Trojaner-Board - Schwarzes Fenster: Aus Sicherheitsgründen wurde Ihr System blockiert

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Schwarzes Fenster: Aus Sicherheitsgründen wurde Ihr System blockiert (https://www.trojaner-board.de/109962-schwarzes-fenster-sicherheitsgruenden-wurde-system-blockiert.html)

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hallo Cosinus,

hier die OTL-Logdatei:

Code:

OTL logfile created on: 16.02.2012 16:33:30 - Run 2

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Dokumente und Einstellungen\Dauber\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,48 Mb Total Physical Memory | 337,52 Mb Available Physical Memory | 43,98% Memory free

1013,08 Mb Paging File | 533,95 Mb Available in Paging File | 52,71% Paging File free

Paging file location(s): c:\pagefile.sys 288 576 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,52 Gb Total Space | 28,11 Gb Free Space | 37,72% Space Free | Partition Type: NTFS

 

Computer Name: USER-6D961DF72B | User Name: Dauber | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.02.14 21:06:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dauber\Desktop\OTL.exe

PRC - [2011.06.28 12:51:25 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.06.25 11:06:32 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe

PRC - [2011.05.21 05:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2011.04.28 15:10:06 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.11.04 18:17:26 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010.05.08 12:48:36 | 000,229,376 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe

PRC - [2010.01.14 20:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006.11.03 18:20:12 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

PRC - [2006.11.03 18:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MsMpEng.exe

PRC - [2006.07.25 21:05:58 | 000,372,736 | ---- | M] (SANYO Electric Co., Ltd.) -- C:\Programme\SANYO\XactiScreenCapture\SetClip.exe

PRC - [2006.03.06 18:48:46 | 000,286,720 | ---- | M] () -- C:\Programme\Lexmark 3400 Series\lxcymon.exe

PRC - [2006.02.20 20:23:08 | 000,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcycoms.exe

PRC - [2006.02.07 06:10:34 | 000,098,304 | ---- | M] (Lexmark International Inc.) -- C:\Programme\Lexmark 3400 Series\ezprint.exe

PRC - [2005.06.23 20:33:00 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

PRC - [2005.03.04 10:50:00 | 000,118,784 | ---- | M] (AVM Berlin) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE

PRC - [2004.09.30 07:44:26 | 007,957,504 | ---- | M] (VIA Technologies, Inc.) -- C:\Programme\VIAudioi\SBADeck\ADeck.exe

PRC - [2004.08.27 19:22:38 | 000,090,112 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\Autodetector\Monitor.exe

PRC - [2004.08.24 16:26:34 | 000,671,744 | ---- | M] (D-Link) -- C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE

PRC - [2004.07.30 17:50:24 | 000,286,720 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe

PRC - [2004.01.15 13:33:44 | 000,049,152 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe

PRC - [2002.05.03 09:47:46 | 000,069,632 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

PRC - [2001.12.10 17:34:06 | 000,020,739 | ---- | M] (BVRP Software) -- C:\Programme\Classic PhoneTools\capFax.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.01.02 01:36:20 | 003,182,592 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll

MOD - [2011.10.13 23:53:44 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll

MOD - [2011.05.04 23:02:44 | 000,355,432 | ---- | M] () -- C:\Programme\NVIDIA Corporation\nView\nvShell.dll

MOD - [2011.05.04 23:02:42 | 001,558,120 | ---- | M] () -- C:\Programme\NVIDIA Corporation\nView\nView.dll

MOD - [2010.05.08 12:48:36 | 000,229,376 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe

MOD - [2010.01.28 11:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2009.10.23 17:01:58 | 000,067,872 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll

MOD - [2009.04.09 11:38:00 | 000,053,248 | ---- | M] () -- C:\WINDOWS\system32\SearchRequire.dll

MOD - [2009.02.27 16:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU

MOD - [2007.05.31 14:50:48 | 000,758,272 | ---- | M] () -- C:\Programme\PdfGrabber 4.0\PdfGrabberShellExt2.dll

MOD - [2006.03.06 18:52:58 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\lxcycaps.dll

MOD - [2006.03.06 18:52:58 | 000,065,536 | ---- | M] () -- C:\Programme\Lexmark 3400 Series\lxcycaps.dll

MOD - [2006.03.06 18:51:28 | 000,692,224 | ---- | M] () -- C:\WINDOWS\system32\lxcydrs.dll

MOD - [2006.03.06 18:48:46 | 000,286,720 | ---- | M] () -- C:\Programme\Lexmark 3400 Series\lxcymon.exe

MOD - [2006.03.06 18:48:10 | 000,274,432 | ---- | M] () -- C:\Programme\Lexmark 3400 Series\lxcyscw.dll

MOD - [2006.02.13 14:04:20 | 000,143,360 | ---- | M] () -- C:\Programme\Lexmark 3400 Series\lxcydrec.dll

MOD - [2006.02.02 09:24:56 | 000,012,288 | ---- | M] () -- C:\Programme\Lexmark Fax Solutions\fxctrstr.dll

MOD - [2006.02.02 09:12:22 | 000,040,960 | ---- | M] () -- C:\WINDOWS\system32\LXPRMON.DLL

MOD - [2006.02.02 09:10:20 | 000,032,768 | ---- | M] () -- C:\Programme\Lexmark Fax Solutions\ipcmt.dll

MOD - [2006.01.25 23:11:04 | 000,061,440 | ---- | M] () -- C:\WINDOWS\system32\lxcycnv4.dll

MOD - [2006.01.25 17:27:42 | 000,241,664 | ---- | M] () -- C:\Programme\Lexmark 3400 Series\iptk.dll

MOD - [2006.01.12 15:20:04 | 000,114,688 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxcypp5c.dll

MOD - [2005.03.04 10:47:18 | 000,155,648 | ---- | M] () -- C:\Programme\FRITZ!DSL\SSLEAY32.DLL

MOD - [2005.03.04 10:46:44 | 000,790,528 | ---- | M] () -- C:\Programme\FRITZ!DSL\LIBEAY32.DLL

MOD - [2004.08.20 18:09:14 | 000,086,016 | ---- | M] () -- C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\ExtWLANConfig.dll

MOD - [2004.07.30 17:50:24 | 000,286,720 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe

MOD - [2004.07.26 17:11:50 | 000,028,672 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Ulead Systems\Autodetector\DetMethod.dll

MOD - [2004.04.19 10:31:02 | 000,032,768 | ---- | M] () -- C:\Programme\VIAudioi\SBADeck\ExtendDll.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] --  -- (HidServ)

SRV - File not found [On_Demand | Stopped] --  -- (AppMgmt)

SRV - [2011.06.28 12:51:25 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.05.21 05:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.04.28 15:10:06 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010.05.08 12:48:36 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe -- (DCService.exe)

SRV - [2008.11.04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2006.11.03 18:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2006.02.20 20:23:08 | 000,495,616 | ---- | M] ( ) [On_Demand | Running] -- C:\WINDOWS\System32\lxcycoms.exe -- (lxcy_device)

SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2005.03.04 10:50:00 | 000,118,784 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (AVM IGD CTRL Service)

SRV - [2005.03.04 10:42:08 | 000,315,392 | ---- | M] (AVM Berlin) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe -- (de_serv)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.07.07 05:47:33 | 000,259,584 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\XHASP.sys -- (XHASP)

DRV - [2011.06.28 12:51:34 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 12:51:34 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.05.22 13:48:20 | 000,070,656 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ew_jubusenum.sys -- (huawei_enumerator)

DRV - [2010.03.25 09:08:30 | 000,105,728 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)

DRV - [2009.08.05 21:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)

DRV - [2009.05.11 08:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2007.06.28 11:44:58 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (nmwcd)

DRV - [2007.06.28 11:44:18 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (nmwcdcm)

DRV - [2007.06.28 11:44:18 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (nmwcdcj)

DRV - [2007.06.28 11:44:16 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (nmwcdc)

DRV - [2006.11.22 09:01:48 | 000,693,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)

DRV - [2006.02.23 10:38:32 | 000,009,728 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32)

DRV - [2004.10.29 12:52:48 | 000,413,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)

