Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Nach Neuaufsetzen Grafikfehler, PC langsam (https://www.trojaner-board.de/134660-neuaufsetzen-grafikfehler-pc-langsam.html)

bmell 08.05.2013 14:06
Nach Neuaufsetzen Grafikfehler, PC langsam
 
Hallo Anti-Virengemeinde :-)


Gestern habe ich einen etwas älteren Windows PC geschenkt bekommen den ich kurzerhand formatiert und neu aufgesetzt habe.
Ich habe mir dazu W7 Ultimate (evtl. nicht die beste Wahl) aus dem Netz gezogen (von Digitalrivers oder wie die offiz. MSFT
Spiegelseite heisst) und losgelegt. Nach dem Aufsetzen fiel mir auf, daß bei der weiteren Einrichtung ab und an der Display kurz
aus geht, umschaltet? ,so dass ich kurzerhand den hier oft erwähnten ESET Scanner zog und einen scan durchführte.
Unter Quellen, sah ich aber auch einen Microsoft Terminal-Adapter(?), den ich so bewusst noch nie wahrgenommen hatte. Da ich von Natur
aus etwas zur Paranoia neige, vollzog ich einen weiteren Scan mit MBAM, der aber keine Ergebnisse lieferte.
Auf Anraten eines Freundes hin, zog ich mir noch RogieKiller. Dieser fand folgende Einträge:



Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000001


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=dword:00000001


Da ich mir hierauf keinen reim machen konnte, besorgte ich mir noch den hier oft erwähnten GMER, der mir folgende Resultate liferte:

Code:

GMER Logfile:

       
Code:

       
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-08 14:41:00
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_SP2004C rev.VM100-33 186,31GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\PanAm\AppData\Local\Temp\agloapow.sys


---- Kernel code sections - GMER 2.1 ----

.text   ntkrnlpa.exe!ZwRollbackEnlistment + 140D            8287DA09 1 Byte  [06]
.text   ntkrnlpa.exe!KiDispatchInterrupt + 5A2              828B71F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?       system32\drivers\52684182.sys                       The system cannot find the path specified. !
?       C:\Windows\system32\drivers\TrueSight.sys           The system cannot find the file specified. !

---- Devices - GMER 2.1 ----

Device  \FileSystem\55470833 \Device\KLMD13082012_208040_B  52684182.sys

---- EOF - GMER 2.1 ----

--- --- ---

Hier auch noch das von euch oft gewünschte OTL.txt und ADWCleaner Log

OTL Logfile:
Code:
OTL logfile created on: 08.05.2013 14:54:34 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\PanAm\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 68,20% Memory free
4,00 Gb Paging File | 3,20 Gb Available in Paging File | 80,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 186,21 Gb Total Space | 169,81 Gb Free Space | 91,19% Space Free | Partition Type: NTFS
 
Computer Name: PANAM-PC | User Name: PanAm | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\PanAm\Downloads\gmer_2.1.19163.exe ()
PRC - C:\Users\PanAm\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\PanAm\Downloads\gmer_2.1.19163.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (nvUpdatusService) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (agloapow) -- C:\Users\PanAm\AppData\Local\Temp\agloapow.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (tsusbhub) -- C:\Windows\System32\drivers\tsusbhub.sys (Microsoft Corporation)
DRV - (Synth3dVsc) -- C:\Windows\System32\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (terminpt) -- C:\Windows\System32\drivers\terminpt.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) -- C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (Si3114r5) -- C:\Windows\System32\drivers\Si3114r5.sys (Silicon Image, Inc)
DRV - (SiFilter) -- C:\Windows\System32\drivers\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (SiRemFil) -- C:\Windows\System32\drivers\SiRemFil.sys (Silicon Image, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3C 51 DA B9 F8 CF C3 01  [binary data]
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\S-1-5-21-4038230851-2195228265-2914162078-1003\..\SearchScopes,DefaultScope =
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.7
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2004.01.01 01:56:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2004.01.01 01:56:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\PanAm\AppData\Roaming\Mozilla\Extensions
[2013.05.08 13:59:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\PanAm\AppData\Roaming\Mozilla\Firefox\Profiles\h4n7bjy7.default\extensions
[2013.05.08 13:59:57 | 000,134,804 | ---- | M] () (No name found) -- C:\Users\PanAm\AppData\Roaming\Mozilla\Firefox\Profiles\h4n7bjy7.default\extensions\adblockpopups@jessehakanen.net.xpi
[2013.05.08 13:59:24 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\PanAm\AppData\Roaming\Mozilla\Firefox\Profiles\h4n7bjy7.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2004.01.01 01:56:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013.04.10 08:57:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.04.10 10:18:46 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.04.10 10:18:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.04.10 10:18:46 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.04.10 10:18:46 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.04.10 10:18:46 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.04.10 10:18:46 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4038230851-2195228265-2914162078-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\PanAm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\PanAm\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E4D9300-4359-4E2F-B3A6-A811181D5E85}: NameServer = 8.8.8.8,8.8.4.4
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.08 14:17:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\What's Running
[2013.05.08 14:17:47 | 000,000,000 | ---D | C] -- C:\Program Files\WhatsRunning
[2013.05.08 14:02:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2013.05.08 14:01:56 | 000,000,000 | ---D | C] -- C:\Program Files\Panda USB Vaccine
[2013.05.08 14:01:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[2013.05.08 12:16:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.08 12:16:56 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.05.08 12:16:56 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.05.08 11:54:21 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013.05.07 19:06:21 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Local\Apple Computer
[2013.05.07 19:06:19 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Apple Computer
[2013.05.07 19:06:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.05.07 19:05:55 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2013.05.07 19:05:03 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.05.07 19:05:02 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.05.07 19:05:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013.05.07 19:05:02 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.05.07 19:04:24 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Local\Apple
[2013.05.07 19:04:23 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2013.05.07 19:04:05 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2013.05.07 19:03:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2013.05.07 19:03:53 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2013.05.07 19:03:25 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.05.07 15:45:50 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013.05.07 15:44:41 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2013.05.07 15:44:11 | 000,053,024 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2013.05.07 15:43:39 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2013.05.07 15:43:33 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2013.05.07 15:40:01 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Canneverbe Limited
[2013.05.07 15:40:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2013.05.07 15:39:37 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP
[2013.05.07 15:29:14 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Macromedia
[2013.05.07 15:29:14 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Local\Macromedia
[2013.05.07 15:29:14 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Adobe
[2013.05.07 15:28:41 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2013.05.07 15:26:20 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Dropbox
[2013.05.07 14:14:10 | 000,000,000 | ---D | C] -- C:\Users\PanAm\Desktop\7125v1D
[2013.05.07 13:26:37 | 000,000,000 | ---D | C] -- C:\Users\PanAm\Desktop\RK_Quarantine
[2013.05.07 13:23:10 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Roaming\Malwarebytes
[2013.05.07 13:23:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.05.07 13:22:57 | 000,000,000 | ---D | C] -- C:\Users\PanAm\AppData\Local\Programs
[2004.01.01 01:54:10 | 020,900,984 | ---- | C] (Mozilla) -- C:\Users\PanAm\Firefox Setup 20.0.1.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.08 14:23:05 | 000,007,599 | ---- | M] () -- C:\Users\PanAm\AppData\Local\Resmon.ResmonCfg
[2013.05.08 14:17:48 | 000,000,957 | ---- | M] () -- C:\Users\PanAm\Desktop\What's Running.lnk
[2013.05.08 14:00:42 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.08 14:00:42 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.08 13:55:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.08 13:55:44 | 1610,260,480 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.08 13:54:53 | 000,016,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.08 13:54:53 | 000,016,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.08 12:50:44 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.05.08 12:10:21 | 000,000,000 | ---- | M] () -- C:\Users\PanAm\defogger_reenable
[2013.05.07 19:06:09 | 000,001,753 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.05.07 19:00:46 | 000,001,411 | ---- | M] () -- C:\Users\PanAm\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013.05.07 16:11:57 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.07 15:49:38 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013.05.07 15:46:38 | 000,001,049 | ---- | M] () -- C:\Users\PanAm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.07 15:39:39 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2013.05.07 15:30:14 | 000,013,373 | ---- | M] () -- C:\Users\PanAm\Desktop\RogueKiller - Shortcut.lnk
[2013.05.07 14:16:03 | 004,402,436 | R--- | M] () -- C:\Users\PanAm\Desktop\everesthome220.zip
 
========== Files Created - No Company Name ==========
 
[2013.05.08 14:17:48 | 000,000,957 | ---- | C] () -- C:\Users\PanAm\Desktop\What's Running.lnk
[2013.05.08 12:16:57 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.05.08 12:10:21 | 000,000,000 | ---- | C] () -- C:\Users\PanAm\defogger_reenable
[2013.05.07 19:06:09 | 000,001,753 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.05.07 19:04:23 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2013.05.07 15:49:38 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013.05.07 15:46:38 | 000,001,049 | ---- | C] () -- C:\Users\PanAm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.07 15:39:39 | 000,001,891 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2013.05.07 15:39:39 | 000,001,849 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2013.05.07 15:30:14 | 000,013,373 | ---- | C] () -- C:\Users\PanAm\Desktop\RogueKiller - Shortcut.lnk
[2013.05.07 14:15:58 | 004,402,436 | R--- | C] () -- C:\Users\PanAm\Desktop\everesthome220.zip
[2004.01.01 01:09:03 | 000,007,599 | ---- | C] () -- C:\Users\PanAm\AppData\Local\Resmon.ResmonCfg
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.05.07 15:40:01 | 000,000,000 | ---D | M] -- C:\Users\PanAm\AppData\Roaming\Canneverbe Limited
[2013.05.07 19:01:37 | 000,000,000 | ---D | M] -- C:\Users\PanAm\AppData\Roaming\Dropbox
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---


[/CODE]



AdwCleaner Logfile:
Code:
# AdwCleaner v2.300 - Logfile created 05/08/2013 at 13:19:44
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : PanAm - PANAM-PC
# Boot Mode : Normal
# Running from : C:\Users\PanAm\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (de)

File : C:\Users\PanAm\AppData\Roaming\Mozilla\Firefox\Profiles\h4n7bjy7.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [923 octets] - [08/05/2013 12:55:54]
AdwCleaner[R2].txt - [855 octets] - [08/05/2013 13:19:44]
AdwCleaner[S1].txt - [316 octets] - [08/05/2013 12:57:05]

########## EOF - C:\AdwCleaner[R2].txt - [973 octets] ##########
--- --- ---


[/CODE]


Ebenfalls nahm ich kleinere Grafikfehler wahr, wie z.B. dass eine horizontale Pixel-Linie bei diversen Fonts/Strings fehlten, so dass ich nun Angst habe kompromitiert
worden zu sein.

Im ADWCleaner hatte ich auf säubern geklickt, das war auch das einzige was ich ohne eure Hilfe in einem Anfall von AKtionismus getan habe.

Es wäre klasse, wenn ihr mir weiterhelfen könntet.


LG Bernd

Weiterhin sind auch folgende Ports offen, bzw. im "Listen"-Mode - evtl. hilft das auch weiter:

C:\Users\PanAm>netstat -an | find "LISTEN"
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:554 0.0.0.0:0 LISTENING
TCP 0.0.0.0:2869 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING
TCP 0.0.0.0:10243 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING
TCP 127.0.0.1:2559 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING
TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING
TCP 192.168.0.2:139 0.0.0.0:0 LISTENING
TCP [::]:135 [::]:0 LISTENING
TCP [::]:445 [::]:0 LISTENING
TCP [::]:554 [::]:0 LISTENING
TCP [::]:2869 [::]:0 LISTENING
TCP [::]:5357 [::]:0 LISTENING
TCP [::]:10243 [::]:0 LISTENING
TCP [::]:49152 [::]:0 LISTENING
TCP [::]:49153 [::]:0 LISTENING
TCP [::]:49154 [::]:0 LISTENING
TCP [::]:49155 [::]:0 LISTENING
TCP [::]:49157 [::]:0 LISTENING

Ich habe auch noch zufällig Mal ein "DDS.SCR" aus einem anderen Forum laufen lassen und ichs ehe dort, wie von mir vermutet? etwas mit Remote Desktop Generic USB Device.
Jetzt habe ich Angst und warte erstmal auf einen Profi, Danke schonmal im Voraus!

Code:
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-5-8 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-5-8 701512]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-5-8 22856]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 62464]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\Synth3dVsc.sys [2010-11-21 77184]
S3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-21 25600]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-21 112640]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-14 311296]
Und mir fällt rad spontan noch etwas auf:

Ich habe 2 Floppy disk controller!


Einmal wörtlich "Floppy disk drives"-> Floppy disk drive

und einmal "Floppy drive controllers" -> Standard floppy disk controller"

Weiterhin sehe ich grade, dass nvtray.exe auf port 2559 unendlich viele SYN_SENT sendet.
Jetzt habe ich wirllich Bammel ...

bmell 10.05.2013 14:18
Hallo allerseits,


Mag mir wirklich niemand helfen ? ;( Ich würde das gerne am Wochenende in Angriff nehmen, da ich hier alleine wohl nicht weiterkomme.

LG Bernd

t'john 10.05.2013 19:10
:hallo:

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
:OTL

DRV - (agloapow) -- C:\Users\PanAm\AppData\Local\Temp\agloapow.sys File not found

:Files
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\PanAm\*.tmp
C:\Users\PanAm\AppData\*.dll
C:\Users\PanAm\AppData\*.exe
C:\Users\PanAm\AppData\Local\Temp\*.exe
C:\Users\PanAm\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[emptytemp]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers


danach:

3. Schritt
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

bmell 23.05.2013 12:50
hallo,

Hier die Logs:

Code:
All processes killed
========== OTL ==========
Error: No service named agloapow was found to stop!
Service\Driver key agloapow not found.
File  C:\Users\PanIngo\AppData\Local\Temp\agloapow.sys File not found not found.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
File\Folder C:\ProgramData\TEMP not found.
File\Folder C:\Users\PanIngo\*.tmp not found.
File\Folder C:\Users\PanIngo\AppData\*.dll not found.
File\Folder C:\Users\PanIngo\AppData\*.exe not found.
C:\Users\PanIngo\AppData\Local\Temp\917b0b87-3358-4e79-93de-3dfc2fc99ed0.exe moved successfully.
C:\Users\PanIngo\AppData\Local\Temp\mirc729.exe moved successfully.
C:\Users\PanIngo\AppData\Local\Temp\xmlUpdater.exe moved successfully.
File\Folder C:\Users\PanIngo\AppData\LocalLow\Sun\Java\Deployment\cache not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\PanIngo\Downloads\cmd.bat deleted successfully.
C:\Users\PanIngo\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: PanIngo
->Temp folder emptied: 481420671 bytes
->Temporary Internet Files folder emptied: 154859228 bytes
->FireFox cache emptied: 22310606 bytes
->Google Chrome cache emptied: 81026291 bytes
->Opera cache emptied: 23559600 bytes
->Flash cache emptied: 1560 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 122528241 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50461 bytes
RecycleBin emptied: 5453067788 bytes
 
Total Files Cleaned = 6.045,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05232013_133018

Files\Folders moved on Reboot...
C:\Users\PanIngo\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\PanIngo\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Code:

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.23.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
PanIngo :: PANINGO-PC [administrator]

23.05.2013 13:41:59
mbar-log-2013-05-23 (13-41-59).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 27993
Time elapsed: 5 minute(s), 48 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
AdwCleaner Logfile:
Code:
# AdwCleaner v2.301 - Logfile created 05/23/2013 at 13:48:33
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : PanIngo - PANINGO-PC
# Boot Mode : Normal
# Running from : C:\Users\PanIngo\Downloads\AdwCleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16483

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (de)

File : C:\Users\PanIngo\AppData\Roaming\Mozilla\Firefox\Profiles\p5if9kzt.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\PanIngo\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Opera v12.15.1748.0

File : C:\Users\PanIngo\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************


AdwCleaner[S1].txt - [1317 octets] - [23/05/2013 13:21:49]

########## EOF - C:\AdwCleaner[S1].txt - [1233 octets] ##########
--- --- ---

[/CODE]

Ich habe eben noch durch Zufall etwas seltsames entdeckt: einen neuen User namens "UpdatusUser" - das ist doch sicher auch was kompromitiertes ?

t'john 23.05.2013 13:32
Zitat:
einen neuen User namens "UpdatusUser" - das ist doch sicher auch was kompromitiertes ?
Das ist i.O.

Sehr gut! :daumenhoc

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



danach:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




danach:

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

bmell 23.05.2013 19:30
Danke.

ich habe das Gefphl das etwas nicht stimmt. Meine Browser sind gehijacked. Ich bekomme wenn ich auf z.B. heise.de gehe eine zanox affiliate id addiert. Auch verhalten sich einige Seiten anders. Dies ist z.B. der DL Link von heise für ccleaner:

hxxp://www.cleverbridge.com/502/cookie?affiliate=10653&redirectto=hxxp://www.piriform.com/ccleaner

Das kann doch nie und nimmer sein ?
Ich habe mal HJT laufen lassen und das ergab folgenden Log:

[CODE]
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 20:24:17, on 23.05.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16483)

FIREFOX: 21.0 (de)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\PanIngo\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [AcronisTibMounterMonitor] C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
O4 - HKLM\..\RunOnce: [Z1] cmd /c "C:\Users\PanIngo\Downloads\mbar\mbar.exe" /cleanup /s
O4 - Startup: Dropbox.lnk = PanIngo\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O8 - Extra context menu item: Mit Mipony herunterladen - file://C:\Program Files (x86)\MiPony\Browser\IEContext.htm
O9 - Extra button: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{B98EE5A0-1356-4E02-A17B-C1CA23743F45}: NameServer = 208.67.222.222,208.67.220.220
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Acronis Nonstop Backup Service (afcdpsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASUS HM Com Service (asHmComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
O23 - Service: devolo Network Service (DevoloNetworkService) - devolo AG - C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Acronis Sync Agent Service (syncagentsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 6763 bytes
--- --- ---


aswmbr:

Code:
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-23 20:36:36
-----------------------------
20:36:36.941    OS Version: Windows x64 6.1.7601 Service Pack 1
20:36:36.941    Number of processors: 4 586 0x1707
20:36:36.942    ComputerName: PANINGO-PC  UserName: PanIngo
20:36:38.772    Initialize success
20:36:48.157    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4
20:36:48.159    Disk 0 Vendor: SAMSUNG_HD103SI 1AG01118 Size: 953869MB BusType: 3
20:36:48.243    Disk 0 MBR read successfully
20:36:48.245    Disk 0 MBR scan
20:36:48.247    Disk 0 Windows 7 default MBR code
20:36:48.251    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
20:36:48.262    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      497904 MB offset 206848
20:36:48.265    Disk 0 Partition - 00    05    Extended            455862 MB offset 1019916276
20:36:48.289    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      455862 MB offset 1019916288
20:36:48.342    Disk 0 scanning C:\Windows\system32\drivers
20:36:52.782    Service scanning
20:37:01.876    Modules scanning
20:37:01.883    Disk 0 trace - called modules:
20:37:01.901    ntoskrnl.exe CLASSPNP.SYS disk.sys vidsflt.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
20:37:01.906    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007aba790]
20:37:02.115    3 CLASSPNP.SYS[fffff88001b2443f] -> nt!IofCallDriver -> [0xfffffa800790aa00]
20:37:02.120    5 vidsflt.sys[fffff88000fbd5f1] -> nt!IofCallDriver -> [0xfffffa8006990d10]
20:37:02.124    7 ACPI.sys[fffff88000f137a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-4[0xfffffa8007804680]
20:37:02.129    Scan finished successfully
20:42:59.945    Disk 0 MBR has been saved successfully to "C:\Users\PanIngo\Downloads\MBR.dat"
20:42:59.950    The log file has been saved successfully to "C:\Users\PanIngo\Downloads\aswMBR.txt"
sec check:

Code:
Results of screen317's Security Check version 0.99.63 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 Adobe Flash Player 11.7.700.202 
 Mozilla Firefox (21.0)
 Mozilla Thunderbird (17.0.6)
 Google Chrome 26.0.1410.64 
````````Process Check: objlist.exe by Laurent```````` 
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbamgui.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Gehe ich auf Google (https), dann collapsed die Seite sobald ich anfange zu tippen und eine neue Page geht auf die XSS verseucht ausschaut.

Habe auch nochmal ein RogueKiller Scan gemacht - evtl. nützt es was. Ich habe jetzt wirklich etwas Angst grade ;(

Code:
RogueKiller V8.5.4 [Mar 18 2013] durch Tigzy
mail: tigzyRK<at>gmail<dot>com

mail : tigzyRK<at>gmail<dot>com
Kommentare : hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Webseite : hxxp://tigzy.geekstogo.com/roguekiller.php
Blog : hxxp://tigzyrk.blogspot.com/

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Gestartet in : Normaler Modus
Benutzer : PanIngo [Admin Rechte]
Funktion : Scannen -- Datum : 05/23/2013 20:59:39
| ARK || FAK || MBR |

¤¤¤ Böswillige Prozesse : 0 ¤¤¤

¤¤¤ Registry-Einträge : 2 ¤¤¤
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> GEFUNDEN
[HJ DESK] HKCU\[...]\NewStartPanel : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> GEFUNDEN

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts



¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD103SI ATA Device +++++
--- User ---
[MBR] 9029de2ab50cac328dc53169fec8bd3c
[BSP] 6daa3e062875f31ee5f2921b9b81e7f4 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 497904 Mo
2 - [XXXXXX] EXTEN (0x05) [VISIBLE] Offset (sectors): 1019916276 | Size: 455862 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Abgeschlossen : << RKreport[1]_S_05232013_02d2059.txt >>
RKreport[1]_S_05232013_02d2059.txt
Code:
RogueKiller V8.5.4 [Mar 18 2013] durch Tigzy
mail: tigzyRK<at>gmail<dot>com

mail : tigzyRK<at>gmail<dot>com
Kommentare : hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Webseite : hxxp://tigzy.geekstogo.com/roguekiller.php
Blog : hxxp://tigzyrk.blogspot.com/

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Gestartet in : Normaler Modus
Benutzer : PanIngo [Admin Rechte]
Funktion : Reparierte Verknüpfungen -- Datum : 05/23/2013 21:03:11
| ARK || FAK || MBR |

¤¤¤ Böswillige Prozesse : 0 ¤¤¤

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Dateiattribute wiederhergestellt: ¤¤¤
Desktop: Success 0 / Fail 0
Schnellstart: Success 0 / Fail 0
Programme: Success 5 / Fail 0
Startmenü: Success 0 / Fail 0
Benutzer-Ordner: Success 53 / Fail 0
Eigene Dateien: Success 0 / Fail 0
Meine Favoriten: Success 0 / Fail 0
Meine Bilder: Success 0 / Fail 0
Meine Musik: Success 0 / Fail 0
Meine Videos: Success 0 / Fail 0
Lokale Laufwerke: Success 35 / Fail 0
Sicherungskopie: [NOT FOUND]

Laufwerke:
[C:] \Device\HarddiskVolume2 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped
[E:] \Device\HarddiskVolume3 -- 0x3 --> Restored

Abgeschlossen : << RKreport[5]_SC_05232013_02d2103.txt >>
RKreport[1]_S_05232013_02d2059.txt ; RKreport[2]_PR_05232013_02d2103.txt ; RKreport[3]_H_05232013_02d2103.txt ; RKreport[4]_DN_05232013_02d2103.txt ; RKreport[5]_SC_05232013_02d2103.txt

t'john 24.05.2013 10:15
der Link von heise stimmt so.

Wo ist der ESET Scan?

Bitte nichts mehr ausfuehren, ohne Anweisung!

bmell 25.05.2013 20:04
Bitte, sorry für die Verzögerung.

Code:
C:\Users\PanIngo\Downloads\coretemp_1236.exe        probably a variant of Win32/InstallIQ application
Habe auch noch einen gmer scan gemacht, im tcpview seh ich nämlich, wie nvtray.exe versucht nach aussen zu telefonieren (syn_sent)

GMER Logfile:
Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-25 21:04:03
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 SAMSUNG_HD103SI rev.1AG01118 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\PanIngo\AppData\Local\Temp\awtiyfod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69  0000000075ae1465 2 bytes [AE, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000075ae14bb 2 bytes [AE, 75]
.text  ...                                                                                                                                      * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [2436:3384]                                                                                              000007fef1f09688

---- EOF - GMER 2.1 ----
--- --- ---

t'john 26.05.2013 14:59
Zitat:
wie nvtray.exe versucht nach aussen zu telefonieren (syn_sent)
oder einfach nur nach Updates gesucht...

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

bmell 26.05.2013 15:15
Wie gehts weiter ?;) - das oberste war vom Eset ...

t'john 26.05.2013 15:31
steht alles hier: http://www.trojaner-board.de/134660-...ml#post1070531

bmell 27.05.2013 10:57
Zitat:
Zitat von t'john (Beitrag 1070531)
oder einfach nur nach Updates gesucht...
Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.
OK, weiter gehts von meiner Seite:
Hallo,


Also ich vermute (ich weiss, das hört ihr öfter) das die Sache ganz tief sitzt.
Ich habe gestern Abend nachdem ich wieder diese ports offen gesehen habe und nvtray wieder
wie wild versucht zu synchen, ein bischen rumgeschaut und musste mit Entsetzen festellen,
dass irgendein 2. OS=Chrome OS? installiert wurde, diverse Fonts und .ico´s ausgetauscht
wurden. Auch wurde ein "Editor für benutzerdefinierte Zeichen" installiert, wo man mit
Schriftarten koppeln kann an einen Programmaufruf koppeln kann? Weiterhin sind diverse
Rechte verletzt in &appdata% (kein Zugriff z.B. auf FXSAPIDebugLogFile.txt). Da muss
irgendwas geladen werden per irgendeinem Treiber? ) und es liegt dort allerlei Kram (ASP)
der niemals von mir stammen kann wie z.B. "ASP NET MMC Extensions":
[AspNet_State.Reg]
HKLM,System\CurrentControlSet\Services\aspnet_state\Parameters,"Port",0x00010001,42424
HKLM,System\CurrentControlSet\Services\aspnet_state\Parameters,"AllowRemoteConnection",0x00010001,0

Weil ich dann noch mehr Angst bekommen habe, habe ich mir Whatsrunning gezogen und mir die Ports mit
den zugehörigen Applikatione und auch Parent ID´s angesehen: Es sieh auf den ersten Blick hin
alles OK aus, ist es aber nicht: wininit.exe hat eine 468 Parent ID. Diesen kann ich aber nicht finden.
Weiterhin war dieser ja auch mehrmals? im HijackThis Log auf meine ich mich zu erinnern.
Zu dieser ominösen von mir nicht gefundenen 468er root ID führen führen diverse andere taks
via nur einem winnnit.exe (gestartet sind 2 winit.exe) ,so auch der wohl kompromitierte nvidia driver und Druckertreiber?: Per Zufall habe ich noch gesehen, dass ich
2 Fontcache Services drauf habe, wovon einer mit dem Namen "FontCache" von der Gruppe "AudioGroup"
geladen wird. Fonts haben wenig mit Audio zu tun (zumindest nach meinen Erfahrungen ;) )

Weiterhin als Service meines Erachtens auffallend (seltsamer Name):
<Service_Name>clr_optimization_v2.0.50727_32</Service_Name>
audiodg.exe ohne Namen und ohne Grösse wird via einem svchost gestartet (nicht immer?).
Ausserdem ist es unisichtbar und auf dem Desktop nirgends zu finden, wohl aber 2 desktop.ini´s?
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183
Wird dort das kompromitierte Fontsystem geladen und läd das audiodg.exe .
Ach bevor ichs vergesse: Es wurden auch Programme nachinstalliert, btw. verändert, wie z.B. PepperFlash
anstelle des von mir verwendeten FlashPlayers ... Es kann also gut sein, dass auch die ganzen VirenScanner
und Tools ausgetauscht wurden. Nur so als Hinweis, ich trau denen alles zu. Ausserdem zeigen neu
installierte Porgramme, wenn man sie instaölliert, japanische Zeichen an = japansche Version?
Falls gewünscht kann ich den ganzen Process/Task Tree irgendwohin uploaden und es Dir zukommen lassen.

Danke nochmalfür Deine Mühe, ich bin hier wirklich etwas ratlos.
Ich warte auf auf Instruktionen, LG


Code:
Results of screen317's Security Check version 0.99.63 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 Adobe Flash Player 11.7.700.202 
 Mozilla Firefox (21.0)
 Mozilla Thunderbird (17.0.6)
 Google Chrome 27.0.1453.94 
````````Process Check: objlist.exe by Laurent```````` 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

t'john 27.05.2013 12:09
Wie hast du denn den Rechner neuaufgesetzt?

Vorher formatiert oder Recovery benutzt?

bmell 30.05.2013 10:16
Formatiert und weil mein Sohn das vor Jahren schonmal hatte mit so einem Primzahlenüberschreibungstool überschrieben, sprich also ganz neu. Der PC hing aber am kurrzeitig Netz da er derzeit gerne "daddelt" wie er sich ausdrückt. Soll ich ein Gmer Log evtl. erstellen?

t'john 30.05.2013 10:35
Nein.

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

  • Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Wähle Scanne Alle Benuzer
  • Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
  • Unter Extra Registrierung, wähle bitte Benutze SafeList
  • Klicke nun auf Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.



Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

bmell 04.06.2013 10:31
Poste ich in der Mittagspause, bis gleich.
Es fühlt sich nach wie vor an, als ob ich gar micht Herr des Systems bin - alles ist angeblich sauber. Evtl. ist da eine virtuelle HD oder sowas?
Mbar sys log sagt zumindest:

"Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007add790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP4T0L0-4\
Lower Device Object: 0xfffffa8007829060
Lower Device Driver Name: \Driver\atapi\"

OTL.txt ist ledier zu gross, von daher hab ichs nache pastebin kopiert:
hxxp://pastebin.com/PVtDpZGJ


extras:
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 04.06.2013 11:45:18 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\PanIngo\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,64 Gb Available Physical Memory | 83,06% Memory free
16,00 Gb Paging File | 14,48 Gb Available in Paging File | 90,53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 486,23 Gb Total Space | 428,31 Gb Free Space | 88,09% Space Free | Partition Type: NTFS
Drive E: | 445,18 Gb Total Space | 408,06 Gb Free Space | 91,66% Space Free | Partition Type: NTFS
 
Computer Name: PANINGO-PC | User Name: PanIngo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
[HKEY_USERS\S-1-5-21-2330493419-2886327782-1176343205-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00F07621-0D1B-497D-8FA8-C2C9EB319CA4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{02C46F84-A45F-492D-931E-3E433F21567D}" = lport=19375 | protocol=17 | dir=in | app=c:\program files (x86)\devolo\dlan\devolonetsvc.exe |
"{2794DEB8-0D8C-465D-B800-E776F241415C}" = rport=137 | protocol=17 | dir=out | app=system |
"{425D5774-CDD8-46AD-86FF-27467671EC27}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{566462FD-FA01-4DB3-BF65-BFCC48309DB5}" = lport=138 | protocol=17 | dir=in | app=system |
"{5A49DA42-5D14-47B2-919C-0881BBEDF709}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7FF6EB8D-F9B4-40C8-8289-4AFD8D021B2D}" = lport=445 | protocol=6 | dir=in | app=system |
"{850C813D-92AF-41F7-91BF-13B11475530E}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework64\v3.0\windows communication foundation\smsvchost.exe |
"{8F980233-EE7E-4D02-8B8D-21A86E403F64}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8FFA91F0-C5D8-4DCE-A80C-5AC172D4E9E5}" = lport=137 | protocol=17 | dir=in | app=system |
"{93006F6C-A3F4-4A10-9817-64D2633A2B46}" = rport=445 | protocol=6 | dir=out | app=system |
"{A531BD57-66E8-4C39-A7F0-62513D38A4E3}" = rport=139 | protocol=6 | dir=out | app=system |
"{A9AB011C-A470-48DD-9E01-118B7069EB62}" = lport=10243 | protocol=6 | dir=in | app=system |
"{A9E7A435-9F33-458B-812C-7B468AD00919}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BEE8A920-C0B4-4C39-943A-CC2177FA61B3}" = lport=139 | protocol=6 | dir=in | app=system |
"{C627E470-E0FC-4DE0-A231-19EA19DEA092}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CF0D0405-617E-4C0E-A82F-8864DC4C220F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D9D27E45-C293-4DCA-AD75-C7A9C47A19C2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E88A5DBB-EA78-45A5-88F5-4CE4D6161DFB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E9C60C13-1EF4-483B-AA13-9AEF2D5DD5C2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EDB1C6D0-FFA7-467C-B3C6-05509B4A57C6}" = lport=19376 | protocol=6 | dir=in | app=c:\program files (x86)\devolo\dlan\devolonetsvc.exe |
"{EDDB5CED-FCE1-4750-AD41-04E8CDEE0F39}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F114E2D1-BB40-4D2B-B0E1-7FFC28D59CB5}" = rport=138 | protocol=17 | dir=out | app=system |
"{FF17AC2E-94EC-4843-8C94-0F0889125BEC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0335E719-A010-4D50-8AE2-0B7BED2E08DB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{044EC376-7F45-4622-BD56-FB5E15F761CF}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\acronis\syncagent\syncagentsrv.exe |
"{06411F98-5894-4FB4-93A7-C54B12B714B7}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{0BD65A5B-C479-4941-9431-270518A9AB96}" = protocol=6 | dir=in | app=c:\users\paningo\appdata\roaming\dropbox\bin\dropbox.exe |
"{216E809E-32D3-4C3A-80A3-5C8DE0DA9F8D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{33C33FB1-85DB-4C43-A26F-ACA0D32F96C7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3BEFE39D-C02B-448F-BEF2-D223CF22359F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{428A6FBA-2F20-495A-A78C-18139BC2A345}" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"{452B3858-6830-47C8-BB57-95583AB94E70}" = protocol=6 | dir=out | app=system |
"{4CB2E9E4-E76A-4521-886D-246AC1AE8146}" = protocol=17 | dir=in | app=c:\users\paningo\appdata\roaming\dropbox\bin\dropbox.exe |
"{4D1D56C4-6DEF-407B-AC6D-097C8F54A9B6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{524C4DB5-85F3-42BE-8507-6A7D856C42AF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6D40266C-EF26-4B91-8570-47D6C5312BAC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7410A231-F811-455E-BB32-BE0BB5AAD2CC}" = protocol=17 | dir=in | app=c:\program files (x86)\mipony\mipony.exe |
"{7FE41EDB-5D57-4CDD-94CC-D753A32F0A29}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{85324534-AB39-43C3-BBCA-90C778D8682A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{98973326-E55E-40BD-A829-97086636BF8A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A903F49B-FE9D-4251-B705-DA6AA2E3280B}" = protocol=6 | dir=in | app=c:\program files (x86)\fiddler2\fiddler.exe |
"{B3E82515-C95E-456E-85EE-350354799D50}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C222E357-A268-43F4-93EB-0102BFB10546}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C6A1D216-6A3C-4A52-A455-FB85998553AF}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C7C7C662-F9E7-4886-906C-92251DA05531}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D97E389A-B97B-4311-88F1-78C78E816A2E}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\acronis\syncagent\syncagentsrv.exe |
"{DAD18545-AD1F-48FC-B3ED-18E81D21A3E2}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{DD420FEB-AD95-4D24-A838-468A606C8CB5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E5B36E84-53FE-40E5-98BB-D3F0BF5250E2}" = protocol=6 | dir=in | app=c:\program files (x86)\mipony\mipony.exe |
"{E649D7EA-8A09-4233-ADFF-852FF889724E}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{EB75E426-7174-4535-BD89-ACD6524635FC}" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"{EBE01AB2-8512-4D6C-AF6A-1490C85A7DC8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F3223245-44AB-4667-9948-1F8D8D565533}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"TCP Query User{0456A5F9-0E63-4F89-B062-6814F0792191}C:\program files (x86)\mipony\mipony.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mipony\mipony.exe |
"TCP Query User{33CD367D-7191-4FE9-8EA2-A13493B51936}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"TCP Query User{3429D290-BABB-47BD-A8CD-0EF1342593AA}C:\program files (x86)\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"TCP Query User{3E613E2A-0A81-400E-90A4-9C8206852A6A}C:\users\paningo\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\paningo\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{03C69DE1-CB53-44CA-AD5D-74D9C8A59537}C:\program files (x86)\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"UDP Query User{AC66F513-FBE9-493E-84B8-933911218E16}C:\program files (x86)\mipony\mipony.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mipony\mipony.exe |
"UDP Query User{D4341DE6-0510-4C5B-B9E9-D88879B9CA0E}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{D5F028C5-7778-4789-8979-9490F340C0FD}C:\users\paningo\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\paningo\appdata\roaming\dropbox\bin\dropbox.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0C1DE303-E41B-44BA-8ABA-B7F09D857001}" = Oracle VM VirtualBox 4.2.12
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"CCleaner" = CCleaner
"Totalcmd64" = Total Commander 64-bit (Remove or Repair)
"WinRAR archiver" = WinRAR 5.00 beta 3 (64-bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1" = MiniTool Partition Wizard Home Edition 7.8
"{0A844D8F-A965-11E2-9E77-B8AC6F98CCE3}" = Google Earth
"{4AA75223-6CBF-46F4-8EE4-7BF0591089F7}" = True Image 2013
"{4AA75223-6CBF-46F4-8EE4-7BF0591089F7}Visible" = True Image 2013
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{986A654F-F1E4-11DD-9FCA-005056C00008}" = Paragon Partition Manager™ 12 Home Demo
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"dlancockpit" = devolo dLAN Cockpit
"ESET Online Scanner" = ESET Online Scanner v3
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Fiddler2" = Fiddler
"FlashFXP 4" = FlashFXP 4
"Google Chrome" = Google Chrome
"HD Tune Pro_is1" = HD Tune Pro 5.50
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Marvell Miniport Driver" = Marvell Miniport Driver
"MiPony" = MiPony 2.0.5
"mIRC" = mIRC
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"Mozilla Thunderbird 17.0.6 (x86 de)" = Mozilla Thunderbird 17.0.6 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Opera 12.15.1748" = Opera 12.15
"Trillian" = Trillian
"UltraISO_is1" = UltraISO Premium V9.53
"VLC media player" = VLC media player 2.0.6
"What's Running_is1" = What's Running 3.0
"Winamp" = Winamp
"winscp3_is1" = WinSCP 5.1.5
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2330493419-2886327782-1176343205-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 26.05.2013 19:39:19 | Computer Name = PanIngo-PC | Source = Windows Search Service | ID = 3029
Description =
 
Error - 26.05.2013 19:39:20 | Computer Name = PanIngo-PC | Source = Windows Search Service | ID = 3029
Description =
 
Error - 26.05.2013 19:39:20 | Computer Name = PanIngo-PC | Source = Windows Search Service | ID = 3028
Description =
 
Error - 26.05.2013 19:39:20 | Computer Name = PanIngo-PC | Source = Windows Search Service | ID = 3058
Description =
 
Error - 26.05.2013 19:39:20 | Computer Name = PanIngo-PC | Source = Windows Search Service | ID = 7010
Description =
 
Error - 26.05.2013 19:40:12 | Computer Name = PanIngo-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 27.05.2013 02:51:38 | Computer Name = PanIngo-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 27.05.2013 05:12:46 | Computer Name = PanIngo-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 27.05.2013 05:24:49 | Computer Name = PanIngo-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 04.06.2013 05:35:56 | Computer Name = PanIngo-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 27.05.2013 05:09:12 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Plug and Play" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt:
 Reboot the machine.
 
Error - 27.05.2013 05:09:12 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Power" wurde unerwartet beendet. Dies ist bereits 1 Mal
 vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt:
 Reboot the machine.
 
Error - 27.05.2013 05:09:12 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Plug and Play" Korrekturmaßnahmen (Reboot the machine) durchzuführen,
 ist fehlgeschlagen. Fehler:  %%1190
 
Error - 27.05.2013 05:09:12 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Power" Korrekturmaßnahmen (Reboot the machine) durchzuführen, ist
 fehlgeschlagen. Fehler:  %%1190
 
Error - 27.05.2013 05:13:23 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%2
 
Error - 27.05.2013 05:13:24 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%2
 
Error - 27.05.2013 05:35:09 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Stereoscopic 3D Driver Service" wurde unerwartet beendet.
 Dies ist bereits 1 Mal passiert.
 
Error - 27.05.2013 07:23:07 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Function Discovery Resource Publication" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 120000 Millisekunden durchgeführt: Restart the service.
 
Error - 27.05.2013 07:23:07 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "SSDP Discovery" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt:
 Restart the service.
 
Error - 04.06.2013 05:36:27 | Computer Name = PanIngo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%2
 
 
< End of report >
--- --- ---

t'john 04.06.2013 11:43
von Malware ist nichts zu sehen.

bitte mal Screenshots machen von:
CrystalDiskInfo - Download - Filepony
Open Hardware Monitor - Download - Filepony

bmell 04.06.2013 13:12
mbam:

Code:
Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org

Database version: v2013.06.04.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
PanIngo :: PANINGO-PC [administrator]

04.06.2013 13:28:39
mbar-log-2013-06-04 (13-28-39).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 242414
Time elapsed: 4 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Ha, ich seh was in Deinem Open Hw Monitor > "Manufacturer0 PartNum0" !

Code:

Open Hardware Monitor Report

--------------------------------------------------------------------------------

Version: 0.5.1.0

--------------------------------------------------------------------------------

Common Language Runtime: 2.0.50727.5466
Operating System: Microsoft Windows NT 6.1.7601 Service Pack 1
Process Type: 64-Bit

--------------------------------------------------------------------------------

Sensors

|
+- ASUS P5K PRO (/mainboard)
|  |
|  +- Winbond W83627DHG (/lpc/w83627dhg)
|  |  +- CPU VCore      :    1.04    1.04    1.168 (/lpc/w83627dhg/voltage/0)
|  |  +- Voltage #2    :    1.736    1.736    1.744 (/lpc/w83627dhg/voltage/1)
|  |  +- AVCC          :    3.232    3.232    3.248 (/lpc/w83627dhg/voltage/2)
|  |  +- 3VCC          :    3.232    3.232    3.248 (/lpc/w83627dhg/voltage/3)
|  |  +- Voltage #5    :    1.68    1.672    1.68 (/lpc/w83627dhg/voltage/4)
|  |  +- Voltage #6    :    1.648    1.648    1.648 (/lpc/w83627dhg/voltage/5)
|  |  +- Voltage #7    :    1.656    1.656    1.664 (/lpc/w83627dhg/voltage/6)
|  |  +- 3VSB          :    3.232    3.232    3.248 (/lpc/w83627dhg/voltage/7)
|  |  +- Auxiliary      :      -47      -47      -46 (/lpc/w83627dhg/temperature/1)
|  |  +- System        :      46      46      46 (/lpc/w83627dhg/temperature/2)
|  |  +- CPU Fan        :  2070.55  2020.96  2083.33 (/lpc/w83627dhg/fan/1)
|
+- Intel Core 2 Quad Q9450 (/intelcpu/0)
|  +- Bus Speed      :  333.961  333.961  333.961 (/intelcpu/0/clock/0)
|  +- CPU Core #1    :  2003.77  2003.77  2671.69 (/intelcpu/0/clock/1)
|  +- CPU Core #2    :  2003.77  2003.77  2671.69 (/intelcpu/0/clock/2)
|  +- CPU Core #3    :  2003.77  2003.77  2671.69 (/intelcpu/0/clock/3)
|  +- CPU Core #4    :  2003.77  2003.77  2671.69 (/intelcpu/0/clock/4)
|  +- CPU Core #1    :      49      47      53 (/intelcpu/0/temperature/0)
|  +- CPU Core #2    :      49      47      53 (/intelcpu/0/temperature/1)
|  +- CPU Core #3    :      44      42      51 (/intelcpu/0/temperature/2)
|  +- CPU Core #4    :      43      41      50 (/intelcpu/0/temperature/3)
|  +- CPU Total      :  2.69231 0.384617  22.3077 (/intelcpu/0/load/0)
|  +- CPU Core #1    :        0        0      75 (/intelcpu/0/load/1)
|  +- CPU Core #2    :        0        0  35.3846 (/intelcpu/0/load/2)
|  +- CPU Core #3    :  1.53846        0  24.6154 (/intelcpu/0/load/3)
|  +- CPU Core #4    :  9.23077        0  33.8462 (/intelcpu/0/load/4)
|
+- Manufacturer0 PartNum0 (/ram)
|  +- Memory        :  30.9603  30.9599  31.599 (/ram/load/0)
|  +- Used Memory    :  2.47655  2.47652  2.52765 (/ram/data/0)
|  +- Available Memory :  5.52258  5.47148  5.52261 (/ram/data/1)
|
+- NVIDIA GeForce 9500 GT (/nvidiagpu/0)
|  +- GPU Core      :      550      550      550 (/nvidiagpu/0/clock/0)
|  +- GPU Memory    :    399.6    399.6    399.6 (/nvidiagpu/0/clock/1)
|  +- GPU Shader    :    1350    1350    1350 (/nvidiagpu/0/clock/2)
|  +- GPU Core      :      59      54      59 (/nvidiagpu/0/temperature/0)
|  +- GPU Core      :      41        0      50 (/nvidiagpu/0/load/0)
|  +- GPU Memory Controller :      39        8      45 (/nvidiagpu/0/load/1)
|  +- GPU Video Engine :        0        0        0 (/nvidiagpu/0/load/2)
|  +- GPU Memory    :  79.4846  79.3953  83.3405 (/nvidiagpu/0/load/3)
|  +- GPU Fan        :      50      50      50 (/nvidiagpu/0/control/0)
|
+- SAMSUNG HD103SI (/hdd/0)
|  +- Temperature    :      26      26      26 (/hdd/0/temperature/0)
|  +- Used Space    :  10.2026  10.2026  10.2026 (/hdd/0/load/0)

