciide - ok
21:34:51.0807 1388        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:34:51.0839 1388        pcmcia - ok
21:34:51.0870 1388        pcouffin        (af7ce12c4f3dc8cb2b07685c916bbcfe) C:\Windows\system32\Drivers\pcouffin.sys
21:34:51.0885 1388        pcouffin - ok
21:34:51.0901 1388        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:34:51.0917 1388        pcw - ok
21:34:51.0932 1388        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:34:51.0995 1388        PEAUTH - ok
21:34:52.0041 1388        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:34:52.0073 1388        PptpMiniport - ok
21:34:52.0073 1388        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:34:52.0104 1388        Processor - ok
21:34:52.0119 1388        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:34:52.0182 1388        Psched - ok
21:34:52.0213 1388        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:34:52.0275 1388        ql2300 - ok
21:34:52.0291 1388        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:34:52.0307 1388        ql40xx - ok
21:34:52.0307 1388        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:34:52.0338 1388        QWAVEdrv - ok
21:34:52.0353 1388        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:34:52.0400 1388        RasAcd - ok
21:34:52.0431 1388        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:34:52.0463 1388        RasAgileVpn - ok
21:34:52.0494 1388        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:34:52.0525 1388        Rasl2tp - ok
21:34:52.0541 1388        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:34:52.0572 1388        RasPppoe - ok
21:34:52.0587 1388        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:34:52.0619 1388        RasSstp - ok
21:34:52.0634 1388        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:34:52.0665 1388        rdbss - ok
21:34:52.0681 1388        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:34:52.0697 1388        rdpbus - ok
21:34:52.0697 1388        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:34:52.0728 1388        RDPCDD - ok
21:34:52.0743 1388        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:34:52.0775 1388        RDPENCDD - ok
21:34:52.0790 1388        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:34:52.0821 1388        RDPREFMP - ok
21:34:52.0837 1388        RDPWD          (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
21:34:52.0884 1388        RDPWD - ok
21:34:52.0931 1388        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:34:52.0946 1388        rdyboost - ok
21:34:52.0993 1388        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:34:53.0040 1388        rspndr - ok
21:34:53.0071 1388        SaiH0BAC        (231a3700154b1a49c2f05cb0da4b2747) C:\Windows\system32\DRIVERS\SaiH0BAC.sys
21:34:53.0087 1388        SaiH0BAC - ok
21:34:53.0133 1388        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:34:53.0149 1388        sbp2port - ok
21:34:53.0165 1388        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:34:53.0211 1388        scfilter - ok
21:34:53.0227 1388        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:34:53.0258 1388        secdrv - ok
21:34:53.0274 1388        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:34:53.0289 1388        Serenum - ok
21:34:53.0321 1388        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:34:53.0352 1388        Serial - ok
21:34:53.0367 1388        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:34:53.0399 1388        sermouse - ok
21:34:53.0430 1388        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:34:53.0477 1388        sffdisk - ok
21:34:53.0477 1388        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:34:53.0508 1388        sffp_mmc - ok
21:34:53.0523 1388        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:34:53.0555 1388        sffp_sd - ok
21:34:53.0555 1388        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:34:53.0570 1388        sfloppy - ok
21:34:53.0586 1388        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:34:53.0601 1388        SiSRaid2 - ok
21:34:53.0601 1388        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:34:53.0617 1388        SiSRaid4 - ok
