Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Maleware gefunden was tun? (https://www.trojaner-board.de/113894-maleware-gefunden-tun.html)

j_wolfgang 20.04.2012 12:07
Maleware gefunden was tun?
 
Hallo zusammen,
das Malwarebytes Anti-Malware hat bei mir eben angeschlagen und 2 identifizierte Bateien auf meiner externen Festplatte entdeckt und "gelöscht und in Quarantäne verschoben.
Hier die Logfile:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.20.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Jörg :: AMILO [Administrator]

20.04.2012 10:12:03
mbam-log-2012-04-20 (10-12-03).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 304576
Laufzeit: 1 Stunde(n), 39 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
E:\DmailerSync_9_1_18359.exe (Malware.Packer.as) -> Erfolgreich gelöscht und in Quarantäne gestellt.
E:\Recycled\De1.exe (Malware.Packer.as) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


Was muss ich tun oder ist hiermit schon alles getan?
Vielen DAnk schon mal.
GRuß Jörg

cosinus 20.04.2012 14:08
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

j_wolfgang 20.04.2012 14:16
das waren leider alle, da ich das Program eben erst installiert habe!

cosinus 20.04.2012 14:24
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


j_wolfgang 20.04.2012 18:43
da ist das ding:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=55ea8b3d59035641b6ed8400bde28f3b
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-20 04:34:08
# local_time=2012-04-20 06:34:08 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 180693 180693 0 0
# compatibility_mode=1792 16777191 100 0 16151718 16151718 0 0
# compatibility_mode=8192 67108863 100 0 187 187 0 0
# scanned=102079
# found=2
# cleaned=0
# scan_time=8598
C:\Dokumente und Einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\Cache\F\EF\CA790d01 HTML/ScrInject.B.Gen virus (unable to clean) 00000000000000000000000000000000 I
E:\System Volume Information\_restore{F7CB9B9C-8254-491D-8076-EC108F3167B0}\RP13\A0001203.exe probably a variant of Win32/Adware.NaviPromo application (unable to clean) 00000000000000000000000000000000 I


was nun...

cosinus 20.04.2012 20:41
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

j_wolfgang 20.04.2012 20:56
1.funktioniert alles
2.soweit nichts aufälliges

wieso stimmt was nicht?

cosinus 20.04.2012 21:03
Ist nur zur Sicherheit, damit wir nicht was löschen, was wir noch evtl. brauchen könnten

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

j_wolfgang 20.04.2012 21:41
und weiter
OTL Logfile:
Code:
OTL logfile created on: 20.04.2012 22:26:54 - Run 1
OTL by OldTimer - Version 3.2.40.0    Folder = C:\Dokumente und Einstellungen\Jörg\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,36 Mb Total Physical Memory | 577,30 Mb Available Physical Memory | 56,41% Memory free
2,40 Gb Paging File | 1,75 Gb Available in Paging File | 72,77% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 34,42 Gb Free Space | 46,18% Space Free | Partition Type: NTFS
Drive E: | 149,01 Gb Total Space | 76,57 Gb Free Space | 51,39% Space Free | Partition Type: FAT32
 
Computer Name: AMILO | User Name: Jörg | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.04.20 22:25:19 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jörg\Eigene Dateien\Downloads\OTL.exe
PRC - [2012.03.22 16:06:22 | 000,018,888 | ---- | M] () -- c:\Programme\Ocster Backup\bin\backupService-ox.exe
PRC - [2012.03.21 20:53:46 | 000,030,720 | ---- | M] () -- c:\Programme\Ocster Backup\bin\oxHelper.exe
PRC - [2011.12.13 17:24:19 | 000,079,872 | ---- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk\Sansa Updater\SansaDispatch.exe
PRC - [2011.10.11 15:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.08.05 13:01:04 | 000,220,552 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005.05.26 18:12:26 | 000,544,768 | ---- | M] (Motorola Inc.) -- C:\WINDOWS\sm56hlpr.exe
PRC - [2005.03.18 15:35:46 | 000,098,393 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe
PRC - [2005.03.10 09:46:18 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SoundMan.exe
PRC - [2005.02.25 14:26:06 | 000,589,824 | ---- | M] (VIA Technologies) -- C:\Programme\VIA\RAID\raid_tool.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2011.10.11 14:59:51 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2008.09.16 21:18:06 | 000,132,608 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2005.05.26 18:12:26 | 000,065,536 | ---- | M] () -- C:\WINDOWS\sm56spn.dll
MOD - [2005.05.26 18:12:26 | 000,065,536 | ---- | M] () -- C:\WINDOWS\sm56itl.dll
MOD - [2005.05.26 18:12:26 | 000,065,536 | ---- | M] () -- C:\WINDOWS\sm56ger.dll
MOD - [2005.05.26 18:12:26 | 000,065,536 | ---- | M] () -- C:\WINDOWS\sm56fra.dll
MOD - [2005.05.26 18:12:26 | 000,065,536 | ---- | M] () -- C:\WINDOWS\sm56eng.dll
MOD - [2005.05.26 18:12:26 | 000,065,536 | ---- | M] () -- C:\WINDOWS\sm56brz.dll
MOD - [2005.05.26 18:12:26 | 000,049,152 | ---- | M] () -- C:\WINDOWS\sm56jpn.dll
MOD - [2005.05.26 18:12:26 | 000,045,056 | ---- | M] () -- C:\WINDOWS\sm56cht.dll
MOD - [2005.05.26 18:12:26 | 000,045,056 | ---- | M] () -- C:\WINDOWS\sm56chs.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Programme\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.04.20 09:51:24 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.03.22 16:06:22 | 000,018,888 | ---- | M] () [Auto | Running] -- c:\Programme\Ocster Backup\bin\backupService-ox.exe -- (ocster_backup)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.09.29 18:47:00 | 004,032,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\system32\GameMon.des -- (npggsvc)
SRV - [2010.06.14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tsmpkt.sys -- (TSMPacket)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.02.15 22:54:07 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.05.16 13:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM)
DRV - [2008.05.16 13:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS)
DRV - [2008.05.16 13:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV - [2008.05.16 13:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016mdm.sys -- (s0016mdm)
DRV - [2008.05.16 13:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM)
DRV - [2008.05.16 13:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016obex.sys -- (s0016obex)
DRV - [2008.05.16 13:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM)
DRV - [2005.05.26 18:19:18 | 000,839,724 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2005.03.23 16:08:52 | 002,547,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004.12.02 17:36:08 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004.10.29 18:48:10 | 003,222,784 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2004.10.27 15:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-57989841-527237240-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-57989841-527237240-839522115-1005\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-57989841-527237240-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://startsear.ch/?q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.10.24 21:21:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.03.26 20:21:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.12 18:05:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.10.24 21:21:43 | 000,000,000 | ---D | M]
 