--------------------------------------------------------------------------------

Parameters

|
+- ASUS P5K PRO (/mainboard)
|  |
|  +- Winbond W83627DHG (/lpc/w83627dhg)
|  |  |
|  |  +- CPU VCore (/lpc/w83627dhg/voltage/0)
|  |  |  +- Ri [kΩ] : 0 : 0
|  |  |  +- Rf [kΩ] : 1 : 1
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- Voltage #2 (/lpc/w83627dhg/voltage/1)
|  |  |  +- Ri [kΩ] : 0 : 0
|  |  |  +- Rf [kΩ] : 1 : 1
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- AVCC (/lpc/w83627dhg/voltage/2)
|  |  |  +- Ri [kΩ] : 34 : 34
|  |  |  +- Rf [kΩ] : 34 : 34
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- 3VCC (/lpc/w83627dhg/voltage/3)
|  |  |  +- Ri [kΩ] : 34 : 34
|  |  |  +- Rf [kΩ] : 34 : 34
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- Voltage #5 (/lpc/w83627dhg/voltage/4)
|  |  |  +- Ri [kΩ] : 0 : 0
|  |  |  +- Rf [kΩ] : 1 : 1
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- Voltage #6 (/lpc/w83627dhg/voltage/5)
|  |  |  +- Ri [kΩ] : 0 : 0
|  |  |  +- Rf [kΩ] : 1 : 1
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- Voltage #7 (/lpc/w83627dhg/voltage/6)
|  |  |  +- Ri [kΩ] : 0 : 0
|  |  |  +- Rf [kΩ] : 1 : 1
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- 3VSB (/lpc/w83627dhg/voltage/7)
|  |  |  +- Ri [kΩ] : 34 : 34
|  |  |  +- Rf [kΩ] : 34 : 34
|  |  |  +- Vf [V] : 0 : 0
|  |  |
|  |  +- Auxiliary (/lpc/w83627dhg/temperature/1)
|  |  |  +- Offset [°C] : 0 : 0
|  |  |
|  |  +- System (/lpc/w83627dhg/temperature/2)
|  |  |  +- Offset [°C] : 0 : 0
|
+- Intel Core 2 Quad Q9450 (/intelcpu/0)
|  |
|  +- CPU Core #1 (/intelcpu/0/temperature/0)
|  |  +- TjMax [°C] : 100 : 100
|  |  +- TSlope [°C] : 1 : 1
|  |
|  +- CPU Core #2 (/intelcpu/0/temperature/1)
|  |  +- TjMax [°C] : 100 : 100
|  |  +- TSlope [°C] : 1 : 1
|  |
|  +- CPU Core #3 (/intelcpu/0/temperature/2)
|  |  +- TjMax [°C] : 100 : 100
|  |  +- TSlope [°C] : 1 : 1
|  |
|  +- CPU Core #4 (/intelcpu/0/temperature/3)
|  |  +- TjMax [°C] : 100 : 100
|  |  +- TSlope [°C] : 1 : 1
|
+- Manufacturer0 PartNum0 (/ram)
|
+- NVIDIA GeForce 9500 GT (/nvidiagpu/0)
|
+- SAMSUNG HD103SI (/hdd/0)
|  |
|  +- Temperature (/hdd/0/temperature/0)
|  |  +- Offset [°C] : 0 : 0

--------------------------------------------------------------------------------

Mainboard

SMBIOS Version: 2.4

BIOS Vendor: American Megatrends Inc.
BIOS Version: 1303 

System Manufacturer: System manufacturer
System Name: System Product Name
System Version: System Version

Mainboard Manufacturer: ASUSTeK Computer INC.
Mainboard Name: P5K PRO
Mainboard Version: Rev 1.xx

Memory Device [0] Manufacturer: Manufacturer0
Memory Device [0] Part Number: PartNum0
Memory Device [0] Device Locator: DIMM0
Memory Device [0] Bank Locator: BANK0

Memory Device [1] Manufacturer: Manufacturer1
Memory Device [1] Part Number: PartNum1
Memory Device [1] Device Locator: DIMM1
Memory Device [1] Bank Locator: BANK1

Memory Device [2] Manufacturer: Manufacturer2
Memory Device [2] Part Number: PartNum2
Memory Device [2] Device Locator: DIMM2
Memory Device [2] Bank Locator: BANK2

Memory Device [3] Manufacturer: Manufacturer3
Memory Device [3] Part Number: PartNum3
Memory Device [3] Device Locator: DIMM3
Memory Device [3] Bank Locator: BANK3

SMBIOS Table

 ABgAAAECAPADD5Dei38BAAAAMwUIDP//QW1lcmljYW4gTWVnYXRyZW5kcyBJbmMu
 ADEzMDMgICAAMTIvMTYvMjAwOAAAARsBAAECAwQAAgADAAQABQAGAAcACAAJBgUG
 U3lzdGVtIG1hbnVmYWN0dXJlcgBTeXN0ZW0gUHJvZHVjdCBOYW1lAFN5c3RlbSBW
 ZXJzaW9uAFN5c3RlbSBTZXJpYWwgTnVtYmVyAFRvIEJlIEZpbGxlZCBCeSBPLkUu
 TS4AVG8gQmUgRmlsbGVkIEJ5IE8uRS5NLgAAAg8CAAECAwQFCQYDAAoAQVNVU1Rl
 SyBDb21wdXRlciBJTkMuAFA1SyBQUk8AUmV2IDEueHgATUItMTIzNDU2Nzg5MABU
 byBCZSBGaWxsZWQgQnkgTy5FLk0uAFRvIEJlIEZpbGxlZCBCeSBPLkUuTS4AAAMV
 AwABAwIDBAMDAwMEAAAAAAEAAENoYXNzaXMgTWFudWZhY3R1cmUAQ2hhc3NpcyBW
 ZXJzaW9uAENoYXNzaXMgU2VyaWFsIE51bWJlcgBBc3NldC0xMjM0NTY3ODkwAAAE
 IwQAAQMBAncGAQD/++u/A4xNAdgOagpBFQUABgAHAAQFBkxHQTc3NQBJbnRlbCAg
 ICAgICAgICAgIABJbnRlbChSKSBDb3JlKFRNKTIgUXVhZCBDUFUgUTk0NTAgQCAy
 LjY2R0h6ICAgICAgICAgAFRvIEJlIEZpbGxlZCBCeSBPLkUuTS4AVG8gQmUgRmls
 bGVkIEJ5IE8uRS5NLgBUbyBCZSBGaWxsZWQgQnkgTy5FLk0uAAAHEwUAAYABgACA
 AAEAAQAABAQHTDEtQ2FjaGUAAAcTBgABgQEAMAAwAQABAAAFAwdMMi1DYWNoZQAA
 BxMHAAECAwAAAAACAAIAAAICAkwzLUNhY2hlAAAFGAgABgQDAwsBAAABAgQJAAoA
 CwAMAAQAAAYMCQABARkAAYuLAERJTU0wAAAGDAoAASMZAAGLiwBESU1NMQAABgwL
 AAFFGQABi4sARElNTTIAAAYMDAABZxkAAYuLAERJTU0zAAAICQ0AAQACDw1QUy8y
 IE1vdXNlAFBTLzIgTW91c2UAAAgJDgABAAIPDVBTLzIgS2V5Ym9hcmQAUFMvMiBL
 ZXlib2FyZAAACAkPAAEAAhIQVVNCMV8yAFVTQjFfMgAACAkQAAEAAhIQVVNCM180
 AFVTQjNfNAAACAkRAAEAAgsfR2JFIExBTgBHYkUgTEFOAAAICRIAAQAC/x1BVURJ
 TwBBVURJTwAACAkTAAEAAggJQ09NIDEAQ09NIDEAAAgJFAABAAIfHUF1ZGlvIExp
 bmUgT3V0MQBBdWRpbyBMaW5lIE91dDEAAAgJFQABAAIfHUF1ZGlvIExpbmUgT3V0
 MgBBdWRpbyBMaW5lIE91dDIAAAgJFgABAAIfHUF1ZGlvIExpbmUgT3V0MwBBdWRp
 byBMaW5lIE91dDMAAAgJFwABAAIfHUF1ZGlvIExpbmUgT3V0NABBdWRpbyBMaW5l
 IE91dDQAAAgJGAABAAIfHUF1ZGlvIExpbmUgT3V0NQBBdWRpbyBMaW5lIE91dDUA
 AAgJGQABAAIfHUF1ZGlvIExpbmUgT3V0NgBBdWRpbyBMaW5lIE91dDYAAAgJGgAB
 AAIcHVNQRElGX09VVABTUERJRl9PVVQAAAgJGwABAAIhEUlFMTM5NF8xAEZpcmVX
 aXJlIDEAAAgJHAABAAIhEUlFMTM5NF8yAEZpcmVXaXJlIDIAAAgJHQABIgAAIFNB
 VEExAAAICR4AASIAACBTQVRBMgAACAkfAAEiAAAgU0FUQTMAAAgJIAABIgAAIFNB
 VEE0AAAICSEAASIAACBTQVRBNQAACAkiAAEiAAAgU0FUQTYAAAgJIwABIgAAIFBS
 SV9FSURFAAAICSQAARIAABBVU0I1XzYAAAgJJQABEgAAEFVTQjdfOAAACAkmAAES
 AAAQVVNCOV8xMAAACAknAAESAAAQVVNCMTFfMTIAAAgJKAABFwAA/0ZMT1BQWQAA
 CAkpAAEcAAAdQ0QAAAgJKgABHwAAHUFBRlAAAAgJKwABHAAAHUZQX0FVRElPAAAI
 CSwAAf8AAP9DUFVfRkFOAAAICS0AAf8AAP9QV1JfRkFOAAAICS4AAf8AAP9DSEFf
 RkFOMQAACAkvAAH/AAD/Q0hBX0ZBTjIAAAkNMAABpQUDAwEADAFQQ0lFWDE2XzEA
 AAkNMQABEgUDAwIADAFQQ0lFWDFfMQAACQ0yAAESBQMDAwAMAVBDSUVYMV8yAAAJ
 DTMAAQYFAwMBAAwBUENJXzEAAAkNNAABBgUDAwIADAFQQ0lfMgAACQ01AAGlBQMD
 BAAMAVBDSUVYMTZfMgAACgY2AIUBIE9uYm9hcmQgRXRoZXJuZXQAAAsFNwAEVG8g
 QmUgRmlsbGVkIEJ5IE8uRS5NLgBUbyBCZSBGaWxsZWQgQnkgTy5FLk0uAFRvIEJl
 IEZpbGxlZCBCeSBPLkUuTS4AVG8gQmUgRmlsbGVkIEJ5IE8uRS5NLgAADAU4AAFU
 byBCZSBGaWxsZWQgQnkgTy5FLk0uAAANFjkAAf8AAAAAAAAAAAAAAAAAAAABZW58
 VVN8aXNvODg1OS0xAAAPIzoABAAAAAIAAgAAAAAAagRsBAAGAv//////////////
 /wAAEA87AAMDAwAAIAD+/wQAAAATDzwAAAAAAP//fwA7AAQAABEbPQA7AP7/QABA
 AAAICQABAhOAACADAwQFBkRJTU0wAEJBTkswAE1hbnVmYWN0dXJlcjAAU2VyTnVt
 MABBc3NldFRhZ051bTAAUGFydE51bTAAABQTPgAAAAAA//8fAD0APAABAAEAABEb
 PwA7AP7/QABAAAAICQABAhOAACADAwQFBkRJTU0xAEJBTksxAE1hbnVmYWN0dXJl
 cjEAU2VyTnVtMQBBc3NldFRhZ051bTEAUGFydE51bTEAABQTQAAAACEA//9AAD8A
 PAABAAEAABEbQQA7AP7/QABAAAAICQABAhOAACADAwQFBkRJTU0yAEJBTksyAE1h
 bnVmYWN0dXJlcjIAU2VyTnVtMgBBc3NldFRhZ051bTIAUGFydE51bTIAABQTQgAA
 ACEA//9AAEEAPAABAAEAABEbQwA7AP7/QABAAAAICQABAhOAACADAwQFBkRJTU0z
 AEJBTkszAE1hbnVmYWN0dXJlcjMAU2VyTnVtMwBBc3NldFRhZ051bTMAUGFydE51
 bTMAABQTRAAAACEA//9AAEMAPAABAAEAACAURQAAAAAAAAAAAAAAAAAAAAAAAACL
 NkYA/ty6mHZUMhAAAAAAAqAA+AAAAAAGEUQwA99AgAAgAAA8EAgAAAAAAAAAAAAA
 AAAAAAFWMTM5NEdVSUQAAH8ERwAAAA==

--------------------------------------------------------------------------------

LPC W836XX

Chip ID: 0xA020
Chip revision: 0x23
Base Adress: 0x0290

Hardware Monitor Registers

      00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

 00  04 FF 04 FF 00 00 3B 30 01 37 01 01 3C 3C 14 14
 10  04 FF 10 00 00 01 01 3C 43 17 00 00 FF FF FF C2
 20  82 D9 CA CA D2 CE CF 2E FF A7 FF DA 00 3C A0 82
 30  A0 70 4C 02 6D C4 52 88 DE 29 44 7A F8 D2 B1 FF
 40  03 DE 2F FF FF FF 07 B5 2D 02 00 C4 90 95 00 A3
 50  FF FF 00 FF FF FF 00 80 C1 EF FF FF 19 A4 04 05
 60  04 FF 40 00 01 01 3C FF 14 FF 01 FF FF FF FF FF
 70  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
Bank 1
 50  28 00 00 4B 00 50 05 FE FF FF FF FF FF FF FF FF
Bank 2
 50  D1 00 00 4B 00 50 1E 40 FF FF FF FF FF FF FF FF
Bank 3
 50  04 05 06 07 02 06 07 07 00 06 00 70 2D 0E 00 00
Bank 4
 50  3B 13 FF 00 00 00 00 04 41 4E 0D BB 09 5D 20 7F
Bank 5
 50  CA 48 09 FF 2A 0A 12 00 B2 62 00 00 0C 00 00 00
Bank 6
 50  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
Bank 7
 50  6A C4 00 00 00 A2 BF 77 80 64 08 68 29 0F 00 00
Bank 8
 50  FF FF 00 FF FF FF 00 80 C1 EF FF FF 19 A4 04 05
Bank 9
 50  28 00 00 4B 00 50 05 FE FF FF FF FF FF FF FF FF
Bank 10
 50  D1 00 00 4B 00 50 1E 40 FF FF FF FF FF FF FF FF
Bank 11
 50  04 05 06 07 02 06 07 07 00 06 00 70 2D 0E 00 00
Bank 12
 50  00 13 FF 00 00 00 00 04 41 4E 0D BB 09 5D 20 7F
Bank 13
 50  CA 48 09 FF 2A 0A 12 00 B2 62 00 00 0C 00 00 00
Bank 14
 50  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
Bank 15
 50  6A C0 00 00 00 A2 BF 77 80 64 08 68 29 0F 00 00

--------------------------------------------------------------------------------

CPUID

Processor 0

Processor Vendor: Intel
Processor Brand: Intel(R) Core(TM)2 Quad  CPU  Q9450  @ 2.66GHz
Family: 0x6
Model: 0x17
Stepping: 0x7

CPUID Return Values

 CPU Thread: 0
 APIC ID: 0
 Processor ID: 0
 Core ID: 0
 Thread ID: 0

 Function  EAX      EBX      ECX      EDX
 00000000  0000000A  756E6547  6C65746E  49656E69
 00000001  00010677  00040800  0008E3FD  BFEBFBFF
 00000002  05B0B101  005657F0  00000000  2CB4304E
 00000003  00000000  00000000  00000000  00000000
 00000004  0C000121  01C0003F  0000003F  00000001
 00000005  00000040  00000040  00000003  00000020
 00000006  00000001  00000002  00000001  00000000
 00000007  00000000  00000000  00000000  00000000
 00000008  00000400  00000000  00000000  00000000
 00000009  00000000  00000000  00000000  00000000
 0000000A  07280202  00000000  00000000  00000503
 80000000  80000008  00000000  00000000  00000000
 80000001  00000000  00000000  00000001  20100800
 80000002  65746E49  2952286C  726F4320  4D542865
 80000003  51203229  20646175  55504320  51202020
 80000004  30353439  20402020  36362E32  007A4847
 80000005  00000000  00000000  00000000  00000000
 80000006  00000000  00000000  18008040  00000000
 80000007  00000000  00000000  00000000  00000000
 80000008  00003024  00000000  00000000  00000000

 CPU Thread: 1
 APIC ID: 1
 Processor ID: 0
 Core ID: 1
 Thread ID: 0

 Function  EAX      EBX      ECX      EDX
 00000000  0000000A  756E6547  6C65746E  49656E69
 00000001  00010677  01040800  0008E3FD  BFEBFBFF
 00000002  05B0B101  005657F0  00000000  2CB4304E
 00000003  00000000  00000000  00000000  00000000
 00000004  0C000121  01C0003F  0000003F  00000001
 00000005  00000040  00000040  00000003  00000020
 00000006  00000001  00000002  00000001  00000000
 00000007  00000000  00000000  00000000  00000000
 00000008  00000400  00000000  00000000  00000000
 00000009  00000000  00000000  00000000  00000000
 0000000A  07280202  00000000  00000000  00000503
 80000000  80000008  00000000  00000000  00000000
 80000001  00000000  00000000  00000001  20100800
 80000002  65746E49  2952286C  726F4320  4D542865
 80000003  51203229  20646175  55504320  51202020
 80000004  30353439  20402020  36362E32  007A4847
 80000005  00000000  00000000  00000000  00000000
 80000006  00000000  00000000  18008040  00000000
 80000007  00000000  00000000  00000000  00000000
 80000008  00003024  00000000  00000000  00000000

 CPU Thread: 2
 APIC ID: 2
 Processor ID: 0
 Core ID: 2
 Thread ID: 0

 Function  EAX      EBX      ECX      EDX
 00000000  0000000A  756E6547  6C65746E  49656E69
 00000001  00010677  02040800  0008E3FD  BFEBFBFF
 00000002  05B0B101  005657F0  00000000  2CB4304E
 00000003  00000000  00000000  00000000  00000000
 00000004  0C000121  01C0003F  0000003F  00000001
 00000005  00000040  00000040  00000003  00000020
 00000006  00000001  00000002  00000001  00000000
 00000007  00000000  00000000  00000000  00000000
 00000008  00000400  00000000  00000000  00000000
 00000009  00000000  00000000  00000000  00000000
 0000000A  07280202  00000000  00000000  00000503
 80000000  80000008  00000000  00000000  00000000
 80000001  00000000  00000000  00000001  20100800
 80000002  65746E49  2952286C  726F4320  4D542865
 80000003  51203229  20646175  55504320  51202020
 80000004  30353439  20402020  36362E32  007A4847
 80000005  00000000  00000000  00000000  00000000
 80000006  00000000  00000000  18008040  00000000
 80000007  00000000  00000000  00000000  00000000
 80000008  00003024  00000000  00000000  00000000

 CPU Thread: 3
 APIC ID: 3
 Processor ID: 0
 Core ID: 3
 Thread ID: 0

 Function  EAX      EBX      ECX      EDX
 00000000  0000000A  756E6547  6C65746E  49656E69
 00000001  00010677  03040800  0008E3FD  BFEBFBFF
 00000002  05B0B101  005657F0  00000000  2CB4304E
 00000003  00000000  00000000  00000000  00000000
 00000004  0C000121  01C0003F  0000003F  00000001
 00000005  00000040  00000040  00000003  00000020
 00000006  00000001  00000002  00000001  00000000
 00000007  00000000  00000000  00000000  00000000
 00000008  00000400  00000000  00000000  00000000
 00000009  00000000  00000000  00000000  00000000
 0000000A  07280202  00000000  00000000  00000503
 80000000  80000008  00000000  00000000  00000000
 80000001  00000000  00000000  00000001  20100800
 80000002  65746E49  2952286C  726F4320  4D542865
 80000003  51203229  20646175  55504320  51202020
 80000004  30353439  20402020  36362E32  007A4847
 80000005  00000000  00000000  00000000  00000000
 80000006  00000000  00000000  18008040  00000000
 80000007  00000000  00000000  00000000  00000000
 80000008  00003024  00000000  00000000  00000000

--------------------------------------------------------------------------------

Intel CPU

Name: Intel Core 2 Quad Q9450
Number of Cores: 4
Threads per Core: 1
Timer Frequency: 2.609023 MHz
Time Stamp Counter: Not Invariant
Estimated Time Stamp Counter Frequency: 2671.69 MHz
Estimated Time Stamp Counter Frequency Error: 0.04096 Mhz
Time Stamp Counter Frequency: 2671.69 MHz

MSR Core #1

 MSR      EDX      EAX
 000000CE  0013081D  7F7F070F
 00000198  0613081D  0600081D
 0000019C  00000000  88310000
 000001A2  00000000  00001800

MSR Core #2

 MSR      EDX      EAX
 000000CE  0013081D  7F7F070F
 00000198  0613081D  0600081D
 0000019C  00000000  88310000
 000001A2  00000000  00001800

MSR Core #3

 MSR      EDX      EAX
 000000CE  0013081D  7F7F070F
 00000198  0613081D  0600081D
 0000019C  00000000  88380000
 000001A2  00000000  00001800

MSR Core #4

 MSR      EDX      EAX
 000000CE  0013081D  7F7F070F
 00000198  0613081D  0600081D
 0000019C  00000000  88380000
 000001A2  00000000  00001800

Microarchitecture: Core
Time Stamp Counter Multiplier: 8

--------------------------------------------------------------------------------

AMD Display Library

Status: -1

--------------------------------------------------------------------------------

NVAPI

Version: NVidia Complete Version 1.10
Number of GPUs: 1

--------------------------------------------------------------------------------

Nvidia GPU

Name: NVIDIA GeForce 9500 GT
Index: 0
Driver Version: 311.06
Driver Branch: r310_00-257

DeviceID: 0x64010DE
SubSystemID: 0x604619DA
RevisionID: 0xA1
ExtDeviceID: 0x640

Thermal Settings

 Sensor[0].Controller: GPU_INTERNAL
 Sensor[0].DefaultMinTemp: 0
 Sensor[0].DefaultMaxTemp: 127
 Sensor[0].CurrentTemp: 59
 Sensor[0].Target: GPU

Clocks

 Clock[0]: 550000
 Clock[1]: 9
 Clock[8]: 399600
 Clock[9]: 11
 Clock[10]: 277778
 Clock[11]: 9
 Clock[12]: 416666
 Clock[13]: 9
 Clock[14]: 1350000
 Clock[15]: 9
 Clock[16]: 154195
 Clock[17]: 1
 Clock[18]: 154195
 Clock[19]: 1
 Clock[24]: 450000
 Clock[25]: 9
 Clock[26]: 450000
 Clock[27]: 9
 Clock[64]: 550000
 Clock[65]: 32
 Clock[92]: 399600
 Clock[93]: 32
 Clock[99]: 277778
 Clock[100]: 32
 Clock[106]: 416666
 Clock[107]: 32
 Clock[113]: 1350000
 Clock[114]: 32
 Clock[120]: 154195
 Clock[121]: 32
 Clock[127]: 154195
 Clock[128]: 32
 Clock[148]: 450000
 Clock[149]: 32
 Clock[155]: 450000
 Clock[156]: 32

Tachometer

 Status: NOT_SUPPORTED

P-States

 Percentage[0]: 40
 Percentage[1]: 38
 Percentage[2]: 0
 Percentage[3]: 0

Usages

 Usage[1]: 1
 Usage[2]: 40
 Usage[3]: 58
 Usage[4]: 23
 Usage[5]: 1
 Usage[6]: 38
 Usage[7]: 58
 Usage[8]: 23
 Usage[9]: 1
 Usage[11]: 58
 Usage[12]: 23
 Usage[13]: 1
 Usage[15]: 100
 Usage[16]: 100

Cooler Settings

 Cooler[0].Type: 1
 Cooler[0].Controller: 1
 Cooler[0].DefaultMin: 50
 Cooler[0].DefaultMax: 100
 Cooler[0].CurrentMin: 50
 Cooler[0].CurrentMax: 100
 Cooler[0].CurrentLevel: 50
 Cooler[0].DefaultPolicy: 4
 Cooler[0].CurrentPolicy: 4
 Cooler[0].Target: 7
 Cooler[0].ControlType: 2
 Cooler[0].Active: 0

Memory Info

 Value[0]: 524288
 Value[1]: 499264
 Value[2]: 0
 Value[3]: 3669580
 Value[4]: 107448

--------------------------------------------------------------------------------

GenericHarddisk

Drive name: SAMSUNG HD103SI
Firmware version: 1AG01118

 ID Description                        Raw Value    Worst Value Thres Physical
 01 Read Error Rate                    040000000000 100  100  51    -     
 03 Spin-Up Time                      701700000000 83    83    11    -     
 04 Start/Stop Count                  2C0300000000 99    99    0    812   
 05 Reallocated Sectors Count          000000000000 100  100  10    -     
 07 Seek Error Rate                    000000000000 253  253  51    -     
 08 Seek Time Performance              442F00000000 100  100  15    -     
 09 Power-On Hours (POH)              714900000000 96    96    0    18801 
 0A Spin Retry Count                  000000000000 100  100  51    -     
 0B Recalibration Retries              010000000000 100  100  0    -     
 0C Power Cycle Count                  940200000000 99    99    0    660   
 0D Soft Read Error Rate              040000000000 100  100  0    -     
 B7 SATA Downshift Error Count        000000000000 100  100  0    0     
 B8 End-to-End error                  000000000000 100  100  0    -     
 BB Reported Uncorrectable Errors      040000000000 100  100  0    4     
 BC Command Timeout                    000000000000 100  100  0    0     
 BE Temperature Difference from 100    1A00191A0000 68    74    0    74     
 C2 Temperature                        1A00191B0000 67    74    0    26     
 C3 Hardware ECC Recovered            C2D68B000000 100  100  0    -     
 C4 Reallocation Event Count          000000000000 100  100  0    -     
 C5 Current Pending Sector Count      000000000000 100  100  0    -     
 C6 Uncorrectable Sector Count        000000000000 100  100  0    -     
 C7 UltraDMA CRC Error Count          430000000000 100  100  0    -     
 C8 Write Error Rate                  000000000000 100  100  0    -     
 C9 Unknown                            000000000000 100  100  0    -     

Logical drive name: C:\
Format: NTFS
Total size: 522090180608
Total free space: 459904720896

Logical drive name: E:\
Format: NTFS
Total size: 478005948416
Total free space: 438155862016
Und CD:

hxxp://vvcap.net/db/a7_yMiNjMbPVIOcfwpdx.htp

Und eine 2. Maus ? Ich nutze aber nur eine PS2 Maus und eine USB Tastatur:

VVCap Image

und dieses 8mit Everest geguckt) wird direkt über das Bios geladen? (auch das ROOT ist auffällig) :

VVCap Image

VVCap Image

VVCap Image

Und was Bitte ist ein remote desktop device redirector bus?