21:34:53.0633 1388        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:34:53.0679 1388        Smb - ok
21:34:53.0695 1388        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:34:53.0695 1388        spldr - ok
21:34:53.0726 1388        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:34:53.0757 1388        srv - ok
21:34:53.0773 1388        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:34:53.0804 1388        srv2 - ok
21:34:53.0820 1388        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:34:53.0851 1388        srvnet - ok
21:34:53.0867 1388        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:34:53.0882 1388        stexstor - ok
21:34:53.0913 1388        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:34:53.0929 1388        swenum - ok
21:34:53.0960 1388        sxuptp          (11681df337d53ecff172124c1e1ff0a4) C:\Windows\system32\DRIVERS\sxuptp.sys
21:34:53.0976 1388        sxuptp - ok
21:34:54.0038 1388        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
21:34:54.0116 1388        Tcpip - ok
21:34:54.0147 1388        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
21:34:54.0163 1388        TCPIP6 - ok
21:34:54.0194 1388        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:34:54.0225 1388        tcpipreg - ok
21:34:54.0257 1388        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:34:54.0288 1388        TDPIPE - ok
21:34:54.0303 1388        TDTCP          (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
21:34:54.0319 1388        TDTCP - ok
21:34:54.0350 1388        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:34:54.0381 1388        tdx - ok
21:34:54.0397 1388        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:34:54.0413 1388        TermDD - ok
21:34:54.0428 1388        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:34:54.0459 1388        tssecsrv - ok
21:34:54.0491 1388        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:34:54.0522 1388        TsUsbFlt - ok
21:34:54.0553 1388        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:34:54.0600 1388        tunnel - ok
21:34:54.0615 1388        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:34:54.0631 1388        uagp35 - ok
21:34:54.0647 1388        UBHelper        (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
21:34:54.0647 1388        UBHelper - ok
21:34:54.0678 1388        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:34:54.0740 1388        udfs - ok
21:34:54.0756 1388        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:34:54.0771 1388        uliagpkx - ok
21:34:54.0787 1388        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
21:34:54.0803 1388        umbus - ok
21:34:54.0818 1388        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:34:54.0818 1388        UmPass - ok
21:34:54.0881 1388        UnlockerDriver5 (9dc07e73a4abb9acf692113b36a5009f) D:\Programme\Unlocker\UnlockerDriver5.sys
21:34:54.0896 1388        UnlockerDriver5 - ok
21:34:54.0943 1388        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:34:54.0990 1388        usbccgp - ok
21:34:55.0052 1388        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:34:55.0083 1388        usbcir - ok
21:34:55.0099 1388        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
21:34:55.0130 1388        usbehci - ok
21:34:55.0130 1388        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:34:55.0161 1388        usbhub - ok
21:34:55.0193 1388        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
21:34:55.0208 1388        usbohci - ok
21:34:55.0239 1388        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:34:55.0271 1388        usbprint - ok
21:34:55.0286 1388        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:34:55.0333 1388        USBSTOR - ok
21:34:55.0349 1388        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
21:34:55.0364 1388        usbuhci - ok
21:34:55.0411 1388        VClone          (84bb306b7863883018d7f3eb0c453bd5) C:\Windows\system32\DRIVERS\VClone.sys
21:34:55.0442 1388        VClone - ok
21:34:55.0458 1388        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:34:55.0489 1388        vdrvroot - ok
