Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Weiterleitung nach google Suche + amazon Daten ausgepäht (https://www.trojaner-board.de/111365-weiterleitung-google-suche-amazon-daten-ausgepaeht.html)

motzerrobo 13.03.2012 01:20
Weiterleitung nach google Suche + amazon Daten ausgepäht
 
Hallo Trojaner-board,

vor zwei Wochen wurde ich Opfer eines Angriffs, welcher meine Einloggdaten für meinen amazon Account als "Beute" zur Folge hatte. Amazon hat zum Glück den 900€ Geschenkgutschein der Nachts um 3:00 Uhr gekauft wurde storniert und mein Konto gesperrt. In direkte Verbindung mit meinem System habe ich es nicht gebracht, da keinerlei Anzeichen oder ungewöhnliches im Vorfeld aufgetreten ist. Seit dieser Woche jedoch werde ich zu dubiosen Seiten weitergeleitet, wenn ich die goolge-Suche verwende. Ich habe dazu schon einige Themen hier gefunden und nachgelesen - deshalb habe ich jetzt einen Malware Full Scan gemacht und diese Logfile (siehe Anhang) wurde erzeugt. Dazu habe ich mit dem CC-Cleaner temporäre Files gelöscht und die Registry gecleant. Antivir findet seit heute schon 11 Mal "HTML-Scriptvirus HTML/Infected.WebPage.Gen2" und zusätzlich einmal "TR/Spy.Gen" . Da habe ich mir wohl was eingefangen....

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.12.06

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
motzer :: STEEL [Administrator]

12.03.2012 21:40:32
mbam-log-2012-03-12 (21-40-32).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 642911
Laufzeit: 2 Stunde(n), 2 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Windows\System32\NETw5x32.dll (RootKit.0Access.H) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{91419E33-D9AC-2F4F-9DDB-0A31B337FF79} (Trojan.ZbotR.Gen) -> Daten: C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Windows\System32\NETw5x32.dll (RootKit.0Access.H) -> Löschen bei Neustart.
C:\Windows\System32\drivers\cdrom.sys (Trojan.Patched) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe (Trojan.ZbotR.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Der Rechner wird privat benutzt ich bin Student, Online Banking nutze ich täglich. Heute natürlich noch nicht, möchte jedoch wieder ruhigen gewissens das System und Onlinedienste nutzen können.

Bitte um Hilfe

Mit freundlichen Grüßen
motzer

Psychotic 13.03.2012 08:35
:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
  • Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren) - wenn du die anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
  • Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  • Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.


Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.



Schritt 1: Online-Banking sperren!


Da dein Rechner offensichtlich Schadsoftware enthält, welche Anmeldedaten abgreift:

Rufe die Sperrhotline 116 116 an und lasse das online banking sicherheitshalber sperren - sofort!





Schritt 2: FRST


Downloade dir bitte Farbar's Recovery Scan Tool und speichere diese auf einen USB Stick. Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und starte von der CD
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !!
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein. e:\frst.exe Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

motzerrobo 13.03.2012 22:11
Hallo Marius,

danke für die schnellen Hinweise. War etwas stressig eine Windows CD zu bekommen, hatte die Uni Version damals vom USB Stick installiert. Habe daher versuch vorhin per VPN ins Uni Netz zu gelangen hat aber nicht funktioniert auch mit verschiedenen Clients nicht, obs am Netz oder an meinem System lag weiß ich leider nicht. Habe dann letztendlich doch eine System CD bekommen.
Was mir noch aufgefallen ist die CD Laufwerke waren nicht mehr im Arbeitsplatz vorhanden, habe über den Gerätemanager nachgeschaut, Treiber sollen defekt gewesen sein. Habe sie entfernt und neu installiert - funktionierte danach um die Windows CD brennen zu können.

Lange rede kurzer Sinn hier der Log

Code:
Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 13-03-2012 21:58:50
Running from L:\
Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [281768 2011-03-28] (Avira GmbH)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: []  [x]
HKLM\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-01-03] (Adobe Systems Inc.)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [NI Update Service] "C:\Program Files\National Instruments\Shared\Update Service\NIUpdateService.exe" -startupTask [3002976 2011-06-07] (National Instruments)
HKLM\...\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [290816 2005-11-11] (Sunbelt Software)
HKU\motzer\...\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe -autoDiscover 1 -displayIfNoneFound 0 -displayRegisterOptions 1 -sleepIfNoneFound 0 -locale 1031 [846520 2010-06-21] ()
HKU\motzer\...\Run: [{91419E33-D9AC-2F4F-9DDB-0A31B337FF79}] C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe [x]
Winlogon\Notify\lkapoer:
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

================================ Services (Whitelisted) ==================

2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [172032 2009-11-18] (AMD)
2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [136360 2011-03-28] (Avira GmbH)
2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [269480 2011-07-04] (Avira GmbH)
2 ASDR; C:\Windows\System32\ASDR.exe [61440 2009-07-27] ()
2 ATKFUSService; C:\Windows\system32\ATKFUSService.exe [61952 2009-12-01] (ASUSTeK COMPUTER INC.)
2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
3 FLEXnet Licensing Service; "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [1044816 2011-10-10] (Flexera Software, Inc.)
2 LkCitadelServer; C:\Windows\system32\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
2 lkClassAds; C:\Windows\system32\lkads.exe [46192 2011-06-14] (National Instruments Corporation)
2 lkTimeSync; C:\Windows\system32\lktsrv.exe [56952 2011-06-14] (National Instruments Corporation)
3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice [31125880 2011-06-12] (Microsoft Corporation)
2 mitsijm2012; "C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe" [580416 2011-08-03] (Autodesk, Inc.)
2 mxssvr; "C:\Program Files\National Instruments\MAX\nimxs.exe" [12696 2011-06-14] (National Instruments Corporation)
4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-18] (Microsoft Corporation)
4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
2 NIApplicationWebServer; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [50336 2011-05-27] (National Instruments Corporation)
2 NIDomainService; "C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe" [362104 2011-06-14] (National Instruments Corporation)
3 NILM License Manager; "C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe" [1427688 2010-08-02] (Macrovision Corporation)
2 nimDNSResponder; "C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe" [194224 2011-06-01] (National Instruments Corporation)
2 NINetworkDiscovery; "C:\Program Files\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe" [121032 2011-06-10] (National Instruments Corporation)
2 niSvcLoc; "C:\Program Files\National Instruments\Shared\NI WebServer\SystemWebServer.exe" -system [50328 2011-11-17] (National Instruments Corporation)
2 NITaggerService; "C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe" [676016 2011-06-14] (National Instruments Corporation)
3 OpcEnum; C:\Windows\system32\OpcEnum.exe [98304 2009-06-03] (OPC Foundation)
3 StorSvc; C:\Windows\System32\storsvc.dll [16384 2009-07-14] (Microsoft Corporation)
2 vpnagent; "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe" [435152 2011-03-23] (Cisco Systems, Inc.)
2 ntservice1; C:\Windows\System32\NETw5x32.dll [x]

========================== Drivers (Whitelisted) =============

3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [77968 2011-03-23] (Cisco Systems, Inc.)
3 asusgsb; C:\Windows\System32\drivers\asusgsb.sys [15232 2009-02-17] (ASUSTeK Computer Inc.)
3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [5140480 2009-11-18] (ATI Technologies Inc.)
3 atkdisplf; C:\Windows\System32\drivers\ATKDispLowFilter.sys [30976 2009-02-17] (ASUSTeK Computer Inc.)
2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-07-04] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-07-04] (Avira GmbH)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
2 cvintdrv; C:\Windows\System32\Drivers\cvintdrv.sys [19552 2011-11-04] ()
3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-02] (Samsung Electronics Co., Ltd.)
3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [77624 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
4 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
1 EIO; C:\Windows\System32\DRIVERS\EIO.sys [14336 2011-07-27] (ASUSTeK Computer Inc.)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2010-10-22] (AVM GmbH)
3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [57112 2011-01-21] (Paragon Software Group)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl.sys [18432 2011-05-10] (Apple Inc.)
3 nipalfwedl; C:\Windows\System32\drivers\nipalfwedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 NIPALK; C:\Windows\System32\drivers\nipalk.sys [584856 2011-06-29] (National Instruments Corporation)
3 nipalusbedl; C:\Windows\System32\drivers\nipalusbedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 nipbcfk; C:\Windows\System32\drivers\nipbcfk.sys [15448 2010-03-24] (National Instruments Corporation)
0 PrecSim; C:\Windows\System32\DRIVERS\precsim.sys [69600 2002-05-22] (Engelmann GmbH)
3 Ser2pl; C:\Windows\System32\DRIVERS\ser2pl.sys [77824 2008-10-27] (Prolific Technology Inc.)
3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [17920 2009-10-08] (Silicon Laboratories, Inc.)
3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [63488 2009-10-08] (Silicon Laboratories)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [722416 2011-08-16] (Duplex Secure Ltd.)
1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [5120 2009-03-02] (Samsung Electronics)
3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [181432 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 TVicPort; \??\C:\Windows\system32\DRIVERS\TVICPORT.SYS [14544 2005-03-30] (EnTech Taiwan)
1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [40824 2011-01-21] (Windows (R) 2000 DDK provider)
1 Uim_IM; C:\Windows\System32\Drivers\Uim_IM.sys [381032 2011-01-21] (Paragon)
1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [17920 2010-09-02] (Shrew Soft Inc)
3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [13824 2010-09-02] (Shrew Soft Inc)
3 vpnva; C:\Windows\System32\DRIVERS\vpnva.sys [19680 2011-03-23] (Cisco Systems, Inc.)
3 VSPerfDrv100; \??\C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation)
3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195968 2010-08-31] (Jungo)

========================== NetSvcs (Whitelisted) ===========
NETSVC: rbfilter
NETSVC: SNC
NETSVC: cmuda
NETSVC: ntservice1
NETSVC: mcontrol
NETSVC: vmm

============ One Month Created Files and Folders ==============

2012-03-13 20:36 - 2012-03-13 21:31 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 19:15 - 2012-03-13 20:25 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 19:12 - 2012-03-13 20:27 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 19:12 - 2009-03-18 16:35 - 0026176 ___AH (LogMeIn, Inc.) C:\Windows\System32\hamachi.sys
2012-03-13 19:07 - 2012-03-13 20:28 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 18:30 - 2012-02-15 06:44 - 0826368 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-03-13 18:30 - 2012-02-15 05:22 - 0177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-03-13 18:30 - 2012-02-15 05:22 - 0024064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-03-13 18:30 - 2012-01-25 06:44 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-03-13 18:30 - 2012-01-25 06:44 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-03-13 18:30 - 2012-01-25 06:40 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:05 - 2012-03-13 01:46 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:05 - 2012-03-13 01:05 - 0001054 ____A C:\Windows\PFRO.log
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-12 22:29 - 2012-03-13 21:54 - 0001400 ____A C:\Windows\setupact.log
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:33 - 2011-12-10 15:24 - 0020464 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:19 - 2012-03-12 21:20 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:17 - 2012-03-12 21:17 - 4435063 ____A (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:39 - 2012-03-12 20:56 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:26 - 2012-03-13 01:03 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ihuw
2012-03-12 00:26 - 2012-03-12 00:45 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ygacva
2012-03-12 00:15 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-11 23:57 - 2012-03-13 18:23 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-11 23:56 - 2012-03-12 00:45 - 0000000 ____D C:\Program Files\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-11 23:51 - 2012-03-12 00:42 - 0000000 ____D C:\National Instruments Downloads
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-18 01:21 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-02-16 21:25 - 2012-01-03 06:44 - 0478208 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-02-16 21:25 - 2011-12-16 08:59 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2012-02-16 21:24 - 2012-01-14 04:48 - 2340864 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-02-16 21:24 - 2012-01-04 10:03 - 12868096 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-02-16 21:24 - 2012-01-04 10:03 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-02-12 14:45 - 2012-02-12 14:46 - 0000000 ____D C:\Program Files\iTunes
2012-02-12 14:45 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iPod