VVCap Image

Ups, keine URLS - kannst du sie trotzdem sehen?

Hab mal mit CCleaner nach Fehlern gesucht - das stinkt doch auch zum Himmel:

hxxp://vvcap.net/db/zvWw0UYm0Q9y-JwkG_yw.htp

Und auch - 1 Milliarde Cpm/ActiveX Fehler:

Code:

Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\system.enterpriseservices.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\system.configuration.install.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\wminet_utils.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\microsoft.vsa.vb.codedomprocessor.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscordbi.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorrc.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\diasymreader.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\vsavb7rt.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\microsoft.jscript.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorsec.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\iehost.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
Missing Shared DLL        C:\Windows\Microsoft.NET\Framework\v1.0.3705\system.data.dll        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
ActiveX/COM Issue        ComUpdatus.ComUpdatusAPI - {88F5E7B2-09B9-471e-895A-25247585905C}        HKCR\ComUpdatus.ComUpdatusAPI
ActiveX/COM Issue        ComUpdatus.ComUpdatusAPI.1 - {88F5E7B2-09B9-471e-895A-25247585905C}        HKCR\ComUpdatus.ComUpdatusAPI.1
ActiveX/COM Issue        DisplayServer.AdjustDesktopSizePos - {074BFFFD-4E50-42c1-A7EB-40D9D70F2471}        HKCR\DisplayServer.AdjustDesktopSizePos
ActiveX/COM Issue        DisplayServer.AdjustDesktopSizePos.1 - {074BFFFD-4E50-42c1-A7EB-40D9D70F2471}        HKCR\DisplayServer.AdjustDesktopSizePos.1
ActiveX/COM Issue        DisplayServer.AdjustSizePosExt - {6539579C-2657-45E5-985F-835E197959C2}        HKCR\DisplayServer.AdjustSizePosExt
ActiveX/COM Issue        DisplayServer.AdjustSizePosExt.1 - {6539579C-2657-45E5-985F-835E197959C2}        HKCR\DisplayServer.AdjustSizePosExt.1
ActiveX/COM Issue        DisplayServer.AppSettingsBasic - {9B5EC720-9A44-4811-8B9F-24BD53F2050D}        HKCR\DisplayServer.AppSettingsBasic
ActiveX/COM Issue        DisplayServer.AppSettingsBasic.1 - {9B5EC720-9A44-4811-8B9F-24BD53F2050D}        HKCR\DisplayServer.AppSettingsBasic.1
ActiveX/COM Issue        DisplayServer.CategoryAppearance - {01367108-5EE2-4E1C-A8DE-24438065ABC9}        HKCR\DisplayServer.CategoryAppearance
ActiveX/COM Issue        DisplayServer.CategoryAppearance.1 - {01367108-5EE2-4E1C-A8DE-24438065ABC9}        HKCR\DisplayServer.CategoryAppearance.1
ActiveX/COM Issue        DisplayServer.CategoryMultiMon - {88FC94D1-2ABB-42CF-8A07-4BC54F66EDDF}        HKCR\DisplayServer.CategoryMultiMon
ActiveX/COM Issue        DisplayServer.CategoryMultiMon.1 - {88FC94D1-2ABB-42CF-8A07-4BC54F66EDDF}        HKCR\DisplayServer.CategoryMultiMon.1
ActiveX/COM Issue        DisplayServer.ChangeResExt - {91363F1E-E7CA-4959-85D6-963719EC79FC}        HKCR\DisplayServer.ChangeResExt
ActiveX/COM Issue        DisplayServer.ChangeResExt.1 - {91363F1E-E7CA-4959-85D6-963719EC79FC}        HKCR\DisplayServer.ChangeResExt.1
ActiveX/COM Issue        DisplayServer.ColorCorrection - {CC0648AE-7E85-483C-B1DB-9335C9D6F8C7}        HKCR\DisplayServer.ColorCorrection
ActiveX/COM Issue        DisplayServer.ColorCorrection.1 - {CC0648AE-7E85-483C-B1DB-9335C9D6F8C7}        HKCR\DisplayServer.ColorCorrection.1
ActiveX/COM Issue        DisplayServer.ColorSettingsAdv - {B53EBC0C-2251-4AE2-9818-FD6AAF843EC2}        HKCR\DisplayServer.ColorSettingsAdv
ActiveX/COM Issue        DisplayServer.ColorSettingsAdv.1 - {B53EBC0C-2251-4AE2-9818-FD6AAF843EC2}        HKCR\DisplayServer.ColorSettingsAdv.1
ActiveX/COM Issue        DisplayServer.Config - {26A37DC6-935D-439B-80DD-C1006AE13D71}        HKCR\DisplayServer.Config
ActiveX/COM Issue        DisplayServer.Config.1 - {26A37DC6-935D-439B-80DD-C1006AE13D71}        HKCR\DisplayServer.Config.1
ActiveX/COM Issue        DisplayServer.CustomRez - {49F585C0-CE12-4306-9100-B6A28857B10B}        HKCR\DisplayServer.CustomRez
ActiveX/COM Issue        DisplayServer.CustomRez.1 - {49F585C0-CE12-4306-9100-B6A28857B10B}        HKCR\DisplayServer.CustomRez.1
ActiveX/COM Issue        DisplayServer.DualView - {7945F814-7BFB-4506-A113-2BD66CDC713A}        HKCR\DisplayServer.DualView
ActiveX/COM Issue        DisplayServer.DualView.1 - {7945F814-7BFB-4506-A113-2BD66CDC713A}        HKCR\DisplayServer.DualView.1
ActiveX/COM Issue        DisplayServer.IdentifyDisp - {0FB41BD0-3107-40A5-8D49-456E585947B2}        HKCR\DisplayServer.IdentifyDisp
ActiveX/COM Issue        DisplayServer.IdentifyDisp.1 - {0FB41BD0-3107-40A5-8D49-456E585947B2}        HKCR\DisplayServer.IdentifyDisp.1
ActiveX/COM Issue        DisplayServer.MultiMon - {6E4B938E-4BA1-4E8D-BCBA-8C51CE95F94F}        HKCR\DisplayServer.MultiMon
ActiveX/COM Issue        DisplayServer.MultiMon.1 - {6E4B938E-4BA1-4E8D-BCBA-8C51CE95F94F}        HKCR\DisplayServer.MultiMon.1
ActiveX/COM Issue        DisplayServer.MultiView - {894BF76C-115F-44B7-9B32-ABFA7E6A804A}        HKCR\DisplayServer.MultiView
ActiveX/COM Issue        DisplayServer.MultiView.1 - {894BF76C-115F-44B7-9B32-ABFA7E6A804A}        HKCR\DisplayServer.MultiView.1
ActiveX/COM Issue        DisplayServer.NameDisp - {6A22E68F-887C-4221-9DF1-EE0B3AC76497}        HKCR\DisplayServer.NameDisp
ActiveX/COM Issue        DisplayServer.NameDisp.1 - {6A22E68F-887C-4221-9DF1-EE0B3AC76497}        HKCR\DisplayServer.NameDisp.1
ActiveX/COM Issue        DisplayServer.Power - {A158544D-66FA-4F19-8806-F3CA2E2A4C52}        HKCR\DisplayServer.Power
ActiveX/COM Issue        DisplayServer.Power.1 - {A158544D-66FA-4F19-8806-F3CA2E2A4C52}        HKCR\DisplayServer.Power.1
ActiveX/COM Issue        DisplayServer.RotateDisplay - {6017A978-93AD-4F2F-9E2D-07CF8C8DEBC4}        HKCR\DisplayServer.RotateDisplay
ActiveX/COM Issue        DisplayServer.RotateDisplay.1 - {6017A978-93AD-4F2F-9E2D-07CF8C8DEBC4}        HKCR\DisplayServer.RotateDisplay.1
ActiveX/COM Issue        DisplayServer.ScreenMove - {1BC39379-8D90-4F18-8817-795C57163770}        HKCR\DisplayServer.ScreenMove
ActiveX/COM Issue        DisplayServer.ScreenMove.1 - {1BC39379-8D90-4F18-8817-795C57163770}        HKCR\DisplayServer.ScreenMove.1
ActiveX/COM Issue        DisplayServer.ScreenTimingDVI - {51840041-B26F-4843-B358-22ABB067396C}        HKCR\DisplayServer.ScreenTimingDVI
ActiveX/COM Issue        DisplayServer.ScreenTimingDVI.1 - {51840041-B26F-4843-B358-22ABB067396C}        HKCR\DisplayServer.ScreenTimingDVI.1
ActiveX/COM Issue        DisplayServer.ServerMain - {73BCA54E-6AEB-4597-8F27-E1284FF12722}        HKCR\DisplayServer.ServerMain
ActiveX/COM Issue        DisplayServer.ServerMain.1 - {73BCA54E-6AEB-4597-8F27-E1284FF12722}        HKCR\DisplayServer.ServerMain.1
ActiveX/COM Issue        DisplayServer.SetupDigitalAudio - {A3B877C7-83CA-4c9b-87FB-BE0D518C2441}        HKCR\DisplayServer.SetupDigitalAudio
ActiveX/COM Issue        DisplayServer.SetupDigitalAudio.1 - {A3B877C7-83CA-4c9b-87FB-BE0D518C2441}        HKCR\DisplayServer.SetupDigitalAudio.1
ActiveX/COM Issue        DisplayServer.TVWizard - {63005CD0-8541-439c-A66A-617F4B1F2BCB}        HKCR\DisplayServer.TVWizard
ActiveX/COM Issue        DisplayServer.TVWizard.1 - {63005CD0-8541-439c-A66A-617F4B1F2BCB}        HKCR\DisplayServer.TVWizard.1
ActiveX/COM Issue        DisplayServer.VideoAudioControl - {AAB8F985-EADA-428B-8636-270F58E1F1EF}        HKCR\DisplayServer.VideoAudioControl
ActiveX/COM Issue        DisplayServer.VideoAudioControl.1 - {AAB8F985-EADA-428B-8636-270F58E1F1EF}        HKCR\DisplayServer.VideoAudioControl.1
ActiveX/COM Issue        DisplayServer.VideoHDCPStatus - {EEF5290C-7F3D-4640-93F2-F189DC616510}        HKCR\DisplayServer.VideoHDCPStatus
ActiveX/COM Issue        DisplayServer.VideoHDCPStatus.1 - {EEF5290C-7F3D-4640-93F2-F189DC616510}        HKCR\DisplayServer.VideoHDCPStatus.1
ActiveX/COM Issue        GamesConfigServer.Cat1 - {A8679087-E64A-413A-9CBF-F38BE510C46C}        HKCR\GamesConfigServer.Cat1
ActiveX/COM Issue        GamesConfigServer.Cat1.1 - {A8679087-E64A-413A-9CBF-F38BE510C46C}        HKCR\GamesConfigServer.Cat1.1
ActiveX/COM Issue        GamesConfigServer.CategoryPerformance - {2FD96798-0D65-4D57-A095-B57679740E37}        HKCR\GamesConfigServer.CategoryPerformance
ActiveX/COM Issue        GamesConfigServer.CategoryPerformance.1 - {2FD96798-0D65-4D57-A095-B57679740E37}        HKCR\GamesConfigServer.CategoryPerformance.1
ActiveX/COM Issue        GamesConfigServer.MainServer - {3156EC84-29BD-4EAA-AE0A-817ED606FA99}        HKCR\GamesConfigServer.MainServer
ActiveX/COM Issue        GamesConfigServer.MainServer.1 - {3156EC84-29BD-4EAA-AE0A-817ED606FA99}        HKCR\GamesConfigServer.MainServer.1
ActiveX/COM Issue        GamesConfigServer.Manage3DSettings - {BBB7D605-8639-49D0-849E-32C4A5DBB9C3}        HKCR\GamesConfigServer.Manage3DSettings
ActiveX/COM Issue        GamesConfigServer.Manage3DSettings.1 - {BBB7D605-8639-49D0-849E-32C4A5DBB9C3}        HKCR\GamesConfigServer.Manage3DSettings.1
ActiveX/COM Issue        GamesConfigServer.SliBasic - {DE0549BD-F34D-4748-AD94-0F2F22749F4F}        HKCR\GamesConfigServer.SliBasic
ActiveX/COM Issue        GamesConfigServer.SliBasic.1 - {DE0549BD-F34D-4748-AD94-0F2F22749F4F}        HKCR\GamesConfigServer.SliBasic.1
ActiveX/COM Issue        GamesConfigServer.SliPhysXExt - {C8F113AE-A2C9-47CB-8DAE-9376C64665AD}        HKCR\GamesConfigServer.SliPhysXExt
ActiveX/COM Issue        GamesConfigServer.SliPhysXExt.1 - {C8F113AE-A2C9-47CB-8DAE-9376C64665AD}        HKCR\GamesConfigServer.SliPhysXExt.1
ActiveX/COM Issue        GamesConfigServer.SmartPower - {E851CB66-C839-4E96-8363-8535EB16FE2C}        HKCR\GamesConfigServer.SmartPower
ActiveX/COM Issue        GamesConfigServer.SmartPower.1 - {E851CB66-C839-4E96-8363-8535EB16FE2C}        HKCR\GamesConfigServer.SmartPower.1
ActiveX/COM Issue        GEAbstractBalloonCoClass.GEAbstract - {B1068D20-A431-4DBA-B1F8-990621E8A762}        HKCR\GEAbstractBalloonCoClass.GEAbstract
ActiveX/COM Issue        GEAbstractBalloonCoClass.GEAbstract.1.0 - {B1068D20-A431-4DBA-B1F8-990621E8A762}        HKCR\GEAbstractBalloonCoClass.GEAbstract.1.0
ActiveX/COM Issue        GEBalloonState_CoClass.GEBalloonSta - {B29922E4-4279-4319-8153-6064BA4609AF}        HKCR\GEBalloonState_CoClass.GEBalloonSta
ActiveX/COM Issue        GEBalloonState_CoClass.GEBalloonSta.1.0 - {B29922E4-4279-4319-8153-6064BA4609AF}        HKCR\GEBalloonState_CoClass.GEBalloonSta.1.0
ActiveX/COM Issue        GEBoundingBoxView_CoClass.GEBoundin - {589C3930-F194-11DD-BA2F-0800200C9A66}        HKCR\GEBoundingBoxView_CoClass.GEBoundin
ActiveX/COM Issue        GEBoundingBoxView_CoClass.GEBoundin.1.0 - {589C3930-F194-11DD-BA2F-0800200C9A66}        HKCR\GEBoundingBoxView_CoClass.GEBoundin.1.0
ActiveX/COM Issue        GEEventEmitterCoClass.GEEventEmitte - {26EA376A-51E6-11DC-8314-0800200C9A66}        HKCR\GEEventEmitterCoClass.GEEventEmitte
ActiveX/COM Issue        GEEventEmitterCoClass.GEEventEmitte.1.0 - {26EA376A-51E6-11DC-8314-0800200C9A66}        HKCR\GEEventEmitterCoClass.GEEventEmitte.1.0
ActiveX/COM Issue        GEEventSimulator_CoClass.GEEventSim - {733F6140-BF61-11DE-8A39-0800200C9A66}        HKCR\GEEventSimulator_CoClass.GEEventSim
ActiveX/COM Issue        GEEventSimulator_CoClass.GEEventSim.1.0 - {733F6140-BF61-11DE-8A39-0800200C9A66}        HKCR\GEEventSimulator_CoClass.GEEventSim.1.0
ActiveX/COM Issue        GEExecuteBatch_CoClass.GEExecuteBat - {2C64651A-7B7F-4CED-A051-16AD65AF57F5}        HKCR\GEExecuteBatch_CoClass.GEExecuteBat
ActiveX/COM Issue        GEExecuteBatch_CoClass.GEExecuteBat.1.0 - {2C64651A-7B7F-4CED-A051-16AD65AF57F5}        HKCR\GEExecuteBatch_CoClass.GEExecuteBat.1.0
ActiveX/COM Issue        GEFeatureBalloonCoClass.GEFeatureBa - {012B7A17-97C0-4506-B05C-FE051B88ECB7}        HKCR\GEFeatureBalloonCoClass.GEFeatureBa
ActiveX/COM Issue        GEFeatureBalloonCoClass.GEFeatureBa.1.0 - {012B7A17-97C0-4506-B05C-FE051B88ECB7}        HKCR\GEFeatureBalloonCoClass.GEFeatureBa.1.0
ActiveX/COM Issue        GEFeatureContainerCoClass.GEFeature - {56B61E20-0FC6-11DD-BD0B-0800200C9A66}        HKCR\GEFeatureContainerCoClass.GEFeature
ActiveX/COM Issue        GEFeatureContainerCoClass.GEFeature.1.0 - {56B61E20-0FC6-11DD-BD0B-0800200C9A66}        HKCR\GEFeatureContainerCoClass.GEFeature.1.0
ActiveX/COM Issue        GEFeatureView_CoClass.GEFeatureView - {62BF65A0-F193-11DD-BA2F-0800200C9A66}        HKCR\GEFeatureView_CoClass.GEFeatureView
ActiveX/COM Issue        GEFeatureView_CoClass.GEFeatureView.1.0 - {62BF65A0-F193-11DD-BA2F-0800200C9A66}        HKCR\GEFeatureView_CoClass.GEFeatureView.1.0
ActiveX/COM Issue        GEFetchKmlHelper_CoClass.GEFetchKml - {288E09A2-927A-49A7-BB24-9481ABF8817D}        HKCR\GEFetchKmlHelper_CoClass.GEFetchKml
ActiveX/COM Issue        GEFetchKmlHelper_CoClass.GEFetchKml.1.0 - {288E09A2-927A-49A7-BB24-9481ABF8817D}        HKCR\GEFetchKmlHelper_CoClass.GEFetchKml.1.0
ActiveX/COM Issue        GEGeometryContainerCoClass.GEGeomet - {B1E81530-2120-11DD-BD0B-0800200C9A66}        HKCR\GEGeometryContainerCoClass.GEGeomet
ActiveX/COM Issue        GEGeometryContainerCoClass.GEGeomet.1.0 - {B1E81530-2120-11DD-BD0B-0800200C9A66}        HKCR\GEGeometryContainerCoClass.GEGeomet.1.0
ActiveX/COM Issue        GEGlobeCoClass.GEGlobeCoClass - {288E09A2-927A-49A7-BB24-2988ABDD83EF}        HKCR\GEGlobeCoClass.GEGlobeCoClass
ActiveX/COM Issue        GEGlobeCoClass.GEGlobeCoClass.1.0 - {288E09A2-927A-49A7-BB24-2988ABDD83EF}        HKCR\GEGlobeCoClass.GEGlobeCoClass.1.0
ActiveX/COM Issue        GEHitTestResultCoClass.GEHitTestRes - {2040DDEF-7DD9-4903-A552-DC82C74A3C0F}        HKCR\GEHitTestResultCoClass.GEHitTestRes
ActiveX/COM Issue        GEHitTestResultCoClass.GEHitTestRes.1.0 - {2040DDEF-7DD9-4903-A552-DC82C74A3C0F}        HKCR\GEHitTestResultCoClass.GEHitTestRes.1.0
ActiveX/COM Issue        GEHtmlBalloonCoClass.GEHtmlBalloonC - {A52BFCF1-6B91-4ACC-9566-8F018C044E61}        HKCR\GEHtmlBalloonCoClass.GEHtmlBalloonC
ActiveX/COM Issue        GEHtmlBalloonCoClass.GEHtmlBalloonC.1.0 - {A52BFCF1-6B91-4ACC-9566-8F018C044E61}        HKCR\GEHtmlBalloonCoClass.GEHtmlBalloonC.1.0
ActiveX/COM Issue        GEHtmlDivBalloonCoClass.GEHtmlDivBa - {07E8E5BA-2347-47BD-9113-44D275F36205}        HKCR\GEHtmlDivBalloonCoClass.GEHtmlDivBa
ActiveX/COM Issue        GEHtmlDivBalloonCoClass.GEHtmlDivBa.1.0 - {07E8E5BA-2347-47BD-9113-44D275F36205}        HKCR\GEHtmlDivBalloonCoClass.GEHtmlDivBa.1.0
ActiveX/COM Issue        GEHtmlStringBalloonCoClass.GEHtmlSt - {9C23E22F-BEBE-4E75-86C1-68C08607574B}        HKCR\GEHtmlStringBalloonCoClass.GEHtmlSt
ActiveX/COM Issue        GEHtmlStringBalloonCoClass.GEHtmlSt.1.0 - {9C23E22F-BEBE-4E75-86C1-68C08607574B}        HKCR\GEHtmlStringBalloonCoClass.GEHtmlSt.1.0
ActiveX/COM Issue        GELinearRingContainerCoClass.GELine - {546864F0-1BF8-11DD-BD0B-0800200C9A66}        HKCR\GELinearRingContainerCoClass.GELine
ActiveX/COM Issue        GELinearRingContainerCoClass.GELine.1.0 - {546864F0-1BF8-11DD-BD0B-0800200C9A66}        HKCR\GELinearRingContainerCoClass.GELine.1.0
ActiveX/COM Issue        GEModeler_CoClass.GEModeler_CoClass - {CA5A19C0-C269-11DD-AD8B-0800200C9A66}        HKCR\GEModeler_CoClass.GEModeler_CoClass
ActiveX/COM Issue        GEModeler_CoClass.GEModeler_CoClass.1.0 - {CA5A19C0-C269-11DD-AD8B-0800200C9A66}        HKCR\GEModeler_CoClass.GEModeler_CoClass.1.0
ActiveX/COM Issue        GENavigationControlCoClass.GENaviga - {23144A1F-AF18-4815-82E0-3D198EF782AB}        HKCR\GENavigationControlCoClass.GENaviga
ActiveX/COM Issue        GENavigationControlCoClass.GENaviga.1.0 - {23144A1F-AF18-4815-82E0-3D198EF782AB}        HKCR\GENavigationControlCoClass.GENaviga.1.0
ActiveX/COM Issue        GEOptionsCoClass.GEOptionsCoClass - {051064BB-AEF7-4815-82E0-3D155FF09F8A}        HKCR\GEOptionsCoClass.GEOptionsCoClass
ActiveX/COM Issue        GEOptionsCoClass.GEOptionsCoClass.1.0 - {051064BB-AEF7-4815-82E0-3D155FF09F8A}        HKCR\GEOptionsCoClass.GEOptionsCoClass.1.0
ActiveX/COM Issue        GEPhotoControlCoClass.GEPhotoContro - {EEFEC232-DD4E-4DA8-9777-C3AFB8520D73}        HKCR\GEPhotoControlCoClass.GEPhotoContro
ActiveX/COM Issue        GEPhotoControlCoClass.GEPhotoContro.1.0 - {EEFEC232-DD4E-4DA8-9777-C3AFB8520D73}        HKCR\GEPhotoControlCoClass.GEPhotoContro.1.0
ActiveX/COM Issue        GEPhotoOverlayViewerCoClass.GEPhoto - {BB465410-0465-11DE-8C30-0800200C9A66}        HKCR\GEPhotoOverlayViewerCoClass.GEPhoto
ActiveX/COM Issue        GEPhotoOverlayViewerCoClass.GEPhoto.1.0 - {BB465410-0465-11DE-8C30-0800200C9A66}        HKCR\GEPhotoOverlayViewerCoClass.GEPhoto.1.0
ActiveX/COM Issue        GEPhotoOverlayView_CoClass.GEPhotoO - {BBBFD220-F193-11DD-BA2F-0800200C9A66}        HKCR\GEPhotoOverlayView_CoClass.GEPhotoO
ActiveX/COM Issue        GEPhotoOverlayView_CoClass.GEPhotoO.1.0 - {BBBFD220-F193-11DD-BA2F-0800200C9A66}        HKCR\GEPhotoOverlayView_CoClass.GEPhotoO.1.0
ActiveX/COM Issue        GEPluginCoClass.GEPluginCoClass - {F9152AEC-3462-4632-8087-EEE3C3CDDA24}        HKCR\GEPluginCoClass.GEPluginCoClass
ActiveX/COM Issue        GEPluginCoClass.GEPluginCoClass.1.0 - {F9152AEC-3462-4632-8087-EEE3C3CDDA24}        HKCR\GEPluginCoClass.GEPluginCoClass.1.0