21:34:55.0505 1388        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:34:55.0536 1388        vga - ok
21:34:55.0536 1388        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:34:55.0583 1388        VgaSave - ok
21:34:55.0614 1388        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:34:55.0629 1388        vhdmp - ok
21:34:55.0661 1388        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:34:55.0661 1388        viaide - ok
21:34:55.0676 1388        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:34:55.0676 1388        volmgr - ok
21:34:55.0707 1388        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:34:55.0723 1388        volmgrx - ok
21:34:55.0754 1388        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:34:55.0785 1388        volsnap - ok
21:34:55.0801 1388        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:34:55.0817 1388        vsmraid - ok
21:34:55.0817 1388        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
21:34:55.0832 1388        vwifibus - ok
21:34:55.0848 1388        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
21:34:55.0863 1388        vwififlt - ok
21:34:55.0879 1388        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:34:55.0895 1388        WacomPen - ok
21:34:55.0926 1388        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:34:55.0973 1388        WANARP - ok
21:34:55.0973 1388        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:34:56.0004 1388        Wanarpv6 - ok
21:34:56.0004 1388        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:34:56.0019 1388        Wd - ok
21:34:56.0035 1388        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:34:56.0066 1388        Wdf01000 - ok
21:34:56.0082 1388        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:34:56.0113 1388        WfpLwf - ok
21:34:56.0113 1388        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:34:56.0129 1388        WIMMount - ok
21:34:56.0175 1388        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:34:56.0207 1388        WinUsb - ok
21:34:56.0222 1388        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:34:56.0238 1388        WmiAcpi - ok
21:34:56.0285 1388        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:34:56.0331 1388        ws2ifsl - ok
21:34:56.0363 1388        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:34:56.0394 1388        WudfPf - ok
21:34:56.0409 1388        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:34:56.0441 1388        WUDFRd - ok
21:34:56.0456 1388        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:34:56.0612 1388        \Device\Harddisk0\DR0 - ok
21:34:56.0612 1388        Boot (0x1200)  (281f98107bbbe2c6f5a122eb6ba15158) \Device\Harddisk0\DR0\Partition0
21:34:56.0612 1388        \Device\Harddisk0\DR0\Partition0 - ok
21:34:56.0628 1388        Boot (0x1200)  (300a42b9a8d6e23935db328471265271) \Device\Harddisk0\DR0\Partition1
21:34:56.0628 1388        \Device\Harddisk0\DR0\Partition1 - ok
21:34:56.0628 1388        Boot (0x1200)  (c82fb9d05e79fe57f7b49b9f5931e1c5) \Device\Harddisk0\DR0\Partition2
21:34:56.0628 1388        \Device\Harddisk0\DR0\Partition2 - ok
21:34:56.0643 1388        Boot (0x1200)  (3f7dba5dc11c4511e7a523de3cfcb356) \Device\Harddisk0\DR0\Partition3
21:34:56.0643 1388        \Device\Harddisk0\DR0\Partition3 - ok
21:34:56.0659 1388        Boot (0x1200)  (d3b0fd1d1215029907e9447117ba0e41) \Device\Harddisk0\DR0\Partition4
21:34:56.0659 1388        \Device\Harddisk0\DR0\Partition4 - ok
21:34:56.0659 1388        ============================================================
21:34:56.0659 1388        Scan finished
21:34:56.0659 1388        ============================================================
21:34:56.0675 1580        Detected object count: 1
21:34:56.0675 1580        Actual detected object count: 1
21:35:25.0332 1580        NUServer64 ( UnsignedFile.Multi.Generic ) - skipped by user
21:35:25.0332 1580        NUServer64 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 26.01.2012 22:16
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Tim2012 27.01.2012 00:21
Bei der Ausführung von ComboFix tauchte das Problem auf, daß ComboFix Antivir als aktiviert anmäkelte, obwohl es deaktiviert war.

