Trojaner-Board
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Weißer Sperrbildschirm - Kein Zugriff auf den Rechner mehr (https://www.trojaner-board.de/115988-weisser-sperrbildschirm-kein-zugriff-rechner-mehr.html)

LIV77 05.06.2012 15:57
O.k. versuche es mit FFzu testen...

Mit FF konnte ich ESET runterladen. Aber bei der Scaninitialisierung bricht ESET bei Schritt 1 ab und fragt ob ein Proy eingerichtet ist und meldet, dass die Updates nicht funktionieren.

Die Einstellungen im FF zeigen das kein Proxy eingerichtet ist. Und das soll doch auch so sein, oder?

LIV77 08.06.2012 19:06
So, danke daß Du Dich meinem Problem nochmal animmst. Hier das log vom ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=45315
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=534a8bcf7d979d4789566cc69755af3c
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-06-08 05:21:26
# local_time=2012-06-08 07:21:26 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=5121 16777045 83 75 678347 39660738 0 0
# compatibility_mode=8192 67108863 100 0 253753 253753 0 0
# scanned=83971
# found=1
# cleaned=0
# scan_time=6812
C:\_OTL\MovedFiles\Neuer Ordner\05312012_153437\C_Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7CPYQAK7\xxxpornxxx_serveuser_com[1].htm        HTML/Iframe.B.Gen Virus (Säubern nicht möglich)        00000000000000000000000000000000        I

cosinus 08.06.2012 19:15
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

LIV77 08.06.2012 19:58
zu Frage 1: Ich weiß nicht genau was Du mit uneingeschränkt meinst. Also ich kann mich wieder normal als Admin anmelden, ja.

zu Frage 2: Unter alle Programme ist tatsächlich alles leer, lediglich den IE konnte ich wieder herstellen. Also eigentlich vermisse ich alle Programme, ja.

cosinus 08.06.2012 20:22
Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

LIV77 09.06.2012 15:30
So, ich hab unhide.exe ausgeführt. Ich habe danach leider noch immer die Dateien und Ordner nicht wieder. hier das log vom unhide:

Code:
Unhide by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
  hxxp://www.bleepingcomputer.com/forums/topic405109.html

Program started at: 06/09/2012 03:53:40 PM
Windows Version: Windows XP

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 90997 files processed.

The C:\WINDOWS\TEMP\smtmp\ folder does not exist!!
Unhide cannot restore your missing shortcuts!!
Please see this topic in order to learn how to restore default
Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html

Searching for Windows Registry changes made by FakeHDD rogues.
 - Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
  * NoRun policy was found and deleted!
 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

Restarting Explorer.exe in order to apply changes.

Program finished at: 06/09/2012 03:59:03 PM
Execution time: 0 hours(s), 5 minute(s), and 23 seconds(s)
Ich freue mich, wenn Du noch was Weiteres weißt um die Daten wiederherzustellen.

cosinus 10.06.2012 00:15
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

LIV77 10.06.2012 07:59
Guten Morgen,
hier das neue otl log:

Code:
OTL logfile created on: 10.06.2012 08:22:31 - Run 1
OTL by OldTimer - Version 3.2.44.0    Folder = C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale:  | Country:  | Language:  | Date Format:
 
1014,07 Mb Total Physical Memory | 711,99 Mb Available Physical Memory | 70,21% Memory free
2,38 Gb Paging File | 1,93 Gb Available in Paging File | 81,07% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,50 Gb Total Space | 17,92 Gb Free Space | 24,05% Space Free | Partition Type: NTFS
 
Computer Name: PHYSIOCARE-1 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.29 23:33:14 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop\OTL.exe
PRC - [2012.03.22 19:29:22 | 000,308,392 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
PRC - [2012.03.21 21:16:10 | 001,318,816 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~1\mcafee.com\agent\mcagent.exe
PRC - [2012.03.20 13:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe
PRC - [2012.03.20 13:05:00 | 000,161,632 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe
PRC - [2012.03.20 13:04:32 | 000,166,288 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mcshield.exe
PRC - [2012.01.13 12:21:10 | 000,095,200 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe
PRC - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
PRC - [2010.02.05 21:14:42 | 000,229,688 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Online Backup\MOBKbackup.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008.02.25 02:00:00 | 000,364,544 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WlanNetService.exe
PRC - [2003.08.28 14:01:22 | 000,061,440 | ---- | M] () -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.02.05 21:14:42 | 000,077,624 | ---- | M] () -- C:\Programme\McAfee Online Backup\librs2.dll
MOD - [2009.02.27 18:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
MOD - [2008.11.14 13:25:24 | 000,071,696 | ---- | M] () -- c:\Programme\McAfee\SiteAdvisor\mcfrmwk.dll
MOD - [2008.11.14 13:25:20 | 000,207,376 | ---- | M] () -- c:\Programme\McAfee\SiteAdvisor\cntscan.dll
MOD - [2008.11.14 13:25:18 | 000,117,264 | ---- | M] () -- c:\Programme\McAfee\SiteAdvisor\apengine.dll
MOD - [2004.09.01 15:20:32 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\IMGMSGMO.dll
MOD - [2003.08.28 14:01:22 | 000,061,440 | ---- | M] () -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (MSDTC)
SRV - [2012.06.01 17:37:22 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.03.22 19:29:08 | 000,361,976 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2012.03.20 13:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe -- (mfevtp)
SRV - [2012.03.20 13:05:00 | 000,161,632 | ---- | M] () [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2012.03.20 13:04:32 | 000,166,288 | ---- | M] () [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2012.01.13 12:21:10 | 000,095,200 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2010.02.05 21:14:42 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)
SRV - [2008.04.14 04:23:03 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\tlntsvr.exe -- (TlntSvr)
SRV - [2008.04.14 04:22:55 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 04:22:55 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 04:22:38 | 000,033,280 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\clipsrv.exe -- (ClipSrv)
SRV - [2008.04.14 04:22:33 | 000,483,840 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC)
SRV - [2008.04.14 04:22:16 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 04:22:15 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 04:22:07 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2008.02.25 02:00:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003.08.28 14:01:22 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe -- (spkrmon)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (mfeavfk01)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\GTNDIS5.SYS -- (GTNDIS5)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.02.22 13:29:46 | 000,464,304 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2012.02.22 13:29:46 | 000,340,920 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2012.02.22 13:29:46 | 000,180,848 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2012.02.22 13:29:46 | 000,121,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2012.02.22 13:29:46 | 000,089,792 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\mfetdi2k.sys -- (mfetdi2k)
DRV - [2012.02.22 13:29:46 | 000,087,656 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2012.02.22 13:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\mfendisk.sys -- (mfendiskmp)
DRV - [2012.02.22 13:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\mfendisk.sys -- (mfendisk)
DRV - [2012.02.22 13:29:46 | 000,059,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2012.02.22 13:29:46 | 000,057,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\cfwids.sys -- (cfwids)
DRV - [2010.02.05 21:13:48 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\WINDOWS\System32\DRIVERS\MOBK.sys -- (MOBKFilter)
DRV - [2009.09.16 10:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009.09.16 10:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2008.04.14 04:02:16 | 000,120,576 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia)
DRV - [2008.04.14 03:58:13 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.13 20:32:36 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2007.12.19 02:00:00 | 000,401,920 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\fwlanusbn.sys -- (fwlanusbn)
DRV - [2007.11.07 03:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2005.05.13 02:00:00 | 000,452,736 | R--- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\fwlanusb.sys -- (FWLANUSB)
DRV - [2004.08.16 20:14:53 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2004.08.16 20:14:32 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC)
DRV - [2004.07.16 11:14:30 | 000,140,416 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\rt2500usb.sys -- (bkn50USB)
DRV - [2004.04.29 18:55:42 | 000,186,112 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\b57xp32.sys -- (b57w2k)
DRV - [2004.01.07 17:04:00 | 000,339,488 | ---- | M] (Cisco-Linksys, LLC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\WUSB20XP.sys -- (PRISM_A02)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Programme\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Programme\McAfee\SiteAdvisor [2012.02.24 08:10:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Programme\Gemeinsame Dateien\McAfee\SystemCore [2012.06.10 08:12:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.09 17:51:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
 