[2008.09.15 18:35:52 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Extensions
[2012.04.20 13:00:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions
[2010.04.28 16:15:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.04.20 13:00:10 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011.04.15 19:17:48 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com
[2012.04.20 13:00:16 | 000,002,112 | ---- | M] () -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\searchplugins\wot-safe-search.xml
[2012.03.26 20:21:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\JöRG\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\I7FUPZ0L.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}
[2012.03.26 20:21:12 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.03.11 14:04:53 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.09.15 12:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npsnapfish.dll
[2011.10.04 11:33:11 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.04 11:33:11 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.10.04 11:33:11 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.04 11:33:11 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.04 11:33:11 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.04 11:33:11 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&output=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKU\S-1-5-21-57989841-527237240-839522115-1005\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [Ocster Backup] C:\Programme\Ocster Backup\bin\backupClient-ox.exe ()
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [RaidTool] C:\Programme\VIA\RAID\raid_tool.exe (VIA Technologies)
O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre6\bin\jusched.exe File not found
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: []  File not found
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: [Device Detection] C:\Programme\Lidl_Fotos\dd.exe File not found
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: [EPSON SX100 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: [SansaDispatch] C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk\Sansa Updater\SansaDispatch.exe (SanDisk Corporation)
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-57989841-527237240-839522115-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-57989841-527237240-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_31.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B161906-D798-44B2-8F28-EED0F4AA6AE5}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.09.15 17:56:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.09.15 06:09:36 | 000,000,000 | ---D | M] - E:\autorun -- [ FAT32 ]
O32 - AutoRun File - [2012.04.20 13:40:38 | 000,000,000 | -H-- | M] () - E:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{3256c7d6-a9d7-11dd-b7dc-0015000089b2}\Shell\AutoRun\command - "" = Menu.exe
O33 - MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\Shell - "" = AutoRun
O33 - MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: NokiaMServer - hkey= - key= - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm -  File not found
SafeBootNet: nm.sys -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\LameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.20 16:07:46 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.04.20 14:25:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Ocster Backup
[2012.04.20 14:25:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Ocster Backup
[2012.04.20 14:25:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ocster Backup
[2012.04.20 14:24:56 | 000,000,000 | ---D | C] -- C:\Programme\Ocster Backup
[2012.04.20 14:10:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Download Manager
[2012.04.20 13:40:20 | 000,000,000 | ---D | C] -- C:\Programme\Western Digital Technologies
[2012.04.20 13:40:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jörg\Startmenü\Programme\WD Diagnostics
[2012.04.20 10:05:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.04.20 10:05:27 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.04.20 10:05:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.04.19 10:20:01 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jörg\Desktop\TFC.exe
[2012.04.18 14:35:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2012.04.18 13:59:20 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2012.04.17 19:23:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2012.04.12 19:22:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jörg\restore
[2012.04.12 18:59:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012.04.12 18:59:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps
[2012.04.12 18:53:38 | 000,000,000 | ---D | C] -- C:\Programme\CEWE COLOR
[2012.04.12 18:42:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Lidl_Fotos
[2012.03.28 20:22:02 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype
[2012.03.28 20:22:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype
[1 C:\Programme\*.tmp files -> C:\Programme\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Jörg\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Jörg\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.20 22:10:00 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.04.20 21:51:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.04.20 19:10:01 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.04.20 14:25:38 | 000,000,784 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ocster Backup Freeware Windows Edition.lnk
[2012.04.20 14:11:01 | 003,884,178 | ---- | M] () -- C:\Dokumente und Einstellungen\Jörg\Desktop\WDSync_7.0.328.zip
[2012.04.20 12:33:00 | 000,022,051 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.04.20 12:32:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.04.20 10:10:57 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.20 09:54:45 | 000,202,528 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.04.19 10:20:02 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jörg\Desktop\TFC.exe
[2012.04.18 14:29:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.04.18 14:20:34 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Jörg\defogger_reenable
[2012.04.13 08:47:38 | 000,503,322 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.04.13 08:47:38 | 000,481,988 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.04.13 08:47:38 | 000,095,598 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.04.13 08:47:38 | 000,080,062 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.04.11 15:53:49 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[1 C:\Programme\*.tmp files -> C:\Programme\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Jörg\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Jörg\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.20 14:25:38 | 000,000,784 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ocster Backup Freeware Windows Edition.lnk
[2012.04.20 14:10:55 | 003,884,178 | ---- | C] () -- C:\Dokumente und Einstellungen\Jörg\Desktop\WDSync_7.0.328.zip
[2012.04.20 10:10:57 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.20 09:46:16 | 000,000,884 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.04.18 14:20:34 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Jörg\defogger_reenable
[2012.02.15 22:57:53 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.06 20:39:50 | 000,000,058 | ---- | C] () -- C:\WINDOWS\ScrAntic.ini
[2011.12.02 21:12:09 | 000,646,150 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-57989841-527237240-839522115-1005-0.dat
[2010.12.09 14:00:42 | 000,221,022 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.12.01 16:24:29 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.06.18 20:06:53 | 018,499,623 | ---- | C] () -- C:\Programme\vlc-1.0.5-win32.exe
 
========== LOP Check ==========
 
[2012.02.06 20:58:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2010.03.29 18:28:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2008.11.22 19:21:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010.03.23 15:41:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010.10.24 21:02:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012.04.20 14:25:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ocster Backup
[2010.03.23 15:26:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OviInstallerCache
[2010.03.23 15:39:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011.06.04 15:22:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2012.04.19 13:03:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2010.03.29 18:43:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2011.12.02 20:13:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Ashampoo
[2012.02.06 20:58:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Babylon
[2012.04.02 18:26:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Dropbox
[2012.01.24 14:27:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.09.30 14:01:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\EPSON
[2010.08.23 15:01:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\FUJIFILM
[2010.03.23 15:43:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Nokia
[2010.03.23 15:43:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Nokia Ovi Suite
[2008.09.16 17:24:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\OpenOffice.org
[2010.03.23 15:41:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\PC Suite
[2010.03.23 16:21:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\PersBackup5
[2010.11.23 22:31:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\PriceGong
[2012.03.07 21:01:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Samsung
[2008.12.10 16:25:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk
[2011.06.04 15:22:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\T-DSL SpeedManager
[2012.02.06 21:04:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Teleca
[2008.12.02 10:47:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Template
[2011.12.02 16:58:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\ZumoDrive
[2012.03.05 18:08:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Samsung
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.04.05 07:21:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Adobe
[2011.12.02 20:13:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Ashampoo
[2011.10.16 17:36:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Avira
[2012.02.06 20:58:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Babylon
[2010.05.07 09:09:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\DivX
[2012.04.20 14:11:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Download Manager
[2012.04.02 18:26:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Dropbox
[2012.01.13 19:55:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\dvdcss
[2012.01.24 14:27:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.09.30 14:01:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\EPSON
[2010.08.23 15:01:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\FUJIFILM
[2008.12.10 17:21:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Google
[2010.10.15 10:13:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Help
[2008.09.15 18:04:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Identities
[2008.09.22 22:57:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\InstallShield
[2008.09.15 18:27:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Macromedia
[2011.08.20 13:50:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Malwarebytes
[2012.04.20 13:40:21 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Microsoft
[2008.09.15 18:35:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla
[2010.03.23 15:43:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Nokia
[2010.03.23 15:43:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Nokia Ovi Suite
[2008.09.16 17:24:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\OpenOffice.org
[2010.03.23 15:41:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\PC Suite
[2010.03.23 16:21:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\PersBackup5
[2010.11.23 22:31:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\PriceGong
[2009.09.30 14:04:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Real
[2012.03.07 21:01:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Samsung
[2008.12.10 16:25:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk
[2012.04.19 17:01:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Skype
[2011.06.30 22:50:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\skypePM
[2012.01.24 13:59:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Sony Ericsson
[2008.11.22 23:01:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Sun
[2011.06.04 15:22:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\T-DSL SpeedManager
[2012.02.06 21:04:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Teleca
[2008.12.02 10:47:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Template
[2008.10.26 18:21:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\vlc
[2008.11.23 16:16:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Winamp
[2008.10.28 20:47:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\WinRAR
[2011.12.02 16:58:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\ZumoDrive
 