DRV - [2004.09.06 09:01:56 | 000,161,536 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio) Vinyl AC'97 Audio Controller (WDM)

DRV - [2004.08.20 18:09:14 | 000,062,865 | ---- | M] (Funk Software, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\odysseyIM3.sys -- (odysseyIM3)

DRV - [2004.08.20 18:09:14 | 000,016,292 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5)

DRV - [2004.05.21 15:59:54 | 000,283,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\GPLUS.sys -- (TNET1130)

DRV - [2003.07.02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2002.12.18 10:10:50 | 000,153,984 | R--- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWCD2.sys -- (HSFHWCD2)

DRV - [2002.12.18 10:09:54 | 000,585,856 | R--- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2002.12.18 10:08:00 | 001,067,008 | R--- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CA F9 5D 24 3B C7 C9 01  [binary data]

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@ei.SmileyCentral_1v.com/Plugin: C:\Programme\SmileyCentral_1vEI\Installr\1.bin\NP1vEISB.dll (SmileyCentral)

FF - HKLM\Software\MozillaPlugins\@eleco.com/o2cplayer: C:\Programme\o2c Player\npO2CPlayer.DLL (Eleco plc)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.06.25 11:07:24 | 000,000,000 | ---D | M]

 

 

O1 HOSTS File: ([2004.08.04 13:00:00 | 000,000,795 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (no name) - {8a194578-81ea-4850-9911-13ba2d71efbd}  - No CLSID value found.

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)

O2 - BHO: (no name) - {CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()

O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()

O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)

O4 - HKLM..\Run: [AudioDeck] C:\Programme\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CapFax] C:\Programme\Classic PhoneTools\capFax.exe (BVRP Software)

O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)

O4 - HKLM..\Run: [EzPrint] C:\Programme\Lexmark 3400 Series\ezprint.exe (Lexmark International Inc.)

O4 - HKLM..\Run: [FaxCenterServer] C:\Programme\Lexmark Fax Solutions\fm3032.exe ()

O4 - HKLM..\Run: [LXCYCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.DLL ()

O4 - HKLM..\Run: [lxcymon.exe] C:\Programme\Lexmark 3400 Series\lxcymon.exe ()

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\Autodetector\Monitor.exe (Ulead Systems, Inc.)

O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)

O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)

O4 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004..\Run: [ffdwnd] C:\Dokumente und Einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\firefox.exe File not found

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\D-Link AirPlus G+ Wireless Adapter Utility.lnk = C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE (D-Link)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Ulead Kalendar Checker 4.0 SE.lnk = C:\Programme\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe (Ulead Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Xacti Screen Capture 1.0.lnk = C:\WINDOWS\Installer\{57134099-FE12-4B1A-BB4A-80CCB04EBBE6}\_4ae13d6c.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\Dauber\Startmenü\Programme\Autostart\OpenOffice.org 2.0.lnk =  File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-2111687655-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML File not found

O8 - Extra context menu item: Add to Windows &Live Favorites - hxxp://favorites.live.com/quickadd.aspx File not found

O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()

O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()

O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()

O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()

O8 - Extra context menu item: Save Page As PDF ... - C:\Programme\Nitro PDF\PDF Download\nitroweb.htm ()

O9 - Extra 'Tools' menuitem : PDF Download - Options - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - Reg Error: Key error. File not found

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\FRITZ!DSL\SARAH.DLL (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)

O15 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..Trusted Domains: fritz.box ([]* in Lokales Intranet)

O15 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..Trusted Ranges: Range1 ([*] in Lokales Intranet)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab (JordanUploader Class)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150054455562 (WUWebControl Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader.cab (IPSUploader Control)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 78.42.43.62 82.212.62.62

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0ACF02D9-DD9B-4DAE-A010-962D0852DEA3}: DhcpNameServer = 78.42.43.62 82.212.62.62

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Programme\Windows Defender\MpShHook.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2005.05.18 16:29:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\Shell - "" = AutoRun

O33 - MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\Shell - "" = AutoRun

O33 - MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: AppMgmt -  File not found

NetSvcs: HidServ -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.

ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB86EC62-CEA7-4C82-9EBA-B7A5E410E54C} - Reg Error: Value error.

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

File not found -- C:\WINDOWS\System32\drivers\mshcmd.sys.

[2012.02.16 10:08:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2012.02.15 23:03:51 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2012.02.14 21:06:30 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dauber\Desktop\OTL.exe

[2012.02.13 11:30:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\Mozilla

[2012.01.26 19:55:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dauber\4.0

[2012.01.26 19:55:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dauber\.tfo4

[2009.04.09 11:38:00 | 000,126,976 | ---- | C] ( ) -- C:\WINDOWS\System32\Interop.SHDocVw.dll

[2006.09.16 20:47:01 | 000,409,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyinpa.dll

[2006.09.16 20:47:00 | 000,393,216 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyiesc.dll

[2006.09.16 20:44:00 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyserv.dll

[2006.09.16 20:44:00 | 000,995,328 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyusb1.dll

[2006.09.16 20:43:59 | 000,536,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcylmpm.dll

[2006.09.16 20:43:59 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyprox.dll

[2006.09.16 20:43:59 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcypplc.dll

[2006.09.16 20:43:58 | 000,380,928 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyih.exe

[2006.09.16 20:43:57 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyhbn3.dll

[2006.09.16 20:43:56 | 000,495,616 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcycoms.exe

[2006.09.16 20:43:56 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcycomm.dll

[2006.09.16 20:43:55 | 000,610,304 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcycomc.dll

[2006.09.16 20:43:55 | 000,385,024 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcycfg.exe

[2006.06.12 08:02:36 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll

[2006.06.12 08:02:36 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll

[2006.06.12 08:02:36 | 000,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll

[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

File not found -- C:\WINDOWS\System32\drivers\mshcmd.sys.

[2012.02.16 16:39:03 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012.02.16 16:39:03 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012.02.16 09:52:14 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Startup.job

[2012.02.16 04:43:03 | 000,000,358 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job

[2012.02.15 22:59:58 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1214440339-2111687655-839522115-1004.job

[2012.02.15 22:59:57 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1214440339-2111687655-839522115-1004.job

[2012.02.15 20:08:47 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job

[2012.02.15 19:32:19 | 000,002,331 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Xacti Screen Capture 1.0.lnk

[2012.02.15 19:31:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.02.14 21:06:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dauber\Desktop\OTL.exe

[2012.02.14 17:00:00 | 000,000,376 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job

[2012.02.13 11:14:55 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012.02.10 17:15:00 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job

[2012.02.06 09:02:17 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2012.02.04 10:51:54 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.21 09:05:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2012.01.17 21:49:28 | 000,448,898 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2012.01.17 21:49:28 | 000,432,784 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012.01.17 21:49:28 | 000,080,338 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2012.01.17 21:49:28 | 000,067,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.02.04 10:51:54 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2011.07.11 13:39:34 | 000,273,344 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin

[2011.07.11 13:39:34 | 000,273,344 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin

[2011.07.11 13:39:34 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin

[2011.07.07 05:48:12 | 000,009,532 | ---- | C] () -- C:\WINDOWS\System32\drivers\808B18A5.bin

[2011.07.07 05:47:33 | 000,259,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\XHASP.sys

[2011.07.06 11:25:17 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.EXE

[2011.07.06 11:25:17 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\hlduinst.exe

[2011.07.06 11:25:17 | 000,006,836 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.INI

[2011.07.06 11:24:41 | 000,697,926 | ---- | C] () -- C:\WINDOWS\unins000.exe

[2011.07.06 11:24:41 | 000,046,825 | ---- | C] () -- C:\WINDOWS\unins000.dat

[2011.05.21 05:01:00 | 002,123,582 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data

[2011.03.06 00:19:30 | 000,119,400 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.04.03 16:27:53 | 000,046,948 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2009.04.09 11:38:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\SearchRequire.dll

[2008.12.21 12:13:45 | 000,205,758 | ---- | C] () -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\mdbu.bin

[2008.07.16 18:09:23 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2008.01.04 12:36:34 | 000,000,032 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat

[2007.06.10 15:38:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI

[2007.06.10 15:35:45 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS6d.DLL