[2012.06.05 18:53:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.01 17:38:43 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.06.01 18:33:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.01 18:33:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.01 18:33:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.01 18:33:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.01 18:33:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.01 18:33:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.06.04 04:37:18 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\ScriptSn.20120608164640.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [mcui_exe] C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\RunOnce: [*Restore] C:\WINDOWS\System32\restore\rstrui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Desktop [2012.05.31 21:40:24 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Cookies [2012.05.31 15:51:42 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Lokale Einstellungen [2012.05.31 15:51:42 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Cookies [2012.05.31 15:57:10 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Lokale Einstellungen [2012.05.31 15:57:10 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten [2012.06.05 18:54:20 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Cookies [2012.05.31 15:58:39 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop [2012.06.10 08:11:31 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Eigene Dateien [2012.06.05 18:56:29 | 000,000,000 | R--D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Favoriten [2012.06.05 10:25:26 | 000,000,000 | R--D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\NTUSER.DAT ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\NTUSER.DAT ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Recent [2012.06.03 23:08:24 | 000,000,000 | R--D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Startmenü [2012.06.03 23:08:24 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Vorlagen [2012.05.31 17:52:47 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten [2012.06.09 17:50:27 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Desktop [2012.06.09 17:51:08 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Dokumente [2012.06.09 17:50:33 | 000,000,000 | R--D | M]
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü [2012.06.03 23:09:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Vorlagen [2012.06.09 17:52:45 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\Default User\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen [2012.05.31 15:59:24 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen [2012.05.31 17:52:34 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Lokale Einstellungen [2012.05.31 17:58:21 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Cookies [2012.05.31 15:55:21 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen [2012.05.31 20:11:59 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Vorlagen [2012.05.31 19:20:02 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Anwendungsdaten [2012.05.31 20:36:52 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Favoriten [2012.05.31 20:43:04 | 000,000,000 | R--D | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Lokale Einstellungen [2012.05.31 20:36:52 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\PrivacIE [2012.05.31 20:43:16 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Startmenü [2012.05.31 20:36:50 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Vorlagen [2012.05.31 20:36:50 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen [2012.05.31 17:52:30 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Lokale Einstellungen [2012.05.31 17:58:17 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\ntuser.dat ()
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} hxxp://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe ()
O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} https://stream.web.de/mail/activex/mail_upload_11213.cab (Attachment Upload Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} hxxp://img.od2.com/Installation/PluginName/MusicManager/MusicManagerPlugin.CAB (Music Manager)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3486EE17-1791-47F3-A629-4603B1A51AB8}: DhcpNameServer = 192.168.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7BAC5297-EA7A-4E44-AA7A-B205632F1459}: NameServer = 192.168.10.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: mcmscsvc - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: McMPFSvc - C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootNet: mcmscsvc - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootNet: mfefire - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe ()
SafeBootNet: mfefirek - C:\WINDOWS\System32\drivers\mfefirek.sys (McAfee, Inc.)
SafeBootNet: mfefirek.sys - C:\WINDOWS\System32\drivers\mfefirek.sys (McAfee, Inc.)
SafeBootNet: mfehidk - C:\WINDOWS\System32\drivers\mfehidk.sys (McAfee, Inc.)
SafeBootNet: mfehidk.sys - C:\WINDOWS\System32\drivers\mfehidk.sys (McAfee, Inc.)
SafeBootNet: mfevtp - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SafeBootNet: MpfService - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.09 17:52:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Vorlagen
[2012.06.09 17:51:08 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.06.09 17:50:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente
[2012.06.09 17:50:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google
[2012.06.09 17:21:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2012.06.08 17:16:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Adobe
[2012.06.08 16:54:16 | 000,000,000 | ---D | C] -- C:\GoogleChromePortable
[2012.06.08 16:54:16 | 000,000,000 | ---D | C] -- \GoogleChromePortable
[2012.06.05 18:58:43 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.06.05 18:54:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2012.06.05 18:53:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.06.05 18:53:16 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2012.06.05 10:25:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Google
[2012.06.05 06:40:44 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.06.05 06:40:44 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.06.05 06:39:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.06.05 06:39:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Desktop
[2012.06.04 23:40:30 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Eigene Dateien
[2012.06.04 17:59:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten
[2012.06.04 12:24:54 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2012.06.03 23:09:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü
[2012.06.03 23:08:25 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Favoriten
[2012.06.03 23:08:24 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Recent
[2012.06.03 23:08:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Startmenü
[2012.06.03 23:08:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop
[2012.05.31 21:34:41 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2012.05.31 21:34:37 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.05.31 21:34:37 | 000,000,000 | ---D | C] -- \_OTL
[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Startmenü
[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Startmenü
[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten
[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten
[2012.05.31 17:52:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Vorlagen
[2012.05.31 17:52:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Microsoft
[2012.05.31 17:52:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft
[2012.05.31 17:52:35 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\IETldCache
[2012.05.31 17:52:35 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\Cookies
[2012.05.31 17:52:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen
[2012.05.31 17:52:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft
[2012.05.31 17:52:30 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NetworkService\IETldCache
[2012.05.31 17:52:30 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NetworkService\Cookies
[2012.05.31 17:52:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen
[2012.05.31 15:58:38 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Cookies
[2012.05.31 15:58:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen
[2012.05.31 15:55:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Genuine Advantage
[2012.05.31 15:53:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee
[2012.05.31 15:51:42 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
[2012.05.31 15:51:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.10 08:09:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.10 08:09:29 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.06.10 08:09:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.09 16:51:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.05 18:53:35 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.06.05 06:40:57 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.25 09:40:23 | 000,003,147 | R--- | M] () -- C:\WINDOWS\THERAPIE.LIC
[2012.05.15 09:47:17 | 000,007,168 | ---- | M] () -- C:\ads_err.adi
[2012.05.15 09:47:14 | 000,269,044 | ---- | M] () -- C:\ads_err.adt
[2012.05.14 16:36:30 | 000,117,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.14 11:15:36 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
 
========== Files Created - No Company Name ==========
 
[2012.06.05 18:53:35 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.06.05 06:40:56 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.31 21:34:41 | 002,237,440 | R--- | C] () -- \OTLPE.exe
[2012.02.16 16:27:58 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.05.18 15:20:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
 