< %APPDATA%\*.exe /s >
[2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Dropbox\bin\Dropbox.exe
[2012.02.15 01:03:22 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Dropbox\bin\Uninstall.exe
[2012.04.20 13:40:21 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\ARPPRODUCTICON.exe
[2012.04.20 13:40:21 | 000,008,854 | R--- | M] () -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\Uninstall_WD_Diagnos_0AB76F69E7614CFAB9B0A1906B4E9E4B.exe
[2012.04.20 13:40:21 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\WinDlg.exe_0AB76F69E7614CFAB9B0A1906B4E9E4B_3.exe
[2010.09.08 12:00:03 | 072,940,376 | ---- | M] () -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
[2011.12.13 17:24:19 | 000,079,872 | ---- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk\Sansa Updater\SansaDispatch.exe
[2009.05.21 19:44:14 | 000,541,696 | ---- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk\Sansa Updater\SansaUpdater.exe
[2008.12.10 16:25:19 | 000,349,184 | ---- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\SanDisk\Sansa Updater\SansaUpdaterInstall.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.09.16 13:47:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.09.16 13:47:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.09.16 13:47:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.09.16 13:47:48 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004.08.04 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2004.09.26 15:24:54 | 000,477,952 | ---- | M] (Intel Corporation) MD5=DD19FDD8BB262F64A11C50CC23FC6F70 -- C:\WINDOWS\OEM\iaStor\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: NVATABUS.SYS  >
[2004.09.02 09:24:38 | 000,082,816 | ---- | M] (NVIDIA Corporation) MD5=EEABD98AA887DD923546F20D400B2907 -- C:\WINDOWS\OEM\nvatabus\nvatabus.sys
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004.08.04 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2005.04.08 11:43:26 | 000,060,928 | ---- | M] (VIA Technologies inc,.ltd) MD5=0363E216E4EB5052969C96608934DBDE -- C:\WINDOWS\system32\drivers\viamraid.sys
[2004.05.18 15:55:26 | 000,074,112 | ---- | M] (VIA Technologies inc,.ltd) MD5=F199939205DCCC7836AE5AB8B5DD5E83 -- C:\WINDOWS\OEM\viapdsk\viamraid.sys
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.09.16 19:45:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2008.09.16 19:45:06 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2008.09.16 19:45:06 | 000,425,984 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

cosinus 20.04.2012 23:35
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-57989841-527237240-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKU\S-1-5-21-57989841-527237240-839522115-1005\..\URLSearchHook:  - No CLSID value found
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "http://startsear.ch/?q="
[2010.04.28 16:15:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.15 19:17:48 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com
O3 - HKU\S-1-5-21-57989841-527237240-839522115-1005\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre6\bin\jusched.exe File not found
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: []  File not found
O4 - HKU\S-1-5-21-57989841-527237240-839522115-1005..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.09.15 17:56:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.09.15 06:09:36 | 000,000,000 | ---D | M] - E:\autorun -- [ FAT32 ]
O32 - AutoRun File - [2012.04.20 13:40:38 | 000,000,000 | -H-- | M] () - E:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{3256c7d6-a9d7-11dd-b7dc-0015000089b2}\Shell\AutoRun\command - "" = Menu.exe
O33 - MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\Shell - "" = AutoRun
O33 - MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
[2012.04.12 18:59:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012.04.12 18:59:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps
[2012.02.06 20:58:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012.02.06 20:58:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Babylon
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

j_wolfgang 21.04.2012 12:11
Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-57989841-527237240-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-57989841-527237240-839522115-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
Prefs.js: "hxxp://startsear.ch/?q=" removed from keyword.URL
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\extensions\engine@conduit.com folder moved successfully.
Registry value HKEY_USERS\S-1-5-21-57989841-527237240-839522115-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry value HKEY_USERS\S-1-5-21-57989841-527237240-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-57989841-527237240-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
File  not found.
E:\autorun.inf moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3256c7d6-a9d7-11dd-b7dc-0015000089b2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3256c7d6-a9d7-11dd-b7dc-0015000089b2}\ not found.
File Menu.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8250b6db-87eb-11dd-b7b4-0015000089b2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8250b6db-87eb-11dd-b7b4-0015000089b2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8250b6db-87eb-11dd-b7b4-0015000089b2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8250b6db-87eb-11dd-b7b4-0015000089b2}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe not found.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp\hps12352741_1652_SafeRegion1 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp\hps12352741_1652_SafeRegion folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps\16523\photofun\styles folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps\16523\photofun\fonts folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps\16523\photofun folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps\16523\04.08.03\resources folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps\16523\04.08.03 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps\16523 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\Jörg\Anwendungsdaten\Babylon folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Jörg
 
User: Jörg
->Temp folder emptied: 15670424 bytes
->Temporary Internet Files folder emptied: 4700647 bytes
->Java cache emptied: 359523 bytes
->FireFox cache emptied: 64562389 bytes
->Flash cache emptied: 5099 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: _ocster_backup_
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 127877335 bytes
 
Total Files Cleaned = 203,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default User
 
User: Jörg
 
User: Jörg
->Flash cache emptied: 0 bytes
 
User: LocalService
 
User: NetworkService
 
User: _ocster_backup_
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.40.0 log created on 04212012_125832

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 21.04.2012 16:57
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