============ 3 Months Modified Files and Folders ===============

2012-03-13 21:58 - 2012-03-13 21:58 - 0000000 ____D C:\FRST
2012-03-13 21:54 - 2012-03-12 22:29 - 0001400 ____A C:\Windows\setupact.log
2012-03-13 21:54 - 2011-05-25 12:41 - 1609175040 __ASH C:\hiberfil.sys
2012-03-13 21:54 - 2009-07-14 05:53 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-03-13 21:53 - 2011-05-25 12:48 - 1713040 ____A C:\Windows\WindowsUpdate.log
2012-03-13 21:31 - 2012-03-13 20:36 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 20:28 - 2012-03-13 19:07 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 20:28 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\DriverStore
2012-03-13 20:27 - 2012-03-13 19:12 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 20:25 - 2012-03-13 19:15 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 20:24 - 2011-06-24 20:33 - 0000000 ___RD C:\Users\motzer\Dropbox
2012-03-13 20:24 - 2011-06-24 20:31 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Dropbox
2012-03-13 20:01 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-03-13 20:01 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-03-13 19:19 - 2011-06-24 17:53 - 0001594 ____A C:\Windows\VPNInstall.MIF
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 18:37 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\Mozilla Firefox
2012-03-13 18:34 - 2011-05-25 12:51 - 1612484 ____A C:\Windows\System32\PerfStringBackup.INI
2012-03-13 18:23 - 2012-03-11 23:57 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-13 01:46 - 2012-03-13 01:05 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:33 - 2011-08-22 12:57 - 0000000 ____D C:\Users\motzer\AppData\Local\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\Users\All Users\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\ProgramData\Samsung
2012-03-13 01:33 - 2011-05-25 15:12 - 0000000 ___HD C:\Program Files\InstallShield Installation Information
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:11 - 2011-05-25 15:39 - 0008224 ____A C:\Users\motzer\AppData\Local\GDIPFONTCACHEV1.DAT
2012-03-13 01:06 - 2009-07-14 05:33 - 0544032 ____A C:\Windows\System32\FNTCACHE.DAT
2012-03-13 01:05 - 2012-03-13 01:05 - 0001054 ____A C:\Windows\PFRO.log
2012-03-13 01:05 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Branding
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-13 01:03 - 2012-03-12 00:26 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ihuw
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:20 - 2012-03-12 21:19 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:17 - 2012-03-12 21:17 - 4435063 ____A (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 21:07 - 2011-09-15 22:09 - 0000000 ____D C:\Users\motzer\AppData\Roaming\TS3Client
2012-03-12 21:07 - 2011-08-04 13:50 - 0000000 ____D C:\Windows\Minidump
2012-03-12 21:07 - 2011-05-26 23:10 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Skype
2012-03-12 21:07 - 2011-05-25 13:40 - 0000000 ____D C:\Windows\Panther
2012-03-12 21:01 - 2011-07-28 11:31 - 0000000 ____D C:\Program Files\CCleaner
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-12 20:56 - 2012-03-12 00:39 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:45 - 2012-03-12 00:26 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ygacva
2012-03-12 00:45 - 2012-03-11 23:56 - 0000000 ____D C:\Program Files\National Instruments
2012-03-12 00:44 - 2011-05-25 17:39 - 0000000 ____D C:\Program Files\Common Files\Merge Modules
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:42 - 2012-03-11 23:51 - 0000000 ____D C:\National Instruments Downloads
2012-03-12 00:17 - 2012-03-12 00:15 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:17 - 2012-02-18 01:21 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-09 23:58 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\JDownloader
2012-03-07 19:47 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Microsoft.NET
2012-03-02 21:02 - 2011-05-25 15:11 - 0000000 ____D C:\Users\motzer\AppData\Roaming\ICQ
2012-03-01 16:18 - 2011-07-15 16:07 - 0000000 ____D C:\Users\motzer\Documents\FinePrint-Dateien
2012-02-28 00:43 - 2011-06-24 20:32 - 0000997 ____A C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-25 01:32 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\rescache
2012-02-24 13:16 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\de-DE
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-21 19:17 - 2011-05-25 15:49 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-02-20 00:22 - 2011-06-22 19:40 - 0000692 ____A C:\Users\motzer\Desktop\Kino.txt
2012-02-20 00:05 - 2011-05-25 15:51 - 0000000 ____D C:\Program Files\Mozilla Thunderbird
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-17 19:25 - 2011-05-25 12:47 - 0000174 ___SH C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-02-17 01:48 - 2011-10-25 13:43 - 0000000 ____D C:\Users\All Users\Microsoft Help
2012-02-17 01:48 - 2011-10-25 13:43 - 0000000 ____D C:\ProgramData\Microsoft Help
2012-02-15 06:44 - 2012-03-13 18:30 - 0826368 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-02-15 05:22 - 2012-03-13 18:30 - 0177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-02-15 05:22 - 2012-03-13 18:30 - 0024064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-02-12 15:35 - 2011-10-26 13:35 - 0000000 ____D C:\Users\motzer\AppData\Local\Deployment
2012-02-12 14:46 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iTunes
2012-02-12 14:45 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iPod
2012-02-12 14:45 - 2011-05-25 16:41 - 0000000 ____D C:\Program Files\Common Files\Apple
2012-02-06 18:40 - 2012-02-06 18:40 - 0000000 ____D C:\Users\motzer\Desktop\RT Vorbereitung
2012-01-27 17:22 - 2011-05-25 15:07 - 0000000 ____D C:\Program Files\Opera
2012-01-25 15:34 - 2011-05-26 23:10 - 0000000 ___RD C:\Program Files\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\Users\All Users\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\ProgramData\Skype
2012-01-25 06:44 - 2012-03-13 18:30 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-01-25 06:44 - 2012-03-13 18:30 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-01-25 06:40 - 2012-03-13 18:30 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-01-23 21:26 - 2012-01-23 20:53 - 0000798 ____A C:\Windows\Ulead32.ini
2012-01-23 21:26 - 2012-01-23 20:53 - 0000000 ____D C:\Windows\ULEAD.DAT
2012-01-23 20:54 - 2012-01-23 20:54 - 0000000 ____D C:\Program Files\iPhoto Plus 4
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\MSDOS.SYS
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\IO.SYS
2012-01-14 04:48 - 2012-02-16 21:24 - 2340864 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-01-14 00:31 - 2011-07-06 11:19 - 0001106 ____A C:\Users\motzer\Desktop\Zitate.txt
2012-01-13 15:59 - 2011-05-25 16:42 - 0017408 ____A C:\Users\motzer\AppData\Local\WebpageIcons.db
2012-01-13 14:57 - 2011-10-10 23:26 - 0000000 ____D C:\Users\motzer\Documents\Inventor
2012-01-12 13:25 - 2011-10-10 20:07 - 0000000 ____D C:\Users\motzer\AppData\Roaming\toolplugin
2012-01-10 17:05 - 2011-09-20 01:50 - 0000000 ____D C:\Users\motzer\Documents\MATLAB
2012-01-09 18:18 - 2011-05-25 16:43 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Apple Computer
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:19 - 0000000 ____D C:\Users\motzer\Documents\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\Documents\FILSHtray
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\AppData\Local\FILSH_Media_GmbH
2012-01-04 10:03 - 2012-02-16 21:24 - 12868096 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-01-04 10:03 - 2012-02-16 21:24 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-01-03 06:44 - 2012-02-16 21:25 - 0478208 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2011-12-20 14:11 - 2011-12-20 14:11 - 0055904 ____A (National Instruments Corporation) C:\Windows\System32\XSpyDll.dll
2011-12-20 13:16 - 2011-12-20 13:16 - 0378064 ____A (National Instruments Corporation) C:\Windows\System32\niemca2l.dll
2011-12-16 08:59 - 2012-02-16 21:25 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\User32.dll
[2009-07-14 00:24] - [2009-07-14 02:16] - 0811520 ____A (Microsoft Corporation) 34B7E222E81FAFA885F0C5F2CFA56861

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 22%
Total physical RAM: 2046.18 MB
Available physical RAM: 1585.79 MB
Total Pagefile: 2046.18 MB
Available Pagefile: 1588.33 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.29 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:222.78 GB) (Free:130.55 GB) NTFS ==>[Drive with boot components (obtanied from BCD)]
2 Drive d: (DATAPART1) (Fixed) (Total:232.83 GB) (Free:54.01 GB) NTFS
3 Drive e: (Elektronik) (Fixed) (Total:10 GB) (Free:6.74 GB) NTFS
5 Drive g: (GSP1RMCPRFRER_DE_DVD) (CDROM) (Total:2.34 GB) (Free:0 GB) UDF
10 Drive l: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
11 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

  Datentr„ger ###  Status        Gr”áe    Frei    Dyn  GPT
  ---------------  -------------  -------  -------  ---  ---
  Datentr„ger 0    Online          232 GB      0 B       
  Datentr„ger 1    Online          232 GB      0 B       
  Datentr„ger 2    Kein Medium        0 B      0 B       
  Datentr„ger 3    Kein Medium        0 B      0 B       
  Datentr„ger 4    Kein Medium        0 B      0 B       
  Datentr„ger 5    Kein Medium        0 B      0 B       
  Datentr„ger 6    Online          965 MB      0 B       

Partitions of Disk 0:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    OEM                54 MB    31 KB
  Partition 2    Prim„r              10 GB    55 MB
  Partition 3    Prim„r            222 GB    10 GB

======================================================================================================

Disk: 0
Partition 1
Typ      : DE
Versteckt: Ja
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 10                    FAT    Partition    54 MB  Fehlerfre  Versteck

======================================================================================================

Disk: 0
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2    E  Elektronik  NTFS  Partition    10 GB  Fehlerfre         

======================================================================================================

Disk: 0
Partition 3
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3    C                NTFS  Partition    222 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 1:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            232 GB  1024 KB

======================================================================================================

Disk: 1
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4    D  DATAPART1    NTFS  Partition    232 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 2:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 3:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 4:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 5:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 6:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            962 MB  1788 KB

======================================================================================================

Disk: 6
Partition 1
Typ      : 06
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 9    L                FAT    Wechselmed  962 MB  Fehlerfre         

======================================================================================================

==========================================================

Last Boot: 2012-03-10 00:57

======================= End Of Log ==========================

mfg motzer

Psychotic 14.03.2012 00:02
Da hast du ja schon ganz schön rumgefroscht - insbesonder Combofix ist ein sehr mächtiges Tool, welches man niemals ausführen sollte, wenn man nicht weiß, was man tut! :twak:


Lass es mich dennoch versuchen...


Schritt 1: Fix mit FRST


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKU\motzer\...\Run: [{91419E33-D9AC-2F4F-9DDB-0A31B337FF79}] C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe [x]
Winlogon\Notify\lkapoer:

2012-03-12 00:26 - 2012-03-13 01:03 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ihuw
2012-03-12 00:26 - 2012-03-12 00:45 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ygacva
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.




Schritt 2: ComboFix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.



Schritt 3: TDSS-Killer (Scan)


Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.



Schritt 4: aswMBR



Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

motzerrobo 14.03.2012 21:29
Hallo Marius,

also vorab ich habe die Tools wie Combofix nur runtergeladen jedoch nie geöffnet, da ich hier im Forum schon gelesen hatte, dass man sie erst nach Aufforderung nutzen sollte - von daher nur halb rumgefroscht =)

So also Fix mit FRST hat geklappt.

Combofix klappt aber irgendwie nicht - ich starte und das Tool erstellt einen Wiederherstellungspunkt geht dann über zum Scan - und dann ist Ende

ich habe gestern 5h scannen lassen bis ich dachte "Die 10 Minuten sind wohl selbst bei meiner Kiste vorbei"

http://www.imgbox.de/users/motzer/th...Combofix_t.gif

das bleibt so stehen der Cursor blinkt ....

Habe dann heute als ich von der Uni kam nochmal getestet beim Hochfahren kam dann diese Meldung ich habe auf "Ja" geklickt und dann nochmal versucht mit Combofix zu scannen und jetzt sind wieder 2h vergangen und nichts passiert. Worran kann es liegen ?

http://www.imgbox.de/users/motzer/th...mbofix_2_t.gif

Ich habe Antivir deaktiviert aber er meckert trotzdem beim Start von Combofix - habe ich es vielleicht nicht komplett "ausgeschaltet" ?

Und jetzt rödelt der Rechner wie verrückt CPU Auslastung bei über 50% und der Lüfter auf volllast - selbst nach erneutem Start. Daher hier nochmal Resourcenmonitor
http://www.imgbox.de/users/motzer/th...esourcen_t.gif


bitte um weitere Anweisungen.

mfg
motzer

Psychotic 14.03.2012 22:06
Dann ist die Combofix.exe also auch schon länger am System?

Starte Windows im abgesicherten Modus mit Netzwerktreibern, lösche die vorhandene combofix.exe und lade dir eine neue von hier herunter.


Starte sie per Rechtsklick-->Als Administrator ausführen.

Poste das logfile/berichte!

motzerrobo 15.03.2012 19:24
Okay Treiber vom WLAN Stick neu installiert und Internet ist wieder da ich versuche jetzt nochmal über den abgesicherten Modus Combofix zu laden!