Soll ich ComboFix erneut ausführen?

So, nun das ComboFix-Log:

[CODE]

Combofix Logfile:
Code:
ComboFix 12-01-26.03 - ***** 26.01.2012  23:56:04.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8183.6680 [GMT 1:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\users\*****\AppData\Roaming\chrtmp
c:\users\*****\AppData\Roaming\Help\coredb\storage
c:\users\*****\AppData\Roaming\inst.exe
c:\users\Public\invokesi.exe
c:\windows\assembly\temp\@
c:\windows\assembly\temp\cfg.ini
c:\windows\iun6002.exe
c:\windows\system32\java.exe
F:\install.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-26 bis 2012-01-26  ))))))))))))))))))))))))))))))
.
.
2012-01-25 20:46 . 2012-01-25 20:46        --------        d-----w-        C:\_OTL
2012-01-24 20:52 . 2012-01-24 20:52        --------        d-----w-        c:\users\*****\AppData\Roaming\Apple
2012-01-23 23:25 . 2012-01-23 23:25        750488        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-01-17 18:55 . 2012-01-17 18:56        --------        d-----w-        c:\users\*****\.mediathek
2012-01-14 18:24 . 2012-01-14 18:22        619008        ----a-w-        c:\windows\SysWow64\dx7vb.dll
2012-01-11 20:32 . 2011-11-17 06:41        1731920        ----a-w-        c:\windows\system32\ntdll.dll
2012-01-11 20:32 . 2011-11-17 05:38        1292080        ----a-w-        c:\windows\SysWow64\ntdll.dll
2012-01-11 20:32 . 2011-11-19 14:58        77312        ----a-w-        c:\windows\system32\packager.dll
2012-01-11 20:32 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\SysWow64\packager.dll
2012-01-11 20:32 . 2011-10-26 05:25        1572864        ----a-w-        c:\windows\system32\quartz.dll
2012-01-11 20:32 . 2011-10-26 05:25        366592        ----a-w-        c:\windows\system32\qdvd.dll
2012-01-11 20:32 . 2011-10-26 04:32        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2012-01-11 20:32 . 2011-10-26 04:32        1328128        ----a-w-        c:\windows\SysWow64\quartz.dll
2012-01-07 18:49 . 2012-01-07 18:49        --------        d-----w-        c:\program files\silex technology
2012-01-07 18:49 . 2010-06-07 11:30        297056        ----a-w-        c:\windows\system32\drivers\sxuptp.sys
2012-01-03 13:10 . 2012-01-03 13:10        182672        ----a-w-        c:\program files (x86)\Internet Explorer\PLUGINS\nppdf32.dll
2012-01-01 22:01 . 1998-06-17 23:00        89360        ----a-w-        c:\windows\SysWow64\VB5DB.DLL
2012-01-01 22:01 . 1997-07-19 14:55        1347344        ----a-w-        c:\windows\SysWow64\MSVBVM50.DLL
2012-01-01 22:00 . 2012-01-02 09:03        --------        d-----w-        c:\program files (x86)\CR-Software
2011-12-30 20:45 . 2011-12-30 21:25        --------        d-----w-        c:\users\*****\AppData\Roaming\Networking USB Server
2011-12-30 20:43 . 2011-12-30 20:43        --------        d-----w-        c:\program files (x86)\USB Server
2011-12-30 20:33 . 2011-12-30 20:33        --------        d-----w-        c:\program files (x86)\Generic
2011-12-29 14:12 . 2011-12-29 14:12        --------        d-----w-        c:\program files (x86)\Common Files\SWF Studio
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-23 23:25 . 2010-09-17 19:55        660368        ----a-w-        c:\windows\system32\deployJava1.dll
2012-01-12 23:04 . 2011-05-18 10:47        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-18 12:15 . 2011-12-18 12:15        98304        ----a-w-        c:\windows\SysWow64\CmdLineExt.dll
2011-12-10 14:24 . 2010-09-19 06:36        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-11-24 04:52 . 2011-12-14 08:02        3145216        ----a-w-        c:\windows\system32\win32k.sys
2011-11-05 05:32 . 2011-12-14 08:02        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-14 08:02        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-14 08:04        2309120        ----a-w-        c:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-14 08:04        1390080        ----a-w-        c:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-14 08:04        1493504        ----a-w-        c:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-14 08:05        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-14 08:04        1798144        ----a-w-        c:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-14 08:04        1427456        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-14 08:04        1127424        ----a-w-        c:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-14 08:05        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="d:\programme\SlySoft\AnyDVD\AnyDVDtray.exe" [2011-06-13 4980344]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-12 261888]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-25 98304]
"ArcadeDeluxeAgent"="d:\programme\Acer\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2010-09-15 128296]
"PlayMovie"="d:\programme\Acer\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2010-03-30 181480]
"LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"avgnt"="d:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"GrooveMonitor"="d:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"NBAgent"="d:\programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-04-08 1406248]
"TkBellExe"="d:\programme\RealPlayer\update\realsched.exe" [2011-10-31 273528]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
SX Virtual Link.lnk - c:\programme\silex technology\SX Virtual Link\Connect.exe [2012-1-7 399232]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SmartCopy.lnk - c:\program files (x86)\Northstar\SmartCopy\SmartCopy.exe [2009-12-17 319488]
SmartLauncher.lnk - c:\program files (x86)\Northstar\SmartLauncher\SmartLauncher.exe [2009-12-17 339968]
TrekStor NDAS-Geräte-Manager.lnk - c:\program files\NDAS\System\ndasmgmt.exe [2007-7-3 368128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys [x]
R3 HRService;Haufe iDesk-Service in c:\program files (x86)\Haufe\iDesk\iDeskService\Zope;c:\program files (x86)\Haufe\iDesk\iDeskService\iDeskService.exe [2010-10-25 71024]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\EC91.tmp [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]
R3 NUS_Bus;Network USB Server Bus;c:\windows\system32\DRIVERS\NUS_Bus.sys [x]
R3 NUServer64;Network USB Server Device ;c:\windows\system32\DRIVERS\NUServer64.sys [x]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x]
R3 SaiH0BAC;SaiH0BAC;c:\windows\system32\DRIVERS\SaiH0BAC.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 ndasfat;NDAS FAT;c:\windows\system32\DRIVERS\ndasfat.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;d:\programme\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208]
S2 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-03 240160]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-06-16 7883296]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-06-16 1833504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.spiegel.de/
uLocal Page = c:\windows\system32\blank.htm
mStart Page =
mLocal Page =
IE: Nach Microsoft E&xel exportieren - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: {96816368-C1E3-414D-A193-63C3CC921990} - hxxp://hotelmetropole-lakecomo.remotemanager.co.uk/common/activex/MJPEGRender.ocx
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0v98xuh5.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-ATR_72500 - c:\windows\iun6002.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\EC91.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="8D79ACAAB36EE2F682E3671D639BC0602EE3434A06CEFD9D135C4C78A560340F152700207FA05C819F0ECDF372815899DFA3273489940814945F1A53834BEECD648B876AFE946DA5468F567EA64582A382F1CC91F64D28F7B547E98E8F4534C774D8D2F316C05449EA2A5361A97E8F2F20C5EBE663D75FE73DE2F029671256266450395A0E6FD5C1A5385A790F1E53E0EB2FF9EA48E933759295A8D90E4CA9897949556E8F3EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DC038D530D6EB3452BA7FD869164D6794C1D22F3529804D68E452C3D66BFBE4FD1645B58A07905E3698EBA0DBBE41B977041D35A72E2117DB280ED1D0B308948509F2AFBDEE17C9CAE0E6992A510CC32E362BB847BCE916A306B6EEACAE6604AD790C441901B4ACC1A7E9D8003A97D105F347F96FE746A6506CA135BA1020B60C45930580B030535660478CF64B861AFC5E30E00D02D607C74B1AE2DD4EF1148ACF81AB6D3583ED957C42843B1D3137E91B17F524A771D8C01ADFDA8D234E67E77FC1136B895E90E47317B6100C212473D022E649329D23C9D0A4A4D38CDADF343FB5BA9AECA2B478C16FBAC8381845152DEB07A7C697D0C36E91EA514D7091567CB0C7AF6267B5DCE6EDCE4F06085E1EE0814BFD47D0ADE1F3BF7CB86A1EF208AB7981F2B076D4EF66A7D3211E9A98332165CD9CDDEC6FAD67BE4C512F2361D543CD54C0E3CDB6E347A44D506B2901CB260D4C6C78C42B84D11272772A761A24BCDC4F88C9A062C197E364801FC38AB32BE3A8E5C765DA17C1302718AB42C026174BA64F7756C5E16354E66B2C2F890B73476918C08DDCE9C8844B39CBE15EE655AFB22DC288AF7442DC46DE4C60B7C4C18937A41DB474D47BEDE170E2685C447E976FCEC60556FBC8D3153C7B06322ADFEEE143D8804707743F90E88F1C0C6F9B037BF36250CF4F13090F7878FCFAD419B359BB36CFDF7E51C024E1B57420ED3D659B703A9F1B98C13C8F1D47DA77B6BE85346FBAB1AC9133AB0AB0F9A02E9B7526B8ADB4DC97D6F8A29646B165EF11A685ADCDAD6A80E7BFAF54B9C50234235A22DC27FC27085DDEE5CAA7C319927E284A21DE1DF31200A1703C7AC8AC908886A939ED015217D220A1F404CC2670E89F5D133C5CF97AA906841B01756B86211980A026F564D032EA6801B5E06E80126E3CA7937C5D39091E76707100BBBD15B5DD8C86D11625C9F4BD0029598A1A0B78DAA8A95AB1AF982045DE82634FC165016E18DD4F57E7BB759B27E15146FB3CA71F85D11040A524C4652DFE5F0A01E027D2818A6FCA520027EECFF22820C6E368E04F770285C34BCA3C46C6F28850AED61EAF81F24602E04998F586834C7F8EAAEF3B99D2B21A85F2A6"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\SysWOW64\brsvc01a.exe
c:\windows\SysWOW64\brss01a.exe
d:\programme\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-27  00:03:23 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-26 23:03
.
Vor Suchlauf: 8.149.696.512 Bytes frei
Nach Suchlauf: 7.970.766.848 Bytes frei
.
- - End Of File - - F9A962704D8E7FEA714BFA2668D535E2
--- --- ---