[2007.01.17 19:43:45 | 000,000,517 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2007.01.17 19:43:00 | 000,000,239 | ---- | C] () -- C:\WINDOWS\KLETT.INI

[2007.01.17 19:42:50 | 000,001,264 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007.01.06 00:03:48 | 000,000,072 | ---- | C] () -- C:\WINDOWS\Pex.INI

[2007.01.05 15:15:19 | 000,000,020 | ---- | C] () -- C:\WINDOWS\InfModM.ini

[2007.01.05 15:13:53 | 000,000,029 | ---- | C] () -- C:\WINDOWS\wgedit.ini

[2007.01.05 15:06:36 | 000,006,633 | R--- | C] () -- C:\WINDOWS\System32\drivers\firmware.bin

[2007.01.05 13:48:41 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2006.09.16 20:47:02 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcyvs.dll

[2006.09.16 20:46:59 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\lxcycoin.dll

[2006.09.16 20:46:19 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxcydrs.dll

[2006.09.16 20:46:19 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcycaps.dll

[2006.09.16 20:46:18 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcycnv4.dll

[2006.09.16 20:45:27 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL

[2006.09.16 20:45:27 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL

[2006.09.16 20:44:00 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\lxcyinst.dll

[2006.06.12 08:02:38 | 000,286,720 | ---- | C] () -- C:\WINDOWS\vsnpstd3.exe

[2006.06.12 08:02:37 | 000,413,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys

[2006.06.12 08:02:37 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd3.dll

[2006.06.12 08:02:37 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini

[2006.06.12 08:02:35 | 000,020,480 | ---- | C] () -- C:\WINDOWS\usnpstd3.exe

[2006.04.25 10:31:38 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll

[2006.04.01 10:27:13 | 000,030,720 | ---- | C] () -- C:\Dokumente und Einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006.01.03 15:59:31 | 000,000,598 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2006.01.03 13:36:36 | 000,001,763 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2005.10.14 18:26:06 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2005.10.09 18:17:53 | 000,006,850 | R--- | C] () -- C:\WINDOWS\Disktool.INI

[2005.10.09 18:17:53 | 000,006,057 | R--- | C] () -- C:\WINDOWS\fwupgrade.ini

[2005.10.09 18:17:53 | 000,003,677 | R--- | C] () -- C:\WINDOWS\PlaySnd.INI

[2005.05.25 13:58:53 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI

[2005.05.18 17:00:39 | 000,283,392 | ---- | C] () -- C:\WINDOWS\System32\drivers\GPLUS.sys

[2005.05.18 17:00:39 | 000,084,644 | ---- | C] () -- C:\WINDOWS\System32\drivers\FwRad17.bin

[2005.05.18 17:00:39 | 000,083,024 | ---- | C] () -- C:\WINDOWS\System32\drivers\FwRad16.bin

[2005.05.18 16:47:42 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll

[2005.05.18 16:39:40 | 000,004,429 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2005.05.18 16:38:27 | 000,213,672 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2005.05.18 16:32:02 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2005.05.18 16:25:56 | 000,022,880 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2004.08.04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004.08.04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004.08.04 13:00:00 | 000,448,898 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2004.08.04 13:00:00 | 000,432,784 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004.08.04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004.08.04 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004.08.04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004.08.04 13:00:00 | 000,080,338 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2004.08.04 13:00:00 | 000,067,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004.08.04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004.08.04 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004.08.04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004.08.04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004.08.04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004.08.04 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004.08.04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

 
 ========== LOP Check ==========

 

[2011.07.06 11:25:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BDE

[2011.09.29 20:54:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService

[2011.11.12 16:50:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular

[2011.07.07 05:45:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PixelPlanet

[2011.07.04 21:14:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RegCure

[2011.11.06 12:58:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

[2007.01.05 15:20:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software

[2007.01.05 23:56:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems

[2009.03.17 07:57:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

[2011.01.20 19:34:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2009.11.05 14:32:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2009.04.10 18:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

[2011.08.08 10:33:13 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{BC3827BC-FEE6-47F6-A08C-EAFB1CE3AA56}

[2011.08.08 10:32:59 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{DA8DD039-AEE2-4D03-83AC-B1E508D4A724}

[2011.11.08 20:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular

[2011.07.11 14:09:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\FRITZ!

[2005.07.10 12:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Leadertech

[2009.03.08 12:38:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\OpenOffice.org

[2011.07.07 05:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\PixelPlanet

[2007.01.05 15:20:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\TuneUp Software

[2007.01.06 00:03:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Ulead Systems

[2009.06.23 15:40:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Windows Live Writer

[2012.02.10 17:15:00 | 000,000,398 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job

[2012.02.15 20:08:47 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

[2012.02.14 17:00:00 | 000,000,376 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure Program Check.job

[2012.02.16 09:52:14 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure Startup.job

[2012.02.16 04:43:03 | 000,000,358 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.08.08 10:34:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Adobe

[2005.11.05 16:19:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\AdobeAUM

[2008.07.16 14:46:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\AdobeUM

[2011.01.20 19:42:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Apple Computer

[2010.06.12 12:12:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Avira

[2006.04.25 09:35:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\CyberLink

[2011.11.08 20:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular

[2010.07.19 19:21:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\FaxCtr

[2011.07.11 14:09:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\FRITZ!

[2009.10.10 15:39:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Google

[2011.09.20 08:42:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Help

[2005.05.18 16:37:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Identities

[2007.01.06 00:00:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Kodak

[2005.07.10 12:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Leadertech

[2005.08.02 15:47:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Macromedia

[2011.07.04 14:50:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Malwarebytes

[2011.08.10 14:23:47 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Microsoft

[2009.03.08 12:38:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\OpenOffice.org

[2009.03.08 12:24:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\OpenOffice.org2

[2011.07.07 05:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\PixelPlanet

[2011.06.25 11:08:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Real

[2011.09.05 20:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Skype

[2011.09.05 15:00:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\skypePM

[2005.12.31 17:15:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Sun

[2007.01.05 13:44:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Symantec

[2007.01.05 15:20:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\TuneUp Software

[2011.12.22 15:07:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\U3

[2007.01.06 00:03:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Ulead Systems

[2009.06.23 15:40:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Windows Live Writer

 
 < %APPDATA%\*.exe /s >

[2007.08.28 07:22:15 | 023,813,608 | ---- | M] (                            ) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe

[2008.07.16 14:37:57 | 022,319,360 | ---- | M] (                                   ) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr710_de_DE.exe

[2012.02.04 12:35:59 | 004,891,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\install_dfv12.exe

[2012.02.04 12:37:10 | 004,944,584 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\install_lsta12.exe

[2012.02.04 12:38:25 | 005,149,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\install_lstb12.exe

[2012.02.04 12:33:34 | 005,545,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\install_par34a11.exe

[2012.02.04 12:34:47 | 005,026,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\install_ust11.exe

[2012.02.04 12:39:38 | 004,939,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\install_ustva12.exe

[2012.02.04 12:30:09 | 012,718,200 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\update_pica_0_7094_8086.exe

[2012.02.04 12:44:42 | 004,449,656 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\elsterformular\pluginmanager\tmp\update_ustva_11_7094_8086.exe

[2011.08.08 10:50:57 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

[2011.07.07 05:45:03 | 000,069,632 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Microsoft\Installer\{8DAEAEA6-BCA4-450C-9219-A84C81D8E54D}\ARPPRODUCTICON.exe

[2011.07.07 05:45:03 | 000,021,886 | R--- | M] () -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Microsoft\Installer\{8DAEAEA6-BCA4-450C-9219-A84C81D8E54D}\NewShortcut1_27DC6280A26D4B449D41574FE91C22D3.exe

[2011.07.07 05:45:03 | 000,069,632 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Microsoft\Installer\{8DAEAEA6-BCA4-450C-9219-A84C81D8E54D}\NewShortcut3_4859F549FCFC42FFBF9587D90140A3FB.exe

[2011.07.07 05:45:03 | 000,069,632 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Microsoft\Installer\{8DAEAEA6-BCA4-450C-9219-A84C81D8E54D}\NewShortcut5_263C52C36CC74A01820415746500FF86.exe