Edit:

Also im abgesicherten Modus funktioniert keine Internetverbindung. Ich habe Combofix dann regulär geladen und im abgesicherten Modus ausgeführt - selbes Bild wie vorher. Wiederherszellungspunkt wird erstellt danach startet der Scan, jedoch wird nichts weiter angezeigt. Was soll ich tun?

motzer

Psychotic 16.03.2012 08:11
Neues FRST-Log

Lösche die FRST.TXT (falls vorhanden) vom Stick.

Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und starte von der CD
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !!
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein. e:\frst.exe Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

motzerrobo 16.03.2012 22:05
Okay ausgeführt

Code:
Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 16-03-2012 21:55:44
Running from H:\
Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [281768 2011-03-28] (Avira GmbH)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: []  [x]
HKLM\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-01-03] (Adobe Systems Inc.)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [NI Update Service] "C:\Program Files\National Instruments\Shared\Update Service\NIUpdateService.exe" -startupTask [3002976 2011-06-07] (National Instruments)
HKLM\...\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [290816 2005-11-11] (Sunbelt Software)
HKU\motzer\...\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe -autoDiscover 1 -displayIfNoneFound 0 -displayRegisterOptions 1 -sleepIfNoneFound 0 -locale 1031 [846520 2010-06-21] ()
HKU\motzer\...\Policies\system: [disableregistrytools] 0
HKU\motzer\...\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe -autoDiscover 1 -displayIfNoneFound 0 -displayRegisterOptions 1 -sleepIfNoneFound 0 -locale 1031 [846520 2010-06-21] ()
HKU\motzer\...\Policies\system: [disableregistrytools] 0
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

================================ Services (Whitelisted) ==================

2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [172032 2009-11-18] (AMD)
2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [136360 2011-03-28] (Avira GmbH)
2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [269480 2011-07-04] (Avira GmbH)
2 ASDR; C:\Windows\System32\ASDR.exe [61440 2009-07-27] ()
2 ATKFUSService; C:\Windows\system32\ATKFUSService.exe [61952 2009-12-01] (ASUSTeK COMPUTER INC.)
2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
3 FLEXnet Licensing Service; "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [1044816 2011-10-10] (Flexera Software, Inc.)
2 LkCitadelServer; C:\Windows\system32\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
2 lkClassAds; C:\Windows\system32\lkads.exe [46192 2011-06-14] (National Instruments Corporation)
2 lkTimeSync; C:\Windows\system32\lktsrv.exe [56952 2011-06-14] (National Instruments Corporation)
3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice [31125880 2011-06-12] (Microsoft Corporation)
2 mitsijm2012; "C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe" [580416 2011-08-03] (Autodesk, Inc.)
2 mxssvr; "C:\Program Files\National Instruments\MAX\nimxs.exe" [12696 2011-06-14] (National Instruments Corporation)
4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-18] (Microsoft Corporation)
4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
2 NIApplicationWebServer; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [50336 2011-05-27] (National Instruments Corporation)
2 NIDomainService; "C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe" [362104 2011-06-14] (National Instruments Corporation)
3 NILM License Manager; "C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe" [1427688 2010-08-02] (Macrovision Corporation)
2 nimDNSResponder; "C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe" [194224 2011-06-01] (National Instruments Corporation)
2 NINetworkDiscovery; "C:\Program Files\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe" [121032 2011-06-10] (National Instruments Corporation)
2 niSvcLoc; "C:\Program Files\National Instruments\Shared\NI WebServer\SystemWebServer.exe" -system [50328 2011-11-17] (National Instruments Corporation)
2 NITaggerService; "C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe" [676016 2011-06-14] (National Instruments Corporation)
3 OpcEnum; C:\Windows\system32\OpcEnum.exe [98304 2009-06-03] (OPC Foundation)
3 StorSvc; C:\Windows\System32\storsvc.dll [16384 2009-07-14] (Microsoft Corporation)
2 vpnagent; "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe" [435152 2011-03-23] (Cisco Systems, Inc.)
2 ntservice1; C:\Windows\System32\NETw5x32.dll [x]

========================== Drivers (Whitelisted) =============

3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [77968 2011-03-23] (Cisco Systems, Inc.)
3 asusgsb; C:\Windows\System32\drivers\asusgsb.sys [15232 2009-02-17] (ASUSTeK Computer Inc.)
3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [5140480 2009-11-18] (ATI Technologies Inc.)
3 atkdisplf; C:\Windows\System32\drivers\ATKDispLowFilter.sys [30976 2009-02-17] (ASUSTeK Computer Inc.)
2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-07-04] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-07-04] (Avira GmbH)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
3 BridgeMP; C:\Windows\System32\DRIVERS\bridge.sys [78336 2009-07-14] (Microsoft Corporation)
2 cvintdrv; C:\Windows\System32\Drivers\cvintdrv.sys [19552 2011-11-04] ()
3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-02] (Samsung Electronics Co., Ltd.)
3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [77624 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
4 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
1 EIO; C:\Windows\System32\DRIVERS\EIO.sys [14336 2011-07-27] (ASUSTeK Computer Inc.)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2010-10-22] (AVM GmbH)
3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [57112 2011-01-21] (Paragon Software Group)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl.sys [18432 2011-05-10] (Apple Inc.)
3 nipalfwedl; C:\Windows\System32\drivers\nipalfwedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 NIPALK; C:\Windows\System32\drivers\nipalk.sys [584856 2011-06-29] (National Instruments Corporation)
3 nipalusbedl; C:\Windows\System32\drivers\nipalusbedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 nipbcfk; C:\Windows\System32\drivers\nipbcfk.sys [15448 2010-03-24] (National Instruments Corporation)
0 PrecSim; C:\Windows\System32\DRIVERS\precsim.sys [69600 2002-05-22] (Engelmann GmbH)
3 Ser2pl; C:\Windows\System32\DRIVERS\ser2pl.sys [77824 2008-10-27] (Prolific Technology Inc.)
3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [17920 2009-10-08] (Silicon Laboratories, Inc.)
3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [63488 2009-10-08] (Silicon Laboratories)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [722416 2011-08-16] (Duplex Secure Ltd.)
1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [5120 2009-03-02] (Samsung Electronics)
3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [181432 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 TVicPort; \??\C:\Windows\system32\DRIVERS\TVICPORT.SYS [14544 2005-03-30] (EnTech Taiwan)
1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [40824 2011-01-21] (Windows (R) 2000 DDK provider)
1 Uim_IM; C:\Windows\System32\Drivers\Uim_IM.sys [381032 2011-01-21] (Paragon)
1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [17920 2010-09-02] (Shrew Soft Inc)
3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [13824 2010-09-02] (Shrew Soft Inc)
3 vpnva; C:\Windows\System32\DRIVERS\vpnva.sys [19680 2011-03-23] (Cisco Systems, Inc.)
3 VSPerfDrv100; \??\C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation)
3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195968 2010-08-31] (Jungo)
3 catchme; \??\C:\Users\motzer\AppData\Local\Temp\catchme.sys [x]

========================== NetSvcs (Whitelisted) ===========
NETSVC: rbfilter
NETSVC: SNC
NETSVC: cmuda
NETSVC: ntservice1
NETSVC: mcontrol
NETSVC: vmm

============ One Month Created Files and Folders ==============

2012-03-15 22:17 - 2012-03-15 22:24 - 0000000 ___SD C:\ComboFix
2012-03-15 22:17 - 2012-03-15 22:17 - 0000000 ____D C:\Qoobox
2012-03-15 22:17 - 2011-06-26 07:45 - 0256000 ____A C:\Windows\PEV.exe
2012-03-15 22:17 - 2010-11-07 18:20 - 0208896 ____A C:\Windows\MBR.exe
2012-03-15 22:17 - 2009-04-20 05:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0098816 ____A C:\Windows\sed.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0080412 ____A C:\Windows\grep.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0068096 ____A C:\Windows\zip.exe
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Documents and Settings\motzer\Desktop\ComboFix.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Users\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Documents and Settings\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Users\motzer\Desktop\tdsskiller.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\motzer\Desktop\tdsskiller.exe
2012-03-15 19:40 - 2010-10-22 02:00 - 0013189 ___RA C:\Windows\instwcli.inf
2012-03-15 19:31 - 2012-03-15 19:40 - 0059618 ____A C:\Windows\avmacc.log
2012-03-15 19:31 - 2012-03-15 19:40 - 0017411 ____A C:\Windows\AVMInstall.Log
2012-03-15 19:31 - 2012-03-15 19:40 - 0009330 ____A C:\Windows\avmsetup.log
2012-03-15 19:31 - 2012-03-15 19:40 - 0002266 ____A C:\Windows\avmadd32.log
2012-03-15 19:31 - 2012-03-15 19:33 - 0009607 ____A C:\Windows\avmsetup1.log
2012-03-15 19:31 - 2012-03-15 19:33 - 0002442 ____A C:\Windows\avmadd321.log
2012-03-15 19:31 - 2012-03-15 19:31 - 0000413 ____A C:\Windows\avmacc1.log
2012-03-15 19:31 - 2010-10-22 01:01 - 0078336 ____A (AVM Berlin) C:\Windows\System32\fwusbnci.org
2012-03-15 19:31 - 2010-10-22 01:00 - 0074240 ____A (AVM Berlin) C:\Windows\System32\fwlanci.org
2012-03-15 19:26 - 2012-03-15 19:40 - 0026658 ____A C:\Windows\avmfwlanci.log
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Users\motzer\Desktop\Wlan.png
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Documents and Settings\motzer\Desktop\Wlan.png
2012-03-15 19:09 - 2012-03-15 20:10 - 0305120 ____A C:\Windows\ntbtlog.txt
2012-03-15 18:54 - 2012-01-25 06:32 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-03-15 18:54 - 2012-01-25 06:32 - 0058880 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-03-14 21:50 - 2012-03-14 21:50 - 0000000 ____D C:\Windows\System32\SPReview
2012-03-14 21:49 - 2012-03-14 21:49 - 0000000 ____D C:\Windows\System32\EventProviders
2012-03-14 21:46 - 2012-03-04 16:23 - 54215544 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Users\motzer\Desktop\Resourcen.png
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Documents and Settings\motzer\Desktop\Resourcen.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Users\motzer\Desktop\Combofix_2.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Documents and Settings\motzer\Desktop\Combofix_2.png
2012-03-14 21:30 - 2012-03-16 00:09 - 0007601 ____A C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-14 21:30 - 2012-03-16 00:09 - 0007601 ____A C:\Documents and Settings\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Users\motzer\Desktop\Combofix.png
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Documents and Settings\motzer\Desktop\Combofix.png
2012-03-14 01:02 - 2012-03-15 22:17 - 0000000 ____D C:\Windows\ERDNT
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Users\motzer\Desktop\Fixlist.txt
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Documents and Settings\motzer\Desktop\Fixlist.txt
2012-03-13 23:14 - 2011-11-19 15:50 - 3968368 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2012-03-13 23:14 - 2011-11-19 15:50 - 3913584 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-03-13 21:58 - 2012-03-16 21:56 - 0000000 ____D C:\FRST
2012-03-13 20:36 - 2012-03-13 21:31 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 20:36 - 2012-03-13 21:31 - 2509058048 ____A C:\Documents and Settings\motzer\Desktop\X17-59886.iso
2012-03-13 20:30 - 2012-02-10 06:38 - 1077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2012-03-13 20:30 - 2012-02-03 04:54 - 2343424 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-03-13 19:15 - 2012-03-13 20:25 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 19:12 - 2012-03-13 20:27 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 19:12 - 2012-03-13 20:27 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 19:12 - 2009-03-18 16:35 - 0026176 ___AH (LogMeIn, Inc.) C:\Windows\System32\hamachi.sys
2012-03-13 19:07 - 2012-03-13 20:28 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Documents and Settings\motzer\Documents\Shrew Soft VPN
2012-03-13 18:30 - 2012-02-17 06:34 - 0826880 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-03-13 18:30 - 2012-02-17 05:14 - 0183808 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-03-13 18:30 - 2012-02-17 05:13 - 0024576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-03-13 18:30 - 2012-01-25 06:27 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-03-13 18:30 - 2010-11-20 11:21 - 0018432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdpipe.sys
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:05 - 2012-03-16 21:46 - 0009422 ____A C:\Windows\PFRO.log
2012-03-13 01:05 - 2012-03-13 01:46 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Documents and Settings\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-12 22:29 - 2012-03-16 21:46 - 0003808 ____A C:\Windows\setupact.log
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Documents and Settings\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Documents and Settings\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Documents and Settings\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\All Users\Malwarebytes
2012-03-12 21:33 - 2011-12-10 15:24 - 0020464 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Documents and Settings\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:19 - 2012-03-12 21:20 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:19 - 2012-03-12 21:20 - 12410880 ____A C:\Documents and Settings\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Documents and Settings\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Documents and Settings\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Documents and Settings\Public\Documents\National Instruments
2012-03-12 00:39 - 2012-03-12 20:56 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:15 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:15 - 2012-03-12 00:17 - 0000000 ____D C:\Documents and Settings\motzer\Documents\LabVIEW Data
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Documents and Settings\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-11 23:57 - 2012-03-13 18:23 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-11 23:56 - 2012-03-12 00:45 - 0000000 ____D C:\Program Files\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\Documents and Settings\All Users\National Instruments
2012-03-11 23:51 - 2012-03-12 00:42 - 0000000 ____D C:\National Instruments Downloads
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Documents and Settings\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-18 01:21 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-02-18 01:21 - 2012-03-12 00:17 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Captcha_Brotherhood
2012-02-16 21:25 - 2012-01-04 09:59 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-02-16 21:25 - 2011-12-30 06:27 - 0478720 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-02-16 21:25 - 2011-12-16 08:52 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2012-02-16 21:24 - 2012-01-04 09:58 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll


============ 3 Months Modified Files and Folders ===============

2012-03-16 21:56 - 2012-03-13 21:58 - 0000000 ____D C:\FRST
2012-03-16 21:51 - 2011-05-25 12:48 - 2004146 ____A C:\Windows\WindowsUpdate.log
2012-03-16 21:51 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-03-16 21:51 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-03-16 21:50 - 2011-05-25 12:51 - 1612484 ____A C:\Windows\System32\PerfStringBackup.INI
2012-03-16 21:48 - 2011-06-24 20:33 - 0000000 ___RD C:\Users\motzer\Dropbox
2012-03-16 21:48 - 2011-06-24 20:33 - 0000000 ___RD C:\Documents and Settings\motzer\Dropbox
2012-03-16 21:48 - 2011-06-24 20:31 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Dropbox
2012-03-16 21:48 - 2011-06-24 20:31 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Dropbox
2012-03-16 21:47 - 2009-07-14 03:36 - 0000000 __SHD C:\$Recycle.Bin
2012-03-16 21:46 - 2012-03-13 01:05 - 0009422 ____A C:\Windows\PFRO.log
2012-03-16 21:46 - 2012-03-12 22:29 - 0003808 ____A C:\Windows\setupact.log
2012-03-16 21:46 - 2011-05-25 12:41 - 1609175040 __ASH C:\hiberfil.sys
2012-03-16 21:46 - 2009-07-14 05:53 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-03-16 00:09 - 2012-03-14 21:30 - 0007601 ____A C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-16 00:09 - 2012-03-14 21:30 - 0007601 ____A C:\Documents and Settings\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-15 22:24 - 2012-03-15 22:17 - 0000000 ___SD C:\ComboFix
2012-03-15 22:17 - 2012-03-15 22:17 - 0000000 ____D C:\Qoobox
2012-03-15 22:17 - 2012-03-14 01:02 - 0000000 ____D C:\Windows\ERDNT
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Documents and Settings\motzer\Desktop\ComboFix.exe
2012-03-15 20:49 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Microsoft.NET
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Users\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Documents and Settings\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Users\motzer\Desktop\tdsskiller.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\motzer\Desktop\tdsskiller.exe
2012-03-15 20:10 - 2012-03-15 19:09 - 0305120 ____A C:\Windows\ntbtlog.txt
2012-03-15 19:40 - 2012-03-15 19:31 - 0059618 ____A C:\Windows\avmacc.log
2012-03-15 19:40 - 2012-03-15 19:31 - 0017411 ____A C:\Windows\AVMInstall.Log
2012-03-15 19:40 - 2012-03-15 19:31 - 0009330 ____A C:\Windows\avmsetup.log
2012-03-15 19:40 - 2012-03-15 19:31 - 0002266 ____A C:\Windows\avmadd32.log
2012-03-15 19:40 - 2012-03-15 19:26 - 0026658 ____A C:\Windows\avmfwlanci.log
2012-03-15 19:40 - 2011-05-25 15:04 - 0000000 ____D C:\Program Files\avmwlanstick
2012-03-15 19:33 - 2012-03-15 19:31 - 0009607 ____A C:\Windows\avmsetup1.log
2012-03-15 19:33 - 2012-03-15 19:31 - 0002442 ____A C:\Windows\avmadd321.log
2012-03-15 19:33 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\NDF
2012-03-15 19:31 - 2012-03-15 19:31 - 0000413 ____A C:\Windows\avmacc1.log
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Users\motzer\Desktop\Wlan.png
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Documents and Settings\motzer\Desktop\Wlan.png
2012-03-15 19:11 - 2011-06-21 14:40 - 0000000 ____D C:\Users\motzer\AppData\Local\ElevatedDiagnostics
2012-03-15 19:11 - 2011-06-21 14:40 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\ElevatedDiagnostics
2012-03-15 18:51 - 2011-05-25 12:47 - 0000174 ___SH C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-03-15 18:51 - 2011-05-25 12:47 - 0000174 ___SH C:\Documents and Settings\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-03-15 18:45 - 2009-07-14 05:33 - 0544032 ____A C:\Windows\System32\FNTCACHE.DAT
2012-03-14 22:06 - 2009-07-14 09:57 - 0000000 ____D C:\Program Files\Windows Journal
2012-03-14 22:06 - 2009-07-14 09:47 - 0000000 ____D C:\Windows\System32\Drivers\de-DE
2012-03-14 22:06 - 2009-07-14 09:47 - 0000000 ____D C:\Windows\de-DE
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Sidebar
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Portable Devices
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Photo Viewer
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Defender
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\DVD Maker
2012-03-14 22:06 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\de-DE
2012-03-14 22:06 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\AdvancedInstallers
2012-03-14 22:06 - 2009-07-14 03:37 - 0000000 ____D C:\Program Files\Common Files\System
2012-03-14 22:05 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\DriverStore
2012-03-14 21:56 - 2009-07-14 03:05 - 0152576 ____A (Microsoft Corporation) C:\Windows\System32\msclmd.dll
2012-03-14 21:50 - 2012-03-14 21:50 - 0000000 ____D C:\Windows\System32\SPReview
2012-03-14 21:49 - 2012-03-14 21:49 - 0000000 ____D C:\Windows\System32\EventProviders
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Users\motzer\Desktop\Resourcen.png
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Documents and Settings\motzer\Desktop\Resourcen.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Users\motzer\Desktop\Combofix_2.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Documents and Settings\motzer\Desktop\Combofix_2.png
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Users\motzer\Desktop\Combofix.png
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Documents and Settings\motzer\Desktop\Combofix.png
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Users\motzer\Desktop\Fixlist.txt
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Documents and Settings\motzer\Desktop\Fixlist.txt
2012-03-13 23:22 - 2011-10-25 13:43 - 0000000 ____D C:\Users\All Users\Microsoft Help
2012-03-13 23:22 - 2011-10-25 13:43 - 0000000 ____D C:\ProgramData\Microsoft Help
2012-03-13 23:22 - 2011-10-25 13:43 - 0000000 ____D C:\Documents and Settings\All Users\Microsoft Help
2012-03-13 23:17 - 2011-05-25 15:39 - 0165368 ____A C:\Users\motzer\AppData\Local\GDIPFONTCACHEV1.DAT
2012-03-13 23:17 - 2011-05-25 15:39 - 0165368 ____A C:\Documents and Settings\motzer\AppData\Local\GDIPFONTCACHEV1.DAT
2012-03-13 21:31 - 2012-03-13 20:36 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 21:31 - 2012-03-13 20:36 - 2509058048 ____A C:\Documents and Settings\motzer\Desktop\X17-59886.iso
2012-03-13 20:28 - 2012-03-13 19:07 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 20:27 - 2012-03-13 19:12 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 20:27 - 2012-03-13 19:12 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 20:25 - 2012-03-13 19:15 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 19:19 - 2011-06-24 17:53 - 0001594 ____A C:\Windows\VPNInstall.MIF
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Documents and Settings\motzer\Documents\Shrew Soft VPN
2012-03-13 18:37 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\Mozilla Firefox
2012-03-13 18:23 - 2012-03-11 23:57 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-13 01:46 - 2012-03-13 01:05 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:33 - 2011-08-22 12:57 - 0000000 ____D C:\Users\motzer\AppData\Local\Samsung
2012-03-13 01:33 - 2011-08-22 12:57 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\Users\All Users\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\ProgramData\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\Documents and Settings\All Users\Samsung
2012-03-13 01:33 - 2011-05-25 15:12 - 0000000 ___HD C:\Program Files\InstallShield Installation Information
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:05 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Branding
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Documents and Settings\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Documents and Settings\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Documents and Settings\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Documents and Settings\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\All Users\Malwarebytes
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Documents and Settings\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:20 - 2012-03-12 21:19 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:20 - 2012-03-12 21:19 - 12410880 ____A C:\Documents and Settings\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Documents and Settings\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Documents and Settings\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 21:07 - 2011-09-15 22:09 - 0000000 ____D C:\Users\motzer\AppData\Roaming\TS3Client
2012-03-12 21:07 - 2011-09-15 22:09 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\TS3Client
2012-03-12 21:07 - 2011-08-04 13:50 - 0000000 ____D C:\Windows\Minidump
2012-03-12 21:07 - 2011-05-26 23:10 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Skype
2012-03-12 21:07 - 2011-05-26 23:10 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Skype
2012-03-12 21:07 - 2011-05-25 13:40 - 0000000 ____D C:\Windows\Panther
2012-03-12 21:01 - 2011-07-28 11:31 - 0000000 ____D C:\Program Files\CCleaner
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\Documents and Settings\All Users\National Instruments
2012-03-12 20:56 - 2012-03-12 00:39 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:45 - 2012-03-11 23:56 - 0000000 ____D C:\Program Files\National Instruments
2012-03-12 00:44 - 2011-05-25 17:39 - 0000000 ____D C:\Program Files\Common Files\Merge Modules
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Documents and Settings\Public\Documents\National Instruments
2012-03-12 00:42 - 2012-03-11 23:51 - 0000000 ____D C:\National Instruments Downloads
2012-03-12 00:17 - 2012-03-12 00:15 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:17 - 2012-03-12 00:15 - 0000000 ____D C:\Documents and Settings\motzer\Documents\LabVIEW Data
2012-03-12 00:17 - 2012-02-18 01:21 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-03-12 00:17 - 2012-02-18 01:21 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Captcha_Brotherhood
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Documents and Settings\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-09 23:58 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\JDownloader
2012-03-04 16:23 - 2012-03-14 21:46 - 54215544 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-03-02 21:02 - 2011-05-25 15:11 - 0000000 ____D C:\Users\motzer\AppData\Roaming\ICQ
2012-03-02 21:02 - 2011-05-25 15:11 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\ICQ
2012-03-01 16:18 - 2011-07-15 16:07 - 0000000 ____D C:\Users\motzer\Documents\FinePrint-Dateien
2012-03-01 16:18 - 2011-07-15 16:07 - 0000000 ____D C:\Documents and Settings\motzer\Documents\FinePrint-Dateien
2012-02-28 00:43 - 2011-06-24 20:32 - 0000997 ____A C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-28 00:43 - 2011-06-24 20:32 - 0000997 ____A C:\Documents and Settings\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-25 01:32 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\rescache
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-21 19:17 - 2011-05-25 15:49 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-02-20 00:22 - 2011-06-22 19:40 - 0000692 ____A C:\Users\motzer\Desktop\Kino.txt
2012-02-20 00:22 - 2011-06-22 19:40 - 0000692 ____A C:\Documents and Settings\motzer\Desktop\Kino.txt
2012-02-20 00:05 - 2011-05-25 15:51 - 0000000 ____D C:\Program Files\Mozilla Thunderbird
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Documents and Settings\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-17 06:34 - 2012-03-13 18:30 - 0826880 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-02-17 05:14 - 2012-03-13 18:30 - 0183808 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-02-17 05:13 - 2012-03-13 18:30 - 0024576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-02-12 15:35 - 2011-10-26 13:35 - 0000000 ____D C:\Users\motzer\AppData\Local\Deployment
2012-02-12 15:35 - 2011-10-26 13:35 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Deployment
2012-02-12 14:46 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iTunes
2012-02-12 14:45 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iPod
2012-02-12 14:45 - 2011-05-25 16:41 - 0000000 ____D C:\Program Files\Common Files\Apple
2012-02-10 06:38 - 2012-03-13 20:30 - 1077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2012-02-06 18:40 - 2012-02-06 18:40 - 0000000 ____D C:\Users\motzer\Desktop\RT Vorbereitung
2012-02-06 18:40 - 2012-02-06 18:40 - 0000000 ____D C:\Documents and Settings\motzer\Desktop\RT Vorbereitung
2012-02-03 04:54 - 2012-03-13 20:30 - 2343424 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-01-27 17:22 - 2011-05-25 15:07 - 0000000 ____D C:\Program Files\Opera
2012-01-25 15:34 - 2011-05-26 23:10 - 0000000 ___RD C:\Program Files\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\Users\All Users\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\ProgramData\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\Documents and Settings\All Users\Skype
2012-01-25 06:32 - 2012-03-15 18:54 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-01-25 06:32 - 2012-03-15 18:54 - 0058880 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-01-25 06:27 - 2012-03-13 18:30 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-01-23 21:26 - 2012-01-23 20:53 - 0000798 ____A C:\Windows\Ulead32.ini
2012-01-23 21:26 - 2012-01-23 20:53 - 0000000 ____D C:\Windows\ULEAD.DAT
2012-01-23 20:54 - 2012-01-23 20:54 - 0000000 ____D C:\Program Files\iPhoto Plus 4
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\MSDOS.SYS
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\IO.SYS
2012-01-14 00:31 - 2011-07-06 11:19 - 0001106 ____A C:\Users\motzer\Desktop\Zitate.txt
2012-01-14 00:31 - 2011-07-06 11:19 - 0001106 ____A C:\Documents and Settings\motzer\Desktop\Zitate.txt
2012-01-13 15:59 - 2011-05-25 16:42 - 0017408 ____A C:\Users\motzer\AppData\Local\WebpageIcons.db
2012-01-13 15:59 - 2011-05-25 16:42 - 0017408 ____A C:\Documents and Settings\motzer\AppData\Local\WebpageIcons.db
2012-01-13 14:57 - 2011-10-10 23:26 - 0000000 ____D C:\Users\motzer\Documents\Inventor
2012-01-13 14:57 - 2011-10-10 23:26 - 0000000 ____D C:\Documents and Settings\motzer\Documents\Inventor
2012-01-12 13:25 - 2011-10-10 20:07 - 0000000 ____D C:\Users\motzer\AppData\Roaming\toolplugin
2012-01-12 13:25 - 2011-10-10 20:07 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\toolplugin
2012-01-10 17:05 - 2011-09-20 01:50 - 0000000 ____D C:\Users\motzer\Documents\MATLAB
2012-01-10 17:05 - 2011-09-20 01:50 - 0000000 ____D C:\Documents and Settings\motzer\Documents\MATLAB
2012-01-09 18:18 - 2011-05-25 16:43 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Apple Computer
2012-01-09 18:18 - 2011-05-25 16:43 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Apple Computer
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoft
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:19 - 0000000 ____D C:\Users\motzer\Documents\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:19 - 0000000 ____D C:\Documents and Settings\motzer\Documents\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\Documents\FILSHtray
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\AppData\Local\FILSH_Media_GmbH
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Documents and Settings\motzer\Documents\FILSHtray
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\FILSH_Media_GmbH
2012-01-04 09:59 - 2012-02-16 21:25 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-01-04 09:58 - 2012-02-16 21:24 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2011-12-30 06:27 - 2012-02-16 21:25 - 0478720 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2011-12-20 14:11 - 2011-12-20 14:11 - 0055904 ____A (National Instruments Corporation) C:\Windows\System32\XSpyDll.dll
2011-12-20 13:16 - 2011-12-20 13:16 - 0378064 ____A (National Instruments Corporation) C:\Windows\System32\niemca2l.dll