ActiveX/COM Issue        GESchemaObjectCoClass.GESchemaObjec - {4060EDFE-CC12-489C-9D95-62F7FD9A1A8C}        HKCR\GESchemaObjectCoClass.GESchemaObjec
ActiveX/COM Issue        GESchemaObjectCoClass.GESchemaObjec.1.0 - {4060EDFE-CC12-489C-9D95-62F7FD9A1A8C}        HKCR\GESchemaObjectCoClass.GESchemaObjec.1.0
ActiveX/COM Issue        GESchemaObjectContainerCoClass.GESc - {8DE80270-0CD6-11DD-BD0B-0800200C9A66}        HKCR\GESchemaObjectContainerCoClass.GESc
ActiveX/COM Issue        GESchemaObjectContainerCoClass.GESc.1.0 - {8DE80270-0CD6-11DD-BD0B-0800200C9A66}        HKCR\GESchemaObjectContainerCoClass.GESc.1.0
ActiveX/COM Issue        GESideDatabaseHelper_CoClass.GESide - {CC1B9A74-16E2-4DAC-9FC8-430785F0A452}        HKCR\GESideDatabaseHelper_CoClass.GESide
ActiveX/COM Issue        GESideDatabaseHelper_CoClass.GESide.1.0 - {CC1B9A74-16E2-4DAC-9FC8-430785F0A452}        HKCR\GESideDatabaseHelper_CoClass.GESide.1.0
ActiveX/COM Issue        GEStyleSelectorContainerCoClass.GES - {03A81800-0CD8-11DD-BD0B-0800200C9A66}        HKCR\GEStyleSelectorContainerCoClass.GES
ActiveX/COM Issue        GEStyleSelectorContainerCoClass.GES.1.0 - {03A81800-0CD8-11DD-BD0B-0800200C9A66}        HKCR\GEStyleSelectorContainerCoClass.GES.1.0
ActiveX/COM Issue        GESunCoClass.GESunCoClass - {2938ABF2-9123-4112-BA24-38771ABBC34C}        HKCR\GESunCoClass.GESunCoClass
ActiveX/COM Issue        GESunCoClass.GESunCoClass.1.0 - {2938ABF2-9123-4112-BA24-38771ABBC34C}        HKCR\GESunCoClass.GESunCoClass.1.0
ActiveX/COM Issue        GETourPlayerCoClass.GETourPlayerCoC - {1B9D5A00-F252-11DD-BA2F-0800200C9A66}        HKCR\GETourPlayerCoClass.GETourPlayerCoC
ActiveX/COM Issue        GETourPlayerCoClass.GETourPlayerCoC.1.0 - {1B9D5A00-F252-11DD-BA2F-0800200C9A66}        HKCR\GETourPlayerCoClass.GETourPlayerCoC.1.0
ActiveX/COM Issue        GETourView_CoClass.GETourView_CoCla - {A8469360-C168-11DD-AD8B-0800200C9A66}        HKCR\GETourView_CoClass.GETourView_CoCla
ActiveX/COM Issue        GETourView_CoClass.GETourView_CoCla.1.0 - {A8469360-C168-11DD-AD8B-0800200C9A66}        HKCR\GETourView_CoClass.GETourView_CoCla.1.0
ActiveX/COM Issue        GEViewCoClass.GEViewCoClass - {F2AA8FF0-0201-11DD-95FF-0800200C9A66}        HKCR\GEViewCoClass.GEViewCoClass
ActiveX/COM Issue        GEViewCoClass.GEViewCoClass.1.0 - {F2AA8FF0-0201-11DD-95FF-0800200C9A66}        HKCR\GEViewCoClass.GEViewCoClass.1.0
ActiveX/COM Issue        GEWindowCoClass.GEWindowCoClass - {288E09A2-927A-49A7-BB24-58E48EBAD58C}        HKCR\GEWindowCoClass.GEWindowCoClass
ActiveX/COM Issue        GEWindowCoClass.GEWindowCoClass.1.0 - {288E09A2-927A-49A7-BB24-58E48EBAD58C}        HKCR\GEWindowCoClass.GEWindowCoClass.1.0
Invalid or empty file class        Google Earth.kmlfile        HKCR\Google Earth.kmlfile
Invalid or empty file class        Google Earth.kmzfile        HKCR\Google Earth.kmzfile
ActiveX/COM Issue        GoogleEarth.AnimationControllerGE - {1A239250-B650-4B63-B4CF-7FCC4DC07DC6}        HKCR\GoogleEarth.AnimationControllerGE
ActiveX/COM Issue        GoogleEarth.AnimationControllerGE.1 - {1A239250-B650-4B63-B4CF-7FCC4DC07DC6}        HKCR\GoogleEarth.AnimationControllerGE.1
ActiveX/COM Issue        GoogleEarth.ApplicationGE - {8097D7E9-DB9E-4AEF-9B28-61D82A1DF784}        HKCR\GoogleEarth.ApplicationGE
ActiveX/COM Issue        GoogleEarth.ApplicationGE.1 - {8097D7E9-DB9E-4AEF-9B28-61D82A1DF784}        HKCR\GoogleEarth.ApplicationGE.1
ActiveX/COM Issue        GoogleEarth.CameraInfoGE - {645EEE5A-BD51-4C05-A6AF-6F2CF8950AAB}        HKCR\GoogleEarth.CameraInfoGE
ActiveX/COM Issue        GoogleEarth.CameraInfoGE.1 - {645EEE5A-BD51-4C05-A6AF-6F2CF8950AAB}        HKCR\GoogleEarth.CameraInfoGE.1
ActiveX/COM Issue        GoogleEarth.FeatureCollectionGE - {9059C329-4661-49B2-9984-8753C45DB7B9}        HKCR\GoogleEarth.FeatureCollectionGE
ActiveX/COM Issue        GoogleEarth.FeatureCollectionGE.1 - {9059C329-4661-49B2-9984-8753C45DB7B9}        HKCR\GoogleEarth.FeatureCollectionGE.1
ActiveX/COM Issue        GoogleEarth.FeatureGE - {CBD4FB70-F00B-4963-B249-4B056E6A981A}        HKCR\GoogleEarth.FeatureGE
ActiveX/COM Issue        GoogleEarth.FeatureGE.1 - {CBD4FB70-F00B-4963-B249-4B056E6A981A}        HKCR\GoogleEarth.FeatureGE.1
ActiveX/COM Issue        GoogleEarth.PointOnTerrainGE - {1796A329-04C1-4C07-B28E-E4A807935C06}        HKCR\GoogleEarth.PointOnTerrainGE
ActiveX/COM Issue        GoogleEarth.PointOnTerrainGE.1 - {1796A329-04C1-4C07-B28E-E4A807935C06}        HKCR\GoogleEarth.PointOnTerrainGE.1
ActiveX/COM Issue        GoogleEarth.SearchControllerGE - {A4F65992-5738-475B-9C16-CF102BCDE153}        HKCR\GoogleEarth.SearchControllerGE
ActiveX/COM Issue        GoogleEarth.SearchControllerGE.1 - {A4F65992-5738-475B-9C16-CF102BCDE153}        HKCR\GoogleEarth.SearchControllerGE.1
ActiveX/COM Issue        GoogleEarth.TimeGE - {1AEDB68D-18A7-4CA9-B41B-3CE7E59FAB24}        HKCR\GoogleEarth.TimeGE
ActiveX/COM Issue        GoogleEarth.TimeGE.1 - {1AEDB68D-18A7-4CA9-B41B-3CE7E59FAB24}        HKCR\GoogleEarth.TimeGE.1
ActiveX/COM Issue        GoogleEarth.TimeIntervalGE - {42DF0D46-7D49-4AE5-8EF6-9CA6E41EFEC1}        HKCR\GoogleEarth.TimeIntervalGE
ActiveX/COM Issue        GoogleEarth.TimeIntervalGE.1 - {42DF0D46-7D49-4AE5-8EF6-9CA6E41EFEC1}        HKCR\GoogleEarth.TimeIntervalGE.1
ActiveX/COM Issue        GoogleEarth.TourControllerGE - {77C4C807-E257-43AD-BB3F-7CA88760BD29}        HKCR\GoogleEarth.TourControllerGE
ActiveX/COM Issue        GoogleEarth.TourControllerGE.1 - {77C4C807-E257-43AD-BB3F-7CA88760BD29}        HKCR\GoogleEarth.TourControllerGE.1
ActiveX/COM Issue        GoogleEarth.ViewExtentsGE - {D93BF052-FC68-4DB6-A4F8-A4DC9BEEB1C0}        HKCR\GoogleEarth.ViewExtentsGE
ActiveX/COM Issue        GoogleEarth.ViewExtentsGE.1 - {D93BF052-FC68-4DB6-A4F8-A4DC9BEEB1C0}        HKCR\GoogleEarth.ViewExtentsGE.1
ActiveX/COM Issue        Keyhole.KHFeature - {B153D707-447A-4538-913E-6146B3FDEE02}        HKCR\Keyhole.KHFeature
ActiveX/COM Issue        Keyhole.KHFeature.1 - {B153D707-447A-4538-913E-6146B3FDEE02}        HKCR\Keyhole.KHFeature.1
ActiveX/COM Issue        Keyhole.KHInterface - {AFD07A5E-3E20-4D77-825C-2F6D1A50BE5B}        HKCR\Keyhole.KHInterface
ActiveX/COM Issue        Keyhole.KHInterface.1 - {AFD07A5E-3E20-4D77-825C-2F6D1A50BE5B}        HKCR\Keyhole.KHInterface.1
ActiveX/COM Issue        Keyhole.KHViewExtents - {63E6BE14-A742-4EEA-8AF3-0EC39F10F850}        HKCR\Keyhole.KHViewExtents
ActiveX/COM Issue        Keyhole.KHViewExtents.1 - {63E6BE14-A742-4EEA-8AF3-0EC39F10F850}        HKCR\Keyhole.KHViewExtents.1
ActiveX/COM Issue        Keyhole.KHViewInfo - {A2D4475B-C9AA-48E2-A029-1DB829DACF7B}        HKCR\Keyhole.KHViewInfo
ActiveX/COM Issue        Keyhole.KHViewInfo.1 - {A2D4475B-C9AA-48E2-A029-1DB829DACF7B}        HKCR\Keyhole.KHViewInfo.1
ActiveX/COM Issue        KmlAbstractViewCoClass.KmlAbstractV - {A4155C74-D67F-11DC-91F3-896C55D89593}        HKCR\KmlAbstractViewCoClass.KmlAbstractV
ActiveX/COM Issue        KmlAbstractViewCoClass.KmlAbstractV.1.0 - {A4155C74-D67F-11DC-91F3-896C55D89593}        HKCR\KmlAbstractViewCoClass.KmlAbstractV.1.0
ActiveX/COM Issue        KmlBalloonOpeningEventCoClass.KmlBa - {765EA019-3E9F-4122-90B5-65B68362B814}        HKCR\KmlBalloonOpeningEventCoClass.KmlBa
ActiveX/COM Issue        KmlBalloonOpeningEventCoClass.KmlBa.1.0 - {765EA019-3E9F-4122-90B5-65B68362B814}        HKCR\KmlBalloonOpeningEventCoClass.KmlBa.1.0
ActiveX/COM Issue        KmlBalloonStyleCoClass.KmlBalloonSt - {5DEC30F0-8361-4403-8D65-496A0F1E43CC}        HKCR\KmlBalloonStyleCoClass.KmlBalloonSt
ActiveX/COM Issue        KmlBalloonStyleCoClass.KmlBalloonSt.1.0 - {5DEC30F0-8361-4403-8D65-496A0F1E43CC}        HKCR\KmlBalloonStyleCoClass.KmlBalloonSt.1.0
ActiveX/COM Issue        KmlCameraCoClass.KmlCameraCoClass - {BF356210-DC0B-11DC-95FF-0800200C9A66}        HKCR\KmlCameraCoClass.KmlCameraCoClass
ActiveX/COM Issue        KmlCameraCoClass.KmlCameraCoClass.1.0 - {BF356210-DC0B-11DC-95FF-0800200C9A66}        HKCR\KmlCameraCoClass.KmlCameraCoClass.1.0
ActiveX/COM Issue        KmlColorCoClass.KmlColorCoClass - {8A2CF8A4-B7EA-484B-BF26-83771ABB3281}        HKCR\KmlColorCoClass.KmlColorCoClass
ActiveX/COM Issue        KmlColorCoClass.KmlColorCoClass.1.0 - {8A2CF8A4-B7EA-484B-BF26-83771ABB3281}        HKCR\KmlColorCoClass.KmlColorCoClass.1.0
ActiveX/COM Issue        KmlColorStyleCoClass.KmlColorStyleC - {8A2CF8A4-B7EA-484B-BF26-5172089C88A0}        HKCR\KmlColorStyleCoClass.KmlColorStyleC
ActiveX/COM Issue        KmlColorStyleCoClass.KmlColorStyleC.1.0 - {8A2CF8A4-B7EA-484B-BF26-5172089C88A0}        HKCR\KmlColorStyleCoClass.KmlColorStyleC.1.0
ActiveX/COM Issue        KmlContainerCoClass.KmlContainerCoC - {DE556AEC-1266-2931-2441-D203819332AF}        HKCR\KmlContainerCoClass.KmlContainerCoC
ActiveX/COM Issue        KmlContainerCoClass.KmlContainerCoC.1.0 - {DE556AEC-1266-2931-2441-D203819332AF}        HKCR\KmlContainerCoClass.KmlContainerCoC.1.0
ActiveX/COM Issue        KmlCoordArrayCoClass.KmlCoordArrayC - {94B91AB6-AC08-4C5B-9B80-F195024B6923}        HKCR\KmlCoordArrayCoClass.KmlCoordArrayC
ActiveX/COM Issue        KmlCoordArrayCoClass.KmlCoordArrayC.1.0 - {94B91AB6-AC08-4C5B-9B80-F195024B6923}        HKCR\KmlCoordArrayCoClass.KmlCoordArrayC.1.0
ActiveX/COM Issue        KmlCoordCoClass.KmlCoordCoClass - {F9152AEC-3462-9202-3411-175546271882}        HKCR\KmlCoordCoClass.KmlCoordCoClass
ActiveX/COM Issue        KmlCoordCoClass.KmlCoordCoClass.1.0 - {F9152AEC-3462-9202-3411-175546271882}        HKCR\KmlCoordCoClass.KmlCoordCoClass.1.0
ActiveX/COM Issue        KmlDocumentCoClass.KmlDocumentCoCla - {1CCCB35C-7924-4244-ADC3-0CCD16034A71}        HKCR\KmlDocumentCoClass.KmlDocumentCoCla
ActiveX/COM Issue        KmlDocumentCoClass.KmlDocumentCoCla.1.0 - {1CCCB35C-7924-4244-ADC3-0CCD16034A71}        HKCR\KmlDocumentCoClass.KmlDocumentCoCla.1.0
ActiveX/COM Issue        KmlEventCoClass.KmlEventCoClass - {6E7B1428-73A7-420E-9601-BC0FD12F7881}        HKCR\KmlEventCoClass.KmlEventCoClass
ActiveX/COM Issue        KmlEventCoClass.KmlEventCoClass.1.0 - {6E7B1428-73A7-420E-9601-BC0FD12F7881}        HKCR\KmlEventCoClass.KmlEventCoClass.1.0
ActiveX/COM Issue        KmlExtrudableGeometryCoClass.KmlExt - {49274E02-AC7E-431B-8C24-3005C2F00CB0}        HKCR\KmlExtrudableGeometryCoClass.KmlExt
ActiveX/COM Issue        KmlExtrudableGeometryCoClass.KmlExt.1.0 - {49274E02-AC7E-431B-8C24-3005C2F00CB0}        HKCR\KmlExtrudableGeometryCoClass.KmlExt.1.0
ActiveX/COM Issue        KmlFeatureCoClass.KmlFeatureCoClass - {F9152AEC-3462-4632-8087-F23539485E40}        HKCR\KmlFeatureCoClass.KmlFeatureCoClass
ActiveX/COM Issue        KmlFeatureCoClass.KmlFeatureCoClass.1.0 - {F9152AEC-3462-4632-8087-F23539485E40}        HKCR\KmlFeatureCoClass.KmlFeatureCoClass.1.0
ActiveX/COM Issue        KmlFolderCoClass.KmlFolderCoClass - {DE556AEC-F321-1EF3-2441-921ABFEDD133}        HKCR\KmlFolderCoClass.KmlFolderCoClass
ActiveX/COM Issue        KmlFolderCoClass.KmlFolderCoClass.1.0 - {DE556AEC-F321-1EF3-2441-921ABFEDD133}        HKCR\KmlFolderCoClass.KmlFolderCoClass.1.0
ActiveX/COM Issue        KmlGeometryCoClass.KmlGeometryCoCla - {F9152AEC-3462-4632-8087-F123B498BC3C}        HKCR\KmlGeometryCoClass.KmlGeometryCoCla
ActiveX/COM Issue        KmlGeometryCoClass.KmlGeometryCoCla.1.0 - {F9152AEC-3462-4632-8087-F123B498BC3C}        HKCR\KmlGeometryCoClass.KmlGeometryCoCla.1.0
ActiveX/COM Issue        KmlGroundOverlayCoClass.KmlGroundOv - {8ABBC112-3462-4632-8087-1199A8BEED11}        HKCR\KmlGroundOverlayCoClass.KmlGroundOv
ActiveX/COM Issue        KmlGroundOverlayCoClass.KmlGroundOv.1.0 - {8ABBC112-3462-4632-8087-1199A8BEED11}        HKCR\KmlGroundOverlayCoClass.KmlGroundOv.1.0
ActiveX/COM Issue        KmlIconCoClass.KmlIconCoClass - {3A508B42-FFFE-4B78-ACFD-EF66A94CD156}        HKCR\KmlIconCoClass.KmlIconCoClass
ActiveX/COM Issue        KmlIconCoClass.KmlIconCoClass.1.0 - {3A508B42-FFFE-4B78-ACFD-EF66A94CD156}        HKCR\KmlIconCoClass.KmlIconCoClass.1.0
ActiveX/COM Issue        KmlIconStyleCoClass.KmlIconStyleCoC - {F99A79E0-13E1-478A-8836-56ADD3610C90}        HKCR\KmlIconStyleCoClass.KmlIconStyleCoC
ActiveX/COM Issue        KmlIconStyleCoClass.KmlIconStyleCoC.1.0 - {F99A79E0-13E1-478A-8836-56ADD3610C90}        HKCR\KmlIconStyleCoClass.KmlIconStyleCoC.1.0
ActiveX/COM Issue        KmlLabelStyleCoClass.KmlLabelStyleC - {B7A51621-758F-42B7-9365-7F8CBCBBED08}        HKCR\KmlLabelStyleCoClass.KmlLabelStyleC
ActiveX/COM Issue        KmlLabelStyleCoClass.KmlLabelStyleC.1.0 - {B7A51621-758F-42B7-9365-7F8CBCBBED08}        HKCR\KmlLabelStyleCoClass.KmlLabelStyleC.1.0
ActiveX/COM Issue        KmlLatLonAltBoxCoClass.KmlLatLonAlt - {15BEB520-8337-4CB3-97F4-39A8710BC739}        HKCR\KmlLatLonAltBoxCoClass.KmlLatLonAlt
ActiveX/COM Issue        KmlLatLonAltBoxCoClass.KmlLatLonAlt.1.0 - {15BEB520-8337-4CB3-97F4-39A8710BC739}        HKCR\KmlLatLonAltBoxCoClass.KmlLatLonAlt.1.0
ActiveX/COM Issue        KmlLatLonBoxCoClass.KmlLatLonBoxCoC - {15BEB520-8337-4CB3-97F4-62E0721371A3}        HKCR\KmlLatLonBoxCoClass.KmlLatLonBoxCoC
ActiveX/COM Issue        KmlLatLonBoxCoClass.KmlLatLonBoxCoC.1.0 - {15BEB520-8337-4CB3-97F4-62E0721371A3}        HKCR\KmlLatLonBoxCoClass.KmlLatLonBoxCoC.1.0
ActiveX/COM Issue        KmlLayerCoClass.KmlLayerCoClass - {399E09A4-826A-49A7-BB24-2988ABDD7700}        HKCR\KmlLayerCoClass.KmlLayerCoClass
ActiveX/COM Issue        KmlLayerCoClass.KmlLayerCoClass.1.0 - {399E09A4-826A-49A7-BB24-2988ABDD7700}        HKCR\KmlLayerCoClass.KmlLayerCoClass.1.0
ActiveX/COM Issue        KmlLayerRootCoClass.KmlLayerRootCoC - {048313F0-A816-11DC-8EBB-C0CA56D89593}        HKCR\KmlLayerRootCoClass.KmlLayerRootCoC
ActiveX/COM Issue        KmlLayerRootCoClass.KmlLayerRootCoC.1.0 - {048313F0-A816-11DC-8EBB-C0CA56D89593}        HKCR\KmlLayerRootCoClass.KmlLayerRootCoC.1.0
ActiveX/COM Issue        KmlLinearRingCoClass.KmlLinearRingC - {B918AB28-1266-2931-E9A2-837488ABC211}        HKCR\KmlLinearRingCoClass.KmlLinearRingC
ActiveX/COM Issue        KmlLinearRingCoClass.KmlLinearRingC.1.0 - {B918AB28-1266-2931-E9A2-837488ABC211}        HKCR\KmlLinearRingCoClass.KmlLinearRingC.1.0
ActiveX/COM Issue        KmlLineStringCoClass.KmlLineStringC - {DE556AEC-1266-2931-2441-0BFC47A92DD2}        HKCR\KmlLineStringCoClass.KmlLineStringC
ActiveX/COM Issue        KmlLineStringCoClass.KmlLineStringC.1.0 - {DE556AEC-1266-2931-2441-0BFC47A92DD2}        HKCR\KmlLineStringCoClass.KmlLineStringC.1.0
ActiveX/COM Issue        KmlLineStyleCoClass.KmlLineStyleCoC - {E0CCEE92-6573-4549-9721-5CFD87360A01}        HKCR\KmlLineStyleCoClass.KmlLineStyleCoC
ActiveX/COM Issue        KmlLineStyleCoClass.KmlLineStyleCoC.1.0 - {E0CCEE92-6573-4549-9721-5CFD87360A01}        HKCR\KmlLineStyleCoClass.KmlLineStyleCoC.1.0
ActiveX/COM Issue        KmlLinkCoClass.KmlLinkCoClass - {B692B1C4-8973-4DB8-9FCE-9813A057ED09}        HKCR\KmlLinkCoClass.KmlLinkCoClass
ActiveX/COM Issue        KmlLinkCoClass.KmlLinkCoClass.1.0 - {B692B1C4-8973-4DB8-9FCE-9813A057ED09}        HKCR\KmlLinkCoClass.KmlLinkCoClass.1.0
ActiveX/COM Issue        KmlListStyleCoClass.KmlListStyleCoC - {F3B378CC-345E-4435-A1B3-788455599C7B}        HKCR\KmlListStyleCoClass.KmlListStyleCoC
ActiveX/COM Issue        KmlListStyleCoClass.KmlListStyleCoC.1.0 - {F3B378CC-345E-4435-A1B3-788455599C7B}        HKCR\KmlListStyleCoClass.KmlListStyleCoC.1.0
ActiveX/COM Issue        KmlLocationCoClass.KmlLocationCoCla - {7C730856-A82B-11DC-91EB-7AC855D89593}        HKCR\KmlLocationCoClass.KmlLocationCoCla
ActiveX/COM Issue        KmlLocationCoClass.KmlLocationCoCla.1.0 - {7C730856-A82B-11DC-91EB-7AC855D89593}        HKCR\KmlLocationCoClass.KmlLocationCoCla.1.0
ActiveX/COM Issue        KmlLodCoClass.KmlLodCoClass - {B50F4299-76E8-475E-B4B6-34B30BD89619}        HKCR\KmlLodCoClass.KmlLodCoClass
ActiveX/COM Issue        KmlLodCoClass.KmlLodCoClass.1.0 - {B50F4299-76E8-475E-B4B6-34B30BD89619}        HKCR\KmlLodCoClass.KmlLodCoClass.1.0
ActiveX/COM Issue        KmlLookAtCoClass.KmlLookAtCoClass - {F9152AEC-3462-4632-8087-F1232355FD63}        HKCR\KmlLookAtCoClass.KmlLookAtCoClass
ActiveX/COM Issue        KmlLookAtCoClass.KmlLookAtCoClass.1.0 - {F9152AEC-3462-4632-8087-F1232355FD63}        HKCR\KmlLookAtCoClass.KmlLookAtCoClass.1.0
ActiveX/COM Issue        KmlModelCoClass.KmlModelCoClass - {38D274E5-9232-4444-915E-9A5731409FD3}        HKCR\KmlModelCoClass.KmlModelCoClass
ActiveX/COM Issue        KmlModelCoClass.KmlModelCoClass.1.0 - {38D274E5-9232-4444-915E-9A5731409FD3}        HKCR\KmlModelCoClass.KmlModelCoClass.1.0
ActiveX/COM Issue        KmlMouseEventCoClass.KmlMouseEventC - {397D6D52-48DC-4FA5-9736-7AFB30CA2850}        HKCR\KmlMouseEventCoClass.KmlMouseEventC
ActiveX/COM Issue        KmlMouseEventCoClass.KmlMouseEventC.1.0 - {397D6D52-48DC-4FA5-9736-7AFB30CA2850}        HKCR\KmlMouseEventCoClass.KmlMouseEventC.1.0
ActiveX/COM Issue        KmlMultiGeometryCoClass.KmlMultiGeo - {82EAFAE0-1BF8-11DD-BD0B-0800200C9A66}        HKCR\KmlMultiGeometryCoClass.KmlMultiGeo
ActiveX/COM Issue        KmlMultiGeometryCoClass.KmlMultiGeo.1.0 - {82EAFAE0-1BF8-11DD-BD0B-0800200C9A66}        HKCR\KmlMultiGeometryCoClass.KmlMultiGeo.1.0
ActiveX/COM Issue        KmlNetworkLinkCoClass.KmlNetworkLin - {EBE69A72-7483-410C-B50C-2B40885E6F5B}        HKCR\KmlNetworkLinkCoClass.KmlNetworkLin