[2011.01.23 20:03:36 | 000,510,120 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Real\Update\setup3.13\setup.exe

[2011.11.14 16:42:29 | 000,317,048 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\Real\Update\UpgradeHelper\RealPlayer\9.00\rnupgagent.exe

[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\U3\temp\cleanup.exe

[2008.05.02 10:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Dauber\Anwendungsdaten\U3\temp\Launchpad Removal.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2001.05.24 11:59:30 | 000,162,304 | ---- | M] () -- C:\UNWISE.EXE

 

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.09.20 09:52:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008.09.20 09:52:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

[2004.08.04 13:00:00 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.09.20 09:52:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.09.20 09:52:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.04 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.04 13:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.04 13:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 16:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.04 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.04 13:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2006.06.11 19:20:48 | 000,262,144 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2006.06.11 17:12:13 | 000,262,144 | ---- | M] () -- C:\WINDOWS\System32\config\security.sav

[2006.06.11 19:20:48 | 013,893,632 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2006.06.11 19:20:49 | 003,145,728 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 117 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C3AE45C9
 

< End of report >

Gruß

Kriszi

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CA F9 5D 24 3B C7 C9 01  [binary data]

IE - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found

FF - HKLM\Software\MozillaPlugins\@ei.SmileyCentral_1v.com/Plugin: C:\Programme\SmileyCentral_1vEI\Installr\1.bin\NP1vEISB.dll (SmileyCentral)

O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (no name) - {8a194578-81ea-4850-9911-13ba2d71efbd}  - No CLSID value found.

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)

O2 - BHO: (no name) - {CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()

O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()

O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O3 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O4 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004..\Run: [ffdwnd] C:\Dokumente und Einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\firefox.exe File not found

O4 - Startup: C:\Dokumente und Einstellungen\Dauber\Startmenü\Programme\Autostart\OpenOffice.org 2.0.lnk =  File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-2111687655-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML File not found

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2005.05.18 16:29:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\Shell - "" = AutoRun

O33 - MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\Shell - "" = AutoRun

O33 - MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\Shell\AutoRun\command - "" = G:\AutoRun.exe

@Alternate Data Stream - 117 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C3AE45C9

:Files

C:\WINDOWS\System32\drivers\mshcmd.sys

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hallo Cosinus,

hier ist die Log Datei:

Code:

All processes killed

========== OTL ==========

HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!

HKU\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@ei.SmileyCentral_1v.com/Plugin\ deleted successfully.

C:\Programme\SmileyCentral_1vEI\Installr\1.bin\NP1vEISB.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ deleted successfully.

C:\Programme\Lexmark Toolbar\toolband.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ deleted successfully.

File move failed. C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll scheduled to be moved on reboot.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3049C3E9-B461-4BC5-8870-4C09146192CA}\ deleted successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8a194578-81ea-4850-9911-13ba2d71efbd}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8a194578-81ea-4850-9911-13ba2d71efbd}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.

C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.

C:\Programme\Google\Google Toolbar\GoogleToolbar.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}\ deleted successfully.

C:\Programme\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54}\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ not found.

File C:\Programme\Lexmark Toolbar\toolband.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.

File C:\Programme\Google\Google Toolbar\GoogleToolbar.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{327C2873-E90D-4c37-AA9D-10AC9BABA46C} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{327C2873-E90D-4c37-AA9D-10AC9BABA46C}\ deleted successfully.

File WebPrint\Toolband.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.

C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll moved successfully.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ not found.

File C:\Programme\Lexmark Toolbar\toolband.dll not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

File C:\Programme\Google\Google Toolbar\GoogleToolbar.dll not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.

File C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\ffdwnd deleted successfully.

C:\Dokumente und Einstellungen\Dauber\Startmenü\Programme\Autostart\OpenOffice.org 2.0.lnk moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1214440339-2111687655-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&ICQ Toolbar Search\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Add to Windows &Live Favorites\ deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\AUTOEXEC.BAT moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70da52fc-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70da52fc-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70da52fc-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70da52fc-ead4-11e0-aace-001109c64412}\ not found.

File G:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70da52fe-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70da52fe-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70da52fe-ead4-11e0-aace-001109c64412}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70da52fe-ead4-11e0-aace-001109c64412}\ not found.

File G:\AutoRun.exe not found.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C3AE45C9 deleted successfully.

========== FILES ==========

File\Folder C:\WINDOWS\System32\drivers\mshcmd.sys not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Dauber

->Temp folder emptied: 133998882 bytes

->Temporary Internet Files folder emptied: 89515446 bytes

->Java cache emptied: 93273884 bytes

->Apple Safari cache emptied: 2292736 bytes

->Flash cache emptied: 56943 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56468 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: NetworkService

->Temp folder emptied: 2816536 bytes

->Temporary Internet Files folder emptied: 90952310 bytes

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 4249097 bytes

%systemroot%\System32 .tmp files removed: 930183 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 96078283 bytes

RecycleBin emptied: 7095998 bytes

 

Total Files Cleaned = 497,00 mb

 

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

Error: Unable to interpret <         => in the current context!

 

OTL by OldTimer - Version 3.2.31.0 log created on 02172012_100907
 

Files\Folders moved on Reboot...

C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll moved successfully.

File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot.

File\Folder C:\WINDOWS\temp\TMP00000011B9576A56B0067697 not found!
 

Registry entries deleted on Reboot...

Kann man jetzt davon ausgehen, dass der Computer wieder in Ordnung ist?

Gruß

Kriszi

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hallo Cosinus,

es hat etwas gedauert, aber hier ist endlich die Lod Datei:

Code:

13:34:20.0406 2032        TDSS rootkit removing tool 2.7.13.0 Feb 15 2012 19:33:14

13:34:20.0546 2032        ============================================================

13:34:20.0546 2032        Current date / time: 2012/02/17 13:34:20.0546

13:34:20.0546 2032        SystemInfo:

13:34:20.0546 2032        

13:34:20.0546 2032        OS Version: 5.1.2600 ServicePack: 3.0

13:34:20.0546 2032        Product type: Workstation

13:34:20.0546 2032        ComputerName: USER-6D961DF72B

13:34:20.0546 2032        UserName: Dauber

13:34:20.0546 2032        Windows directory: C:\WINDOWS

13:34:20.0546 2032        System windows directory: C:\WINDOWS

13:34:20.0546 2032        Processor architecture: Intel x86

13:34:20.0546 2032        Number of processors: 1

13:34:20.0546 2032        Page size: 0x1000

13:34:20.0546 2032        Boot type: Normal boot

13:34:20.0546 2032        ============================================================

13:34:23.0781 2032        Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

13:34:23.0812 2032        \Device\Harddisk0\DR0:

13:34:23.0828 2032        MBR used

13:34:23.0828 2032        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1

13:34:23.0859 2032        Initialize success

13:34:23.0859 2032        ============================================================

13:35:19.0093 2556        ============================================================

13:35:19.0093 2556        Scan started

13:35:19.0093 2556        Mode: Manual; SigCheck; TDLFS; 

13:35:19.0093 2556        ============================================================

13:35:19.0312 2556        Abiosdsk - ok

13:35:19.0375 2556        abp480n5 - ok

13:35:19.0468 2556        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

13:35:21.0609 2556        ACPI - ok

13:35:21.0703 2556        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

13:35:21.0921 2556        ACPIEC - ok

13:35:22.0000 2556        adpu160m - ok

13:35:22.0109 2556        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

13:35:22.0312 2556        aec - ok

13:35:22.0421 2556        AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

13:35:22.0500 2556        AFD - ok

13:35:22.0578 2556        Aha154x - ok

13:35:22.0640 2556        aic78u2 - ok

13:35:22.0718 2556        aic78xx - ok

13:35:22.0812 2556        AliIde - ok

13:35:22.0890 2556        AmdK7           (3a0dafac778236559c14c7203fb550eb) C:\WINDOWS\system32\DRIVERS\amdk7.sys