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 22%
Total physical RAM: 2046.18 MB
Available physical RAM: 1583.91 MB
Total Pagefile: 2046.18 MB
Available Pagefile: 1587.7 MB
Total Virtual: 2047.88 MB
Available Virtual: 1967.21 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:222.78 GB) (Free:136.83 GB) NTFS ==>[Drive with boot components (obtanied from BCD)]
2 Drive d: (DATAPART1) (Fixed) (Total:232.83 GB) (Free:45.6 GB) NTFS
3 Drive e: (Elektronik) (Fixed) (Total:10 GB) (Free:6.74 GB) NTFS
5 Drive g: (GSP1RMCPRFRER_DE_DVD) (CDROM) (Total:2.34 GB) (Free:0 GB) UDF
6 Drive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
11 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

  Datentr„ger ###  Status        Gr”áe    Frei    Dyn  GPT
  ---------------  -------------  -------  -------  ---  ---
  Datentr„ger 0    Online          232 GB      0 B       
  Datentr„ger 1    Online          232 GB      0 B       
  Datentr„ger 2    Online          965 MB      0 B       
  Datentr„ger 3    Kein Medium        0 B      0 B       
  Datentr„ger 4    Kein Medium        0 B      0 B       
  Datentr„ger 5    Kein Medium        0 B      0 B       
  Datentr„ger 6    Kein Medium        0 B      0 B       

Partitions of Disk 0:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    OEM                54 MB    31 KB
  Partition 2    Prim„r              10 GB    55 MB
  Partition 3    Prim„r            222 GB    10 GB

======================================================================================================

Disk: 0
Partition 1
Typ      : DE
Versteckt: Ja
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 10                    FAT    Partition    54 MB  Fehlerfre  Versteck

======================================================================================================

Disk: 0
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2    E  Elektronik  NTFS  Partition    10 GB  Fehlerfre         

======================================================================================================

Disk: 0
Partition 3
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3    C                NTFS  Partition    222 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 1:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            232 GB  1024 KB

======================================================================================================

Disk: 1
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4    D  DATAPART1    NTFS  Partition    232 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 2:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            962 MB  1788 KB

======================================================================================================

Disk: 2
Partition 1
Typ      : 06
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 5    H                FAT    Wechselmed  962 MB  Fehlerfre         

======================================================================================================

Partitions of Disk 3:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 4:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 5:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 6:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

==========================================================

Last Boot: 2012-03-10 00:57

======================= End Of Log ==========================

mfg
motzer

Psychotic 17.03.2012 11:25
Schritt 1: Fix mit FRST


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKLM\...\Run: []
2 ntservice1; C:\Windows\System32\NETw5x32.dll

C:\Windows\System32\NETw5x32.dll
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


Schritt 2: Gmer


Bitte
  • alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
  • keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
  • nichts am Rechner arbeiten,
  • nach jedem Scan der Rechner neu gestarten.
Gmer scannen lassen
  • Lade Dir Gmer von dieser Seite herunter
    (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
  • Alle anderen Programme sollen geschlossen sein.
  • Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen).
    Vista und Win7 User mit Rechtsklick und als Administrator starten.
  • Sollte sich ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei:
    • IAT/EAT
    • Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
    • Show all (sollte abgehackt sein)
  • Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt[/B] auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

motzerrobo 18.03.2012 03:49
Hallo Marius,

langer Weg =) aber geschafft. Als ich heute morgen den FRST Fix machen wollte und gerade hier im Forum deine Anweisungen gelesen habe kam aus dem nichts der "GEMA" Virus und hat meinen Screen zugedeckt - mit einigen Affengriffen hab ich es geschafft das Teil zu "beenden" und habe die gema.exe aus dem versteckten Ordner gelöscht. Danach habe ich neu gestartet und den Fix durchgeführt hier die Log File:

Code:
Fix result of Farbar Recovery Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 2012-03-17 20:40:30 R:2
Running from L:\

==============================================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HKLM\...\Run: [] Value not found.
ntservice1 service deleted successfully.
C:\Windows\System32\NETw5x32.dll not found.

==== End of Fixlog ====
Danach habe ich weiter deine Anweisungen befolgt und den GMER Scan mit den vorgegebenen Einstellungen und ohne Netzverbindung gemacht. Das lange warten von 6 Stunden hat sich ausgezahlt der Scan ist tatsächlich beendet worden und zwar vor 10 Minuten =) Wieso das so lange dauert und ob das üblich ist weiß ich nicht - vielleicht kannst du darauß ja noch irgendwelche Schlüsse ziehen.

hier die LogFile
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-18 03:34:54
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500JS-75NCB3 rev.10.02E04
Running: eu0cksk6.exe; Driver: C:\Users\motzer\AppData\Local\Temp\pxldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                            82C563D9 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                    82C8FD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?              System32\Drivers\spmj.sys                                                Das System kann den angegebenen Pfad nicht finden. !
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                  section is writeable [0x8EC3B000, 0x2CA9C0, 0xE8000020]
.text          USBPORT.SYS!DllUnload                                                    8E352DB9 5 Bytes  JMP 864D84E0
PAGE            spsys.sys!?SPRevision@@3PADA + 4F90                                      AF078000 290 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 50B3                                      AF078123 629 Bytes  [35, 07, AF, FE, 05, 34, 35, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 5329                                      AF078399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 538F                                      AF0783FF 148 Bytes  [18, 5D, C2, 14, 00, 8B, FF, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 543B                                      AF0784AB 2228 Bytes  [8B, FF, 55, 8B, EC, FF, 75, ...]
PAGE            ...                                                                     

---- User code sections - GMER 1.0.15 ----

.text          C:\Windows\Explorer.EXE[1472] kernel32.dll!CreateProcessW                76AC204D 5 Bytes  JMP 01CB504E
.text          C:\Windows\system32\svchost.exe[2856] kernel32.dll!ExitProcess            76B1BBE2 5 Bytes  JMP 000203E8

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                    85D3A1F8
Device          \FileSystem\fastfat \FatCdrom                                            87AE2500
Device          \FileSystem\udfs \UdfsCdRom                                              86EEF1F8
Device          \FileSystem\udfs \UdfsDisk                                                86EEF1F8
Device          \Driver\USBSTOR \Device\0000009b                                          86E3E1F8

AttachedDevice  \Driver\volsnap \Device\HarddiskVolumeShadowCopy1                        hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\volsnap \Device\HarddiskVolumeShadowCopy2                        hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\usbuhci \Device\USBPDO-0                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-1                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-2                                          864A91F8
Device          \Driver\usbehci \Device\USBPDO-3                                          863A9500
Device          \Driver\usbuhci \Device\USBPDO-4                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-5                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-6                                          864A91F8
Device          \Driver\volmgr \Device\HarddiskVolume1                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\usbehci \Device\USBPDO-7                                          863A9500
Device          \Driver\volmgr \Device\HarddiskVolume2                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\cdrom \Device\CdRom0                                              862B21F8
Device          \Driver\cdrom \Device\CdRom0                                              85D9D96E
Device          \Driver\volmgr \Device\HarddiskVolume3                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                              85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort0                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort0                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4                              85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort1                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort1                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort2                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort2                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort3                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort3                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                              85D9F02C
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-5                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-5                              85D9F02C
Device          \Driver\cdrom \Device\CdRom1                                              862B21F8
Device          \Driver\cdrom \Device\CdRom1                                              85D9D96E
Device          \Driver\volmgr \Device\HarddiskVolume4                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\cdrom \Device\CdRom2                                              862B21F8
Device          \Driver\cdrom \Device\CdRom2                                              85D9D96E
Device          \Driver\USBSTOR \Device\000000a6                                          86E3E1F8
Device          \Driver\volmgr \Device\HarddiskVolume5                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\USBSTOR \Device\000000a7                                          86E3E1F8
Device          \Driver\volmgr \Device\HarddiskVolume6                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\volmgr \Device\HarddiskVolume7                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                  863071F8
Device          \Driver\volmgr \Device\HarddiskVolume8                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\volmgr \Device\HarddiskVolume9                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume9                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume9                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\ACPI_HAL \Device\0000005a                                        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device          \Driver\USBSTOR \Device\00000096                                          86E3E1F8
Device          \Driver\USBSTOR \Device\00000098                                          86E3E1F8
Device          \Driver\USBSTOR \Device\00000099                                          86E3E1F8
Device          \Driver\usbuhci \Device\USBFDO-0                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-1                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-2                                          864A91F8
Device          \Driver\usbehci \Device\USBFDO-3                                          863A9500
Device          \Driver\NetBT \Device\NetBT_Tcpip_{CC86D29B-4AE9-4769-94EF-8CBBD26D5AC1}  863071F8
Device          \Driver\usbuhci \Device\USBFDO-4                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-5                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-6                                          864A91F8
Device          \Driver\usbehci \Device\USBFDO-7                                          863A9500
Device          \Driver\PrecSim \Device\Scsi\PrecSim1Port0Path0Target0Lun0                8507E1F8
Device          \Driver\PrecSim \Device\Scsi\PrecSim1Port0Path0Target0Lun0                85D9F00C
Device          \Driver\PrecSim \Device\Scsi\PrecSim1                                    8507E1F8
Device          \Driver\PrecSim \Device\Scsi\PrecSim1                                    85D9F00C
Device          \Driver\USBSTOR \Device\0000009a                                          86E3E1F8
Device          \FileSystem\fastfat \Fat                                                  87AE2500

AttachedDevice  \FileSystem\fastfat \Fat                                                  fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                        771343423
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                        285507792

---- Files - GMER 1.0.15 ----

File            C:\Windows\$NtUninstallKB40230$\1042759890                                0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156                                0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\@                              2048 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\cfg.ini                        316 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\Desktop.ini                    4608 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\L                              0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\L\xadqgnnk                    108544 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\oemid                          229 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U                              0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\00000001.@                  2048 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\00000002.@                  224768 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\00000004.@                  1024 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\80000000.@                  66560 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\80000004.@                  12800 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\80000032.@                  96256 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\version                        851 bytes

---- EOF - GMER 1.0.15 ----
Ich hatte noch nie Probleme mit Viren Würmen Trojanern oder sonstigem Ungeziefer in den letzten 2 Jahrzehnten und jetzt scheint eine wahre Bombe auf mich einzuprasseln, dabei habe ich nichts an meinen Gewohnheiten geändert, schon erschreckend....

ich hoffe auf weitere Hilfe

mfg
motzer

Psychotic 18.03.2012 11:56
Schritt 1: Fix mit FRST


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
C:\Windows\$NtUninstallKB40230$\3762978156\U
C:\Windows\$NtUninstallKB40230$\3762978156\L
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.