j_wolfgang 22.04.2012 10:54
Code:
11:51:10.0281 1148        TDSS rootkit removing tool 2.7.31.0 Apr 20 2012 19:49:47
11:51:10.0343 1148        ============================================================
11:51:10.0343 1148        Current date / time: 2012/04/22 11:51:10.0343
11:51:10.0343 1148        SystemInfo:
11:51:10.0343 1148       
11:51:10.0343 1148        OS Version: 5.1.2600 ServicePack: 3.0
11:51:10.0343 1148        Product type: Workstation
11:51:10.0343 1148        ComputerName: AMILO
11:51:10.0343 1148        UserName: Jörg
11:51:10.0343 1148        Windows directory: C:\WINDOWS
11:51:10.0343 1148        System windows directory: C:\WINDOWS
11:51:10.0343 1148        Processor architecture: Intel x86
11:51:10.0343 1148        Number of processors: 1
11:51:10.0343 1148        Page size: 0x1000
11:51:10.0343 1148        Boot type: Normal boot
11:51:10.0343 1148        ============================================================
11:51:11.0734 1148        Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000058
11:51:11.0734 1148        Drive \Device\Harddisk1\DR2 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
11:51:11.0734 1148        \Device\Harddisk0\DR0:
11:51:11.0734 1148        MBR partitions:
11:51:11.0734 1148        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1
11:51:11.0734 1148        \Device\Harddisk1\DR2:
11:51:11.0734 1148        MBR partitions:
11:51:11.0734 1148        \Device\Harddisk1\DR2\Partition0: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0x12A18A82
11:51:11.0734 1148        C: <-> \Device\Harddisk0\DR0\Partition0
11:51:11.0734 1148        E: <-> \Device\Harddisk1\DR2\Partition0
11:51:11.0734 1148        Initialize success
11:51:11.0734 1148        ============================================================
11:51:22.0859 3300        ============================================================
11:51:22.0859 3300        Scan started
11:51:22.0859 3300        Mode: Manual; SigCheck; TDLFS;
11:51:22.0859 3300        ============================================================
11:51:23.0218 3300        6to4            (d5a6658cbfbbf9a0f8827e83c9fde806) C:\WINDOWS\System32\6to4svc.dll
11:51:24.0078 3300        6to4 - ok
11:51:24.0171 3300        Abiosdsk - ok
11:51:24.0218 3300        abp480n5 - ok
11:51:24.0328 3300        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:51:25.0406 3300        ACPI - ok
11:51:25.0562 3300        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
11:51:25.0734 3300        ACPIEC - ok
11:51:25.0859 3300        AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:51:25.0875 3300        AdobeFlashPlayerUpdateSvc - ok
11:51:25.0890 3300        adpu160m - ok
11:51:25.0968 3300        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
11:51:26.0203 3300        aec - ok
11:51:26.0265 3300        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
11:51:26.0312 3300        AFD - ok
11:51:26.0343 3300        Aha154x - ok
11:51:26.0359 3300        aic78u2 - ok
11:51:26.0375 3300        aic78xx - ok
11:51:26.0421 3300        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
11:51:26.0546 3300        Alerter - ok
11:51:26.0656 3300        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
11:51:26.0796 3300        ALG - ok
11:51:26.0812 3300        AliIde - ok
11:51:26.0828 3300        amsint - ok
11:51:26.0937 3300        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Programme\Avira\AntiVir Desktop\sched.exe
11:51:26.0953 3300        AntiVirSchedulerService - ok
11:51:27.0015 3300        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Programme\Avira\AntiVir Desktop\avguard.exe
11:51:27.0031 3300        AntiVirService - ok
11:51:27.0046 3300        AppMgmt - ok
11:51:27.0109 3300        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
11:51:27.0250 3300        Arp1394 - ok
11:51:27.0265 3300        asc - ok
11:51:27.0281 3300        asc3350p - ok
11:51:27.0296 3300        asc3550 - ok
11:51:27.0437 3300        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:51:27.0531 3300        aspnet_state - ok
11:51:27.0640 3300        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:51:27.0875 3300        AsyncMac - ok
11:51:27.0921 3300        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
11:51:28.0046 3300        atapi - ok
11:51:28.0062 3300        Atdisk - ok
11:51:28.0093 3300        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:51:28.0187 3300        Atmarpc - ok
11:51:28.0265 3300        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
11:51:28.0375 3300        AudioSrv - ok
11:51:28.0437 3300        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
11:51:28.0546 3300        audstub - ok
11:51:28.0593 3300        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
11:51:28.0609 3300        avgntflt - ok
11:51:28.0671 3300        avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\WINDOWS\system32\DRIVERS\avipbb.sys
11:51:28.0671 3300        avipbb - ok
11:51:28.0750 3300        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
11:51:28.0765 3300        avkmgr - ok
11:51:28.0875 3300        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
11:51:29.0062 3300        Beep - ok
11:51:29.0140 3300        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
11:51:29.0515 3300        BITS - ok
11:51:29.0562 3300        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
11:51:29.0687 3300        Browser - ok
11:51:29.0750 3300        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
11:51:29.0859 3300        cbidf2k - ok
11:51:29.0890 3300        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
11:51:30.0000 3300        CCDECODE - ok
11:51:30.0015 3300        cd20xrnt - ok
11:51:30.0031 3300        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
11:51:30.0171 3300        Cdaudio - ok
11:51:30.0281 3300        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
11:51:30.0406 3300        Cdfs - ok
11:51:30.0437 3300        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:51:30.0562 3300        Cdrom - ok
11:51:30.0578 3300        Changer - ok
11:51:30.0609 3300        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
11:51:30.0750 3300        CiSvc - ok
11:51:30.0781 3300        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
11:51:30.0937 3300        ClipSrv - ok
11:51:31.0125 3300        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:51:31.0218 3300        clr_optimization_v2.0.50727_32 - ok
11:51:31.0359 3300        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:51:31.0375 3300        clr_optimization_v4.0.30319_32 - ok
11:51:31.0484 3300        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
11:51:31.0703 3300        CmBatt - ok
11:51:31.0718 3300        CmdIde - ok
11:51:31.0750 3300        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
11:51:31.0875 3300        Compbatt - ok
11:51:31.0890 3300        COMSysApp - ok
11:51:31.0906 3300        Cpqarray - ok
11:51:31.0984 3300        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
11:51:32.0093 3300        CryptSvc - ok
11:51:32.0109 3300        dac2w2k - ok
11:51:32.0125 3300        dac960nt - ok
11:51:32.0171 3300        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:51:32.0250 3300        DcomLaunch - ok
11:51:32.0343 3300        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
11:51:32.0484 3300        Dhcp - ok
11:51:32.0546 3300        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
11:51:32.0703 3300        Disk - ok
11:51:32.0750 3300        dmadmin - ok
11:51:32.0890 3300        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
11:51:33.0171 3300        dmboot - ok
11:51:33.0203 3300        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
11:51:33.0453 3300        dmio - ok
11:51:33.0515 3300        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
11:51:33.0625 3300        dmload - ok
11:51:33.0671 3300        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
11:51:33.0781 3300        dmserver - ok
11:51:33.0812 3300        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
11:51:33.0937 3300        DMusic - ok
11:51:34.0015 3300        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
11:51:34.0156 3300        Dnscache - ok
11:51:34.0265 3300        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
11:51:34.0468 3300        Dot3svc - ok
11:51:34.0500 3300        dpti2o - ok
11:51:34.0578 3300        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
11:51:34.0765 3300        drmkaud - ok
11:51:34.0796 3300        EagleNT - ok
11:51:34.0843 3300        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
11:51:35.0031 3300        EapHost - ok
11:51:35.0109 3300        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
11:51:35.0281 3300        ERSvc - ok
11:51:35.0406 3300        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:51:35.0468 3300        Eventlog - ok
11:51:35.0625 3300        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
11:51:35.0687 3300        EventSystem - ok
11:51:35.0765 3300        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
11:51:35.0953 3300        Fastfat - ok