========== LOP Check ==========
 
[2012.05.31 21:40:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Desktop
[2012.05.31 15:51:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Cookies
[2012.05.31 15:51:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Lokale Einstellungen
[2012.05.31 15:57:10 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Cookies
[2012.05.31 15:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Lokale Einstellungen
[2012.06.05 18:54:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten
[2012.05.31 15:58:39 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Cookies
[2012.06.10 08:11:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop
[2012.06.05 18:56:29 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Eigene Dateien
[2012.06.05 10:25:26 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Favoriten
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen
[2012.06.03 23:08:24 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Recent
[2012.06.03 23:08:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Startmenü
[2012.05.31 17:52:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Vorlagen
[2012.06.09 17:50:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten
[2012.06.09 17:51:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Desktop
[2012.06.09 17:50:33 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Dokumente
[2012.06.03 23:09:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü
[2012.06.09 17:52:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Vorlagen
[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Default User\Cookies
[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Default User\IETldCache
[2012.05.31 15:59:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten
[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService\Cookies
[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService\IETldCache
[2012.05.31 17:52:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Startmenü
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Anwendungsdaten
[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Cookies
[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\IETldCache
[2012.05.31 17:58:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Lokale Einstellungen
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü
[2012.05.31 15:55:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lutz\Cookies
[2012.05.31 20:11:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen
[2012.05.31 19:20:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lutz\Vorlagen
[2012.05.31 20:36:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Anwendungsdaten
[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\mbecker\Cookies
[2012.05.31 20:43:04 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\mbecker\Favoriten
[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\mbecker\IETldCache
[2012.05.31 20:36:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Lokale Einstellungen
[2012.05.31 20:43:16 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\mbecker\PrivacIE
[2012.05.31 20:36:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Startmenü
[2012.05.31 20:36:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Vorlagen
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten
[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService\Cookies
[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService\IETldCache
[2012.05.31 17:52:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Startmenü
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Anwendungsdaten
[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Cookies
[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\IETldCache
[2012.05.31 17:58:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Lokale Einstellungen
[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Startmenü
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.06.09 17:50:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Adobe
[2012.06.05 10:51:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Google
[2012.06.05 18:18:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Macromedia
[2012.06.05 06:41:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Malwarebytes
[2012.06.09 17:52:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Microsoft
[2012.06.09 17:51:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Mozilla
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
[2005.06.19 17:20:25 | 002,629,120 | ---- | M] (Microsoft Corporation) -- C:\F5D7050_v2_uk.EXE
[2011.07.13 04:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe
 
< MD5 for: AGP440.SYS  >
[2004.08.16 20:26:20 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.16 20:26:20 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.16 20:14:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.16 20:16:17 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2004.08.16 20:33:30 | 000,467,200 | ---- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 -- C:\WINDOWS\dell\iastor\iastor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.16 20:21:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.16 20:24:42 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.16 20:28:49 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.16 20:28:50 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2004.08.16 20:30:47 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.16 20:31:54 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.16 20:31:54 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2005.04.16 20:53:36 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005.04.16 20:53:36 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005.04.16 20:53:35 | 000,434,176 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >

cosinus 10.06.2012 15:46
Das Log sieht merkwürdig aus. Die ganzen Startmenü-Einträge in der O4-Sektio sind mir so noch nie untergekommen :wtf:
Hier ein Auszug
Code:
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.ini ()
O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Cookies [2012.05.31 15:55:21 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen [2012.05.31 20:11:59 | 000,000,000 | ---D | M]
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()
O4 - Startup: C:\Dokumente und Einstellungen\Lutz\ntuser.ini ()
Normalweise müssten sich wild o.g. Ordner und Dateien bei jedem Einloggen öffnen, merkst du davon was?

LIV77 10.06.2012 17:43
Nein davon hab ich noch nix bemerkt. Was mach ich nun:confused:

cosinus 10.06.2012 18:46
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

LIV77 11.06.2012 19:52
o. k. hier das log vom tdss

Code:
2012/06/11 20:41:31.0781 2448        TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15
2012/06/11 20:41:36.0812 2448        ================================================================================
2012/06/11 20:41:36.0812 2448        SystemInfo:
2012/06/11 20:41:36.0812 2448       
2012/06/11 20:41:36.0812 2448        OS Version: 5.1.2600 ServicePack: 3.0
2012/06/11 20:41:36.0812 2448        Product type: Workstation
2012/06/11 20:41:36.0812 2448        ComputerName: PHYSIOCARE-1
2012/06/11 20:41:36.0812 2448        UserName: Administrator
2012/06/11 20:41:36.0812 2448        Windows directory: C:\WINDOWS
2012/06/11 20:41:36.0812 2448        System windows directory: C:\WINDOWS
2012/06/11 20:41:36.0812 2448        Processor architecture: Intel x86
2012/06/11 20:41:36.0812 2448        Number of processors: 1
2012/06/11 20:41:36.0812 2448        Page size: 0x1000
2012/06/11 20:41:36.0812 2448        Boot type: Normal boot
2012/06/11 20:41:36.0812 2448        ================================================================================
2012/06/11 20:41:38.0890 2448        Initialize success
2012/06/11 20:42:25.0281 2992        ================================================================================
2012/06/11 20:42:25.0281 2992        Scan started
2012/06/11 20:42:25.0281 2992        Mode: Manual;
2012/06/11 20:42:25.0281 2992        ================================================================================
2012/06/11 20:42:25.0937 2992        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2012/06/11 20:42:26.0000 2992        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
2012/06/11 20:42:26.0281 2992        aeaudio        (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
2012/06/11 20:42:26.0453 2992        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2012/06/11 20:42:26.0515 2992        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
2012/06/11 20:42:26.0750 2992        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2012/06/11 20:42:26.0828 2992        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2012/06/11 20:42:26.0890 2992        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2012/06/11 20:42:26.0953 2992        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2012/06/11 20:42:27.0015 2992        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\WINDOWS\system32\drivers\avmeject.sys
2012/06/11 20:42:27.0234 2992        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2012/06/11 20:42:27.0406 2992        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2012/06/11 20:42:27.0468 2992        bkn50USB        (6d39682a1051a5be7437ec99f1bf9921) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys
2012/06/11 20:42:27.0640 2992        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2012/06/11 20:42:27.0703 2992        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2012/06/11 20:42:27.0765 2992        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2012/06/11 20:42:27.0796 2992        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2012/06/11 20:42:27.0906 2992        cfwids          (1c7b1e36f3ced9e4b0b13385e627fe8b) C:\WINDOWS\system32\drivers\cfwids.sys
2012/06/11 20:42:28.0187 2992        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2012/06/11 20:42:28.0296 2992        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2012/06/11 20:42:28.0546 2992        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2012/06/11 20:42:28.0578 2992        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2012/06/11 20:42:28.0640 2992        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2012/06/11 20:42:28.0703 2992        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2012/06/11 20:42:28.0765 2992        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2012/06/11 20:42:28.0796 2992        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2012/06/11 20:42:28.0843 2992        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2012/06/11 20:42:29.0156 2992        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2012/06/11 20:42:29.0203 2992        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2012/06/11 20:42:29.0234 2992        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2012/06/11 20:42:29.0265 2992        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2012/06/11 20:42:29.0343 2992        FWLANUSB        (41077d927c3654fd2d71549763525d75) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys
2012/06/11 20:42:29.0515 2992        fwlanusbn      (fc06a5be1ab381cd47af3d69006e88f0) C:\WINDOWS\system32\DRIVERS\fwlanusbn.sys
2012/06/11 20:42:29.0859 2992        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2012/06/11 20:42:29.0937 2992        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2012/06/11 20:42:30.0031 2992        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2012/06/11 20:42:30.0156 2992        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\drivers\i8042prt.sys
2012/06/11 20:42:30.0343 2992        ialm            (0acebb31989cbf9a5663fe4a33d28d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2012/06/11 20:42:30.0437 2992        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2012/06/11 20:42:30.0515 2992        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
2012/06/11 20:42:30.0546 2992        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2012/06/11 20:42:30.0765 2992        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2012/06/11 20:42:30.0828 2992        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2012/06/11 20:42:30.0859 2992        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2012/06/11 20:42:30.0890 2992        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2012/06/11 20:42:30.0937 2992        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2012/06/11 20:42:30.0968 2992        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2012/06/11 20:42:31.0000 2992        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2012/06/11 20:42:31.0015 2992        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2012/06/11 20:42:31.0250 2992        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2012/06/11 20:42:31.0390 2992        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2012/06/11 20:42:31.0453 2992        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2012/06/11 20:42:31.0546 2992        MBAMSwissArmy  (0db7527db188c7d967a37bb51bbf3963) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2012/06/11 20:42:31.0750 2992        mfeapfk        (43c31bdf404a6d7a7ac1bfd5ead2a566) C:\WINDOWS\system32\drivers\mfeapfk.sys
2012/06/11 20:42:31.0921 2992        mfeavfk        (c1dc5f42d3367f33b6451be78b38bd46) C:\WINDOWS\system32\drivers\mfeavfk.sys
2012/06/11 20:42:32.0093 2992        mfebopk        (0435c43f4c2be01b84868ad2a906397b) C:\WINDOWS\system32\drivers\mfebopk.sys
2012/06/11 20:42:32.0296 2992        mfefirek        (4ea6ff90015424517843e931448e00f1) C:\WINDOWS\system32\drivers\mfefirek.sys
2012/06/11 20:42:32.0484 2992        mfehidk        (d1e998748ba24a731106611d535c6bbf) C:\WINDOWS\system32\drivers\mfehidk.sys
2012/06/11 20:42:32.0531 2992        mfendisk        (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys
2012/06/11 20:42:32.0625 2992        mfendiskmp      (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys
2012/06/11 20:42:32.0671 2992        mferkdet        (f454a13377f0a006d20a8c14a753c432) C:\WINDOWS\system32\drivers\mferkdet.sys
2012/06/11 20:42:32.0859 2992        mferkdk        (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys
2012/06/11 20:42:33.0031 2992        mfesmfk        (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys
2012/06/11 20:42:33.0187 2992        mfetdi2k        (070d3faf2eac417c59d8674a8752f7a6) C:\WINDOWS\system32\drivers\mfetdi2k.sys
2012/06/11 20:42:33.0343 2992        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2012/06/11 20:42:33.0421 2992        MOBKFilter      (e896775837a8bce436348df460522394) C:\WINDOWS\system32\DRIVERS\MOBK.sys
2012/06/11 20:42:33.0468 2992        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2012/06/11 20:42:33.0625 2992        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2012/06/11 20:42:33.0765 2992        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2012/06/11 20:42:33.0937 2992        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2012/06/11 20:42:34.0000 2992        mozyFilter      (8e5f185f04d4ff203afbb0fd2b609e88) C:\WINDOWS\system32\DRIVERS\mozy.sys
2012/06/11 20:42:34.0046 2992        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2012/06/11 20:42:34.0125 2992        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2012/06/11 20:42:34.0187 2992        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2012/06/11 20:42:34.0234 2992        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2012/06/11 20:42:34.0265 2992        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2012/06/11 20:42:34.0296 2992        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2012/06/11 20:42:34.0328 2992        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2012/06/11 20:42:34.0421 2992        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2012/06/11 20:42:34.0484 2992        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2012/06/11 20:42:34.0531 2992        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2012/06/11 20:42:34.0593 2992        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2012/06/11 20:42:34.0656 2992        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2012/06/11 20:42:34.0718 2992        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2012/06/11 20:42:34.0750 2992        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2012/06/11 20:42:34.0796 2992        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2012/06/11 20:42:34.0859 2992        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2012/06/11 20:42:34.0921 2992        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2012/06/11 20:42:34.0953 2992        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2012/06/11 20:42:35.0015 2992        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2012/06/11 20:42:35.0062 2992        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2012/06/11 20:42:35.0109 2992        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
2012/06/11 20:42:35.0406 2992        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2012/06/11 20:42:35.0453 2992        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2012/06/11 20:42:35.0593 2992        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2012/06/11 20:42:35.0671 2992        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\drivers\PCIIde.sys
2012/06/11 20:42:35.0718 2992        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
2012/06/11 20:42:35.0984 2992        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2012/06/11 20:42:36.0046 2992        PRISM_A02      (57e95881e5f014816a8a53ad94ee0c48) C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys
2012/06/11 20:42:36.0187 2992        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2012/06/11 20:42:36.0218 2992        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2012/06/11 20:42:36.0359 2992        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2012/06/11 20:42:36.0406 2992        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2012/06/11 20:42:36.0437 2992        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2012/06/11 20:42:36.0468 2992        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2012/06/11 20:42:36.0500 2992        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2012/06/11 20:42:36.0531 2992        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2012/06/11 20:42:36.0562 2992        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2012/06/11 20:42:36.0640 2992        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
2012/06/11 20:42:36.0687 2992        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2012/06/11 20:42:36.0953 2992        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2012/06/11 20:42:37.0015 2992        serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2012/06/11 20:42:37.0062 2992        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
2012/06/11 20:42:37.0203 2992        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
2012/06/11 20:42:37.0312 2992        smwdm          (4aa922332433cdeb8b82c072c212e32e) C:\WINDOWS\system32\drivers\smwdm.sys
2012/06/11 20:42:37.0375 2992        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2012/06/11 20:42:37.0421 2992        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2012/06/11 20:42:37.0468 2992        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2012/06/11 20:42:37.0531 2992        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2012/06/11 20:42:37.0578 2992        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2012/06/11 20:42:37.0718 2992        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2012/06/11 20:42:37.0796 2992        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2012/06/11 20:42:37.0843 2992        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2012/06/11 20:42:37.0890 2992        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2012/06/11 20:42:37.0937 2992        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2012/06/11 20:42:38.0031 2992        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2012/06/11 20:42:38.0125 2992        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2012/06/11 20:42:38.0171 2992        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2012/06/11 20:42:38.0203 2992        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2012/06/11 20:42:38.0250 2992        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2012/06/11 20:42:38.0281 2992        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2012/06/11 20:42:38.0328 2992        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2012/06/11 20:42:38.0359 2992        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2012/06/11 20:42:38.0421 2992        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2012/06/11 20:42:38.0468 2992        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2012/06/11 20:42:38.0531 2992        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2012/06/11 20:42:38.0656 2992        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys
2012/06/11 20:42:38.0781 2992        WS2IFSL        (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2012/06/11 20:42:38.0875 2992        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2012/06/11 20:42:38.0937 2992        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2012/06/11 20:42:39.0000 2992        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
2012/06/11 20:42:39.0265 2992        ================================================================================
2012/06/11 20:42:39.0265 2992        Scan finished
2012/06/11 20:42:39.0265 2992        ================================================================================
2012/06/11 20:42:39.0281 1940        Detected object count: 0
2012/06/11 20:42:39.0281 1940        Actual detected object count: 0
Vielen Dank, das Du da drüber guckst!

cosinus 11.06.2012 21:16
Zitat:
TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15
Warum nimmst du so eine Uraltversion von diesem Tool?

LIV77 12.06.2012 19:57
Oh ha! Na das ist mal peinlich! So, hier nun ein aktuelles TDSS log aus einer aktuellen Version. Hab alle Funde mit skip behandelt, noch nix gelöscht.