ActiveX/COM Issue        KmlNetworkLinkCoClass.KmlNetworkLin.1.0 - {EBE69A72-7483-410C-B50C-2B40885E6F5B}        HKCR\KmlNetworkLinkCoClass.KmlNetworkLin.1.0
ActiveX/COM Issue        KmlObjectBaseCoClass.KmlObjectBaseC - {1D7CA30A-3D39-435F-9507-702FE5309312}        HKCR\KmlObjectBaseCoClass.KmlObjectBaseC
ActiveX/COM Issue        KmlObjectBaseCoClass.KmlObjectBaseC.1.0 - {1D7CA30A-3D39-435F-9507-702FE5309312}        HKCR\KmlObjectBaseCoClass.KmlObjectBaseC.1.0
ActiveX/COM Issue        KmlObjectCoClass.KmlObjectCoClass - {F9152AEC-3462-4632-8087-F235A566FE30}        HKCR\KmlObjectCoClass.KmlObjectCoClass
ActiveX/COM Issue        KmlObjectCoClass.KmlObjectCoClass.1.0 - {F9152AEC-3462-4632-8087-F235A566FE30}        HKCR\KmlObjectCoClass.KmlObjectCoClass.1.0
ActiveX/COM Issue        KmlObjectListCoClass.KmlObjectListC - {33393037-2A45-4449-A0AB-4E5F2BEFF220}        HKCR\KmlObjectListCoClass.KmlObjectListC
ActiveX/COM Issue        KmlObjectListCoClass.KmlObjectListC.1.0 - {33393037-2A45-4449-A0AB-4E5F2BEFF220}        HKCR\KmlObjectListCoClass.KmlObjectListC.1.0
ActiveX/COM Issue        KmlOrientationCoClass.KmlOrientatio - {38C744AB-B64A-4DF1-8871-D3479155FADF}        HKCR\KmlOrientationCoClass.KmlOrientatio
ActiveX/COM Issue        KmlOrientationCoClass.KmlOrientatio.1.0 - {38C744AB-B64A-4DF1-8871-D3479155FADF}        HKCR\KmlOrientationCoClass.KmlOrientatio.1.0
ActiveX/COM Issue        KmlOverlayCoClass.KmlOverlayCoClass - {F9152AEC-3462-4632-8087-F23CA598FF34}        HKCR\KmlOverlayCoClass.KmlOverlayCoClass
ActiveX/COM Issue        KmlOverlayCoClass.KmlOverlayCoClass.1.0 - {F9152AEC-3462-4632-8087-F23CA598FF34}        HKCR\KmlOverlayCoClass.KmlOverlayCoClass.1.0
ActiveX/COM Issue        KmlPhotoOverlayCoClass.KmlPhotoOver - {00AB1EF0-C172-11DD-AD8B-0800200C9A66}        HKCR\KmlPhotoOverlayCoClass.KmlPhotoOver
ActiveX/COM Issue        KmlPhotoOverlayCoClass.KmlPhotoOver.1.0 - {00AB1EF0-C172-11DD-AD8B-0800200C9A66}        HKCR\KmlPhotoOverlayCoClass.KmlPhotoOver.1.0
ActiveX/COM Issue        KmlPlacemarkCoClass.KmlPlacemarkCoC - {F912DCEC-3462-4632-8087-FEEFB45AE521}        HKCR\KmlPlacemarkCoClass.KmlPlacemarkCoC
ActiveX/COM Issue        KmlPlacemarkCoClass.KmlPlacemarkCoC.1.0 - {F912DCEC-3462-4632-8087-FEEFB45AE521}        HKCR\KmlPlacemarkCoClass.KmlPlacemarkCoC.1.0
ActiveX/COM Issue        KmlPointCoClass.KmlPointCoClass - {DE556AEC-1266-7632-8087-9847DEFB2172}        HKCR\KmlPointCoClass.KmlPointCoClass
ActiveX/COM Issue        KmlPointCoClass.KmlPointCoClass.1.0 - {DE556AEC-1266-7632-8087-9847DEFB2172}        HKCR\KmlPointCoClass.KmlPointCoClass.1.0
ActiveX/COM Issue        KmlPolygonCoClass.KmlPolygonCoClass - {2A9990A5-E235-4AE6-972C-EDC30B6192E5}        HKCR\KmlPolygonCoClass.KmlPolygonCoClass
ActiveX/COM Issue        KmlPolygonCoClass.KmlPolygonCoClass.1.0 - {2A9990A5-E235-4AE6-972C-EDC30B6192E5}        HKCR\KmlPolygonCoClass.KmlPolygonCoClass.1.0
ActiveX/COM Issue        KmlPolyStyleCoClass.KmlPolyStyleCoC - {553F44FE-A225-4783-A084-478D54EDC63B}        HKCR\KmlPolyStyleCoClass.KmlPolyStyleCoC
ActiveX/COM Issue        KmlPolyStyleCoClass.KmlPolyStyleCoC.1.0 - {553F44FE-A225-4783-A084-478D54EDC63B}        HKCR\KmlPolyStyleCoClass.KmlPolyStyleCoC.1.0
ActiveX/COM Issue        KmlRegionCoClass.KmlRegionCoClass - {ECA7F061-70D0-4507-BABD-F1B0B653CC6A}        HKCR\KmlRegionCoClass.KmlRegionCoClass
ActiveX/COM Issue        KmlRegionCoClass.KmlRegionCoClass.1.0 - {ECA7F061-70D0-4507-BABD-F1B0B653CC6A}        HKCR\KmlRegionCoClass.KmlRegionCoClass.1.0
ActiveX/COM Issue        KmlScaleCoClass.KmlScaleCoClass - {47B797F2-E873-4F47-A999-693A9FDF9E54}        HKCR\KmlScaleCoClass.KmlScaleCoClass
ActiveX/COM Issue        KmlScaleCoClass.KmlScaleCoClass.1.0 - {47B797F2-E873-4F47-A999-693A9FDF9E54}        HKCR\KmlScaleCoClass.KmlScaleCoClass.1.0
ActiveX/COM Issue        KmlScreenOverlayCoClass.KmlScreenOv - {88A9100B-231A-421A-8AAB-918BFFE22C14}        HKCR\KmlScreenOverlayCoClass.KmlScreenOv
ActiveX/COM Issue        KmlScreenOverlayCoClass.KmlScreenOv.1.0 - {88A9100B-231A-421A-8AAB-918BFFE22C14}        HKCR\KmlScreenOverlayCoClass.KmlScreenOv.1.0
ActiveX/COM Issue        KmlStyleCoClass.KmlStyleCoClass - {44AFAC41-D98B-4A3F-BB75-5AA4CC4D9763}        HKCR\KmlStyleCoClass.KmlStyleCoClass
ActiveX/COM Issue        KmlStyleCoClass.KmlStyleCoClass.1.0 - {44AFAC41-D98B-4A3F-BB75-5AA4CC4D9763}        HKCR\KmlStyleCoClass.KmlStyleCoClass.1.0
ActiveX/COM Issue        KmlStyleMapCoClass.KmlStyleMapCoCla - {855DBC4D-C8D7-4816-B1EA-A5EBA403907E}        HKCR\KmlStyleMapCoClass.KmlStyleMapCoCla
ActiveX/COM Issue        KmlStyleMapCoClass.KmlStyleMapCoCla.1.0 - {855DBC4D-C8D7-4816-B1EA-A5EBA403907E}        HKCR\KmlStyleMapCoClass.KmlStyleMapCoCla.1.0
ActiveX/COM Issue        KmlStyleSelectorCoClass.KmlStyleSel - {8A36A57E-CED8-4997-B3FB-19801EF969FD}        HKCR\KmlStyleSelectorCoClass.KmlStyleSel
ActiveX/COM Issue        KmlStyleSelectorCoClass.KmlStyleSel.1.0 - {8A36A57E-CED8-4997-B3FB-19801EF969FD}        HKCR\KmlStyleSelectorCoClass.KmlStyleSel.1.0
ActiveX/COM Issue        KmlTourCoClass.KmlTourCoClass - {2711BC60-C16E-11DD-AD8B-0800200C9A66}        HKCR\KmlTourCoClass.KmlTourCoClass
ActiveX/COM Issue        KmlTourCoClass.KmlTourCoClass.1.0 - {2711BC60-C16E-11DD-AD8B-0800200C9A66}        HKCR\KmlTourCoClass.KmlTourCoClass.1.0
ActiveX/COM Issue        KmlVec2CoClass.KmlVec2CoClass - {D6CB4B7A-10CF-4E51-B237-41D59B17CEE6}        HKCR\KmlVec2CoClass.KmlVec2CoClass
ActiveX/COM Issue        KmlVec2CoClass.KmlVec2CoClass.1.0 - {D6CB4B7A-10CF-4E51-B237-41D59B17CEE6}        HKCR\KmlVec2CoClass.KmlVec2CoClass.1.0
ActiveX/COM Issue        KmlVec2Wrapper_CoClass.KmlVec2Wrapp - {60286710-BEA7-11DE-8A39-0800200C9A66}        HKCR\KmlVec2Wrapper_CoClass.KmlVec2Wrapp
ActiveX/COM Issue        KmlVec2Wrapper_CoClass.KmlVec2Wrapp.1.0 - {60286710-BEA7-11DE-8A39-0800200C9A66}        HKCR\KmlVec2Wrapper_CoClass.KmlVec2Wrapp.1.0
ActiveX/COM Issue        MobileServer.CateogryPowerManagement - {A4A74456-67F8-4F18-B96B-0F1F05DEF65A}        HKCR\MobileServer.CateogryPowerManagement
ActiveX/COM Issue        MobileServer.CateogryPowerManagement.1 - {A4A74456-67F8-4F18-B96B-0F1F05DEF65A}        HKCR\MobileServer.CateogryPowerManagement.1
ActiveX/COM Issue        MobileServer.MainServer - {01504157-8839-4BF6-9B5B-51165A967B2B}        HKCR\MobileServer.MainServer
ActiveX/COM Issue        MobileServer.MainServer.1 - {01504157-8839-4BF6-9B5B-51165A967B2B}        HKCR\MobileServer.MainServer.1
ActiveX/COM Issue        MobileServer.PowerMizer - {56CDA654-2AA2-456F-81B1-153FE7B381A2}        HKCR\MobileServer.PowerMizer
ActiveX/COM Issue        MobileServer.PowerMizer.1 - {56CDA654-2AA2-456F-81B1-153FE7B381A2}        HKCR\MobileServer.PowerMizer.1
ActiveX/COM Issue        MobileServer.SmartDimmer - {7112FB6A-700C-4C25-BB31-5B13CE60CC29}        HKCR\MobileServer.SmartDimmer
ActiveX/COM Issue        MobileServer.SmartDimmer.1 - {7112FB6A-700C-4C25-BB31-5B13CE60CC29}        HKCR\MobileServer.SmartDimmer.1
ActiveX/COM Issue        NvCpl.DesktopContext - {A70C977A-BF00-412C-90B7-034C51DA2439}        HKCR\NvCpl.DesktopContext
ActiveX/COM Issue        NvCpl.DesktopContext.1 - {A70C977A-BF00-412C-90B7-034C51DA2439}        HKCR\NvCpl.DesktopContext.1
ActiveX/COM Issue        NVXDApiX.NvApixEngine - {5DF4E7C5-78E3-4CCA-93CD-DF1639E165FB}        HKCR\NVXDApiX.NvApixEngine
ActiveX/COM Issue        NVXDApiX.NvApixEngine.1 - {5DF4E7C5-78E3-4CCA-93CD-DF1639E165FB}        HKCR\NVXDApiX.NvApixEngine.1
ActiveX/COM Issue        NvXDSync.NvXDSyncEngine - {87BDED91-3F10-4383-B8C1-26886F49F141}        HKCR\NvXDSync.NvXDSyncEngine
ActiveX/COM Issue        NvXDSync.NvXDSyncEngine.1 - {87BDED91-3F10-4383-B8C1-26886F49F141}        HKCR\NvXDSync.NvXDSyncEngine.1
ActiveX/COM Issue        StereoVisionServer.Category_Video - {9C7684B5-FC31-4e57-A852-282D907911CC}        HKCR\StereoVisionServer.Category_Video
ActiveX/COM Issue        StereoVisionServer.Category_Video.1 - {9C7684B5-FC31-4e57-A852-282D907911CC}        HKCR\StereoVisionServer.Category_Video.1
ActiveX/COM Issue        StereoVisionServer.GamesCompatibility - {2DF0ACC2-6D97-491b-9581-70A6001FD25A}        HKCR\StereoVisionServer.GamesCompatibility
ActiveX/COM Issue        StereoVisionServer.MainServer - {C4A29158-1A7E-425f-B25E-80FA382AAA14}        HKCR\StereoVisionServer.MainServer
ActiveX/COM Issue        StereoVisionServer.MainServer.1 - {C4A29158-1A7E-425f-B25E-80FA382AAA14}        HKCR\StereoVisionServer.MainServer.1
ActiveX/COM Issue        StereoVisionServer.SetUpStereoVision - {50125552-EC89-4049-B1B7-5FDBE38C8509}        HKCR\StereoVisionServer.SetUpStereoVision
ActiveX/COM Issue        StereoVisionServer.SetUpStereoVision.1 - {50125552-EC89-4049-B1B7-5FDBE38C8509}        HKCR\StereoVisionServer.SetUpStereoVision.1
ActiveX/COM Issue        StereoVisionServer.Stereoscopic3DSettings - {00E80F18-EC5B-4FCF-A417-7348991A8D32}        HKCR\StereoVisionServer.Stereoscopic3DSettings
ActiveX/COM Issue        StereoVisionServer.Stereoscopic3DSettings.1 - {00E80F18-EC5B-4FCF-A417-7348991A8D32}        HKCR\StereoVisionServer.Stereoscopic3DSettings.1
ActiveX/COM Issue        StereoVisionServer.VideoQualitySetting.1 - {2DF0ACC2-6D97-491b-9581-70A6001FD25A}        HKCR\StereoVisionServer.VideoQualitySetting.1
ActiveX/COM Issue        Video_TVServer.Category_Video - {3020E6D8-7D1A-4D3C-8B62-C4D4B8F28434}        HKCR\Video_TVServer.Category_Video
ActiveX/COM Issue        Video_TVServer.Category_Video.1 - {3020E6D8-7D1A-4D3C-8B62-C4D4B8F28434}        HKCR\Video_TVServer.Category_Video.1
ActiveX/COM Issue        Video_TVServer.FullScreenVideo - {6F3F133D-61E3-4153-8AAE-056031E2B597}        HKCR\Video_TVServer.FullScreenVideo
ActiveX/COM Issue        Video_TVServer.FullScreenVideo.1 - {6F3F133D-61E3-4153-8AAE-056031E2B597}        HKCR\Video_TVServer.FullScreenVideo.1
ActiveX/COM Issue        Video_TVServer.MainServer - {3E500C0C-5D15-4610-8095-7CEBD4C43F24}        HKCR\Video_TVServer.MainServer
ActiveX/COM Issue        Video_TVServer.MainServer.1 - {3E500C0C-5D15-4610-8095-7CEBD4C43F24}        HKCR\Video_TVServer.MainServer.1
ActiveX/COM Issue        Video_TVServer.TVFormat - {89B53798-9A96-4758-9571-93B72CAA5381}        HKCR\Video_TVServer.TVFormat
ActiveX/COM Issue        Video_TVServer.TVFormat.1 - {89B53798-9A96-4758-9571-93B72CAA5381}        HKCR\Video_TVServer.TVFormat.1
ActiveX/COM Issue        Video_TVServer.TVHDMIColor - {81667C73-F396-44a3-923B-3749C0840A58}        HKCR\Video_TVServer.TVHDMIColor
ActiveX/COM Issue        Video_TVServer.TVHDMIColor.1 - {81667C73-F396-44a3-923B-3749C0840A58}        HKCR\Video_TVServer.TVHDMIColor.1
ActiveX/COM Issue        Video_TVServer.TVImage - {87CDE238-C2D9-4E31-99D7-DCD6A7E15F19}        HKCR\Video_TVServer.TVImage
ActiveX/COM Issue        Video_TVServer.TVImage.1 - {87CDE238-C2D9-4E31-99D7-DCD6A7E15F19}        HKCR\Video_TVServer.TVImage.1
ActiveX/COM Issue        Video_TVServer.TVSizeMove - {63005CD0-8541-439c-A66A-617F4B1F2BCB}        HKCR\Video_TVServer.TVSizeMove
ActiveX/COM Issue        Video_TVServer.TVSizeMove.1 - {63005CD0-8541-439c-A66A-617F4B1F2BCB}        HKCR\Video_TVServer.TVSizeMove.1
ActiveX/COM Issue        Video_TVServer.VideoColorSettings - {055A7699-EAFF-47DF-8E55-41F4C0612BF3}        HKCR\Video_TVServer.VideoColorSettings
ActiveX/COM Issue        Video_TVServer.VideoColorSettings.1 - {055A7699-EAFF-47DF-8E55-41F4C0612BF3}        HKCR\Video_TVServer.VideoColorSettings.1
ActiveX/COM Issue        Video_TVServer.VideoImageSettings - {EF884939-F1EA-4EFB-B676-D2F802177C5F}        HKCR\Video_TVServer.VideoImageSettings
ActiveX/COM Issue        Video_TVServer.VideoQualitySetting.1 - {EF884939-F1EA-4EFB-B676-D2F802177C5F}        HKCR\Video_TVServer.VideoQualitySetting.1
ActiveX/COM Issue        Video_TVServer.VideoZoom - {D385E909-3F89-4ECD-B38F-AC11F9FE6F1C}        HKCR\Video_TVServer.VideoZoom
ActiveX/COM Issue        Video_TVServer.VideoZoom.1 - {D385E909-3F89-4ECD-B38F-AC11F9FE6F1C}        HKCR\Video_TVServer.VideoZoom.1
ActiveX/COM Issue        WorkStationServer.CategoryFS - {D8A8B20F-98D2-4EFF-8CE1-EF094F1A8043}        HKCR\WorkStationServer.CategoryFS
ActiveX/COM Issue        WorkStationServer.CategoryFS.1 - {D8A8B20F-98D2-4EFF-8CE1-EF094F1A8043}        HKCR\WorkStationServer.CategoryFS.1
ActiveX/COM Issue        WorkStationServer.CategoryGfxSys - {7BB17C5A-3176-4B40-A3F9-39D4A64D7E83}        HKCR\WorkStationServer.CategoryGfxSys
ActiveX/COM Issue        WorkStationServer.CategoryGfxSys.1 - {7BB17C5A-3176-4B40-A3F9-39D4A64D7E83}        HKCR\WorkStationServer.CategoryGfxSys.1
ActiveX/COM Issue        WorkStationServer.CategorySDI - {75BDD7A1-1224-41DA-90B4-457ACD874F12}        HKCR\WorkStationServer.CategorySDI
ActiveX/COM Issue        WorkStationServer.CategorySDI.1 - {75BDD7A1-1224-41DA-90B4-457ACD874F12}        HKCR\WorkStationServer.CategorySDI.1
ActiveX/COM Issue        WorkStationServer.ECCSettings - {07333BBD-64AF-4206-899D-2809660C61C7}        HKCR\WorkStationServer.ECCSettings
ActiveX/COM Issue        WorkStationServer.ECCSettings.1 - {07333BBD-64AF-4206-899D-2809660C61C7}        HKCR\WorkStationServer.ECCSettings.1
ActiveX/COM Issue        WorkStationServer.FSSettings - {86193C76-0DCA-4B33-83CA-6D7DCCA48D0B}        HKCR\WorkStationServer.FSSettings
ActiveX/COM Issue        WorkStationServer.FSSettings.1 - {86193C76-0DCA-4B33-83CA-6D7DCCA48D0B}        HKCR\WorkStationServer.FSSettings.1
ActiveX/COM Issue        WorkStationServer.MainServer - {0EEC1AF6-7664-4D17-88A5-B71EF18A93BC}        HKCR\WorkStationServer.MainServer
ActiveX/COM Issue        WorkStationServer.MainServer.1 - {0EEC1AF6-7664-4D17-88A5-B71EF18A93BC}        HKCR\WorkStationServer.MainServer.1
ActiveX/COM Issue        WorkStationServer.ManageMaximusSettings - {9BC49CE1-EFA7-4C49-8BB2-5355FEA6C170}        HKCR\WorkStationServer.ManageMaximusSettings
ActiveX/COM Issue        WorkStationServer.ManageMaximusSettings.1 - {9BC49CE1-EFA7-4C49-8BB2-5355FEA6C170}        HKCR\WorkStationServer.ManageMaximusSettings.1
ActiveX/COM Issue        WorkStationServer.ManageQuadroPlex - {FC7AA68D-EAFB-4ce9-A012-9C33E7B02B49}        HKCR\WorkStationServer.ManageQuadroPlex
ActiveX/COM Issue        WorkStationServer.ManageQuadroPlex.1 - {FC7AA68D-EAFB-4ce9-A012-9C33E7B02B49}        HKCR\WorkStationServer.ManageQuadroPlex.1
ActiveX/COM Issue        WorkStationServer.ManageSdiOutput - {DDEF97F5-723E-47D2-87B1-14C39EFBAE11}        HKCR\WorkStationServer.ManageSdiOutput
ActiveX/COM Issue        WorkStationServer.ManageSdiOutput.1 - {DDEF97F5-723E-47D2-87B1-14C39EFBAE11}        HKCR\WorkStationServer.ManageSdiOutput.1
ActiveX/COM Issue        WorkStationServer.Overlap - {9B0C8B3B-8CA5-46cb-B0DD-64542BBA21DC}        HKCR\WorkStationServer.Overlap
ActiveX/COM Issue        WorkStationServer.Overlap.1 - {9B0C8B3B-8CA5-46cb-B0DD-64542BBA21DC}        HKCR\WorkStationServer.Overlap.1
ActiveX/COM Issue        WorkStationServer.Panoramic - {294EC7E3-94B7-4A6C-8636-09B33674D58F}        HKCR\WorkStationServer.Panoramic
ActiveX/COM Issue        WorkStationServer.Panoramic.1 - {294EC7E3-94B7-4A6C-8636-09B33674D58F}        HKCR\WorkStationServer.Panoramic.1
ActiveX/COM Issue        WorkStationServer.SDISettings - {7735B86B-2EAB-43EF-B5DE-31A15F767C14}        HKCR\WorkStationServer.SDISettings
ActiveX/COM Issue        WorkStationServer.SDISettings.1 - {7735B86B-2EAB-43EF-B5DE-31A15F767C14}        HKCR\WorkStationServer.SDISettings.1
ActiveX/COM Issue        WorkStationServer.SetupMosaic - {9C1878FA-A0CB-4F01-8762-A6BF18021C94}        HKCR\WorkStationServer.SetupMosaic
ActiveX/COM Issue        WorkStationServer.SetupMosaic.1 - {9C1878FA-A0CB-4F01-8762-A6BF18021C94}        HKCR\WorkStationServer.SetupMosaic.1
ActiveX/COM Issue        WorkStationServer.SetupMosaicEx - {1618348E-35B3-4631-8C04-2AB15AF5007D}        HKCR\WorkStationServer.SetupMosaicEx
ActiveX/COM Issue        WorkStationServer.SetupMosaicEx.1 - {1618348E-35B3-4631-8C04-2AB15AF5007D}        HKCR\WorkStationServer.SetupMosaicEx.1
ActiveX/COM Issue        WorkStationServer.SynchronizeDisplays - {6A10CEAB-0813-48BA-9769-BD98F03F3EB8}        HKCR\WorkStationServer.SynchronizeDisplays
ActiveX/COM Issue        WorkStationServer.SynchronizeDisplays.1 - {6A10CEAB-0813-48BA-9769-BD98F03F3EB8}        HKCR\WorkStationServer.SynchronizeDisplays.1
ActiveX/COM Issue        WorkStationServer.TopologyViewer - {5135A9C0-F05A-4FBD-8EC6-6B920CD387F6}        HKCR\WorkStationServer.TopologyViewer
ActiveX/COM Issue        WorkStationServer.TopologyViewer.1 - {5135A9C0-F05A-4FBD-8EC6-6B920CD387F6}        HKCR\WorkStationServer.TopologyViewer.1
ActiveX/COM Issue        WorkStationServer.TopologyViewerEx - {D474EBC0-2851-4389-893D-030D2B6BCED1}        HKCR\WorkStationServer.TopologyViewerEx
ActiveX/COM Issue        WorkStationServer.TopologyViewerEx.1 - {D474EBC0-2851-4389-893D-030D2B6BCED1}        HKCR\WorkStationServer.TopologyViewerEx.1
ActiveX/COM Issue        WorkStationServer.TopologyViewerVista - {54CEE07E-E1C8-45DB-B550-417E75C4CA58}        HKCR\WorkStationServer.TopologyViewerVista
ActiveX/COM Issue        WorkStationServer.TopologyViewerVista.1 - {54CEE07E-E1C8-45DB-B550-417E75C4CA58}