11:51:36.0062 3300        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:51:36.0156 3300        FastUserSwitchingCompatibility - ok
11:51:36.0234 3300        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
11:51:36.0437 3300        Fdc - ok
11:51:36.0562 3300        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
11:51:36.0687 3300        Fips - ok
11:51:36.0703 3300        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
11:51:36.0812 3300        Flpydisk - ok
11:51:36.0859 3300        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
11:51:36.0984 3300        FltMgr - ok
11:51:37.0062 3300        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:51:37.0078 3300        FontCache3.0.0.0 - ok
11:51:37.0109 3300        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:51:37.0250 3300        Fs_Rec - ok
11:51:37.0328 3300        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:51:37.0468 3300        Ftdisk - ok
11:51:37.0531 3300        getPlus(R) Helper - ok
11:51:37.0609 3300        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:51:37.0781 3300        Gpc - ok
11:51:37.0890 3300        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Programme\Google\Update\GoogleUpdate.exe
11:51:37.0906 3300        gupdate - ok
11:51:37.0921 3300        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Programme\Google\Update\GoogleUpdate.exe
11:51:37.0937 3300        gupdatem - ok
11:51:38.0015 3300        HdAudAddService (f58d2900c66a1e773e3375098e0e9337) C:\WINDOWS\system32\drivers\HdAudio.sys
11:51:38.0093 3300        HdAudAddService - ok
11:51:38.0171 3300        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
11:51:38.0343 3300        HDAudBus - ok
11:51:38.0453 3300        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:51:38.0687 3300        helpsvc - ok
11:51:38.0750 3300        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
11:51:38.0875 3300        HidServ - ok
11:51:38.0921 3300        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:51:39.0046 3300        hidusb - ok
11:51:39.0093 3300        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
11:51:39.0203 3300        hkmsvc - ok
11:51:39.0218 3300        hpn - ok
11:51:39.0296 3300        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
11:51:39.0359 3300        HTTP - ok
11:51:39.0437 3300        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
11:51:39.0593 3300        HTTPFilter - ok
11:51:39.0640 3300        i2omgmt - ok
11:51:39.0656 3300        i2omp - ok
11:51:39.0687 3300        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:51:39.0859 3300        i8042prt - ok
11:51:40.0031 3300        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
11:51:40.0062 3300        IDriverT ( UnsignedFile.Multi.Generic ) - warning
11:51:40.0062 3300        IDriverT - detected UnsignedFile.Multi.Generic (1)
11:51:40.0187 3300        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:51:40.0281 3300        idsvc - ok
11:51:40.0390 3300        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
11:51:40.0625 3300        Imapi - ok
11:51:40.0734 3300        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
11:51:40.0843 3300        ImapiService - ok
11:51:40.0875 3300        ini910u - ok
11:51:41.0093 3300        IntcAzAudAddService (e7d8f417a4cfe7f1eaca6ae6256347e8) C:\WINDOWS\system32\drivers\RtkHDAud.sys
11:51:41.0531 3300        IntcAzAudAddService - ok
11:51:41.0656 3300        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
11:51:41.0875 3300        IntelIde - ok
11:51:41.0921 3300        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:51:42.0031 3300        intelppm - ok
11:51:42.0062 3300        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
11:51:42.0187 3300        Ip6Fw - ok
11:51:42.0218 3300        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:51:42.0359 3300        IpFilterDriver - ok
11:51:42.0375 3300        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:51:42.0468 3300        IpInIp - ok
11:51:42.0515 3300        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:51:42.0640 3300        IpNat - ok
11:51:42.0671 3300        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:51:42.0781 3300        IPSec - ok
11:51:42.0796 3300        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
11:51:42.0921 3300        IRENUM - ok
11:51:42.0968 3300        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:51:43.0093 3300        isapnp - ok
11:51:43.0250 3300        JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Programme\Java\jre6\bin\jqs.exe
11:51:43.0265 3300        JavaQuickStarterService - ok
11:51:43.0390 3300        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:51:43.0515 3300        Kbdclass - ok
11:51:43.0609 3300        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
11:51:43.0859 3300        kbdhid - ok
11:51:43.0906 3300        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
11:51:44.0031 3300        kmixer - ok
11:51:44.0078 3300        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
11:51:44.0156 3300        KSecDD - ok
11:51:44.0218 3300        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
11:51:44.0265 3300        lanmanserver - ok
11:51:44.0343 3300        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
11:51:44.0421 3300        lanmanworkstation - ok
11:51:44.0515 3300        lbrtfdc - ok
11:51:44.0609 3300        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
11:51:44.0765 3300        LmHosts - ok
11:51:44.0796 3300        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
11:51:45.0015 3300        Messenger - ok
11:51:45.0078 3300        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
11:51:45.0203 3300        mnmdd - ok
11:51:45.0265 3300        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
11:51:45.0375 3300        mnmsrvc - ok
11:51:45.0421 3300        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
11:51:45.0531 3300        Modem - ok
11:51:45.0562 3300        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:51:45.0671 3300        Mouclass - ok
11:51:45.0734 3300        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
11:51:45.0906 3300        mouhid - ok
11:51:46.0078 3300        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
11:51:46.0234 3300        MountMgr - ok
11:51:46.0250 3300        mraid35x - ok
11:51:46.0296 3300        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:51:46.0453 3300        MRxDAV - ok
11:51:46.0515 3300        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:51:46.0671 3300        MRxSmb - ok
11:51:46.0734 3300        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
11:51:46.0921 3300        MSDTC - ok
11:51:46.0968 3300        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
11:51:47.0218 3300        Msfs - ok
11:51:47.0250 3300        MSIServer - ok
11:51:47.0312 3300        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:51:47.0406 3300        MSKSSRV - ok
11:51:47.0421 3300        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:51:47.0562 3300        MSPCLOCK - ok
11:51:47.0578 3300        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
11:51:47.0687 3300        MSPQM - ok
11:51:47.0796 3300        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:51:47.0890 3300        mssmbios - ok
11:51:47.0906 3300        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
11:51:48.0000 3300        MSTEE - ok
11:51:48.0062 3300        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
11:51:48.0078 3300        Mup - ok
11:51:48.0125 3300        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
11:51:48.0234 3300        NABTSFEC - ok
11:51:48.0312 3300        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
11:51:48.0484 3300        napagent - ok
11:51:48.0593 3300        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
11:51:48.0750 3300        NDIS - ok
11:51:48.0765 3300        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
11:51:48.0906 3300        NdisIP - ok
11:51:48.0968 3300        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:51:49.0062 3300        NdisTapi - ok
11:51:49.0156 3300        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:51:49.0359 3300        Ndisuio - ok
11:51:49.0406 3300        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:51:49.0593 3300        NdisWan - ok
11:51:49.0656 3300        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
11:51:49.0703 3300        NDProxy - ok
11:51:49.0796 3300        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
11:51:49.0968 3300        NetBIOS - ok
11:51:50.0015 3300        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
11:51:50.0203 3300        NetBT - ok
11:51:50.0250 3300        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:51:50.0515 3300        NetDDE - ok
11:51:50.0546 3300        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:51:50.0640 3300        NetDDEdsdm - ok
11:51:50.0781 3300        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:51:50.0890 3300        Netlogon - ok
11:51:50.0937 3300        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
11:51:51.0062 3300        Netman - ok