13:35:23.0109 2556        AmdK7 - ok

13:35:23.0203 2556        amsint - ok

13:35:23.0343 2556        asc - ok

13:35:23.0390 2556        asc3350p - ok

13:35:23.0453 2556        asc3550 - ok

13:35:23.0578 2556        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

13:35:23.0781 2556        AsyncMac - ok

13:35:23.0937 2556        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

13:35:24.0156 2556        atapi - ok

13:35:24.0234 2556        Atdisk - ok

13:35:24.0343 2556        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

13:35:24.0546 2556        Atmarpc - ok

13:35:24.0734 2556        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

13:35:24.0968 2556        audstub - ok

13:35:25.0109 2556        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

13:35:25.0109 2556        avgio - ok

13:35:25.0218 2556        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

13:35:25.0265 2556        avgntflt - ok

13:35:25.0390 2556        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys

13:35:25.0437 2556        avipbb - ok

13:35:25.0609 2556        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

13:35:25.0875 2556        Beep - ok

13:35:26.0062 2556        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

13:35:26.0343 2556        cbidf2k - ok

13:35:26.0453 2556        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

13:35:26.0656 2556        CCDECODE - ok

13:35:26.0718 2556        cd20xrnt - ok

13:35:26.0828 2556        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

13:35:27.0093 2556        Cdaudio - ok

13:35:27.0250 2556        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

13:35:27.0468 2556        Cdfs - ok

13:35:27.0609 2556        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

13:35:27.0796 2556        Cdrom - ok

13:35:27.0906 2556        Changer - ok

13:35:28.0031 2556        CmdIde - ok

13:35:28.0187 2556        Cpqarray - ok

13:35:28.0265 2556        dac2w2k - ok

13:35:28.0312 2556        dac960nt - ok

13:35:28.0453 2556        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

13:35:28.0671 2556        Disk - ok

13:35:28.0828 2556        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

13:35:29.0093 2556        dmboot - ok

13:35:29.0218 2556        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

13:35:29.0468 2556        dmio - ok

13:35:29.0578 2556        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

13:35:29.0843 2556        dmload - ok

13:35:30.0000 2556        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

13:35:30.0171 2556        DMusic - ok

13:35:30.0296 2556        dpti2o - ok

13:35:30.0390 2556        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

13:35:30.0656 2556        drmkaud - ok

13:35:30.0859 2556        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

13:35:31.0046 2556        Fastfat - ok

13:35:31.0203 2556        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

13:35:31.0421 2556        Fdc - ok

13:35:31.0484 2556        FETNDIS - ok

13:35:31.0609 2556        FETNDISB        (a583bc166495b07f704533754ce29cbd) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys

13:35:31.0687 2556        FETNDISB - ok

13:35:31.0843 2556        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

13:35:32.0031 2556        Fips - ok

13:35:32.0109 2556        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

13:35:32.0312 2556        Flpydisk - ok

13:35:32.0468 2556        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

13:35:32.0656 2556        FltMgr - ok

13:35:32.0812 2556        fssfltr         (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys

13:35:32.0828 2556        fssfltr - ok

13:35:32.0968 2556        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

13:35:33.0203 2556        Fs_Rec - ok

13:35:33.0296 2556        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

13:35:33.0578 2556        Ftdisk - ok

13:35:33.0703 2556        GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

13:35:33.0718 2556        GEARAspiWDM - ok

13:35:33.0750 2556        GMSIPCI - ok

13:35:33.0875 2556        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

13:35:34.0046 2556        Gpc - ok

13:35:34.0187 2556        Hardlock        (d95554949082fd29a04d351b58396718) C:\WINDOWS\system32\drivers\hardlock.sys

13:35:34.0312 2556        Hardlock - ok

13:35:34.0437 2556        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

13:35:34.0640 2556        HidUsb - ok

13:35:34.0765 2556        hpn - ok

13:35:34.0875 2556        HSFHWCD2        (16b6a3c4c9e9977d9a6f751679c9a36c) C:\WINDOWS\system32\DRIVERS\HSFHWCD2.sys

13:35:34.0906 2556        HSFHWCD2 ( UnsignedFile.Multi.Generic ) - warning

13:35:34.0906 2556        HSFHWCD2 - detected UnsignedFile.Multi.Generic (1)

13:35:35.0062 2556        HSF_DP          (4640edf3ced93a691cee759e41ce7ff5) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

13:35:35.0187 2556        HSF_DP ( UnsignedFile.Multi.Generic ) - warning

13:35:35.0187 2556        HSF_DP - detected UnsignedFile.Multi.Generic (1)

13:35:35.0296 2556        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

13:35:35.0437 2556        HTTP - ok

13:35:35.0562 2556        huawei_enumerator (bb3c8e4b88842f3a1b9c5d603210c277) C:\WINDOWS\system32\DRIVERS\ew_jubusenum.sys

13:35:35.0750 2556        huawei_enumerator - ok

13:35:35.0859 2556        hwdatacard      (3e3bfe85b9fe3720bf4c108f57c945fb) C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys

13:35:35.0953 2556        hwdatacard - ok

13:35:36.0046 2556        i2omgmt - ok

13:35:36.0109 2556        i2omp - ok

13:35:36.0203 2556        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

13:35:36.0390 2556        i8042prt - ok

13:35:36.0531 2556        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

13:35:36.0734 2556        Imapi - ok

13:35:36.0843 2556        ini910u - ok

13:35:36.0953 2556        IntelIde - ok

13:35:37.0078 2556        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

13:35:37.0281 2556        Ip6Fw - ok

13:35:37.0390 2556        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

13:35:37.0640 2556        IpFilterDriver - ok

13:35:37.0734 2556        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

13:35:37.0921 2556        IpInIp - ok

13:35:38.0078 2556        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

13:35:38.0265 2556        IpNat - ok

13:35:38.0421 2556        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

13:35:38.0609 2556        IPSec - ok

13:35:38.0750 2556        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

13:35:38.0937 2556        IRENUM - ok

13:35:39.0078 2556        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

13:35:39.0250 2556        isapnp - ok

13:35:39.0406 2556        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

13:35:39.0593 2556        Kbdclass - ok

13:35:39.0718 2556        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

13:35:39.0906 2556        kmixer - ok

13:35:40.0031 2556        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

13:35:40.0140 2556        KSecDD - ok

13:35:40.0265 2556        lbrtfdc - ok

13:35:40.0421 2556        mdmxsdk         (29174d3d90ee4244fda6355a859691be) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

13:35:40.0500 2556        mdmxsdk ( UnsignedFile.Multi.Generic ) - warning

13:35:40.0500 2556        mdmxsdk - detected UnsignedFile.Multi.Generic (1)

13:35:40.0781 2556        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

13:35:41.0046 2556        mnmdd - ok

13:35:41.0171 2556        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

13:35:41.0343 2556        Modem - ok

13:35:41.0437 2556        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

13:35:41.0609 2556        Mouclass - ok

13:35:41.0750 2556        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

13:35:42.0015 2556        mouhid - ok

13:35:42.0109 2556        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

13:35:42.0296 2556        MountMgr - ok

13:35:42.0390 2556        mraid35x - ok

13:35:42.0484 2556        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

13:35:42.0687 2556        MRxDAV - ok

13:35:42.0828 2556        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

13:35:42.0953 2556        MRxSmb - ok

13:35:43.0109 2556        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

13:35:43.0312 2556        Msfs - ok

13:35:43.0437 2556        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

13:35:43.0625 2556        MSKSSRV - ok

13:35:43.0718 2556        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

13:35:43.0921 2556        MSPCLOCK - ok

13:35:44.0015 2556        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

13:35:44.0218 2556        MSPQM - ok

13:35:44.0312 2556        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

13:35:44.0500 2556        mssmbios - ok

13:35:44.0609 2556        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

13:35:44.0812 2556        MSTEE - ok

13:35:44.0921 2556        Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

13:35:45.0000 2556        Mup - ok

13:35:45.0125 2556        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

13:35:45.0328 2556        NABTSFEC - ok

13:35:45.0468 2556        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

13:35:45.0640 2556        NDIS - ok

13:35:45.0796 2556        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

13:35:46.0000 2556        NdisIP - ok

13:35:46.0125 2556        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

13:35:46.0187 2556        NdisTapi - ok

13:35:46.0296 2556        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

13:35:46.0484 2556        Ndisuio - ok

13:35:46.0671 2556        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

13:35:46.0859 2556        NdisWan - ok

13:35:46.0953 2556        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

13:35:47.0015 2556        NDProxy - ok

13:35:47.0140 2556        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

13:35:47.0312 2556        NetBIOS - ok

13:35:47.0453 2556        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

13:35:47.0640 2556        NetBT - ok

13:35:47.0859 2556        nmwcd           (e380bbcad640304737650367ddfa2366) C:\WINDOWS\system32\drivers\nmwcd.sys