Code:
19:59:29.0529 2880        TDSS rootkit removing tool 2.7.34.0 May  2 2012 09:59:18
19:59:46.0967 2880        ============================================================
19:59:46.0967 2880        Current date / time: 2012/06/12 19:59:46.0967
19:59:46.0967 2880        SystemInfo:
19:59:46.0982 2880       
19:59:46.0982 2880        OS Version: 5.1.2600 ServicePack: 3.0
19:59:46.0982 2880        Product type: Workstation
19:59:46.0982 2880        ComputerName: PHYSIOCARE-1
19:59:46.0982 2880        UserName: Administrator
19:59:46.0982 2880        Windows directory: C:\WINDOWS
19:59:46.0982 2880        System windows directory: C:\WINDOWS
19:59:46.0982 2880        Processor architecture: Intel x86
19:59:46.0982 2880        Number of processors: 1
19:59:46.0982 2880        Page size: 0x1000
19:59:46.0982 2880        Boot type: Normal boot
19:59:46.0982 2880        ============================================================
19:59:48.0529 2880        Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
19:59:48.0529 2880        Drive \Device\Harddisk1\DR2 - Size: 0xEEF00000 (3.73 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
19:59:48.0529 2880        ============================================================
19:59:48.0529 2880        \Device\Harddisk0\DR0:
19:59:48.0529 2880        MBR partitions:
19:59:48.0529 2880        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x94FE97E
19:59:48.0529 2880        \Device\Harddisk1\DR2:
19:59:48.0529 2880        MBR partitions:
19:59:48.0529 2880        \Device\Harddisk1\DR2\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x7777E0
19:59:48.0529 2880        ============================================================
19:59:48.0576 2880        C: <-> \Device\Harddisk0\DR0\Partition0
19:59:48.0576 2880        ============================================================
19:59:48.0576 2880        Initialize success
19:59:48.0576 2880        ============================================================
20:00:06.0123 3232        ============================================================
20:00:06.0123 3232        Scan started
20:00:06.0123 3232        Mode: Manual; SigCheck; TDLFS;
20:00:06.0123 3232        ============================================================
20:00:06.0310 3232        Abiosdsk - ok
20:00:06.0310 3232        abp480n5 - ok
20:00:06.0373 3232        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:00:07.0857 3232        ACPI - ok
20:00:07.0904 3232        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:00:08.0060 3232        ACPIEC - ok
20:00:08.0060 3232        adpu160m - ok
20:00:08.0092 3232        aeaudio        (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
20:00:08.0154 3232        aeaudio - ok
20:00:08.0185 3232        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:00:08.0357 3232        aec - ok
20:00:08.0404 3232        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:00:08.0513 3232        AFD - ok
20:00:08.0513 3232        Aha154x - ok
20:00:08.0529 3232        aic78u2 - ok
20:00:08.0529 3232        aic78xx - ok
20:00:08.0560 3232        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:00:08.0717 3232        Alerter - ok
20:00:08.0732 3232        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:00:08.0810 3232        ALG - ok
20:00:08.0826 3232        AliIde - ok
20:00:08.0826 3232        amsint - ok
20:00:08.0873 3232        AppMgmt        (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
20:00:08.0982 3232        AppMgmt - ok
20:00:08.0982 3232        asc - ok
20:00:08.0998 3232        asc3350p - ok
20:00:08.0998 3232        asc3550 - ok
20:00:09.0092 3232        aspnet_state    (e1a1206a4fb19b675e947b29ccd25fba) C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
20:00:09.0123 3232        aspnet_state ( UnsignedFile.Multi.Generic ) - warning
20:00:09.0123 3232        aspnet_state - detected UnsignedFile.Multi.Generic (1)
20:00:09.0154 3232        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:00:09.0295 3232        AsyncMac - ok
20:00:09.0326 3232        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:00:09.0482 3232        atapi - ok
20:00:09.0482 3232        Atdisk - ok
20:00:09.0529 3232        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:00:09.0670 3232        Atmarpc - ok
20:00:09.0717 3232        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:00:09.0873 3232        AudioSrv - ok
20:00:09.0951 3232        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:00:10.0076 3232        audstub - ok
20:00:10.0185 3232        AVM WLAN Connection Service (06c3528e0686a58701367749b0145a4a) C:\Programme\avmwlanstick\WlanNetService.exe
20:00:10.0373 3232        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
20:00:10.0373 3232        AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
20:00:10.0388 3232        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\WINDOWS\system32\drivers\avmeject.sys
20:00:10.0420 3232        avmeject ( UnsignedFile.Multi.Generic ) - warning
20:00:10.0420 3232        avmeject - detected UnsignedFile.Multi.Generic (1)
20:00:10.0467 3232        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
20:00:10.0592 3232        b57w2k - ok
20:00:10.0607 3232        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:00:10.0763 3232        Beep - ok
20:00:10.0826 3232        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:00:11.0060 3232        BITS - ok
20:00:11.0107 3232        bkn50USB        (6d39682a1051a5be7437ec99f1bf9921) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys
20:00:11.0138 3232        bkn50USB ( UnsignedFile.Multi.Generic ) - warning
20:00:11.0138 3232        bkn50USB - detected UnsignedFile.Multi.Generic (1)
20:00:11.0170 3232        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:00:11.0326 3232        Browser - ok
20:00:11.0373 3232        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:00:11.0529 3232        cbidf2k - ok
20:00:11.0545 3232        cd20xrnt - ok
20:00:11.0576 3232        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:00:11.0717 3232        Cdaudio - ok
20:00:11.0763 3232        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:00:11.0951 3232        Cdfs - ok
20:00:11.0967 3232        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:00:12.0138 3232        Cdrom - ok
20:00:12.0170 3232        cfwids          (1c7b1e36f3ced9e4b0b13385e627fe8b) C:\WINDOWS\system32\drivers\cfwids.sys
20:00:21.0998 3232        cfwids - ok
20:00:21.0998 3232        Changer - ok
20:00:22.0029 3232        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:00:22.0185 3232        CiSvc - ok
20:00:22.0201 3232        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:00:22.0357 3232        ClipSrv - ok
20:00:22.0357 3232        CmdIde - ok
20:00:22.0357 3232        COMSysApp - ok
20:00:22.0373 3232        Cpqarray - ok
20:00:22.0404 3232        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:00:22.0545 3232        CryptSvc - ok
20:00:22.0560 3232        dac2w2k - ok
20:00:22.0560 3232        dac960nt - ok
20:00:22.0623 3232        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:00:22.0717 3232        DcomLaunch - ok
20:00:22.0763 3232        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:00:22.0935 3232        Dhcp - ok
20:00:22.0982 3232        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:00:23.0123 3232        Disk - ok
20:00:23.0123 3232        dmadmin - ok
20:00:23.0170 3232        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:00:23.0373 3232        dmboot - ok
20:00:23.0388 3232        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:00:23.0545 3232        dmio - ok
20:00:23.0560 3232        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:00:23.0717 3232        dmload - ok
20:00:23.0920 3232        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:00:24.0107 3232        dmserver - ok
20:00:24.0185 3232        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:00:24.0342 3232        DMusic - ok
20:00:24.0623 3232        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
20:00:24.0873 3232        Dnscache - ok
20:00:25.0154 3232        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:00:25.0295 3232        Dot3svc - ok
20:00:25.0295 3232        dpti2o - ok
20:00:25.0326 3232        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:00:25.0467 3232        drmkaud - ok
20:00:25.0498 3232        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:00:25.0654 3232        EapHost - ok
20:00:25.0685 3232        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:00:25.0842 3232        ERSvc - ok
20:00:25.0888 3232        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:00:25.0920 3232        Eventlog - ok
20:00:25.0982 3232        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:00:26.0092 3232        EventSystem - ok
20:00:26.0138 3232        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:00:26.0295 3232        Fastfat - ok
20:00:26.0326 3232        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:00:26.0451 3232        FastUserSwitchingCompatibility - ok
20:00:26.0467 3232        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:00:26.0607 3232        Fdc - ok
20:00:26.0638 3232        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:00:26.0779 3232        Fips - ok
20:00:26.0810 3232        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:00:26.0951 3232        Flpydisk - ok
20:00:26.0982 3232        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