Schritt 2: ComboFix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

starte den Rechner einfach neu. Dies sollte das Problem beheben.

motzerrobo 18.03.2012 22:43
Hallo Marius,

also heute starte ich meinen Rechner und Gema.exe startet wieder diesmal aus dem system32 Ordner. Ich habe die Datei wieder gelöscht um am Rechner arbeiten zu können. Dann hat Antivir direkt alarm geschlagen

"TR/Spy.Banker.Gen2" ich klicke auf entfernen und nach einigen Minuten den gleichen Trojaner nochmal und einige Minuten wieder. Das alles während ich hier deine Anweisungen gelesen habe.

Ich habe den FRST Fix ausgeführt hier die Logfile

Code:
Fix result of Farbar Recovery Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 2012-03-18 21:08:40 R:3
Running from H:\

==============================================

C:\Windows\$NtUninstallKB40230$\3762978156\U not found.
C:\Windows\$NtUninstallKB40230$\3762978156\L not found.

==== End of Fixlog ====
bei Combofix bietet sich das gleiche Bild wie vorher es startet stellt den Wiederherstellungspunkt her und beginnt scheinbar den Scan, dann passiert aber nichts weiter. Liegt es vielleicht daran, dass der Rechner so heftig ausgelastet ist und nur wenig scannt pro Zeit. Nach dem CombofixScan Versuch war die Internetverbindung wieder zerschossen und ich musste mit der FritzboxWLan Stick CD die Software dafür neu installieren. Klappt wieder!

Die CPU Auslastung ist aber weiterhin sehr hoch - immer noch um die 70% dauerhaft ohne irgendeine Aktion am Rechner services.exe und svchost.exe (netsvcs) nehmen davon fast alles ein.


Wenn ich heute Abend noch neue Anweisungen bekommen sollte befolge ich diese natürliche, ansonsten werde ich morgen bevor ich in die Uni gehe den Rechner anschalten und einen Combofix Scan starten und den ganzen Tag laufen lassen - keine Ahnung ob das was bringt, jedoch nervt der laute Lüfter durch die hohe CPU Auslastung und ich kann das Teil nachts nicht durchlaufen lassen.

mfg
motzer

Psychotic 18.03.2012 23:19
Schritt 1: Scan mit TDSS-Killer


Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.



Schritt 2: OTL (Custom Scan)


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread



Schritt 3: Datei suchen


Check mal, ob die Datei C:\Qoobox\ComboFix-quarantined-files.txt existiert und lade sie in dem Fall hoch!