13:35:47.0984 2556        nmwcd - ok

13:35:48.0078 2556        nmwcdc          (3c4650af9712ae0cb405064b6278ccad) C:\WINDOWS\system32\drivers\nmwcdc.sys

13:35:48.0156 2556        nmwcdc - ok

13:35:48.0296 2556        nmwcdcj         (9c9ff3ec04021234d6f440acbd3b70c1) C:\WINDOWS\system32\drivers\nmwcdcj.sys

13:35:48.0343 2556        nmwcdcj - ok

13:35:48.0484 2556        nmwcdcm         (9c9ff3ec04021234d6f440acbd3b70c1) C:\WINDOWS\system32\drivers\nmwcdcm.sys

13:35:48.0515 2556        nmwcdcm - ok

13:35:48.0640 2556        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

13:35:48.0828 2556        Npfs - ok

13:35:48.0953 2556        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

13:35:49.0218 2556        Ntfs - ok

13:35:49.0328 2556        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

13:35:49.0593 2556        Null - ok

13:35:50.0187 2556        nv              (8b2c874897ea498da012284e12f9db2b) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

13:35:51.0359 2556        nv - ok

13:35:51.0515 2556        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

13:35:51.0796 2556        NwlnkFlt - ok

13:35:51.0921 2556        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

13:35:52.0203 2556        NwlnkFwd - ok

13:35:52.0359 2556        odysseyIM3      (5dcc587deba479b1f8e33aa8fb079b8a) C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys

13:35:52.0375 2556        odysseyIM3 ( UnsignedFile.Multi.Generic ) - warning

13:35:52.0375 2556        odysseyIM3 - detected UnsignedFile.Multi.Generic (1)

13:35:52.0531 2556        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

13:35:52.0718 2556        Parport - ok

13:35:52.0890 2556        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

13:35:53.0062 2556        PartMgr - ok

13:35:53.0218 2556        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

13:35:53.0484 2556        ParVdm - ok

13:35:53.0640 2556        PCANDIS5        (58c5ea3de400fe1d08cfeca6d5c14ebd) C:\WINDOWS\system32\PCANDIS5.SYS

13:35:53.0687 2556        PCANDIS5 ( UnsignedFile.Multi.Generic ) - warning

13:35:53.0687 2556        PCANDIS5 - detected UnsignedFile.Multi.Generic (1)

13:35:53.0781 2556        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

13:35:53.0953 2556        PCI - ok

13:35:54.0046 2556        PCIDump - ok

13:35:54.0109 2556        PCIIde - ok

13:35:54.0250 2556        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

13:35:54.0453 2556        Pcmcia - ok

13:35:54.0546 2556        PDCOMP - ok

13:35:54.0625 2556        PDFRAME - ok

13:35:54.0703 2556        PDRELI - ok

13:35:54.0765 2556        PDRFRAME - ok

13:35:54.0812 2556        perc2 - ok

13:35:54.0859 2556        perc2hib - ok

13:35:55.0078 2556        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

13:35:55.0250 2556        PptpMiniport - ok

13:35:55.0437 2556        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

13:35:55.0625 2556        PSched - ok

13:35:55.0734 2556        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

13:35:55.0968 2556        Ptilink - ok

13:35:56.0062 2556        ql1080 - ok

13:35:56.0125 2556        Ql10wnt - ok

13:35:56.0171 2556        ql12160 - ok

13:35:56.0218 2556        ql1240 - ok

13:35:56.0281 2556        ql1280 - ok

13:35:56.0375 2556        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

13:35:56.0656 2556        RasAcd - ok

13:35:56.0812 2556        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

13:35:56.0984 2556        Rasl2tp - ok

13:35:57.0140 2556        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

13:35:57.0328 2556        RasPppoe - ok

13:35:57.0421 2556        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

13:35:57.0687 2556        Raspti - ok

13:35:57.0812 2556        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

13:35:57.0984 2556        Rdbss - ok

13:35:58.0109 2556        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

13:35:58.0375 2556        RDPCDD - ok

13:35:58.0546 2556        RDPWD           (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys

13:35:58.0625 2556        RDPWD - ok

13:35:58.0718 2556        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

13:35:58.0906 2556        redbook - ok

13:35:59.0171 2556        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

13:35:59.0343 2556        Secdrv - ok

13:35:59.0500 2556        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

13:35:59.0703 2556        serenum - ok

13:35:59.0796 2556        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys

13:35:59.0984 2556        Serial - ok

13:36:00.0156 2556        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys

13:36:00.0343 2556        Sfloppy - ok

13:36:00.0765 2556        Simbad - ok

13:36:00.0843 2556        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

13:36:01.0031 2556        SLIP - ok

13:36:01.0171 2556        SNPSTD3         (43b8c052890896c6d1617ca90b2730e0) C:\WINDOWS\system32\DRIVERS\snpstd3.sys

13:36:01.0250 2556        SNPSTD3 ( UnsignedFile.Multi.Generic ) - warning

13:36:01.0250 2556        SNPSTD3 - detected UnsignedFile.Multi.Generic (1)

13:36:01.0375 2556        Sparrow - ok

13:36:01.0468 2556        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

13:36:01.0671 2556        splitter - ok

13:36:01.0796 2556        SQTECH9080 - ok

13:36:01.0890 2556        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

13:36:02.0078 2556        sr - ok

13:36:02.0250 2556        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

13:36:02.0359 2556        Srv - ok

13:36:02.0500 2556        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

13:36:02.0515 2556        ssmdrv - ok

13:36:02.0656 2556        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

13:36:02.0828 2556        streamip - ok

13:36:02.0953 2556        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

13:36:03.0140 2556        swenum - ok

13:36:03.0250 2556        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

13:36:03.0421 2556        swmidi - ok

13:36:03.0546 2556        symc810 - ok

13:36:03.0625 2556        symc8xx - ok

13:36:03.0687 2556        sym_hi - ok

13:36:03.0750 2556        sym_u3 - ok

13:36:03.0843 2556        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

13:36:04.0031 2556        sysaudio - ok

13:36:04.0234 2556        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

13:36:04.0359 2556        Tcpip - ok

13:36:04.0484 2556        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

13:36:04.0671 2556        TDPIPE - ok

13:36:04.0734 2556        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

13:36:04.0906 2556        TDTCP - ok

13:36:05.0031 2556        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

13:36:05.0203 2556        TermDD - ok

13:36:05.0375 2556        TNET1130        (96e5d1f45fb555c913553701efab6ecc) C:\WINDOWS\system32\DRIVERS\GPlus.sys

13:36:05.0437 2556        TNET1130 - ok

13:36:05.0546 2556        TosIde - ok

13:36:05.0703 2556        uagp35          (d85938f272d1bcf3db3a31fc0a048928) C:\WINDOWS\system32\DRIVERS\uagp35.sys

13:36:05.0875 2556        uagp35 - ok

13:36:05.0968 2556        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

13:36:06.0156 2556        Udfs - ok

13:36:06.0250 2556        ultra - ok

13:36:06.0390 2556        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

13:36:06.0609 2556        Update - ok

13:36:06.0781 2556        USBAAPL         (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys

13:36:06.0843 2556        USBAAPL - ok

13:36:07.0000 2556        usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

13:36:07.0187 2556        usbccgp - ok

13:36:07.0359 2556        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

13:36:07.0531 2556        usbehci - ok

13:36:07.0671 2556        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

13:36:07.0859 2556        usbhub - ok

13:36:08.0000 2556        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

13:36:08.0187 2556        usbprint - ok

13:36:08.0250 2556        usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

13:36:08.0453 2556        usbscan - ok

13:36:08.0593 2556        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

13:36:08.0765 2556        USBSTOR - ok

13:36:08.0906 2556        usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