20:00:27.0138 3232        FltMgr - ok
20:00:27.0185 3232        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:00:27.0326 3232        Fs_Rec - ok
20:00:27.0357 3232        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:00:27.0498 3232        Ftdisk - ok
20:00:27.0545 3232        FWLANUSB        (41077d927c3654fd2d71549763525d75) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys
20:00:27.0623 3232        FWLANUSB - ok
20:00:27.0685 3232        fwlanusbn      (fc06a5be1ab381cd47af3d69006e88f0) C:\WINDOWS\system32\DRIVERS\fwlanusbn.sys
20:00:27.0810 3232        fwlanusbn - ok
20:00:27.0857 3232        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:00:27.0998 3232        Gpc - ok
20:00:28.0013 3232        GTNDIS5 - ok
20:00:28.0107 3232        gupdate        (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe
20:00:28.0138 3232        gupdate - ok
20:00:28.0138 3232        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe
20:00:28.0154 3232        gupdatem - ok
20:00:28.0217 3232        gusvc          (cc839e8d766cc31a7710c9f38cf3e375) C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
20:00:28.0248 3232        gusvc - ok
20:00:28.0373 3232        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:00:28.0576 3232        helpsvc - ok
20:00:28.0607 3232        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:00:28.0748 3232        HidServ - ok
20:00:28.0779 3232        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:00:28.0920 3232        hidusb - ok
20:00:28.0967 3232        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:00:29.0107 3232        hkmsvc - ok
20:00:29.0107 3232        hpn - ok
20:00:29.0170 3232        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:00:29.0217 3232        HTTP - ok
20:00:29.0248 3232        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:00:29.0388 3232        HTTPFilter - ok
20:00:29.0404 3232        i2omgmt - ok
20:00:29.0404 3232        i2omp - ok
20:00:29.0451 3232        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\drivers\i8042prt.sys
20:00:29.0592 3232        i8042prt - ok
20:00:29.0638 3232        ialm            (0acebb31989cbf9a5663fe4a33d28d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
20:00:29.0717 3232        ialm ( UnsignedFile.Multi.Generic ) - warning
20:00:29.0717 3232        ialm - detected UnsignedFile.Multi.Generic (1)
20:00:29.0826 3232        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
20:00:29.0967 3232        IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:00:29.0967 3232        IDriverT - detected UnsignedFile.Multi.Generic (1)
20:00:29.0982 3232        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:00:30.0107 3232        Imapi - ok
20:00:30.0154 3232        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:00:30.0295 3232        ImapiService - ok
20:00:30.0295 3232        ini910u - ok
20:00:30.0326 3232        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
20:00:30.0467 3232        IntelIde - ok
20:00:30.0498 3232        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:00:30.0638 3232        intelppm - ok
20:00:30.0654 3232        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
20:00:30.0795 3232        Ip6Fw - ok
20:00:30.0842 3232        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:00:30.0967 3232        IpFilterDriver - ok
20:00:31.0013 3232        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:00:31.0138 3232        IpInIp - ok
20:00:31.0170 3232        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:00:31.0342 3232        IpNat - ok
20:00:31.0357 3232        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:00:31.0482 3232        IPSec - ok
20:00:31.0513 3232        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:00:31.0592 3232        IRENUM - ok
20:00:31.0623 3232        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:00:31.0763 3232        isapnp - ok
20:00:31.0888 3232        JavaQuickStarterService (5fd5865dc1a2100f8d4cf000ee5409a3) C:\Programme\Java\jre6\bin\jqs.exe
20:00:31.0998 3232        JavaQuickStarterService - ok
20:00:32.0029 3232        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:00:32.0154 3232        Kbdclass - ok
20:00:32.0185 3232        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:00:32.0310 3232        kbdhid - ok
20:00:32.0342 3232        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:00:32.0482 3232        kmixer - ok
20:00:32.0513 3232        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:00:32.0623 3232        KSecDD - ok
20:00:32.0685 3232        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:00:32.0763 3232        lanmanserver - ok
20:00:32.0826 3232        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
20:00:32.0935 3232        lanmanworkstation - ok
20:00:32.0935 3232        lbrtfdc - ok
20:00:32.0998 3232        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:00:33.0138 3232        LmHosts - ok
20:00:33.0170 3232        MBAMSwissArmy  (0db7527db188c7d967a37bb51bbf3963) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
20:00:33.0185 3232        MBAMSwissArmy - ok
20:00:33.0295 3232        McAfee SiteAdvisor Service (6c3d154fff0a97a6c3d9f78d60c41655) C:\Programme\McAfee\SiteAdvisor\McSACore.exe
20:00:33.0576 3232        McAfee SiteAdvisor Service - ok
20:00:33.0701 3232        McMPFSvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
20:00:33.0810 3232        McMPFSvc - ok
20:00:33.0826 3232        mcmscsvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
20:00:33.0857 3232        mcmscsvc - ok
20:00:33.0857 3232        McNaiAnn        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
20:00:33.0873 3232        McNaiAnn - ok
20:00:33.0888 3232        McNASvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
20:00:33.0904 3232        McNASvc - ok
20:00:33.0998 3232        McODS          (42117cbc4849a5cf11129912dabbdeca) C:\Programme\McAfee\VirusScan\mcods.exe
20:00:34.0045 3232        McODS - ok
20:00:34.0045 3232        McProxy        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
20:00:34.0076 3232        McProxy - ok
20:00:34.0170 3232        McShield        (593fa4c378818ece76ba64a11ad56cf2) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mcshield.exe
20:00:34.0295 3232        McShield - ok
20:00:34.0326 3232        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:00:34.0467 3232        Messenger - ok
20:00:34.0513 3232        mfeapfk        (43c31bdf404a6d7a7ac1bfd5ead2a566) C:\WINDOWS\system32\drivers\mfeapfk.sys
20:00:34.0545 3232        mfeapfk - ok
20:00:34.0576 3232        mfeavfk        (c1dc5f42d3367f33b6451be78b38bd46) C:\WINDOWS\system32\drivers\mfeavfk.sys
20:00:34.0607 3232        mfeavfk - ok
20:00:34.0607 3232        mfeavfk01 - ok
20:00:34.0623 3232        mfebopk        (0435c43f4c2be01b84868ad2a906397b) C:\WINDOWS\system32\drivers\mfebopk.sys
20:00:34.0670 3232        mfebopk - ok
20:00:34.0701 3232        mfefire        (7e1f8b1bdc8240f08bd358b3a466c005) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe
20:00:34.0810 3232        mfefire - ok
20:00:34.0857 3232        mfefirek        (4ea6ff90015424517843e931448e00f1) C:\WINDOWS\system32\drivers\mfefirek.sys
20:00:34.0873 3232        mfefirek - ok
20:00:34.0935 3232        mfehidk        (d1e998748ba24a731106611d535c6bbf) C:\WINDOWS\system32\drivers\mfehidk.sys
20:00:34.0982 3232        mfehidk - ok
20:00:35.0045 3232        mfendisk        (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys
20:00:35.0060 3232        mfendisk - ok
20:00:35.0060 3232        mfendiskmp      (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys
20:00:35.0092 3232        mfendiskmp - ok
20:00:35.0123 3232        mferkdet        (f454a13377f0a006d20a8c14a753c432) C:\WINDOWS\system32\drivers\mferkdet.sys
20:00:35.0154 3232        mferkdet - ok
20:00:35.0185 3232        mferkdk        (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys
20:00:35.0201 3232        mferkdk - ok
20:00:35.0248 3232        mfesmfk        (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys
20:00:35.0263 3232        mfesmfk - ok
20:00:35.0279 3232        mfetdi2k        (070d3faf2eac417c59d8674a8752f7a6) C:\WINDOWS\system32\drivers\mfetdi2k.sys
20:00:35.0295 3232        mfetdi2k - ok
20:00:35.0388 3232        mfevtp          (b10c4efd40810c08f4b44df2efcb54f7) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe
20:00:35.0498 3232        mfevtp - ok
20:00:35.0529 3232        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:00:35.0670 3232        mnmdd - ok
20:00:35.0717 3232        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:00:35.0842 3232        mnmsrvc - ok
20:00:35.0935 3232        MOBKbackup      (aea8691282dd0afb4b753e378c5501f5) C:\Programme\McAfee Online Backup\MOBKbackup.exe
20:00:36.0045 3232        MOBKbackup - ok
20:00:36.0076 3232        MOBKFilter      (e896775837a8bce436348df460522394) C:\WINDOWS\system32\DRIVERS\MOBK.sys
20:00:36.0092 3232        MOBKFilter - ok
20:00:36.0123 3232        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:00:36.0263 3232        Modem - ok
20:00:36.0279 3232        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:00:36.0420 3232        Mouclass - ok
20:00:36.0467 3232        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:00:36.0592 3232        mouhid - ok
20:00:36.0607 3232        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:00:36.0732 3232        MountMgr - ok
20:00:36.0779 3232        MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