11:51:51.0140 3300        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:51:51.0156 3300        NetTcpPortSharing - ok
11:51:51.0265 3300        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
11:51:51.0406 3300        NIC1394 - ok
11:51:51.0484 3300        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
11:51:51.0515 3300        Nla - ok
11:51:51.0609 3300        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
11:51:51.0734 3300        Npfs - ok
11:51:51.0750 3300        npggsvc - ok
11:51:51.0812 3300        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
11:51:52.0015 3300        Ntfs - ok
11:51:52.0109 3300        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:51:52.0265 3300        NtLmSsp - ok
11:51:52.0359 3300        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
11:51:52.0609 3300        NtmsSvc - ok
11:51:52.0718 3300        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
11:51:52.0906 3300        Null - ok
11:51:53.0171 3300        nv              (0f584db6ab91cf32846bded40a8f91df) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
11:51:53.0578 3300        nv - ok
11:51:53.0656 3300        NVSvc          (1342f2261be567ea04cb4102beb03af7) C:\WINDOWS\system32\nvsvc32.exe
11:51:53.0687 3300        NVSvc - ok
11:51:53.0796 3300        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:51:54.0046 3300        NwlnkFlt - ok
11:51:54.0062 3300        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:51:54.0203 3300        NwlnkFwd - ok
11:51:54.0375 3300        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
11:51:54.0421 3300        odserv - ok
11:51:54.0546 3300        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
11:51:54.0765 3300        ohci1394 - ok
11:51:54.0843 3300        ose            (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
11:51:54.0859 3300        ose - ok
11:51:54.0937 3300        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
11:51:55.0046 3300        Parport - ok
11:51:55.0062 3300        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
11:51:55.0171 3300        PartMgr - ok
11:51:55.0203 3300        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
11:51:55.0328 3300        ParVdm - ok
11:51:55.0375 3300        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
11:51:55.0437 3300        pccsmcfd - ok
11:51:55.0484 3300        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
11:51:55.0640 3300        PCI - ok
11:51:55.0718 3300        PCIDump - ok
11:51:55.0750 3300        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
11:51:55.0937 3300        PCIIde - ok
11:51:56.0000 3300        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
11:51:56.0156 3300        Pcmcia - ok
11:51:56.0187 3300        PDCOMP - ok
11:51:56.0203 3300        PDFRAME - ok
11:51:56.0218 3300        PDRELI - ok
11:51:56.0234 3300        PDRFRAME - ok
11:51:56.0265 3300        perc2 - ok
11:51:56.0281 3300        perc2hib - ok
11:51:56.0359 3300        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:51:56.0406 3300        PlugPlay - ok
11:51:56.0453 3300        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:51:56.0609 3300        PolicyAgent - ok
11:51:56.0656 3300        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:51:56.0828 3300        PptpMiniport - ok
11:51:56.0843 3300        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:51:57.0031 3300        ProtectedStorage - ok
11:51:57.0046 3300        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
11:51:57.0187 3300        PSched - ok
11:51:57.0218 3300        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:51:57.0359 3300        Ptilink - ok
11:51:57.0421 3300        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:51:57.0437 3300        PxHelp20 - ok
11:51:57.0500 3300        ql1080 - ok
11:51:57.0531 3300        Ql10wnt - ok
11:51:57.0546 3300        ql12160 - ok
11:51:57.0562 3300        ql1240 - ok
11:51:57.0578 3300        ql1280 - ok
11:51:57.0593 3300        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:51:57.0734 3300        RasAcd - ok
11:51:57.0796 3300        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
11:51:57.0937 3300        RasAuto - ok
11:51:58.0015 3300        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:51:58.0187 3300        Rasl2tp - ok
11:51:58.0265 3300        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
11:51:58.0406 3300        RasMan - ok
11:51:58.0437 3300        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:51:58.0609 3300        RasPppoe - ok
11:51:58.0640 3300        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
11:51:58.0765 3300        Raspti - ok
11:51:58.0796 3300        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:51:58.0921 3300        Rdbss - ok
11:51:58.0937 3300        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:51:59.0046 3300        RDPCDD - ok
11:51:59.0125 3300        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
11:51:59.0156 3300        RDPWD - ok
11:51:59.0265 3300        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
11:51:59.0390 3300        RDSessMgr - ok
11:51:59.0484 3300        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
11:51:59.0593 3300        redbook - ok
11:51:59.0640 3300        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
11:51:59.0796 3300        RemoteAccess - ok
11:51:59.0859 3300        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
11:51:59.0984 3300        RpcLocator - ok
11:52:00.0062 3300        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:52:00.0093 3300        RpcSs - ok
11:52:00.0156 3300        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
11:52:00.0312 3300        RSVP - ok
11:52:00.0453 3300        RTL8023xp      (4a0ae7891fcf74acc848b109294cb80f) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
11:52:00.0578 3300        RTL8023xp - ok
11:52:00.0703 3300        s0016bus        (59509ad6cbc28f2c73056268985b3e48) C:\WINDOWS\system32\DRIVERS\s0016bus.sys
11:52:00.0718 3300        s0016bus - ok
11:52:00.0750 3300        s0016mdfl      (b98c3a6f91f4fba285af9606a240c6b4) C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys
11:52:00.0765 3300        s0016mdfl - ok
11:52:00.0812 3300        s0016mdm        (8a83426f4fb7b5212825d9de76368b1a) C:\WINDOWS\system32\DRIVERS\s0016mdm.sys
11:52:00.0843 3300        s0016mdm - ok
11:52:00.0859 3300        s0016mgmt      (7a78bba97feb5e6d24c49e93a3bf7287) C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys
11:52:00.0875 3300        s0016mgmt - ok
11:52:00.0906 3300        s0016nd5        (34ef7b5f611957b73e7219dd5a222ad1) C:\WINDOWS\system32\DRIVERS\s0016nd5.sys
11:52:00.0921 3300        s0016nd5 - ok
11:52:00.0953 3300        s0016obex      (36792935847143e4a3cda0dc87248487) C:\WINDOWS\system32\DRIVERS\s0016obex.sys
11:52:00.0968 3300        s0016obex - ok
11:52:00.0984 3300        s0016unic      (927208754fb27fc3e7a659e77500c5d1) C:\WINDOWS\system32\DRIVERS\s0016unic.sys
11:52:01.0000 3300        s0016unic - ok
11:52:01.0062 3300        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:52:01.0171 3300        SamSs - ok
11:52:01.0218 3300        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
11:52:01.0343 3300        SCardSvr - ok
11:52:01.0468 3300        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
11:52:01.0656 3300        Schedule - ok
11:52:01.0750 3300        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:52:01.0921 3300        Secdrv - ok
11:52:01.0953 3300        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
11:52:02.0125 3300        seclogon - ok
11:52:02.0156 3300        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
11:52:02.0328 3300        SENS - ok
11:52:02.0375 3300        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
11:52:02.0546 3300        Serial - ok
11:52:02.0703 3300        ServiceLayer    (2d841b7b7f6dec32162edfcc69d61f42) C:\Programme\PC Connectivity Solution\ServiceLayer.exe
11:52:02.0796 3300        ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
11:52:02.0796 3300        ServiceLayer - detected UnsignedFile.Multi.Generic (1)
11:52:02.0968 3300        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
11:52:03.0140 3300        Sfloppy - ok
11:52:03.0218 3300        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
11:52:03.0515 3300        SharedAccess - ok
11:52:03.0578 3300        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:52:03.0609 3300        ShellHWDetection - ok
11:52:03.0625 3300        Simbad - ok
11:52:03.0750 3300        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) C:\Programme\Skype\Updater\Updater.exe
11:52:03.0765 3300        SkypeUpdate - ok
11:52:03.0781 3300        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
11:52:03.0890 3300        SLIP - ok
11:52:04.0093 3300        smserial        (34d634366fc57524f5932eaec40e4fcb) C:\WINDOWS\system32\DRIVERS\smserial.sys
11:52:04.0234 3300        smserial - ok
11:52:04.0250 3300        Sparrow - ok
11:52:04.0312 3300        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
11:52:04.0484 3300        splitter - ok
11:52:04.0546 3300        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