13:36:09.0078 2556        usbuhci - ok

13:36:09.0203 2556        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys

13:36:09.0359 2556        usbvideo - ok

13:36:09.0484 2556        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

13:36:09.0640 2556        VgaSave - ok

13:36:09.0781 2556        viaagp1         (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys

13:36:09.0828 2556        viaagp1 - ok

13:36:10.0203 2556        viagfx          (0cc705db634a3bc355887e3d478dd386) C:\WINDOWS\system32\DRIVERS\vtmini.sys

13:36:10.0281 2556        viagfx - ok

13:36:10.0437 2556        ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\drivers\ViaIde.sys

13:36:10.0625 2556        ViaIde - ok

13:36:10.0812 2556        VIAudio         (2e1ffc794290d9b16f1db1084583e655) C:\WINDOWS\system32\drivers\vinyl97.sys

13:36:10.0906 2556        VIAudio - ok

13:36:11.0000 2556        videX32         (c8ee49fa76eb7c41a9cddfe58151a74e) C:\WINDOWS\system32\DRIVERS\videX32.sys

13:36:11.0046 2556        videX32 - ok

13:36:11.0203 2556        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

13:36:11.0437 2556        VolSnap - ok

13:36:11.0546 2556        vulfnths        (c0f55cc0903cfdc819f6d857402b697c) C:\WINDOWS\System32\Drivers\vulfnth.sys

13:36:11.0593 2556        vulfnths ( UnsignedFile.Multi.Generic ) - warning

13:36:11.0593 2556        vulfnths - detected UnsignedFile.Multi.Generic (1)

13:36:11.0703 2556        vulfntrs        (545d98a7f61af1c7c4ad38b8f333e0b7) C:\WINDOWS\System32\Drivers\vulfntr.sys

13:36:11.0734 2556        vulfntrs ( UnsignedFile.Multi.Generic ) - warning

13:36:11.0734 2556        vulfntrs - detected UnsignedFile.Multi.Generic (1)

13:36:11.0875 2556        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

13:36:12.0062 2556        Wanarp - ok

13:36:12.0171 2556        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys

13:36:12.0218 2556        Wdf01000 - ok

13:36:12.0312 2556        WDICA - ok

13:36:12.0421 2556        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

13:36:12.0609 2556        wdmaud - ok

13:36:12.0750 2556        winachsf        (c42ddc6f8a3cf3e1309fc627fea30623) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

13:36:12.0828 2556        winachsf ( UnsignedFile.Multi.Generic ) - warning

13:36:12.0828 2556        winachsf - detected UnsignedFile.Multi.Generic (1)

13:36:13.0093 2556        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

13:36:13.0359 2556        WS2IFSL - ok

13:36:13.0500 2556        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

13:36:13.0687 2556        WSTCODEC - ok

13:36:13.0859 2556        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

13:36:13.0921 2556        WudfPf - ok

13:36:14.0031 2556        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

13:36:14.0062 2556        WudfRd - ok

13:36:14.0218 2556        XHASP           (e22df15af05e35a8263d03e6b375090a) c:\windows\system32\drivers\XHASP.sys

13:36:14.0265 2556        XHASP ( UnsignedFile.Multi.Generic ) - warning

13:36:14.0265 2556        XHASP - detected UnsignedFile.Multi.Generic (1)

13:36:14.0359 2556        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0

13:36:14.0625 2556        \Device\Harddisk0\DR0 - ok

13:36:14.0656 2556        Boot (0x1200)   (73697b8d7a43b11108eebe7bedeafa7d) \Device\Harddisk0\DR0\Partition0

13:36:14.0671 2556        \Device\Harddisk0\DR0\Partition0 - ok

13:36:14.0671 2556        ============================================================

13:36:14.0671 2556        Scan finished

13:36:14.0671 2556        ============================================================

13:36:14.0875 1872        Detected object count: 10

13:36:14.0875 1872        Actual detected object count: 10

13:38:34.0156 1872        HSFHWCD2 ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0156 1872        HSFHWCD2 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0156 1872        HSF_DP ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0156 1872        HSF_DP ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0156 1872        mdmxsdk ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0156 1872        mdmxsdk ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0171 1872        odysseyIM3 ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0171 1872        odysseyIM3 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0187 1872        PCANDIS5 ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0187 1872        PCANDIS5 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0187 1872        SNPSTD3 ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0187 1872        SNPSTD3 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0203 1872        vulfnths ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0203 1872        vulfnths ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0203 1872        vulfntrs ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0203 1872        vulfntrs ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0218 1872        winachsf ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0218 1872        winachsf ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:38:34.0218 1872        XHASP ( UnsignedFile.Multi.Generic ) - skipped by user

13:38:34.0218 1872        XHASP ( UnsignedFile.Multi.Generic ) - User select action: Skip

Gruß

Kriszi

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hallo Cosinus,

hier der Inhalt der ComboFix.txt Logdatei (habe ich es richtig verstanden, war dieses mal keine Übermittlung mit Code Tags erforderlich?):

________________________________________________________________

Combofix Logfile:

Code:

ComboFix 12-02-17.02 - Dauber 17.02.2012  15:01:44.1.1 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.767.376 [GMT 1:00]

ausgeführt von:: c:\dokumente und einstellungen\Dauber\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP

c:\dokumente und einstellungen\Dauber\4.0

c:\dokumente und einstellungen\Dauber\WINDOWS

c:\windows\IsUn0407.exe

c:\windows\system32\UNWISE.EXE

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-01-17 bis 2012-02-17  ))))))))))))))))))))))))))))))

.

.

2012-02-17 09:09 . 2012-02-17 09:09        --------        d-----w-        C:\_OTL

2012-02-16 09:07 . 2012-01-11 19:06        3072        -c----w-        c:\windows\system32\dllcache\iacenc.dll

2012-02-16 09:07 . 2012-01-11 19:06        3072        ------w-        c:\windows\system32\iacenc.dll

2012-02-16 09:06 . 2012-01-06 04:19        6557240        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Windows Defender\Definition Updates\{2DA6C252-A9F7-4CE4-A21B-5F53C2CE31A8}\mpengine.dll

2012-02-15 22:03 . 2012-02-15 22:03        --------        d-----w-        c:\programme\ESET

2012-02-13 10:30 . 2012-02-13 10:30        --------        d-----w-        c:\dokumente und einstellungen\Dauber\Lokale Einstellungen\Anwendungsdaten\Mozilla

2012-01-26 18:55 . 2012-01-26 18:55        --------        d-----w-        c:\dokumente und einstellungen\Dauber\.tfo4

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-26 23:21 . 2009-10-03 09:38        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-12 17:20 . 2004-08-04 12:00        1860096        ----a-w-        c:\windows\system32\win32k.sys

2012-01-06 04:19 . 2007-08-28 10:19        6557240        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-12-17 19:43 . 2004-08-04 12:00        916992        ----a-w-        c:\windows\system32\wininet.dll

2011-12-17 19:43 . 2004-08-04 12:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll

2011-12-17 19:43 . 2004-08-04 12:00        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-12-16 12:22 . 2004-08-04 12:00        385024        ----a-w-        c:\windows\system32\html.iec

2011-12-10 14:24 . 2011-07-04 13:49        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-11-25 21:57 . 2004-08-04 12:00        293888        ----a-w-        c:\windows\system32\winsrv.dll

2011-11-20 06:12 . 2004-08-04 12:00        61952        ----a-w-        c:\windows\system32\packager.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-22 68856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VTTimer"="VTTimer.exe" [2004-01-15 49152]

"AudioDeck"="c:\programme\VIAudioi\SBADeck\ADeck.exe" [2004-09-30 7957504]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-23 57344]

"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]

"snpstd3"="c:\windows\vsnpstd3.exe" [2004-07-30 286720]

"lxcymon.exe"="c:\programme\Lexmark 3400 Series\lxcymon.exe" [2006-03-06 286720]

"EzPrint"="c:\programme\Lexmark 3400 Series\ezprint.exe" [2006-02-07 98304]

"FaxCenterServer"="c:\programme\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]

"LXCYCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-02-24 65536]

"CapFax"="c:\programme\Classic PhoneTools\CapFax.EXE" [2001-12-10 20739]

"Ulead AutoDetector v2"="c:\programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 90112]

"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]

"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-12-13 421160]

"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-06-25 273544]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-05-21 13895272]

"NvMediaCenter"="NvMCTray.dll" [2011-05-21 111208]

"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

.

c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\

D-Link AirPlus G+ Wireless Adapter Utility.lnk - c:\programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE [2005-6-26 671744]

Ulead Kalendar Checker 4.0 SE.lnk - c:\programme\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2006-9-24 69632]

Xacti Screen Capture 1.0.lnk - c:\windows\Installer\{57134099-FE12-4B1A-BB4A-80CCB04EBBE6}\_4ae13d6c.exe [2007-1-6 128198]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\FRITZ!DSL\\IGDCTRL.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\FRITZ!DSL\\FBOXUPD.EXE"=

"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\Programme\\iTunes\\iTunes.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Programme\\Gemeinsame Dateien\\XPressUpdate\\XPressUpdate.exe"=

"c:\\Programme\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

.