20:00:36.0920 3232        MozillaMaintenance - ok
20:00:37.0013 3232        mozybackup      (55b717af54ac492fbd275835e5b485ad) C:\Programme\MozyHome\mozybackup.exe
20:00:37.0029 3232        mozybackup - ok
20:00:37.0029 3232        mozyFilter      (8e5f185f04d4ff203afbb0fd2b609e88) C:\WINDOWS\system32\DRIVERS\mozy.sys
20:00:37.0045 3232        mozyFilter - ok
20:00:37.0060 3232        mraid35x - ok
20:00:37.0076 3232        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:00:37.0217 3232        MRxDAV - ok
20:00:37.0279 3232        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:00:37.0420 3232        MRxSmb - ok
20:00:37.0451 3232        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:00:37.0607 3232        MSDTC - ok
20:00:37.0623 3232        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:00:37.0763 3232        Msfs - ok
20:00:37.0779 3232        MSIServer - ok
20:00:37.0842 3232        MSK80Service    (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
20:00:37.0857 3232        MSK80Service - ok
20:00:37.0904 3232        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:00:38.0045 3232        MSKSSRV - ok
20:00:38.0045 3232        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:00:38.0170 3232        MSPCLOCK - ok
20:00:38.0217 3232        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:00:38.0342 3232        MSPQM - ok
20:00:38.0357 3232        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:00:38.0498 3232        mssmbios - ok
20:00:38.0529 3232        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:00:38.0607 3232        Mup - ok
20:00:38.0670 3232        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:00:38.0826 3232        napagent - ok
20:00:38.0842 3232        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:00:38.0982 3232        NDIS - ok
20:00:39.0013 3232        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:00:39.0092 3232        NdisTapi - ok
20:00:39.0123 3232        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:00:39.0263 3232        Ndisuio - ok
20:00:39.0310 3232        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:00:39.0451 3232        NdisWan - ok
20:00:39.0467 3232        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:00:39.0545 3232        NDProxy - ok
20:00:39.0560 3232        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:00:39.0685 3232        NetBIOS - ok
20:00:39.0701 3232        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:00:39.0873 3232        NetBT - ok
20:00:39.0935 3232        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:00:40.0060 3232        NetDDE - ok
20:00:40.0076 3232        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:00:40.0217 3232        NetDDEdsdm - ok
20:00:40.0232 3232        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:00:40.0357 3232        Netlogon - ok
20:00:40.0388 3232        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:00:40.0545 3232        Netman - ok
20:00:40.0576 3232        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:00:40.0638 3232        Nla - ok
20:00:40.0670 3232        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:00:40.0795 3232        Npfs - ok
20:00:40.0857 3232        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:00:41.0013 3232        Ntfs - ok
20:00:41.0029 3232        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:00:41.0154 3232        NtLmSsp - ok
20:00:41.0201 3232        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:00:41.0373 3232        NtmsSvc - ok
20:00:41.0404 3232        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:00:41.0545 3232        Null - ok
20:00:41.0576 3232        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:00:41.0701 3232        NwlnkFlt - ok
20:00:41.0717 3232        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:00:41.0873 3232        NwlnkFwd - ok
20:00:41.0998 3232        ose            (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
20:00:42.0045 3232        ose - ok
20:00:42.0092 3232        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
20:00:42.0217 3232        Parport - ok
20:00:42.0232 3232        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:00:42.0373 3232        PartMgr - ok
20:00:42.0404 3232        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:00:42.0545 3232        ParVdm - ok
20:00:42.0560 3232        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:00:42.0717 3232        PCI - ok
20:00:42.0732 3232        PCIDump - ok
20:00:42.0779 3232        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\drivers\PCIIde.sys
20:00:42.0904 3232        PCIIde - ok
20:00:42.0951 3232        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:00:43.0092 3232        Pcmcia - ok
20:00:43.0107 3232        PDCOMP - ok
20:00:43.0123 3232        PDFRAME - ok
20:00:43.0123 3232        PDRELI - ok
20:00:43.0138 3232        PDRFRAME - ok
20:00:43.0154 3232        perc2 - ok
20:00:43.0154 3232        perc2hib - ok
20:00:43.0217 3232        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:00:43.0232 3232        PlugPlay - ok
20:00:43.0248 3232        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:00:43.0373 3232        PolicyAgent - ok
20:00:43.0388 3232        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:00:43.0529 3232        PptpMiniport - ok
20:00:43.0576 3232        PRISM_A02      (57e95881e5f014816a8a53ad94ee0c48) C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys
20:00:43.0607 3232        PRISM_A02 ( UnsignedFile.Multi.Generic ) - warning
20:00:43.0607 3232        PRISM_A02 - detected UnsignedFile.Multi.Generic (1)
20:00:43.0623 3232        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:00:43.0748 3232        ProtectedStorage - ok
20:00:43.0779 3232        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:00:43.0904 3232        PSched - ok
20:00:43.0951 3232        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:00:44.0092 3232        Ptilink - ok
20:00:44.0092 3232        ql1080 - ok
20:00:44.0107 3232        Ql10wnt - ok
20:00:44.0107 3232        ql12160 - ok
20:00:44.0123 3232        ql1240 - ok
20:00:44.0123 3232        ql1280 - ok
20:00:44.0154 3232        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:00:44.0279 3232        RasAcd - ok
20:00:44.0326 3232        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:00:44.0482 3232        RasAuto - ok
20:00:44.0513 3232        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:00:44.0638 3232        Rasl2tp - ok
20:00:44.0701 3232        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:00:44.0857 3232        RasMan - ok
20:00:44.0873 3232        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:00:44.0998 3232        RasPppoe - ok
20:00:45.0013 3232        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:00:45.0154 3232        Raspti - ok
20:00:45.0201 3232        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:00:45.0357 3232        Rdbss - ok
20:00:45.0373 3232        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:00:45.0498 3232        RDPCDD - ok
20:00:45.0545 3232        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:00:45.0685 3232        rdpdr - ok
20:00:45.0748 3232        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:00:45.0826 3232        RDPWD - ok
20:00:45.0857 3232        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:00:46.0013 3232        RDSessMgr - ok
20:00:46.0045 3232        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:00:46.0170 3232        redbook - ok
20:00:46.0217 3232        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:00:46.0342 3232        RemoteAccess - ok
20:00:46.0373 3232        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
20:00:46.0513 3232        RemoteRegistry - ok
20:00:46.0545 3232        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:00:46.0670 3232        RpcLocator - ok
20:00:46.0732 3232        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:00:46.0779 3232        RpcSs - ok
20:00:46.0842 3232        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:00:46.0998 3232        RSVP - ok
20:00:47.0045 3232        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:00:47.0170 3232        SamSs - ok
20:00:47.0185 3232        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:00:47.0342 3232        SCardSvr - ok
20:00:47.0404 3232        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:00:47.0545 3232        Schedule - ok
20:00:47.0560 3232        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:00:47.0638 3232        Secdrv - ok
20:00:47.0654 3232        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:00:47.0795 3232        seclogon - ok
20:00:47.0810 3232        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:00:47.0951 3232        SENS - ok
20:00:47.0982 3232        serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:00:48.0107 3232        serenum - ok
20:00:48.0123 3232        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
20:00:48.0263 3232        Serial - ok
20:00:48.0295 3232        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
20:00:48.0420 3232        Sfloppy - ok
20:00:48.0482 3232        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:00:48.0638 3232        SharedAccess - ok
20:00:48.0685 3232        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:00:48.0717 3232        ShellHWDetection - ok
20:00:48.0732 3232        Simbad - ok