11:52:04.0609 3300        Spooler - ok
11:52:04.0625 3300        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
11:52:04.0796 3300        sr - ok
11:52:04.0953 3300        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
11:52:05.0140 3300        srservice - ok
11:52:05.0203 3300        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
11:52:05.0281 3300        Srv - ok
11:52:05.0328 3300        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
11:52:05.0546 3300        SSDPSRV - ok
11:52:05.0593 3300        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
11:52:05.0609 3300        ssmdrv - ok
11:52:05.0640 3300        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
11:52:05.0765 3300        stisvc - ok
11:52:05.0812 3300        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
11:52:05.0921 3300        streamip - ok
11:52:05.0968 3300        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
11:52:06.0078 3300        swenum - ok
11:52:06.0203 3300        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
11:52:06.0296 3300        swmidi - ok
11:52:06.0328 3300        SwPrv - ok
11:52:06.0359 3300        symc810 - ok
11:52:06.0375 3300        symc8xx - ok
11:52:06.0390 3300        sym_hi - ok
11:52:06.0406 3300        sym_u3 - ok
11:52:06.0468 3300        SynTP          (59e9d90d6373f8ad4e3ebd0ecdedd35e) C:\WINDOWS\system32\DRIVERS\SynTP.sys
11:52:06.0562 3300        SynTP - ok
11:52:06.0609 3300        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
11:52:06.0796 3300        sysaudio - ok
11:52:06.0843 3300        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
11:52:07.0031 3300        SysmonLog - ok
11:52:07.0078 3300        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
11:52:07.0265 3300        TapiSrv - ok
11:52:07.0421 3300        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:52:07.0453 3300        Tcpip - ok
11:52:07.0546 3300        Tcpip6          (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
11:52:07.0593 3300        Tcpip6 - ok
11:52:07.0656 3300        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
11:52:07.0828 3300        TDPIPE - ok
11:52:07.0875 3300        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
11:52:08.0109 3300        TDTCP - ok
11:52:08.0140 3300        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
11:52:08.0250 3300        TermDD - ok
11:52:08.0343 3300        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
11:52:08.0468 3300        TermService - ok
11:52:08.0593 3300        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:52:08.0609 3300        Themes - ok
11:52:08.0656 3300        TosIde - ok
11:52:08.0703 3300        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
11:52:08.0890 3300        TrkWks - ok
11:52:08.0906 3300        TSMPacket - ok
11:52:08.0984 3300        tunmp          (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
11:52:09.0140 3300        tunmp - ok
11:52:09.0203 3300        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
11:52:09.0390 3300        Udfs - ok
11:52:09.0406 3300        ultra - ok
11:52:09.0468 3300        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
11:52:09.0687 3300        Update - ok
11:52:09.0734 3300        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
11:52:09.0921 3300        upnphost - ok
11:52:09.0984 3300        upperdev - ok
11:52:10.0046 3300        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
11:52:10.0234 3300        UPS - ok
11:52:10.0296 3300        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
11:52:10.0484 3300        usbaudio - ok
11:52:10.0531 3300        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:52:10.0718 3300        usbccgp - ok
11:52:10.0765 3300        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:52:10.0921 3300        usbehci - ok
11:52:10.0953 3300        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:52:11.0125 3300        usbhub - ok
11:52:11.0171 3300        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
11:52:11.0281 3300        usbprint - ok
11:52:11.0312 3300        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:52:11.0421 3300        usbscan - ok
11:52:11.0484 3300        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:52:11.0593 3300        USBSTOR - ok
11:52:11.0640 3300        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
11:52:11.0781 3300        usbuhci - ok
11:52:11.0843 3300        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
11:52:11.0984 3300        usbvideo - ok
11:52:12.0015 3300        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
11:52:12.0125 3300        VgaSave - ok
11:52:12.0140 3300        ViaIde - ok
11:52:12.0203 3300        viamraid        (0363e216e4eb5052969c96608934dbde) C:\WINDOWS\system32\DRIVERS\viamraid.sys
11:52:12.0250 3300        viamraid - ok
11:52:12.0437 3300        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
11:52:12.0593 3300        VolSnap - ok
11:52:12.0718 3300        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
11:52:12.0875 3300        VSS - ok
11:52:13.0140 3300        w29n51          (c89da341fcc883a3d79dc11727484fc2) C:\WINDOWS\system32\DRIVERS\w29n51.sys
11:52:13.0546 3300        w29n51 - ok
11:52:13.0609 3300        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
11:52:13.0843 3300        W32Time - ok
11:52:13.0968 3300        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:52:14.0078 3300        Wanarp - ok
11:52:14.0187 3300        Wdf01000        (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
11:52:14.0234 3300        Wdf01000 - ok
11:52:14.0312 3300        WDICA - ok
11:52:14.0375 3300        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
11:52:14.0546 3300        wdmaud - ok
11:52:14.0609 3300        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
11:52:14.0796 3300        WebClient - ok
11:52:14.0875 3300        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
11:52:15.0062 3300        winmgmt - ok
11:52:15.0171 3300        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
11:52:15.0218 3300        WmdmPmSN - ok
11:52:15.0281 3300        WmiAcpi        (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
11:52:15.0453 3300        WmiAcpi - ok
11:52:15.0578 3300        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:52:15.0750 3300        WmiApSrv - ok
11:52:15.0921 3300        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
11:52:16.0046 3300        WMPNetworkSvc - ok
11:52:16.0140 3300        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys
11:52:16.0187 3300        WpdUsb - ok
11:52:16.0390 3300        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
11:52:16.0484 3300        WPFFontCache_v0400 - ok
11:52:16.0640 3300        WS2IFSL        (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
11:52:16.0890 3300        WS2IFSL - ok
11:52:17.0031 3300        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
11:52:17.0125 3300        wscsvc - ok
11:52:17.0203 3300        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
11:52:17.0328 3300        WSTCODEC - ok
11:52:17.0375 3300        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
11:52:17.0546 3300        wuauserv - ok
11:52:17.0593 3300        WudfPf          (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:52:17.0671 3300        WudfPf - ok
11:52:17.0765 3300        WudfRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:52:17.0812 3300        WudfRd - ok
11:52:17.0859 3300        WudfSvc        (575a4190d989f64732119e4114045a4f) C:\WINDOWS\System32\WUDFSvc.dll
11:52:17.0890 3300        WudfSvc - ok
11:52:17.0984 3300        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
11:52:18.0187 3300        WZCSVC - ok
11:52:18.0234 3300        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
11:52:18.0421 3300        xmlprov - ok
11:52:18.0453 3300        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
11:52:18.0671 3300        \Device\Harddisk0\DR0 - ok
11:52:18.0687 3300        MBR (0x1B8)    (8464d19686910a2e5d0e5c28c70a95ab) \Device\Harddisk1\DR2
11:52:19.0171 3300        \Device\Harddisk1\DR2 - ok
11:52:19.0187 3300        Boot (0x1200)  (4f6ad31cb69ddad60d92c6d37f2b10a9) \Device\Harddisk0\DR0\Partition0
11:52:19.0187 3300        \Device\Harddisk0\DR0\Partition0 - ok
11:52:19.0203 3300        Boot (0x1200)  (43e8c4f8c4f00583565289017676d9d7) \Device\Harddisk1\DR2\Partition0
11:52:19.0203 3300        \Device\Harddisk1\DR2\Partition0 - ok
11:52:19.0203 3300        ============================================================
11:52:19.0203 3300        Scan finished
11:52:19.0203 3300        ============================================================
11:52:19.0312 3932        Detected object count: 2
11:52:19.0312 3932        Actual detected object count: 2
11:52:39.0796 3932        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
11:52:39.0796 3932        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:52:39.0796 3932        ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
11:52:39.0796 3932        ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 22.04.2012 19:18
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