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [20.03.2009 16:30 136360]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [11.07.2011 13:43 2214504]

R2 WinDefend;Windows Defender;c:\programme\Windows Defender\MsMpEng.exe [03.11.2006 18:19 13592]

R2 XHASP;XHASP;c:\windows\system32\drivers\XHASP.sys [07.07.2011 05:47 259584]

R3 HSFHWCD2;HSFHWCD2;c:\windows\system32\drivers\HSFHWCD2.sys [05.01.2007 15:06 153984]

R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [29.09.2011 20:53 70656]

R3 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe -service --> c:\windows\system32\lxcycoms.exe -service [?]

R3 TNET1130;D-Link AirPlus G+ Wireless Adapter;c:\windows\system32\drivers\GPLUS.sys [18.05.2005 17:00 283392]

S2 DCService.exe;DCService.exe;c:\dokumente und einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe [08.05.2010 12:48 229376]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [10.10.2009 15:36 133104]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [10.10.2009 15:36 133104]

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 85104460

*Deregistered* - 85104460

.

Inhalt des "geplante Tasks" Ordners

.

2012-01-21 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

2012-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2009-10-10 14:36]

.

2012-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2009-10-10 14:36]

.

2012-02-17 c:\windows\Tasks\MP Scheduled Scan.job

- c:\programme\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

.

2012-02-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1214440339-2111687655-839522115-1004.job

- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]

.

2012-02-15 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1214440339-2111687655-839522115-1004.job

- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]

.

2012-02-16 c:\windows\Tasks\RegCure Program Check.job

- c:\programme\RegCure\RegCure.exe [2010-05-19 23:20]

.

2012-02-17 c:\windows\Tasks\RegCure Startup.job

- c:\programme\RegCure\RegCure.exe [2010-05-19 23:20]

.

2012-02-16 c:\windows\Tasks\RegCure.job

- c:\programme\RegCure\RegCure.exe [2010-05-19 23:20]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000

IE: Save Page As PDF ... - file://c:\programme\Nitro PDF\PDF Download\nitroweb.htm

LSP: c:\programme\FRITZ!DSL\sarah.dll

TCP: DhcpNameServer = 78.42.43.62 82.212.62.62

DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-Easy-WebPrint - c:\windows\IsUn0407.exe

AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe

AddRemove-Hardlock Gerätetreiber - c:\windows\system32\UNWISE.EXE

AddRemove-S3 - c:\windows\IsUn0407.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-02-17 15:13

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  LXCYCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(1112)

c:\programme\FRITZ!DSL\sarah.dll

c:\programme\FRITZ!DSL\block.dll

c:\programme\FRITZ!DSL\avmcsock.dll

c:\programme\FRITZ!DSL\avmufc.dll

.

Zeit der Fertigstellung: 2012-02-17  15:18:40

ComboFix-quarantined-files.txt  2012-02-17 14:18

.

Vor Suchlauf: 14 Verzeichnis(se), 30.102.368.256 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 30.392.266.752 Bytes frei

.

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 337294B4E6F5F7F268C10B3190D54E4E

--- --- ---

_________________________________________________________________

Gruß

Kriszi

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Hallo Cosinus,

habe weder WINRAR noch 7ZIP.

Von welcher Website können sie sicher heruntergeladen werden?

Mit der Installation eines neuen Produktes auf die Festplatte, wird nicht der ganze Such- und Analyseprozess beinträchtigt, da ja neue Elemente darauf sind?

Gruß

Kriszi

Mit "neuen Produkten" meine ich WinRAR und 7zip, nicht die Tools.

Also wirklich, wie eine Suchmaschine bedient wird weiß du aber schon? :balla:

7-Zip

Ja, googeln kann ich.

Wollte nur vorsichtig sein, da du ja dabei bist, meine Festplatte zu bereinigen, und keinen neuen Müll von irgendeiner unsicheren Website herunterladen.

Man lädst sich ja auch nichts von irgendwas herunter, sondern nach Möglichkeit direkt vom Hersteller. So einfach ist das. Das Hilfsmittel ist keine Zauberei sondern eine Suchmaschine und etwas Eigeninitiative!

Hallo Cosinus,

hier die GMER Log, nachdem der GMER-Scan stundenlang gedauert hat (zwar nicht abgestürtzt, hat einfach ca. 4 Std gebraucht):

GMER Logfile:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-02-18 09:28:01

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800BB-00FJA0 rev.13.03G13

Running: tunzpgx2.exe; Driver: C:\DOKUME~1\Dauber\LOKALE~1\Temp\agnyrpod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT                                                                                                                                  F7DB048C                                                                                             ZwClose

SSDT                                                                                                                                  F7DB0446                                                                                             ZwCreateKey

SSDT                                                                                                                                  F7DB0496                                                                                             ZwCreateSection

SSDT                                                                                                                                  F7DB043C                                                                                             ZwCreateThread

SSDT                                                                                                                                  F7DB044B                                                                                             ZwDeleteKey

SSDT                                                                                                                                  F7DB0455                                                                                             ZwDeleteValueKey

SSDT                                                                                                                                  F7DB0487                                                                                             ZwDuplicateObject

SSDT                                                                                                                                  F7DB045A                                                                                             ZwLoadKey

SSDT                                                                                                                                  F7DB0428                                                                                             ZwOpenProcess

SSDT                                                                                                                                  F7DB042D                                                                                             ZwOpenThread

SSDT                                                                                                                                  F7DB0464                                                                                             ZwReplaceKey

SSDT                                                                                                                                  F7DB045F                                                                                             ZwRestoreKey

SSDT                                                                                                                                  F7DB049B                                                                                             ZwSetContextThread

SSDT                                                                                                                                  F7DB0450                                                                                             ZwSetValueKey

SSDT                                                                                                                                  F7DB0437                                                                                             ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text                                                                                                                                 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                             section is writeable [0xF5FD53A0, 0x88C445, 0xE8000020]

.text                                                                                                                                 C:\WINDOWS\system32\drivers\hardlock.sys                                                             section is writeable [0xB16AC400, 0x87EE2, 0xE8000020]

.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB1750620]  C:\WINDOWS\system32\drivers\hardlock.sys                                                             entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB1750620]

.protectÿÿÿÿhardlockunknown last code section [0xB1750400, 0x5126, 0xE0000020]                                                        C:\WINDOWS\system32\drivers\hardlock.sys                                                             unknown last code section [0xB1750400, 0x5126, 0xE0000020]
 

---- User code sections - GMER 1.0.15 ----
 

.text                                                                                                                                 C:\program files\real\realplayer\update\realsched.exe[724] kernel32.dll!SetUnhandledExceptionFilter  7C84495D 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
 

---- Devices - GMER 1.0.15 ----
 

Device                                                                                                                                \Driver\Hardlock \Device\HLVol                                                                       XHASP.sys

Device                                                                                                                                \Driver\Hardlock \Device\FNT0                                                                        XHASP.sys
 

AttachedDevice                                                                                                                        \Driver\Tcpip \Device\Tcp                                                                            fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

AttachedDevice                                                                                                                        \FileSystem\Fastfat \Fat                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Die OSAM Log folgt in Kürze

Gruß

Kriszi