20:00:48.0795 3232        smwdm          (4aa922332433cdeb8b82c072c212e32e) C:\WINDOWS\system32\drivers\smwdm.sys
20:00:48.0857 3232        smwdm - ok
20:00:48.0873 3232        Sparrow - ok
20:00:48.0935 3232        spkrmon        (4a205d78d17e6234986ddcd0da2761e9) C:\Programme\Analog Devices\SoundMAX\spkrmon.exe
20:00:49.0060 3232        spkrmon ( UnsignedFile.Multi.Generic ) - warning
20:00:49.0060 3232        spkrmon - detected UnsignedFile.Multi.Generic (1)
20:00:49.0107 3232        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:00:49.0232 3232        splitter - ok
20:00:49.0279 3232        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:00:49.0310 3232        Spooler - ok
20:00:49.0342 3232        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:00:49.0420 3232        sr - ok
20:00:49.0482 3232        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:00:49.0592 3232        srservice - ok
20:00:49.0638 3232        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:00:49.0748 3232        Srv - ok
20:00:49.0795 3232        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:00:49.0873 3232        SSDPSRV - ok
20:00:49.0904 3232        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:00:50.0076 3232        stisvc - ok
20:00:50.0107 3232        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:00:50.0248 3232        swenum - ok
20:00:50.0263 3232        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:00:50.0388 3232        swmidi - ok
20:00:50.0404 3232        SwPrv - ok
20:00:50.0404 3232        symc810 - ok
20:00:50.0420 3232        symc8xx - ok
20:00:50.0420 3232        sym_hi - ok
20:00:50.0435 3232        sym_u3 - ok
20:00:50.0467 3232        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:00:50.0638 3232        sysaudio - ok
20:00:50.0670 3232        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:00:50.0795 3232        SysmonLog - ok
20:00:50.0826 3232        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:00:50.0998 3232        TapiSrv - ok
20:00:51.0045 3232        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:00:51.0076 3232        Tcpip - ok
20:00:51.0107 3232        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:00:51.0232 3232        TDPIPE - ok
20:00:51.0263 3232        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:00:51.0404 3232        TDTCP - ok
20:00:51.0420 3232        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:00:51.0545 3232        TermDD - ok
20:00:51.0592 3232        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:00:51.0748 3232        TermService - ok
20:00:51.0795 3232        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:00:51.0826 3232        Themes - ok
20:00:51.0873 3232        TlntSvr        (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
20:00:51.0951 3232        TlntSvr - ok
20:00:51.0951 3232        TosIde - ok
20:00:51.0998 3232        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:00:52.0123 3232        TrkWks - ok
20:00:52.0170 3232        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:00:52.0326 3232        Udfs - ok
20:00:52.0326 3232        ultra - ok
20:00:52.0388 3232        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:00:52.0576 3232        Update - ok
20:00:52.0607 3232        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:00:52.0732 3232        upnphost - ok
20:00:52.0779 3232        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:00:52.0904 3232        UPS - ok
20:00:52.0920 3232        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:00:53.0138 3232        usbehci - ok
20:00:53.0217 3232        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:00:53.0529 3232        usbhub - ok
20:00:53.0545 3232        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:00:53.0795 3232        usbprint - ok
20:00:53.0810 3232        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:00:53.0935 3232        USBSTOR - ok
20:00:53.0967 3232        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:00:54.0092 3232        usbuhci - ok
20:00:54.0107 3232        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:00:54.0232 3232        VgaSave - ok
20:00:54.0248 3232        ViaIde - ok
20:00:54.0263 3232        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:00:54.0388 3232        VolSnap - ok
20:00:54.0451 3232        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:00:54.0545 3232        VSS - ok
20:00:54.0576 3232        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:00:54.0732 3232        W32Time - ok
20:00:54.0748 3232        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:00:54.0920 3232        Wanarp - ok
20:00:54.0935 3232        WDICA - ok
20:00:54.0951 3232        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:00:55.0107 3232        wdmaud - ok
20:00:55.0138 3232        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:00:55.0279 3232        WebClient - ok
20:00:56.0263 3232        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:00:56.0623 3232        winmgmt - ok
20:00:56.0670 3232        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
20:00:56.0763 3232        WmdmPmSN - ok
20:00:56.0826 3232        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
20:00:56.0888 3232        Wmi - ok
20:00:56.0935 3232        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:00:57.0123 3232        WmiApSrv - ok
20:00:57.0279 3232        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
20:00:57.0498 3232        WMPNetworkSvc - ok
20:00:57.0545 3232        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys
20:00:57.0592 3232        WpdUsb - ok
20:00:57.0638 3232        WS2IFSL        (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
20:00:57.0763 3232        WS2IFSL - ok
20:00:57.0810 3232        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:00:57.0935 3232        wscsvc - ok
20:00:57.0982 3232        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:00:58.0107 3232        wuauserv - ok
20:00:58.0138 3232        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:00:58.0201 3232        WudfPf - ok
20:00:58.0217 3232        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:00:58.0263 3232        WudfRd - ok
20:00:58.0295 3232        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
20:00:58.0326 3232        WudfSvc - ok
20:00:58.0373 3232        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:00:58.0560 3232        WZCSVC - ok
20:00:58.0592 3232        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:00:58.0748 3232        xmlprov - ok
20:00:58.0779 3232        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
20:00:58.0810 3232        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected
20:00:58.0810 3232        \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0)
20:00:58.0842 3232        MBR (0x1B8)    (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR2
20:00:58.0967 3232        \Device\Harddisk1\DR2 - ok
20:00:58.0967 3232        Boot (0x1200)  (beaff209fcf932c1d7ff731f54d95dc9) \Device\Harddisk0\DR0\Partition0
20:00:58.0982 3232        \Device\Harddisk0\DR0\Partition0 - ok
20:00:58.0982 3232        Boot (0x1200)  (03db26b74f1015c63ae2e7b6cbcb7005) \Device\Harddisk1\DR2\Partition0
20:00:58.0982 3232        \Device\Harddisk1\DR2\Partition0 - ok
20:00:58.0982 3232        ============================================================
20:00:58.0982 3232        Scan finished
20:00:58.0982 3232        ============================================================
20:00:58.0998 3112        Detected object count: 9
20:00:58.0998 3112        Actual detected object count: 9
20:34:53.0857 3112        aspnet_state ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:53.0982 3112        aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:53.0982 3112        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:53.0982 3112        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:53.0997 3112        avmeject ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:53.0997 3112        avmeject ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:53.0997 3112        bkn50USB ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:53.0997 3112        bkn50USB ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:53.0997 3112        ialm ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:53.0997 3112        ialm ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:53.0997 3112        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:53.0997 3112        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:54.0013 3112        PRISM_A02 ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:54.0013 3112        PRISM_A02 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:54.0013 3112        spkrmon ( UnsignedFile.Multi.Generic ) - skipped by user
20:34:54.0013 3112        spkrmon ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:54.0060 3112        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - skipped by user
20:34:54.0075 3112        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Skip

cosinus 12.06.2012 22:08
Zitat:
\Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - skipped by user
Den SInowal bitte mit dem TDSS-Killer löschen lassen, starte Windows danach neu und mach ein neues Log mit diesem Tool. Poste es wieder mit CODE-Tags umschlossen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:37 Uhr.
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131