j_wolfgang 23.04.2012 13:03
[code]
Combofix Logfile:
Code:
ComboFix 12-04-22.02 - Jörg 23.04.2012  13:29:41.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1023.612 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\J÷rg\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programme\Setup.exe
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\urttemp
c:\windows\system32\urttemp\fusion.dll
c:\windows\system32\urttemp\mscoree.dll
c:\windows\system32\urttemp\mscoree.dll.local
c:\windows\system32\urttemp\mscorsn.dll
c:\windows\system32\urttemp\mscorwks.dll
c:\windows\system32\urttemp\msvcr71.dll
c:\windows\system32\urttemp\regtlib.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-23 bis 2012-04-23  ))))))))))))))))))))))))))))))
.
.
2012-04-22 09:39 . 2012-04-22 09:42        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\oxInstall
2012-04-21 10:58 . 2012-04-21 10:58        --------        d-----w-        C:\_OTL
2012-04-21 10:12 . 2012-04-21 10:12        --------        d-----w-        c:\programme\Microsoft
2012-04-20 14:07 . 2012-04-20 14:07        --------        d-----w-        c:\programme\ESET
2012-04-20 12:25 . 2012-04-22 09:38        --------        d-----w-        c:\dokumente und einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Ocster Backup
2012-04-20 12:25 . 2012-04-22 09:36        --------        d-----w-        c:\dokumente und einstellungen\_ocster_backup_
2012-04-20 12:25 . 2012-04-20 12:25        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Ocster Backup
2012-04-20 12:24 . 2012-04-22 09:39        --------        d-----w-        c:\programme\Ocster Backup
2012-04-20 12:10 . 2012-04-20 12:11        --------        d-----w-        c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Download Manager
2012-04-20 11:40 . 2012-04-20 11:40        40960        ----a-r-        c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\WinDlg.exe_0AB76F69E7614CFAB9B0A1906B4E9E4B_3.exe
2012-04-20 11:40 . 2012-04-20 11:40        --------        d-----w-        c:\programme\Western Digital Technologies
2012-04-20 08:05 . 2012-04-20 08:10        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-04-20 08:05 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-04-20 07:51 . 2012-04-20 07:51        4126368        ----a-w-        c:\windows\system32\FlashPlayerInstaller.exe
2012-04-20 07:46 . 2012-04-20 07:51        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-04-18 11:59 . 2012-04-18 11:59        --------        d-----w-        c:\programme\Trend Micro
2012-04-12 17:22 . 2012-04-12 17:22        --------        d-----w-        c:\dokumente und einstellungen\Jörg\restore
2012-04-12 16:53 . 2012-04-20 11:29        --------        d-----w-        c:\programme\CEWE COLOR
2012-04-12 16:42 . 2012-04-12 16:42        --------        d-----w-        c:\dokumente und einstellungen\Jörg\Lokale Einstellungen\Anwendungsdaten\Lidl_Fotos
2012-04-04 05:53 . 2012-04-04 05:53        182160        ----a-w-        c:\programme\Mozilla Firefox\plugins\nppdf32.dll
2012-04-04 05:53 . 2012-04-04 05:53        182160        ----a-w-        c:\programme\Internet Explorer\PLUGINS\nppdf32.dll
2012-03-28 18:22 . 2012-03-28 18:22        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype
2012-03-26 18:21 . 2012-03-26 18:21        592824        ----a-w-        c:\programme\Mozilla Firefox\gkmedias.dll
2012-03-26 18:21 . 2012-03-26 18:21        44472        ----a-w-        c:\programme\Mozilla Firefox\mozglue.dll
2012-03-24 18:05 . 2012-03-24 18:05        0        ----a-w-        c:\programme\GUM6F.tmp
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-20 07:51 . 2011-06-23 08:24        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-11 12:04 . 2008-11-21 10:50        73728        ----a-w-        c:\windows\system32\javacpl.cpl
2012-03-11 12:04 . 2010-07-04 20:34        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2012-02-29 14:09 . 2004-08-04 12:00        177664        ----a-w-        c:\windows\system32\wintrust.dll
2012-02-29 14:09 . 2004-08-04 12:00        148480        ----a-w-        c:\windows\system32\imagehlp.dll
2012-02-28 18:49 . 2004-09-29 18:47        672768        ----a-w-        c:\windows\system32\wininet.dll
2012-02-28 18:49 . 2004-08-04 12:00        61952        ----a-w-        c:\windows\system32\tdc.ocx
2012-02-28 18:49 . 2004-08-04 12:00        81920        ----a-w-        c:\windows\system32\ieencode.dll
2012-02-28 18:47 . 2004-08-04 12:00        371200        ----a-w-        c:\windows\system32\html.iec
2012-02-15 20:54 . 2011-10-16 15:35        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-02-07 09:02 . 2012-02-07 09:02        1070352        ----a-w-        c:\windows\system32\MSCOMCTL.OCX
2012-02-03 09:57 . 2004-08-04 12:00        1860224        ----a-w-        c:\windows\system32\win32k.sys
2010-06-18 18:07 . 2010-06-18 18:06        18499623        ----a-w-        c:\programme\vlc-1.0.5-win32.exe
2008-09-04 11:38 . 2008-09-04 11:38        9780224        ----a-w-        c:\programme\openofficeorg30.msi
2002-03-11 09:06 . 2002-03-11 09:06        1822520        ----a-w-        c:\programme\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45        1708856        ----a-w-        c:\programme\instmsia.exe
2012-03-26 18:21 . 2011-05-09 14:22        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SansaDispatch"="c:\dokumente und einstellungen\Jörg\Anwendungsdaten\SanDisk\Sansa Updater\SansaDispatch.exe" [2011-12-13 79872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"nwiz"="nwiz.exe" [2005-05-25 1495040]
"RaidTool"="c:\programme\VIA\RAID\raid_tool.exe" [2005-02-25 589824]
"SMSERIAL"="sm56hlpr.exe" [2005-05-26 544768]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2005-03-18 98393]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2005-03-18 688217]
"SoundMan"="SOUNDMAN.EXE" [2005-03-10 90112]
"AlcWzrd"="ALCWZRD.EXE" [2005-03-10 2803712]
"PDFPrint"="c:\programme\PDF24\pdf24.exe" [2011-08-05 220552]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 21:10        1230704        ----a-w-        c:\programme\DivX\DivX Update\DivXUpdate.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programme\\SopCast\\SopCast.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programme\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Programme\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Dokumente und Einstellungen\\Jörg\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [16.10.2011 17:35 36000]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [16.10.2011 17:35 86224]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 14:16 130384]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [12.04.2010 15:19 136176]
S2 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [29.02.2012 08:50 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [20.04.2012 09:46 253088]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [12.04.2010 15:19 136176]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [24.01.2012 13:50 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [24.01.2012 13:50 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [24.01.2012 13:50 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [24.01.2012 13:50 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [24.01.2012 13:50 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [24.01.2012 13:50 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [24.01.2012 13:50 115752]
S3 TSMPacket;T-DSL SpeedManager Service;c:\windows\system32\DRIVERS\tsmpkt.sys --> c:\windows\system32\DRIVERS\tsmpkt.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 14:16 753504]
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-20 07:51]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-12 13:19]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-12 13:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\Jörg\Anwendungsdaten\Mozilla\Firefox\Profiles\i7fupz0l.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - user.js: yahoo.homepage.dontask - true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=108298
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 8ca47cff0000000000000015000089b2
FF - user.js: extensions.BabylonToolbar_i.hardId - 8ca47cff0000000000000015000089b2
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15376
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:58
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Device Detection - c:\programme\Lidl_Fotos\dd.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-23 13:34
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  RaidTool = c:\programme\VIA\RAID\raid_tool.exe????
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  SansaDispatch = c:\dokumente und einstellungen\J?rg\Anwendungsdaten\SanDisk\Sansa Updater\SansaDispatch.exe?latform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_content&?ion
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Zeit der Fertigstellung: 2012-04-23  13:37:11
ComboFix-quarantined-files.txt  2012-04-23 11:37
.
Vor Suchlauf: 14 Verzeichnis(se), 36.758.167.552 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 37.060.395.008 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30
.
- - End Of File - - 24CC4052C1A2909BD01B1A6B283A77A3
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:00 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131