motzerrobo 19.03.2012 00:00
Okay

TDSSKiller File
Code:
23:30:12.0175 9384        TDSS rootkit removing tool 2.7.20.0 Mar  9 2012 17:10:43
23:30:12.0953 9384        ============================================================
23:30:12.0953 9384        Current date / time: 2012/03/18 23:30:12.0953
23:30:12.0953 9384        SystemInfo:
23:30:12.0953 9384       
23:30:12.0953 9384        OS Version: 6.1.7601 ServicePack: 1.0
23:30:12.0953 9384        Product type: Workstation
23:30:12.0953 9384        ComputerName: STEEL
23:30:12.0953 9384        UserName: motzer
23:30:12.0953 9384        Windows directory: C:\Windows
23:30:12.0953 9384        System windows directory: C:\Windows
23:30:12.0953 9384        Processor architecture: Intel x86
23:30:12.0953 9384        Number of processors: 2
23:30:12.0953 9384        Page size: 0x1000
23:30:12.0953 9384        Boot type: Normal boot
23:30:12.0953 9384        ============================================================
23:30:14.0076 9384        Drive \Device\Harddisk0\DR0 - Size: 0x3A35294400 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76BA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:30:14.0094 9384        Drive \Device\Harddisk1\DR1 - Size: 0x3A35294400 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76BA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:30:14.0165 9384        Drive \Device\Harddisk6\DR7 - Size: 0x774488000 (29.82 Gb), SectorSize: 0x200, Cylinders: 0xF34, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
23:30:14.0185 9384        \Device\Harddisk0\DR0:
23:30:14.0185 9384        MBR used
23:30:14.0185 9384        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1B800, BlocksNum 0x1400000
23:30:14.0185 9384        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x141B800, BlocksNum 0x1BD8D000
23:30:14.0185 9384        \Device\Harddisk1\DR1:
23:30:14.0185 9384        MBR used
23:30:14.0185 9384        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1D1A8000
23:30:14.0185 9384        \Device\Harddisk6\DR7:
23:30:14.0204 9384        MBR used
23:30:14.0204 9384        \Device\Harddisk6\DR7\Partition0: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x3BA2420
23:30:14.0317 9384        Initialize success
23:30:14.0317 9384        ============================================================
23:31:57.0248 7008        ============================================================
23:31:57.0248 7008        Scan started
23:31:57.0248 7008        Mode: Manual;
23:31:57.0248 7008        ============================================================
23:31:59.0422 7008        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
23:31:59.0424 7008        1394ohci - ok
23:31:59.0506 7008        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
23:31:59.0509 7008        ACPI - ok
23:31:59.0570 7008        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
23:31:59.0571 7008        AcpiPmi - ok
23:31:59.0636 7008        acsock          (ae954c42547605408cddf03bb13845b8) C:\Windows\system32\DRIVERS\acsock.sys
23:31:59.0638 7008        acsock - ok
23:31:59.0712 7008        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
23:31:59.0729 7008        adp94xx - ok
23:31:59.0753 7008        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
23:31:59.0757 7008        adpahci - ok
23:31:59.0775 7008        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
23:31:59.0777 7008        adpu320 - ok
23:31:59.0840 7008        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
23:31:59.0846 7008        AFD - ok
23:31:59.0933 7008        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
23:31:59.0934 7008        agp440 - ok
23:31:59.0990 7008        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
23:31:59.0991 7008        aic78xx - ok
23:32:00.0051 7008        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
23:32:00.0052 7008        aliide - ok
23:32:00.0122 7008        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
23:32:00.0123 7008        amdagp - ok
23:32:00.0144 7008        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
23:32:00.0145 7008        amdide - ok
23:32:00.0172 7008        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
23:32:00.0173 7008        AmdK8 - ok
23:32:00.0191 7008        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
23:32:00.0192 7008        AmdPPM - ok
23:32:00.0262 7008        amdsata        (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
23:32:00.0263 7008        amdsata - ok
23:32:00.0304 7008        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
23:32:00.0338 7008        amdsbs - ok
23:32:00.0434 7008        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
23:32:00.0434 7008        amdxata - ok
23:32:00.0509 7008        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
23:32:00.0510 7008        AppID - ok
23:32:00.0592 7008        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
23:32:00.0594 7008        arc - ok
23:32:00.0611 7008        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
23:32:00.0613 7008        arcsas - ok
23:32:00.0675 7008        asusgsb        (b6e6b264e9c4d0ad0e97af8434c8754d) C:\Windows\system32\drivers\asusgsb.sys
23:32:00.0676 7008        asusgsb - ok
23:32:00.0705 7008        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
23:32:00.0706 7008        AsyncMac - ok
23:32:00.0755 7008        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
23:32:00.0756 7008        atapi - ok
23:32:00.0934 7008        atikmdag        (b9290cf76263838ed609f3bdb6ad07ec) C:\Windows\system32\DRIVERS\atikmdag.sys
23:32:01.0049 7008        atikmdag - ok
23:32:01.0102 7008        atkdisplf      (409aafbd2642813f2c1bb446c816e354) C:\Windows\system32\drivers\ATKDispLowFilter.sys
23:32:01.0103 7008        atkdisplf - ok
23:32:01.0176 7008        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
23:32:01.0178 7008        avgntflt - ok
23:32:01.0199 7008        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
23:32:01.0202 7008        avipbb - ok
23:32:01.0272 7008        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\Windows\system32\drivers\avmeject.sys
23:32:01.0273 7008        avmeject - ok
23:32:01.0377 7008        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
23:32:01.0392 7008        b06bdrv - ok
23:32:01.0437 7008        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
23:32:01.0440 7008        b57nd60x - ok
23:32:01.0486 7008        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
23:32:01.0487 7008        Beep - ok
23:32:01.0524 7008        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
23:32:01.0525 7008        blbdrive - ok
23:32:01.0602 7008        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
23:32:01.0603 7008        bowser - ok
23:32:01.0622 7008        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
23:32:01.0622 7008        BrFiltLo - ok
23:32:01.0636 7008        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
23:32:01.0637 7008        BrFiltUp - ok
23:32:01.0691 7008        BridgeMP        (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys
23:32:01.0692 7008        BridgeMP - ok
23:32:01.0739 7008        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
23:32:01.0742 7008        Brserid - ok
23:32:01.0755 7008        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
23:32:01.0757 7008        BrSerWdm - ok
23:32:01.0816 7008        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
23:32:01.0816 7008        BrUsbMdm - ok
23:32:01.0846 7008        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
23:32:01.0863 7008        BrUsbSer - ok
23:32:01.0886 7008        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
23:32:01.0887 7008        BTHMODEM - ok
23:32:01.0976 7008        catchme - ok
23:32:02.0023 7008        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
23:32:02.0025 7008        cdfs - ok
23:32:02.0082 7008        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
23:32:02.0084 7008        cdrom - ok
23:32:02.0115 7008        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
23:32:02.0115 7008        circlass - ok
23:32:02.0147 7008        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
23:32:02.0150 7008        CLFS - ok
23:32:02.0184 7008        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
23:32:02.0185 7008        CmBatt - ok
23:32:02.0235 7008        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
23:32:02.0236 7008        cmdide - ok
23:32:02.0326 7008        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
23:32:02.0340 7008        CNG - ok
23:32:02.0379 7008        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
23:32:02.0380 7008        Compbatt - ok
23:32:02.0442 7008        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
23:32:02.0444 7008        CompositeBus - ok
23:32:02.0475 7008        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
23:32:02.0476 7008        crcdisk - ok
23:32:02.0560 7008        CSC            (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
23:32:02.0575 7008        CSC - ok
23:32:02.0661 7008        cvintdrv        (cab213d4681fcfac9bf4e6d3b1ee4bfc) C:\Windows\system32\drivers\cvintdrv.sys
23:32:02.0662 7008        cvintdrv - ok
23:32:02.0724 7008        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
23:32:02.0739 7008        CVirtA - ok
23:32:02.0819 7008        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
23:32:02.0820 7008        DfsC - ok
23:32:02.0921 7008        DgiVecp        (7f19dba1a467b838ccb23124a2c55568) C:\Windows\system32\Drivers\DgiVecp.sys
23:32:02.0922 7008        DgiVecp - ok
23:32:02.0995 7008        dg_ssudbus      (c9f9cafafbffaf7e380efc353ccc940c) C:\Windows\system32\DRIVERS\ssudbus.sys
23:32:02.0997 7008        dg_ssudbus - ok
23:32:03.0058 7008        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
23:32:03.0059 7008        discache - ok
23:32:03.0090 7008        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
23:32:03.0091 7008        Disk - ok
23:32:03.0152 7008        DNE            (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys
23:32:03.0154 7008        DNE - ok
23:32:03.0206 7008        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
23:32:03.0207 7008        drmkaud - ok
23:32:03.0263 7008        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
23:32:03.0287 7008        DXGKrnl - ok
23:32:03.0368 7008        e1express      (cf0a6015f437161698c5b2a0a12cf052) C:\Windows\system32\DRIVERS\e1e6032.sys
23:32:03.0370 7008        e1express - ok
23:32:03.0479 7008        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
23:32:03.0547 7008        ebdrv - ok
23:32:03.0633 7008        EIO            (42584ec72495f4da1704123a20ac1012) C:\Windows\system32\DRIVERS\EIO.sys
23:32:03.0634 7008        EIO - ok
23:32:03.0669 7008        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
23:32:03.0686 7008        elxstor - ok
23:32:03.0742 7008        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
23:32:03.0742 7008        ErrDev - ok
23:32:03.0771 7008        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
23:32:03.0773 7008        exfat - ok
23:32:03.0805 7008        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
23:32:03.0807 7008        fastfat - ok
23:32:03.0834 7008        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
23:32:03.0835 7008        fdc - ok
23:32:03.0857 7008        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
23:32:03.0859 7008        FileInfo - ok
23:32:03.0878 7008        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
23:32:03.0879 7008        Filetrace - ok
23:32:03.0959 7008        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
23:32:03.0960 7008        flpydisk - ok
23:32:03.0987 7008        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
23:32:03.0990 7008        FltMgr - ok
23:32:04.0016 7008        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
23:32:04.0017 7008        FsDepends - ok
23:32:04.0037 7008        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
23:32:04.0037 7008        Fs_Rec - ok
23:32:04.0094 7008        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
23:32:04.0097 7008        fvevol - ok
23:32:04.0156 7008        FWLANUSB        (ff12fa487265da2ac7de4be53f72ff1a) C:\Windows\system32\DRIVERS\fwlanusb.sys
23:32:04.0159 7008        FWLANUSB - ok
23:32:04.0239 7008        fwlanusbn      (34403847d2e224a96b94a123b9ae55a0) C:\Windows\system32\DRIVERS\fwlanusbn.sys
23:32:04.0256 7008        fwlanusbn - ok
23:32:04.0309 7008        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
23:32:04.0310 7008        gagp30kx - ok
23:32:04.0358 7008        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:32:04.0359 7008        GEARAspiWDM - ok
23:32:04.0417 7008        hamachi        (833051c6c6c42117191935f734cfbd97) C:\Windows\system32\DRIVERS\hamachi.sys
23:32:04.0418 7008        hamachi - ok
23:32:04.0479 7008        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
23:32:04.0480 7008        hcw85cir - ok
23:32:04.0551 7008        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
23:32:04.0558 7008        HdAudAddService - ok
23:32:04.0620 7008        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
23:32:04.0622 7008        HDAudBus - ok
23:32:04.0651 7008        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
23:32:04.0652 7008        HidBatt - ok
23:32:04.0681 7008        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
23:32:04.0682 7008        HidBth - ok
23:32:04.0700 7008        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
23:32:04.0701 7008        HidIr - ok
23:32:04.0780 7008        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\drivers\hidusb.sys
23:32:04.0781 7008        HidUsb - ok
23:32:04.0852 7008        hotcore3        (8be9369d385dc0fdf86a59f70d90ae79) C:\Windows\system32\DRIVERS\hotcore3.sys
23:32:04.0853 7008        hotcore3 - ok
23:32:04.0885 7008        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
23:32:04.0886 7008        HpSAMD - ok
23:32:04.0962 7008        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
23:32:04.0980 7008        HTTP - ok
23:32:05.0021 7008        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
23:32:05.0022 7008        hwpolicy - ok
23:32:05.0107 7008        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
23:32:05.0116 7008        i8042prt - ok
23:32:05.0156 7008        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
23:32:05.0171 7008        iaStorV - ok
23:32:05.0345 7008        igfx            (ad626f6964f4d364d226c39e06872dd3) C:\Windows\system32\DRIVERS\igdkmd32.sys
23:32:05.0448 7008        igfx - ok
23:32:05.0491 7008        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
23:32:05.0492 7008        iirsp - ok
23:32:05.0533 7008        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
23:32:05.0534 7008        intelide - ok
23:32:05.0569 7008        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
23:32:05.0570 7008        intelppm - ok
23:32:05.0599 7008        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:32:05.0601 7008        IpFilterDriver - ok
23:32:05.0696 7008        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
23:32:05.0697 7008        IPMIDRV - ok
23:32:05.0721 7008        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
23:32:05.0722 7008        IPNAT - ok
23:32:05.0820 7008        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
23:32:05.0820 7008        IRENUM - ok
23:32:05.0871 7008        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
23:32:05.0872 7008        isapnp - ok
23:32:05.0930 7008        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
23:32:05.0933 7008        iScsiPrt - ok
23:32:05.0979 7008        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
23:32:05.0980 7008        kbdclass - ok
23:32:06.0052 7008        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
23:32:06.0053 7008        kbdhid - ok
23:32:06.0115 7008        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
23:32:06.0116 7008        KSecDD - ok
23:32:06.0144 7008        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
23:32:06.0146 7008        KSecPkg - ok
23:32:06.0219 7008        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
23:32:06.0220 7008        lltdio - ok
23:32:06.0256 7008        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
23:32:06.0257 7008        LSI_FC - ok
23:32:06.0275 7008        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
23:32:06.0277 7008        LSI_SAS - ok
23:32:06.0299 7008        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
23:32:06.0300 7008        LSI_SAS2 - ok
23:32:06.0318 7008        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
23:32:06.0320 7008        LSI_SCSI - ok
23:32:06.0507 7008        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
23:32:06.0526 7008        luafv - ok
23:32:06.0745 7008        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
23:32:06.0946 7008        megasas - ok
23:32:07.0273 7008        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
23:32:07.0295 7008        MegaSR - ok
23:32:07.0436 7008        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
23:32:07.0437 7008        Modem - ok
23:32:07.0515 7008        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
23:32:07.0516 7008        monitor - ok
23:32:07.0577 7008        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
23:32:07.0578 7008        mouclass - ok
23:32:07.0617 7008        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
23:32:07.0618 7008        mouhid - ok
23:32:07.0689 7008        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
23:32:07.0691 7008        mountmgr - ok
23:32:07.0754 7008        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
23:32:07.0756 7008        mpio - ok
23:32:07.0985 7008        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
23:32:07.0987 7008        mpsdrv - ok
23:32:08.0053 7008        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
23:32:08.0055 7008        MRxDAV - ok
23:32:08.0100 7008        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:32:08.0102 7008        mrxsmb - ok
23:32:08.0140 7008        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:32:08.0143 7008        mrxsmb10 - ok
23:32:08.0196 7008        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:32:08.0198 7008        mrxsmb20 - ok
23:32:08.0229 7008        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
23:32:08.0230 7008        msahci - ok
23:32:08.0249 7008        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
23:32:08.0253 7008        msdsm - ok
23:32:08.0298 7008        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
23:32:08.0299 7008        Msfs - ok
23:32:08.0360 7008        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
23:32:08.0361 7008        mshidkmdf - ok
23:32:08.0409 7008        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
23:32:08.0410 7008        msisadrv - ok
23:32:08.0459 7008        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
23:32:08.0460 7008        MSKSSRV - ok
23:32:08.0482 7008        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
23:32:08.0483 7008        MSPCLOCK - ok
23:32:08.0503 7008        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
23:32:08.0504 7008        MSPQM - ok
23:32:08.0533 7008        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
23:32:08.0535 7008        MsRPC - ok
23:32:08.0597 7008        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
23:32:08.0598 7008        mssmbios - ok
23:32:08.0645 7008        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
23:32:08.0646 7008        MSTEE - ok
23:32:08.0671 7008        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