Danke. Bin gespannt auf deine Anwort.

cosinus 27.01.2012 10:36
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Tim2012 27.01.2012 11:54
aswMBR.txt:

Code:
aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-01-27 11:38:42
-----------------------------
11:38:42.851    OS Version: Windows x64 6.1.7601 Service Pack 1
11:38:42.851    Number of processors: 8 586 0x1E05
11:38:42.851    ComputerName: ALPHA  UserName: *****
11:38:45.674    Initialize success
11:41:38.503    AVAST engine defs: 12012700
11:43:23.273    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
11:43:23.273    Disk 0 Vendor: ST310005 CC44 Size: 953869MB BusType: 8
11:43:23.288    Disk 0 MBR read successfully
11:43:23.288    Disk 0 MBR scan
11:43:23.304    Disk 0 Windows 7 default MBR code
11:43:23.319    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        15360 MB offset 2048
11:43:23.335    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 31459328
11:43:23.351    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        49999 MB offset 31664128
11:43:23.351    Disk 0 Partition - 00    05    Extended            888407 MB offset 134062425
11:43:23.382    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS        99998 MB offset 134062488
11:43:23.382    Disk 0 Partition - 00    05    Extended            99998 MB offset 338859045
11:43:23.397    Service scanning
11:43:25.878    Modules scanning
11:43:25.878    Disk 0 trace - called modules:
11:43:25.909    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
11:43:25.909    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007e4d060]
11:43:25.925    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007adf050]
11:43:28.842    AVAST engine scan C:\Windows
11:43:33.272    AVAST engine scan C:\Windows\system32
11:45:55.326    AVAST engine scan C:\Windows\system32\drivers
11:46:04.530    AVAST engine scan C:\Users\*****
11:47:25.713    AVAST engine scan C:\ProgramData
11:49:03.634    Scan finished successfully
11:50:13.741    Disk 0 MBR has been saved successfully to "C:\Users\*****\Desktop\MBR.dat"
11:50:13.741    The log file has been saved successfully to "C:\Users\*****\Desktop\aswMBR.txt"

cosinus 27.01.2012 12:56
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Tim2012 28.01.2012 14:35
Malwarebytes und ESET ohne Befund, SASW Befund ohne Belang.

Der Vollständigkeit halber die Logs:

Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.27.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
****** :: ALPHA [Administrator]

27.01.2012 22:07:06
mbam-log-2012-01-27 (22-07-06).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 784883
Laufzeit: 55 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
SASW:

Code:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/27/2012 at 11:50 PM

Application Version : 5.0.1142

Core Rules Database Version : 8176
Trace Rules Database Version: 5988

Scan type      : Complete Scan
Total Scan Time : 00:40:34

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 722
Memory threats detected  : 0
Registry items scanned    : 44509
Registry threats detected : 0
File items scanned        : 151023
File threats detected    : 1

Heur.Agent/Gen-WhiteBox
        F:\VERWALTUNG\DOWNLOADS\TEMP1\FLIGHTSIM\FLY TAMPA\FLYTAMPA_HONGKONG_FS9_UPDATE_11.EXE
ESET-Log leer, da kein Befund.


Ist der Trojaner vom Rechner verbannt?

Gruß,
Tim

cosinus 29.01.2012 18:45
Zitat:
F:\VERWALTUNG\DOWNLOADS\TEMP1\FLIGHTSIM\FLY TAMPA\FLYTAMPA_HONGKONG_FS9_UPDATE_11.EXE
Was ist das denn?

Tim2012 29.01.2012 22:47
Zitat:
Zitat von cosinus (Beitrag 761911)
Was ist das denn?
Ein reguläres Update, das vom äußerst seriösen Anbieter zum Download angeboten wird.

hxxp://www.flytampa.org/downloads.html

Also alles im grünen Bereich.


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:34 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131