23:32:08.0672 7008        MTConfig - ok
23:32:08.0696 7008        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
23:32:08.0698 7008        Mup - ok
23:32:08.0753 7008        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
23:32:08.0776 7008        NativeWifiP - ok
23:32:08.0835 7008        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
23:32:08.0852 7008        NDIS - ok
23:32:08.0907 7008        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
23:32:08.0908 7008        NdisCap - ok
23:32:08.0949 7008        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
23:32:08.0950 7008        NdisTapi - ok
23:32:09.0008 7008        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
23:32:09.0009 7008        Ndisuio - ok
23:32:09.0059 7008        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
23:32:09.0061 7008        NdisWan - ok
23:32:09.0112 7008        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
23:32:09.0113 7008        NDProxy - ok
23:32:09.0227 7008        Netaapl        (1352e1648213551923a0a822e441553c) C:\Windows\system32\DRIVERS\netaapl.sys
23:32:09.0227 7008        Netaapl - ok
23:32:09.0252 7008        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
23:32:09.0253 7008        NetBIOS - ok
23:32:09.0308 7008        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
23:32:09.0311 7008        NetBT - ok
23:32:09.0384 7008        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
23:32:09.0385 7008        nfrd960 - ok
23:32:09.0469 7008        nipalfwedl      (198ca937f7b20bca38294922109ac8e4) C:\Windows\system32\drivers\nipalfwedl.sys
23:32:09.0470 7008        nipalfwedl - ok
23:32:09.0545 7008        NIPALK          (4413132b1f64efc9571fa47854f188d7) C:\Windows\system32\drivers\nipalk.sys
23:32:09.0562 7008        NIPALK - ok
23:32:09.0603 7008        nipalusbedl    (464baaaba44abe885df42e2394f2b4c5) C:\Windows\system32\drivers\nipalusbedl.sys
23:32:09.0604 7008        nipalusbedl - ok
23:32:09.0644 7008        nipbcfk        (96c846ab33c383583282b0375b34e9d2) C:\Windows\system32\drivers\nipbcfk.sys
23:32:09.0644 7008        nipbcfk - ok
23:32:09.0704 7008        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
23:32:09.0705 7008        Npfs - ok
23:32:09.0722 7008        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
23:32:09.0723 7008        nsiproxy - ok
23:32:09.0804 7008        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
23:32:09.0838 7008        Ntfs - ok
23:32:09.0905 7008        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
23:32:09.0905 7008        Null - ok
23:32:10.0149 7008        nvlddmkm        (b0881dda5a8160422561ffab7f0008b1) C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:32:10.0352 7008        nvlddmkm - ok
23:32:10.0421 7008        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
23:32:10.0423 7008        nvraid - ok
23:32:10.0492 7008        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
23:32:10.0494 7008        nvstor - ok
23:32:10.0519 7008        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
23:32:10.0521 7008        nv_agp - ok
23:32:10.0575 7008        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
23:32:10.0577 7008        ohci1394 - ok
23:32:10.0670 7008        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
23:32:10.0672 7008        Parport - ok
23:32:10.0726 7008        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
23:32:10.0728 7008        partmgr - ok
23:32:10.0800 7008        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
23:32:10.0800 7008        Parvdm - ok
23:32:10.0830 7008        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
23:32:10.0832 7008        pci - ok
23:32:10.0863 7008        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
23:32:10.0864 7008        pciide - ok
23:32:10.0892 7008        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
23:32:10.0894 7008        pcmcia - ok
23:32:10.0921 7008        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
23:32:10.0923 7008        pcw - ok
23:32:10.0955 7008        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
23:32:11.0005 7008        PEAUTH - ok
23:32:11.0358 7008        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
23:32:11.0371 7008        PptpMiniport - ok
23:32:11.0708 7008        PrecSim        (c3127bfdab6200769b5a0184fab48573) C:\Windows\system32\DRIVERS\precsim.sys
23:32:11.0748 7008        PrecSim - ok
23:32:11.0960 7008        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
23:32:11.0976 7008        Processor - ok
23:32:12.0071 7008        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
23:32:12.0073 7008        Psched - ok
23:32:12.0229 7008        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
23:32:12.0257 7008        ql2300 - ok
23:32:12.0456 7008        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
23:32:12.0473 7008        ql40xx - ok
23:32:12.0688 7008        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
23:32:12.0707 7008        QWAVEdrv - ok
23:32:12.0799 7008        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
23:32:12.0799 7008        RasAcd - ok
23:32:12.0857 7008        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
23:32:12.0872 7008        RasAgileVpn - ok
23:32:12.0916 7008        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:32:12.0917 7008        Rasl2tp - ok
23:32:12.0953 7008        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
23:32:12.0955 7008        RasPppoe - ok
23:32:12.0982 7008        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
23:32:12.0984 7008        RasSstp - ok
23:32:13.0063 7008        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
23:32:13.0077 7008        rdbss - ok
23:32:13.0134 7008        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
23:32:13.0135 7008        rdpbus - ok
23:32:13.0220 7008        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:32:13.0221 7008        RDPCDD - ok
23:32:13.0288 7008        RDPDR          (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
23:32:13.0290 7008        RDPDR - ok
23:32:13.0378 7008        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
23:32:13.0398 7008        RDPENCDD - ok
23:32:14.0014 7008        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
23:32:14.0042 7008        RDPREFMP - ok
23:32:14.0755 7008        RDPWD          (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys
23:32:14.0857 7008        RDPWD - ok
23:32:15.0609 7008        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
23:32:15.0645 7008        rdyboost - ok
23:32:15.0992 7008        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
23:32:16.0016 7008        rspndr - ok
23:32:16.0317 7008        s3cap          (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
23:32:16.0334 7008        s3cap - ok
23:32:16.0561 7008        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
23:32:16.0583 7008        sbp2port - ok
23:32:17.0081 7008        SCDEmu          (9feb2026a460916d1a1198b460632630) C:\Windows\system32\drivers\SCDEmu.sys
23:32:17.0103 7008        SCDEmu - ok
23:32:17.0503 7008        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
23:32:17.0535 7008        scfilter - ok
23:32:17.0821 7008        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
23:32:17.0842 7008        secdrv - ok
23:32:18.0030 7008        Ser2pl          (c3179f6f180a435dfc485fdeaef12af6) C:\Windows\system32\DRIVERS\ser2pl.sys
23:32:18.0052 7008        Ser2pl - ok
23:32:18.0335 7008        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
23:32:18.0350 7008        Serenum - ok
23:32:18.0573 7008        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
23:32:18.0592 7008        Serial - ok
23:32:18.0662 7008        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
23:32:18.0663 7008        sermouse - ok
23:32:18.0728 7008        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
23:32:18.0729 7008        sffdisk - ok
23:32:18.0747 7008        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
23:32:18.0747 7008        sffp_mmc - ok
23:32:18.0800 7008        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
23:32:18.0800 7008        sffp_sd - ok
23:32:18.0833 7008        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
23:32:18.0834 7008        sfloppy - ok
23:32:18.0902 7008        silabenm        (c16173316918a1360dc22947c4ff6352) C:\Windows\system32\DRIVERS\silabenm.sys
23:32:18.0903 7008        silabenm - ok
23:32:18.0947 7008        silabser        (182f483ec274015d2b2110eda84e59d0) C:\Windows\system32\DRIVERS\silabser.sys
23:32:18.0949 7008        silabser - ok
23:32:19.0111 7008        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
23:32:19.0112 7008        sisagp - ok
23:32:19.0145 7008        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
23:32:19.0146 7008        SiSRaid2 - ok
23:32:19.0165 7008        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
23:32:19.0167 7008        SiSRaid4 - ok
23:32:19.0203 7008        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
23:32:19.0205 7008        Smb - ok
23:32:19.0251 7008        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
23:32:19.0252 7008        spldr - ok
23:32:19.0352 7008        sptd            (a80cd850d69d996c832bea37e3a6aa1e) C:\Windows\system32\Drivers\sptd.sys
23:32:19.0352 7008        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: a80cd850d69d996c832bea37e3a6aa1e
23:32:19.0354 7008        sptd ( LockedFile.Multi.Generic ) - warning
23:32:19.0354 7008        sptd - detected LockedFile.Multi.Generic (1)
23:32:19.0402 7008        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
23:32:19.0408 7008        srv - ok
23:32:19.0477 7008        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
23:32:19.0499 7008        srv2 - ok
23:32:19.0553 7008        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
23:32:19.0555 7008        srvnet - ok
23:32:19.0622 7008        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
23:32:19.0623 7008        ssmdrv - ok
23:32:19.0785 7008        SSPORT          (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys
23:32:19.0786 7008        SSPORT - ok
23:32:19.0944 7008        ssudmdm        (91970cc4a3a30a01c1573184a62f5143) C:\Windows\system32\DRIVERS\ssudmdm.sys
23:32:19.0947 7008        ssudmdm - ok
23:32:20.0098 7008        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
23:32:20.0099 7008        stexstor - ok
23:32:20.0207 7008        storflt        (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
23:32:20.0222 7008        storflt - ok
23:32:20.0622 7008        storvsc        (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
23:32:20.0641 7008        storvsc - ok
23:32:20.0733 7008        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
23:32:20.0763 7008        swenum - ok
23:32:20.0862 7008        Tcpip          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
23:32:20.0896 7008        Tcpip - ok
23:32:20.0983 7008        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
23:32:20.0989 7008        TCPIP6 - ok
23:32:21.0054 7008        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
23:32:21.0055 7008        tcpipreg - ok
23:32:21.0109 7008        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
23:32:21.0110 7008        TDPIPE - ok
23:32:21.0146 7008        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
23:32:21.0147 7008        TDTCP - ok
23:32:21.0205 7008        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
23:32:21.0206 7008        tdx - ok
23:32:21.0286 7008        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
23:32:21.0287 7008        TermDD - ok
23:32:21.0383 7008        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:32:21.0384 7008        tssecsrv - ok
23:32:21.0481 7008        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
23:32:21.0483 7008        TsUsbFlt - ok
23:32:21.0564 7008        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
23:32:21.0581 7008        tunnel - ok
23:32:21.0799 7008        TVicPort        (97dd70feca64fb4f63de7bb7e66a80b1) C:\Windows\system32\DRIVERS\TVICPORT.SYS
23:32:21.0865 7008        TVicPort - ok
23:32:22.0206 7008        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
23:32:22.0207 7008        uagp35 - ok
23:32:22.0255 7008        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
23:32:22.0259 7008        udfs - ok
23:32:22.0436 7008        UimBus          (16264d4a7f052a7cc516b23e00b14213) C:\Windows\system32\DRIVERS\UimBus.sys
23:32:22.0451 7008        UimBus - ok
23:32:22.0657 7008        Uim_IM          (811e4296913821ce402b9e6629740350) C:\Windows\system32\Drivers\Uim_IM.sys
23:32:22.0663 7008        Uim_IM - ok
23:32:22.0726 7008        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
23:32:22.0727 7008        uliagpkx - ok
23:32:22.0818 7008        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
23:32:22.0837 7008        umbus - ok
23:32:22.0866 7008        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
23:32:22.0867 7008        UmPass - ok
23:32:22.0914 7008        USBAAPL        (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
23:32:22.0915 7008        USBAAPL - ok
23:32:22.0977 7008        usbaudio        (1d9f2bd026e8e2d45033a4df3f16b78c) C:\Windows\system32\drivers\usbaudio.sys
23:32:22.0979 7008        usbaudio - ok
23:32:23.0016 7008        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
23:32:23.0026 7008        usbccgp - ok
23:32:23.0236 7008        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
23:32:23.0244 7008        usbcir - ok
23:32:23.0422 7008        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
23:32:23.0452 7008        usbehci - ok
23:32:23.0789 7008        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
23:32:23.0807 7008        usbhub - ok
23:32:23.0897 7008        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
23:32:23.0898 7008        usbohci - ok
23:32:23.0947 7008        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
23:32:23.0947 7008        usbprint - ok
23:32:23.0989 7008        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\Windows\system32\drivers\USBSTOR.SYS
23:32:23.0990 7008        USBSTOR - ok
23:32:24.0048 7008        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys
23:32:24.0049 7008        usbuhci - ok
23:32:24.0124 7008        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\System32\Drivers\usbvideo.sys
23:32:24.0126 7008        usbvideo - ok
23:32:24.0196 7008        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
23:32:24.0198 7008        vdrvroot - ok
23:32:24.0263 7008        vflt            (b149fc750a51d272a25e0adc7f52dbfd) C:\Windows\system32\DRIVERS\vfilter.sys
23:32:24.0264 7008        vflt - ok
23:32:24.0301 7008        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
23:32:24.0302 7008        vga - ok
23:32:24.0326 7008        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
23:32:24.0327 7008        VgaSave - ok
23:32:24.0380 7008        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
23:32:24.0383 7008        vhdmp - ok
23:32:24.0420 7008        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
23:32:24.0422 7008        viaagp - ok
23:32:24.0486 7008        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
23:32:24.0488 7008        ViaC7 - ok
23:32:24.0517 7008        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
23:32:24.0519 7008        viaide - ok
23:32:24.0561 7008        vmbus          (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
23:32:24.0564 7008        vmbus - ok
23:32:24.0602 7008        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
23:32:24.0603 7008        VMBusHID - ok
23:32:24.0686 7008        vnet            (1b13a6a5253e7f046728980ccb59c0b7) C:\Windows\system32\DRIVERS\virtualnet.sys
23:32:24.0687 7008        vnet - ok
23:32:24.0738 7008        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
23:32:24.0739 7008        volmgr - ok
23:32:24.0790 7008        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
23:32:24.0796 7008        volmgrx - ok
23:32:24.0859 7008        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
23:32:24.0862 7008        volsnap - ok
23:32:24.0950 7008        vpnva          (1b7c80c66742dafaa31f98af4c3a5bc2) C:\Windows\system32\DRIVERS\vpnva.sys
23:32:24.0951 7008        vpnva - ok
23:32:25.0014 7008        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
23:32:25.0016 7008        vsmraid - ok
23:32:25.0203 7008        VSPerfDrv100    (5a2ddc5411a092bedb1a07755e087784) C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys
23:32:25.0205 7008        VSPerfDrv100 - ok
23:32:25.0272 7008        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
23:32:25.0273 7008        vwifibus - ok
23:32:25.0364 7008        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
23:32:25.0365 7008        WacomPen - ok
23:32:25.0435 7008        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
23:32:25.0437 7008        WANARP - ok
23:32:25.0442 7008        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
23:32:25.0443 7008        Wanarpv6 - ok
23:32:25.0480 7008        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
23:32:25.0481 7008        Wd - ok
23:32:25.0531 7008        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
23:32:25.0547 7008        Wdf01000 - ok
23:32:25.0663 7008        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
23:32:25.0664 7008        WfpLwf - ok
23:32:25.0677 7008        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
23:32:25.0678 7008        WIMMount - ok
23:32:25.0775 7008        WinDriver6      (0a597f84bc8af4229b529f655bb2ba14) C:\Windows\system32\drivers\windrvr6.sys
23:32:25.0778 7008        WinDriver6 - ok
23:32:25.0880 7008        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\drivers\WinUsb.sys
23:32:25.0881 7008        WinUsb - ok
23:32:25.0896 7008        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
23:32:25.0897 7008        WmiAcpi - ok
23:32:25.0932 7008        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
23:32:25.0933 7008        ws2ifsl - ok
23:32:26.0010 7008        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
23:32:26.0011 7008        WudfPf - ok
23:32:26.0071 7008        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\drivers\WUDFRd.sys
23:32:26.0073 7008        WUDFRd - ok
23:32:26.0125 7008        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
23:32:26.0188 7008        \Device\Harddisk0\DR0 - ok
23:32:26.0217 7008        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk1\DR1
23:32:26.0219 7008        \Device\Harddisk1\DR1 - ok
23:32:26.0238 7008        Boot (0x1200)  (958f049b4fc9865f18340fe04b262f8d) \Device\Harddisk0\DR0\Partition0
23:32:26.0238 7008        \Device\Harddisk0\DR0\Partition0 - ok
23:32:26.0241 7008        Boot (0x1200)  (1773edc80c05221eab85cb73e9530c54) \Device\Harddisk0\DR0\Partition1
23:32:26.0241 7008        \Device\Harddisk0\DR0\Partition1 - ok
23:32:26.0249 7008        Boot (0x1200)  (5158e063f8c8cf3a77efa0a854813797) \Device\Harddisk1\DR1\Partition0
23:32:26.0250 7008        \Device\Harddisk1\DR1\Partition0 - ok
23:32:26.0254 7008        ============================================================
23:32:26.0254 7008        Scan finished
23:32:26.0254 7008        ============================================================
23:32:26.0264 9368        Detected object count: 1
23:32:26.0264 9368        Actual detected object count: 1
23:33:05.0712 9368        sptd ( LockedFile.Multi.Generic ) - skipped by user
23:33:05.0712 9368        sptd ( LockedFile.Multi.Generic ) - User select action: Skip
23:33:43.0564 8020        Deinitialize success


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:12 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129