t'john 04.06.2013 14:09
Wo bleiben die Screenshots?

Warum verwendest du CCleaner?

bmell 04.06.2013 14:11
Und sieh mal hier, da ist wohl das TDSS Dateisystem ? Unversteckt ... ? ich hab davon leider wenig Ahnung. aber TDSSKiller->TSDD und auch die Abhängigkeiten im Regeditor wären offensichtlich !

HKEY_CURRENT_CONFIG->System->... Services->TSDDD und VGASAVE
VVCap Image

Zitat:
Zitat von t'john (Beitrag 1078018)
Wo bleiben die Screenshots?

Warum verwendest du CCleaner?

Weil mir das mal ein Bekannter riet da mal zu schauen von Zeit zu Zeit.
Entschuldige Bitte falls das jetzt suboptimal war. Die Screenshots hatte ich geposted ?
Aber ohne Link geposted,entweder das Forum macht das so oder der Bot im Hintergrund hier.

t'john 04.06.2013 14:17
Zitat:
Weil mir das mal ein Bekannter riet da mal zu schauen von Zeit zu Zeit.
Keine Gute Idee. hier mal lesen: http://www.trojaner-board.de/51464-a...-ccleaner.html

Screenshot im Forum hochladen.

bmell 04.06.2013 14:19
crystal:

hxxp://vvcap.net/db/a7_yMiNjMbPVIOcfwpdx.htp

OHM:

hxxp://vvcap.net/db/_l5ic3gY4fIW8jLUmFdw.htp

Und das das TD Filesystem was ich meine gefunden zu haben als ich dieses Ding sah bei OHM "Manufacturer0" ...:

hxxp://vvcap.net/db/8r9xxur7IRMJKY0KM6nj.htp

Und auch sehr geschickt dass so aussehen zu lassen als ob es so ein Dir ist "was nie aufhört", evtl. der recht billige aber anscheinend effektive
Weg die Scanner auszutricksen:

"C:\Users\PanIngo\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\A pplication Data" - da liegt dann diverser Müll rum. Ich mach aber nichts ohne Deine expl. Anweisung und verhalt mich ruhig hier.

Eben durch Zufall hab ich das ReadMe.rtf File mit Rechtsclick und Notepad++ geöffnet und musste mit erschrecken feststellen, dass dort wohl (alle) gelockte Dirs nebst Binärcode enthalten sind - es scheinen Hunderte zu sein und MBAM ist wohl auch kompromitiert wenn es im MBAM Ordner liegt z.B.:"

\lsdprioritydef99{\lsdlockedexcept \lsdqformat1 \lsdpriority0 \lsdlocked0 Normal;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 1;"

Habe das ganze File mal hierher kopiert: hxxp://piratenpad.de/p/6Z8Rb7jYuF

(Nachtrag: Das ist wohl eine Art Patch um MBAM zu patchen dass er mir immer einem vom Pferd erzählt von wegen 0 Funde usw.)

Und dieses eine Dir ist blau, sowas hab ich noch nie gesehen:
Mache ich einen rechtscklick drauf, erhalte ich das Kontextmenue eines .mp3 oder
Videofiles:

hxxp://vvcap.net/db/bddlGEaJUgUBeAEiuFtg.htp

t'john 04.06.2013 16:03
Bitte Bilder im Forum anhaengen (http://www.trojaner-board.de/images/editor/attach.gif-Symbol)

bmell 04.06.2013 16:18
Liste der Anhänge anzeigen (Anzahl: 3)
Zitat:
Zitat von t'john (Beitrag 1078102)
Bitte Bilder im Forum anhaengen (http://www.trojaner-board.de/images/editor/attach.gif-Symbol)
OK, sind angehangen an diesen Post.

bmell 04.06.2013 21:18
Da ich jetzt wirklich Angst bekommen habe und nervös bin, ists wohl
mit dem Schlafen erstmal vorbei heute. Ich bin bis bis ca. 24h erreichbar.
Spende ist übrigens raus, ihr sollt ja nicht umsonst ackern hier.

t'john 05.06.2013 11:07
OK:
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

bmell 05.06.2013 12:08
Hi John, ich mag nicht unhöflich erscheinen - aber das rootkit ersetzt jegliches tool "on-the-fly" mit einem faketool - siehe Bitte meine Pics die ich geposted habe. Ich habe gestern versucht mir die hosts Datei anzusehen und dann zu speichern. In der Auswahlliste der Dateiendungen (wohl ein Bug "seinerseits - und auch nur da sichtbar) waren diverse C-Compiler und Addons zur Auswahl ,u.A. ADA und gcc. Ich ziehe den Tdsskiller Test gerne nochmal durch, nur das hab ich gestern leider schon x Mal , ohne Erfolg.
Ich weiss nicht ob der Link ankam, aber es sind überall .rtf Files verstreut in denen Binär-Code nebst dem eig. Code ist. Dieser "patcht" dann das Anti Malware Tool, und es scheinen (fast?) alle zu sein, da ich etliche durchprobiert habe. Auch sieht mein Windows anders aus, ich werde von allen wichtigen Eigenschaften abgeschottet, wie z.B. das administrieren anderer Konten. Ich mach nochmal 2,3 Bilder was die Sache verdeutlichen sollte.


Hier ist der TDSSKiller Log:

t'john 05.06.2013 12:18
Ich habe mir die angeschaut: http://www.trojaner-board.de/134660-...ml#post1078111

Alles prima.

Bitte das TDSSLog posten.

bmell 05.06.2013 13:35
Liste der Anhänge anzeigen (Anzahl: 2)
Alles prima ? ;) Muss aber ironisch gemeint sein ;)

Wie ist das zu erklären, mit dem Manufact0 - PartNum0? - kein Rootkit-Dateisystem ?

Bitte weiterhin die diese umgedrehte TDSS-System beachten:

Code:
14:32:42.0852 3700  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
14:32:42.0991 3700  ============================================================
14:32:42.0991 3700  Current date / time: 2013/06/05 14:32:42.0991
14:32:42.0991 3700  SystemInfo:
14:32:42.0991 3700 
14:32:42.0991 3700  OS Version: 6.1.7601 ServicePack: 1.0
14:32:42.0992 3700  Product type: Workstation
14:32:42.0992 3700  ComputerName: PANINGO-PC
14:32:42.0992 3700  UserName: PanIngo
14:32:42.0992 3700  Windows directory: C:\Windows
14:32:42.0992 3700  System windows directory: C:\Windows
14:32:42.0992 3700  Running under WOW64
14:32:42.0992 3700  Processor architecture: Intel x64
14:32:42.0992 3700  Number of processors: 4
14:32:42.0992 3700  Page size: 0x1000
14:32:42.0992 3700  Boot type: Normal boot
14:32:42.0992 3700  ============================================================
14:32:44.0194 3700  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x19E0186, SectorsPerTrack: 0x4, TracksPerCylinder: 0x12, Type 'K0', Flags 0x00000040
14:32:44.0198 3700  ============================================================
14:32:44.0198 3700  \Device\Harddisk0\DR0:
14:32:44.0198 3700  MBR partitions:
14:32:44.0198 3700  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:32:44.0198 3700  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3CC78000
14:32:44.0217 3700  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x3CCAB000, BlocksNum 0x37A5B000
14:32:44.0217 3700  ============================================================
14:32:44.0251 3700  C: <-> \Device\Harddisk0\DR0\Partition2
14:32:44.0277 3700  E: <-> \Device\Harddisk0\DR0\Partition3
14:32:44.0277 3700  ============================================================
14:32:44.0277 3700  Initialize success
14:32:44.0277 3700  ============================================================
14:33:40.0928 3820  ============================================================
14:33:40.0928 3820  Scan started
14:33:40.0928 3820  Mode: Manual; SigCheck; TDLFS;
14:33:40.0928 3820  ============================================================
14:33:41.0495 3820  ================ Scan system memory ========================
14:33:41.0495 3820  System memory - ok
14:33:41.0495 3820  ================ Scan services =============================
14:33:41.0631 3820  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
14:33:41.0730 3820  1394ohci - ok
14:33:41.0755 3820  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
14:33:41.0770 3820  ACPI - ok
14:33:41.0779 3820  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
14:33:41.0810 3820  AcpiPmi - ok
14:33:41.0834 3820  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
14:33:41.0851 3820  adp94xx - ok
14:33:41.0858 3820  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
14:33:41.0872 3820  adpahci - ok
14:33:41.0882 3820  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
14:33:41.0894 3820  adpu320 - ok
14:33:41.0920 3820  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
14:33:41.0951 3820  AeLookupSvc - ok
14:33:42.0002 3820  [ ABCF9C80EAACE03021BB7F450EB8993F ] afcdp          C:\Windows\system32\DRIVERS\afcdp.sys
14:33:42.0187 3820  afcdp - ok
14:33:42.0237 3820  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
14:33:42.0265 3820  AFD - ok
14:33:42.0283 3820  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
14:33:42.0298 3820  agp440 - ok
14:33:42.0310 3820  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
14:33:42.0331 3820  ALG - ok
14:33:42.0345 3820  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
14:33:42.0357 3820  aliide - ok
14:33:42.0362 3820  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
14:33:42.0373 3820  amdide - ok
14:33:42.0395 3820  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
14:33:42.0426 3820  AmdK8 - ok
14:33:42.0442 3820  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
14:33:42.0453 3820  AmdPPM - ok
14:33:42.0468 3820  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
14:33:42.0479 3820  amdsata - ok
14:33:42.0484 3820  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
14:33:42.0496 3820  amdsbs - ok
14:33:42.0514 3820  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
14:33:42.0523 3820  amdxata - ok
14:33:42.0539 3820  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
14:33:42.0586 3820  AppID - ok
14:33:42.0612 3820  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
14:33:42.0643 3820  AppIDSvc - ok
14:33:42.0665 3820  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo        C:\Windows\System32\appinfo.dll
14:33:42.0717 3820  Appinfo - ok
14:33:42.0787 3820  [ 4DC94A65D374B6892A54A3D707FA52BE ] Application Updater C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
14:33:42.0813 3820  Application Updater - ok
14:33:42.0843 3820  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt        C:\Windows\System32\appmgmts.dll
14:33:42.0857 3820  AppMgmt - ok
14:33:42.0875 3820  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
14:33:42.0886 3820  arc - ok
14:33:42.0902 3820  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
14:33:42.0912 3820  arcsas - ok
14:33:42.0945 3820  [ A63173897EA1A73A75D0E65036DE5B15 ] asHmComSvc      C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
14:33:42.0963 3820  asHmComSvc - ok
14:33:43.0054 3820  [ FEF9DD9EA587F8886ADE43C1BEFBDAFE ] AsIO            C:\Windows\syswow64\drivers\AsIO.sys
14:33:43.0063 3820  AsIO - ok
14:33:43.0080 3820  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:33:43.0139 3820  AsyncMac - ok
14:33:43.0152 3820  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
14:33:43.0162 3820  atapi - ok
14:33:43.0184 3820  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:33:43.0228 3820  AudioEndpointBuilder - ok
14:33:43.0237 3820  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
14:33:43.0269 3820  AudioSrv - ok
14:33:43.0295 3820  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
14:33:43.0331 3820  AxInstSV - ok
14:33:43.0353 3820  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
14:33:43.0384 3820  b06bdrv - ok
14:33:43.0405 3820  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
14:33:43.0434 3820  b57nd60a - ok
14:33:43.0454 3820  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
14:33:43.0479 3820  BDESVC - ok
14:33:43.0494 3820  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
14:33:43.0536 3820  Beep - ok
14:33:43.0572 3820  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
14:33:43.0608 3820  BFE - ok
14:33:43.0646 3820  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
14:33:43.0699 3820  BITS - ok
14:33:43.0722 3820  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
14:33:43.0739 3820  blbdrive - ok
14:33:43.0760 3820  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:33:43.0780 3820  bowser - ok
14:33:43.0791 3820  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
14:33:43.0804 3820  BrFiltLo - ok
14:33:43.0820 3820  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
14:33:43.0831 3820  BrFiltUp - ok
14:33:43.0854 3820  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
14:33:43.0866 3820  Browser - ok
14:33:43.0890 3820  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
14:33:43.0926 3820  Brserid - ok
14:33:43.0941 3820  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
14:33:43.0963 3820  BrSerWdm - ok
14:33:43.0980 3820  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
14:33:43.0992 3820  BrUsbMdm - ok
14:33:44.0004 3820  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
14:33:44.0014 3820  BrUsbSer - ok
14:33:44.0025 3820  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
14:33:44.0038 3820  BTHMODEM - ok
14:33:44.0065 3820  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
14:33:44.0115 3820  bthserv - ok
14:33:44.0129 3820  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:33:44.0174 3820  cdfs - ok
14:33:44.0190 3820  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
14:33:44.0216 3820  cdrom - ok
14:33:44.0249 3820  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
14:33:44.0277 3820  CertPropSvc - ok
14:33:44.0309 3820  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
14:33:44.0322 3820  circlass - ok
14:33:44.0352 3820  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
14:33:44.0366 3820  CLFS - ok
14:33:44.0427 3820  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:33:44.0438 3820  clr_optimization_v2.0.50727_32 - ok
14:33:44.0484 3820  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
14:33:44.0494 3820  clr_optimization_v2.0.50727_64 - ok
14:33:44.0523 3820  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
14:33:44.0549 3820  CmBatt - ok
14:33:44.0571 3820  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
14:33:44.0583 3820  cmdide - ok
14:33:44.0608 3820  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
14:33:44.0635 3820  CNG - ok
14:33:44.0647 3820  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
14:33:44.0656 3820  Compbatt - ok
14:33:44.0675 3820  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
14:33:44.0688 3820  CompositeBus - ok
14:33:44.0692 3820  COMSysApp - ok
14:33:44.0709 3820  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
14:33:44.0719 3820  crcdisk - ok
14:33:44.0745 3820  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:33:44.0780 3820  CryptSvc - ok
14:33:44.0810 3820  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC            C:\Windows\system32\drivers\csc.sys
14:33:44.0850 3820  CSC - ok
14:33:44.0875 3820  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll
14:33:44.0912 3820  CscService - ok
14:33:44.0943 3820  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:33:44.0983 3820  DcomLaunch - ok
14:33:45.0031 3820  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
14:33:45.0071 3820  defragsvc - ok
14:33:45.0153 3820  [ 838C0455A7CA73A845B109B92D78F64C ] DevoloNetworkService C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
14:33:45.0211 3820  DevoloNetworkService - ok
14:33:45.0228 3820  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
14:33:45.0276 3820  DfsC - ok
14:33:45.0291 3820  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
14:33:45.0323 3820  Dhcp - ok
14:33:45.0338 3820  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
14:33:45.0367 3820  discache - ok
14:33:45.0393 3820  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
14:33:45.0405 3820  Disk - ok
14:33:45.0455 3820  [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc          C:\Windows\system32\drivers\dmvsc.sys
14:33:45.0479 3820  dmvsc - ok
14:33:45.0495 3820  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:33:45.0510 3820  Dnscache - ok
14:33:45.0532 3820  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
14:33:45.0583 3820  dot3svc - ok
14:33:45.0601 3820  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
14:33:45.0638 3820  DPS - ok
14:33:45.0663 3820  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
14:33:45.0687 3820  drmkaud - ok
14:33:45.0728 3820  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
14:33:45.0755 3820  DXGKrnl - ok
14:33:45.0788 3820  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
14:33:45.0853 3820  EapHost - ok
14:33:46.0135 3820  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
14:33:46.0186 3820  ebdrv - ok
14:33:46.0257 3820  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
14:33:46.0284 3820  EFS - ok
14:33:46.0337 3820  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
14:33:46.0357 3820  ehRecvr - ok
14:33:46.0371 3820  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
14:33:46.0382 3820  ehSched - ok
14:33:46.0405 3820  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
14:33:46.0423 3820  elxstor - ok
14:33:46.0435 3820  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
14:33:46.0456 3820  ErrDev - ok
14:33:46.0487 3820  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
14:33:46.0520 3820  EventSystem - ok
14:33:46.0540 3820  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
14:33:46.0570 3820  exfat - ok
14:33:46.0587 3820  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
14:33:46.0618 3820  fastfat - ok
14:33:46.0657 3820  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
14:33:46.0691 3820  Fax - ok
14:33:46.0723 3820  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
14:33:46.0739 3820  fdc - ok
14:33:46.0752 3820  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
14:33:46.0787 3820  fdPHost - ok
14:33:46.0797 3820  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
14:33:46.0831 3820  FDResPub - ok
14:33:46.0851 3820  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:33:46.0861 3820  FileInfo - ok
14:33:46.0930 3820  [ D409D4A4517865131999FAC96D366CBF ] FileMonitor    C:\Program Files (x86)\IObit\*IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys
14:33:46.0941 3820  FileMonitor - ok
14:33:46.0959 3820  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
14:33:46.0998 3820  Filetrace - ok
14:33:47.0006 3820  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
14:33:47.0016 3820  flpydisk - ok
14:33:47.0021 3820  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:33:47.0033 3820  FltMgr - ok
14:33:47.0076 3820  [ C06AF3D1E7CA6868A6A3064CE6907C4A ] fltsrv          C:\Windows\system32\DRIVERS\fltsrv.sys
14:33:47.0088 3820  fltsrv - ok
14:33:47.0134 3820  [ C4C183E6551084039EC862DA1C945E3D ] FontCache      C:\Windows\system32\FntCache.dll
14:33:47.0165 3820  FontCache - ok
14:33:47.0205 3820  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
14:33:47.0216 3820  FontCache3.0.0.0 - ok
14:33:47.0238 3820  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
14:33:47.0250 3820  FsDepends - ok
14:33:47.0296 3820  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:33:47.0307 3820  Fs_Rec - ok
14:33:47.0333 3820  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
14:33:47.0352 3820  fvevol - ok
14:33:47.0381 3820  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
14:33:47.0394 3820  gagp30kx - ok
14:33:47.0421 3820  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
14:33:47.0468 3820  gpsvc - ok
14:33:47.0528 3820  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:33:47.0539 3820  gupdate - ok
14:33:47.0542 3820  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:33:47.0551 3820  gupdatem - ok
14:33:47.0561 3820  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
14:33:47.0579 3820  hcw85cir - ok
14:33:47.0612 3820  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:33:47.0640 3820  HdAudAddService - ok
14:33:47.0660 3820  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
14:33:47.0688 3820  HDAudBus - ok
14:33:47.0692 3820  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
14:33:47.0711 3820  HidBatt - ok
14:33:47.0729 3820  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
14:33:47.0742 3820  HidBth - ok
14:33:47.0757 3820  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
14:33:47.0769 3820  HidIr - ok
14:33:47.0784 3820  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
14:33:47.0831 3820  hidserv - ok
14:33:47.0860 3820  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
14:33:47.0873 3820  HidUsb - ok
14:33:47.0899 3820  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:33:47.0948 3820  hkmsvc - ok
14:33:47.0953 3820  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:33:47.0965 3820  HomeGroupListener - ok
14:33:47.0987 3820  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:33:48.0000 3820  HomeGroupProvider - ok
14:33:48.0014 3820  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
14:33:48.0025 3820  HpSAMD - ok
14:33:48.0060 3820  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:33:48.0102 3820  HTTP - ok
14:33:48.0125 3820  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
14:33:48.0133 3820  hwpolicy - ok
14:33:48.0160 3820  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
14:33:48.0170 3820  i8042prt - ok
14:33:48.0197 3820  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
14:33:48.0213 3820  iaStorV - ok
14:33:48.0255 3820  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
14:33:48.0277 3820  idsvc - ok
14:33:48.0291 3820  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
14:33:48.0301 3820  iirsp - ok
14:33:48.0346 3820  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
14:33:48.0406 3820  IKEEXT - ok
14:33:48.0443 3820  [ 24EA4E2F76E216CE70353736E3556585 ] IMFservice      C:\Program Files (x86)\IObit\*IObit Malware Fighter\IMFsrv.exe
14:33:48.0455 3820  IMFservice - ok
14:33:48.0572 3820  [ CCEDD47ABD068C58C8513DEB785093BB ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
14:33:48.0621 3820  IntcAzAudAddService - ok
14:33:48.0625 3820  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
14:33:48.0634 3820  intelide - ok
14:33:48.0659 3820  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
14:33:48.0679 3820  intelppm - ok
14:33:48.0695 3820  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
14:33:48.0730 3820  IPBusEnum - ok
14:33:48.0742 3820  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:33:48.0770 3820  IpFilterDriver - ok
14:33:48.0810 3820  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
14:33:48.0840 3820  iphlpsvc - ok
14:33:48.0856 3820  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
14:33:48.0878 3820  IPMIDRV - ok
14:33:48.0894 3820  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
14:33:48.0940 3820  IPNAT - ok
14:33:48.0958 3820  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
14:33:48.0971 3820  IRENUM - ok
14:33:48.0979 3820  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
14:33:48.0989 3820  isapnp - ok
14:33:49.0004 3820  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
14:33:49.0018 3820  iScsiPrt - ok
14:33:49.0048 3820  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
14:33:49.0057 3820  kbdclass - ok
14:33:49.0083 3820  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
14:33:49.0102 3820  kbdhid - ok
14:33:49.0122 3820  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
14:33:49.0135 3820  KeyIso - ok
14:33:49.0180 3820  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
14:33:49.0190 3820  KSecDD - ok
14:33:49.0208 3820  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
14:33:49.0219 3820  KSecPkg - ok
14:33:49.0228 3820  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
14:33:49.0269 3820  ksthunk - ok
14:33:49.0293 3820  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
14:33:49.0333 3820  KtmRm - ok
14:33:49.0349 3820  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
14:33:49.0390 3820  LanmanServer - ok
14:33:49.0421 3820  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:33:49.0458 3820  LanmanWorkstation - ok
14:33:49.0489 3820  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
14:33:49.0518 3820  lltdio - ok
14:33:49.0534 3820  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
14:33:49.0575 3820  lltdsvc - ok
14:33:49.0591 3820  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
14:33:49.0620 3820  lmhosts - ok
14:33:49.0651 3820  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
14:33:49.0662 3820  LSI_FC - ok
14:33:49.0666 3820  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
14:33:49.0676 3820  LSI_SAS - ok
14:33:49.0688 3820  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
14:33:49.0698 3820  LSI_SAS2 - ok
14:33:49.0707 3820  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
14:33:49.0718 3820  LSI_SCSI - ok
14:33:49.0736 3820  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
14:33:49.0771 3820  luafv - ok
14:33:49.0812 3820  [ 0BB97D43299910CBFBA59C461B99B910 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
14:33:49.0822 3820  MBAMProtector - ok
14:33:49.0930 3820  [ 65085456FD9A74D7F1A999520C299ECB ] MBAMScheduler  C:\Program Files (x86)\*msc\mbamscheduler.exe
14:33:49.0942 3820  MBAMScheduler - ok
14:33:49.0969 3820  [ E0D7732F2D2E24B2DB3F67B6750295B8 ] MBAMService    C:\Program Files (x86)\*msc\mbamservice.exe
14:33:49.0988 3820  MBAMService - ok
14:33:50.0023 3820  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
14:33:50.0043 3820  Mcx2Svc - ok
14:33:50.0060 3820  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
14:33:50.0070 3820  megasas - ok
14:33:50.0087 3820  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
14:33:50.0100 3820  MegaSR - ok
14:33:50.0128 3820  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
14:33:50.0174 3820  MMCSS - ok
14:33:50.0177 3820  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
14:33:50.0215 3820  Modem - ok
14:33:50.0245 3820  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
14:33:50.0269 3820  monitor - ok
14:33:50.0297 3820  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
14:33:50.0309 3820  mouclass - ok
14:33:50.0328 3820  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
14:33:50.0350 3820  mouhid - ok
14:33:50.0378 3820  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
14:33:50.0391 3820  mountmgr - ok
14:33:50.0403 3820  [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
14:33:50.0413 3820  MozillaMaintenance - ok
14:33:50.0424 3820  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
14:33:50.0435 3820  mpio - ok
14:33:50.0450 3820  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
14:33:50.0479 3820  mpsdrv - ok
14:33:50.0507 3820  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
14:33:50.0556 3820  MpsSvc - ok
14:33:50.0572 3820  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
14:33:50.0595 3820  MRxDAV - ok
14:33:50.0615 3820  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
14:33:50.0633 3820  mrxsmb - ok
14:33:50.0654 3820  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:33:50.0667 3820  mrxsmb10 - ok
14:33:50.0677 3820  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:33:50.0688 3820  mrxsmb20 - ok
14:33:50.0705 3820  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
14:33:50.0715 3820  msahci - ok
14:33:50.0728 3820  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
14:33:50.0739 3820  msdsm - ok
14:33:50.0751 3820  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
14:33:50.0795 3820  MSDTC - ok
14:33:50.0817 3820  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
14:33:50.0845 3820  Msfs - ok
14:33:50.0853 3820  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
14:33:50.0890 3820  mshidkmdf - ok
14:33:50.0903 3820  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
14:33:50.0912 3820  msisadrv - ok
14:33:50.0955 3820  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
14:33:50.0991 3820  MSiSCSI - ok
14:33:50.0994 3820  msiserver - ok
14:33:51.0023 3820  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
14:33:51.0056 3820  MSKSSRV - ok
14:33:51.0081 3820  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
14:33:51.0109 3820  MSPCLOCK - ok
14:33:51.0122 3820  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
14:33:51.0236 3820  MSPQM - ok
14:33:51.0300 3820  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
14:33:51.0354 3820  MsRPC - ok
14:33:51.0375 3820  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
14:33:51.0386 3820  mssmbios - ok
14:33:51.0399 3820  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
14:33:51.0440 3820  MSTEE - ok
14:33:51.0447 3820  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
14:33:51.0457 3820  MTConfig - ok
14:33:51.0487 3820  [ 19B006B181E3875FD254F7B67ACF1E7C ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys
14:33:51.0496 3820  MTsensor - ok
14:33:51.0529 3820  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
14:33:51.0541 3820  Mup - ok
14:33:51.0574 3820  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
14:33:51.0619 3820  napagent - ok
14:33:51.0644 3820  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
14:33:51.0676 3820  NativeWifiP - ok
14:33:51.0733 3820  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
14:33:51.0762 3820  NDIS - ok
14:33:51.0784 3820  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
14:33:51.0813 3820  NdisCap - ok
14:33:51.0834 3820  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
14:33:51.0862 3820  NdisTapi - ok
14:33:51.0877 3820  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
14:33:51.0905 3820  Ndisuio - ok
14:33:51.0922 3820  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
14:33:51.0957 3820  NdisWan - ok
14:33:51.0967 3820  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
14:33:51.0994 3820  NDProxy - ok
14:33:52.0010 3820  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
14:33:52.0061 3820  NetBIOS - ok
14:33:52.0066 3820  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
14:33:52.0096 3820  NetBT - ok
14:33:52.0108 3820  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
14:33:52.0118 3820  Netlogon - ok
14:33:52.0153 3820  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
14:33:52.0193 3820  Netman - ok
14:33:52.0224 3820  [ 3E5A36127E201DDF663176B66828FAFE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:33:52.0233 3820  NetMsmqActivator - ok
14:33:52.0237 3820  [ 3E5A36127E201DDF663176B66828FAFE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:33:52.0244 3820  NetPipeActivator - ok
14:33:52.0267 3820  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
14:33:52.0311 3820  netprofm - ok
14:33:52.0315 3820  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:33:52.0323 3820  NetTcpActivator - ok
14:33:52.0326 3820  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:33:52.0333 3820  NetTcpPortSharing - ok
14:33:52.0356 3820  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
14:33:52.0366 3820  nfrd960 - ok
14:33:52.0386 3820  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
14:33:52.0411 3820  NlaSvc - ok
14:33:52.0414 3820  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
14:33:52.0443 3820  Npfs - ok
14:33:52.0477 3820  [ 49697C2C761ACB5C0DE99CC8FE93E95B ] NPF_devolo      C:\Windows\sysWOW64\drivers\npf_devolo.sys
14:33:52.0487 3820  NPF_devolo - ok
14:33:52.0506 3820  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
14:33:52.0574 3820  nsi - ok
14:33:52.0596 3820  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
14:33:52.0636 3820  nsiproxy - ok
14:33:52.0685 3820  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
14:33:52.0722 3820  Ntfs - ok
14:33:52.0730 3820  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
14:33:52.0758 3820  Null - ok
14:33:52.0994 3820  [ FCBA1C22727939E7CFF9EB08FE9692AB ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:33:53.0134 3820  nvlddmkm - ok
14:33:53.0170 3820  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
14:33:53.0185 3820  nvraid - ok
14:33:53.0206 3820  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
14:33:53.0218 3820  nvstor - ok
14:33:53.0247 3820  [ 10C232F6CFFD51D2332898AE7AE0FF23 ] nvsvc          C:\Windows\system32\nvvsvc.exe
14:33:53.0270 3820  nvsvc - ok
14:33:53.0288 3820  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
14:33:53.0299 3820  nv_agp - ok
14:33:53.0314 3820  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
14:33:53.0325 3820  ohci1394 - ok
14:33:53.0376 3820  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
14:33:53.0400 3820  p2pimsvc - ok
14:33:53.0427 3820  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
14:33:53.0444 3820  p2psvc - ok
14:33:53.0472 3820  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
14:33:53.0483 3820  Parport - ok
14:33:53.0504 3820  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
14:33:53.0513 3820  partmgr - ok
14:33:53.0533 3820  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
14:33:53.0555 3820  PcaSvc - ok
14:33:53.0565 3820  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
14:33:53.0577 3820  pci - ok
14:33:53.0593 3820  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
14:33:53.0603 3820  pciide - ok
14:33:53.0622 3820  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
14:33:53.0635 3820  pcmcia - ok
14:33:53.0639 3820  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
14:33:53.0649 3820  pcw - ok
14:33:53.0659 3820  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
14:33:53.0707 3820  PEAUTH - ok
14:33:53.0751 3820  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
14:33:53.0789 3820  PeerDistSvc - ok
14:33:53.0809 3820  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
14:33:53.0833 3820  PerfHost - ok
14:33:53.0877 3820  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
14:33:53.0933 3820  pla - ok
14:33:53.0966 3820  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
14:33:53.0995 3820  PlugPlay - ok
14:33:54.0002 3820  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
14:33:54.0023 3820  PNRPAutoReg - ok
14:33:54.0029 3820  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
14:33:54.0042 3820  PNRPsvc - ok
14:33:54.0068 3820  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
14:33:54.0108 3820  PolicyAgent - ok
14:33:54.0130 3820  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
14:33:54.0175 3820  Power - ok
14:33:54.0198 3820  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
14:33:54.0251 3820  PptpMiniport - ok
14:33:54.0264 3820  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
14:33:54.0282 3820  Processor - ok
14:33:54.0308 3820  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
14:33:54.0332 3820  ProfSvc - ok
14:33:54.0364 3820  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
14:33:54.0375 3820  ProtectedStorage - ok
14:33:54.0414 3820  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
14:33:54.0452 3820  Psched - ok
14:33:54.0482 3820  [ B39371544C22DEDDE79490FDCF5F3B96 ] pwdrvio        C:\Windows\system32\pwdrvio.sys
14:33:54.0496 3820  pwdrvio - ok
14:33:54.0520 3820  [ EC2A33B9F1A21500FADA5E599C381090 ] pwdspio        C:\Windows\system32\pwdspio.sys
14:33:54.0529 3820  pwdspio - ok
14:33:54.0564 3820  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
14:33:54.0605 3820  ql2300 - ok
14:33:54.0618 3820  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
14:33:54.0629 3820  ql40xx - ok
14:33:54.0653 3820  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
14:33:54.0671 3820  QWAVE - ok
14:33:54.0685 3820  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
14:33:54.0700 3820  QWAVEdrv - ok
14:33:54.0716 3820  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
14:33:54.0748 3820  RasAcd - ok
14:33:54.0788 3820  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
14:33:54.0824 3820  RasAgileVpn - ok
14:33:54.0836 3820  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
14:33:54.0867 3820  RasAuto - ok
14:33:54.0882 3820  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
14:33:54.0921 3820  Rasl2tp - ok
14:33:54.0941 3820  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
14:33:54.0981 3820  RasMan - ok
14:33:55.0007 3820  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
14:33:55.0042 3820  RasPppoe - ok
14:33:55.0061 3820  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
14:33:55.0102 3820  RasSstp - ok
14:33:55.0116 3820  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
14:33:55.0147 3820  rdbss - ok
14:33:55.0161 3820  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
14:33:55.0182 3820  rdpbus - ok
14:33:55.0197 3820  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
14:33:55.0225 3820  RDPCDD - ok
14:33:55.0277 3820  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
14:33:55.0290 3820  RDPDR - ok
14:33:55.0317 3820  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
14:33:55.0361 3820  RDPENCDD - ok
14:33:55.0383 3820  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
14:33:55.0411 3820  RDPREFMP - ok
14:33:55.0452 3820  [ 70CBA1A0C98600A2AA1863479B35CB90 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
14:33:55.0478 3820  RdpVideoMiniport - ok
14:33:55.0502 3820  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
14:33:55.0538 3820  RDPWD - ok
14:33:55.0558 3820  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
14:33:55.0570 3820  rdyboost - ok
14:33:55.0582 3820  [ BB26BDE6308A46A8497AA7C4AB569B77 ] RegFilter      C:\Program Files (x86)\IObit\*IObit Malware Fighter\drivers\win7_amd64\regfilter.sys
14:33:55.0590 3820  RegFilter - ok
14:33:55.0612 3820  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
14:33:55.0642 3820  RemoteAccess - ok
14:33:55.0659 3820  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
14:33:55.0696 3820  RemoteRegistry - ok
14:33:55.0707 3820  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
14:33:55.0747 3820  RpcEptMapper - ok
14:33:55.0766 3820  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
14:33:55.0786 3820  RpcLocator - ok
14:33:55.0826 3820  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
14:33:55.0862 3820  RpcSs - ok
14:33:55.0878 3820  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
14:33:55.0918 3820  rspndr - ok
14:33:55.0940 3820  [ E60C0A09F997826C7627B244195AB581 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
14:33:55.0958 3820  s3cap - ok
14:33:55.0967 3820  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
14:33:55.0977 3820  SamSs - ok
14:33:55.0995 3820  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
14:33:56.0006 3820  sbp2port - ok
14:33:56.0019 3820  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
14:33:56.0051 3820  SCardSvr - ok
14:33:56.0063 3820  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
14:33:56.0101 3820  scfilter - ok
14:33:56.0131 3820  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
14:33:56.0187 3820  Schedule - ok
14:33:56.0215 3820  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
14:33:56.0243 3820  SCPolicySvc - ok
14:33:56.0260 3820  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
14:33:56.0273 3820  SDRSVC - ok
14:33:56.0283 3820  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
14:33:56.0325 3820  secdrv - ok
14:33:56.0338 3820  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
14:33:56.0367 3820  seclogon - ok
14:33:56.0381 3820  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
14:33:56.0416 3820  SENS - ok
14:33:56.0435 3820  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
14:33:56.0451 3820  SensrSvc - ok
14:33:56.0471 3820  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
14:33:56.0481 3820  Serenum - ok
14:33:56.0492 3820  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
14:33:56.0502 3820  Serial - ok
14:33:56.0517 3820  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
14:33:56.0530 3820  sermouse - ok
14:33:56.0549 3820  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
14:33:56.0586 3820  SessionEnv - ok
14:33:56.0598 3820  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
14:33:56.0610 3820  sffdisk - ok
14:33:56.0624 3820  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
14:33:56.0649 3820  sffp_mmc - ok
14:33:56.0660 3820  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
14:33:56.0675 3820  sffp_sd - ok
14:33:56.0681 3820  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
14:33:56.0691 3820  sfloppy - ok
14:33:56.0718 3820  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
14:33:56.0751 3820  SharedAccess - ok
14:33:56.0770 3820  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:33:56.0803 3820  ShellHWDetection - ok
14:33:56.0813 3820  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
14:33:56.0823 3820  SiSRaid2 - ok
14:33:56.0840 3820  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
14:33:56.0851 3820  SiSRaid4 - ok
14:33:56.0878 3820  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
14:33:56.0908 3820  Smb - ok
14:33:56.0939 3820  [ E3E56CAF0472163871B922FC7CBC9654 ] snapman        C:\Windows\system32\DRIVERS\snapman.sys
14:33:56.0951 3820  snapman - ok
14:33:56.0968 3820  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
14:33:56.0991 3820  SNMPTRAP - ok
14:33:57.0005 3820  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
14:33:57.0014 3820  spldr - ok
14:33:57.0049 3820  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
14:33:57.0067 3820  Spooler - ok
14:33:57.0132 3820  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
14:33:57.0206 3820  sppsvc - ok
14:33:57.0216 3820  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
14:33:57.0246 3820  sppuinotify - ok
14:33:57.0274 3820  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
14:33:57.0287 3820  srv - ok
14:33:57.0301 3820  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
14:33:57.0319 3820  srv2 - ok
14:33:57.0332 3820  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
14:33:57.0342 3820  srvnet - ok
14:33:57.0354 3820  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
14:33:57.0387 3820  SSDPSRV - ok
14:33:57.0401 3820  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
14:33:57.0431 3820  SstpSvc - ok
14:33:57.0518 3820  [ 5A19667A580B1CE886EAF968B9743F45 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
14:33:57.0533 3820  Stereo Service - ok
14:33:57.0550 3820  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
14:33:57.0563 3820  stexstor - ok
14:33:57.0612 3820  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
14:33:57.0640 3820  stisvc - ok
14:33:57.0665 3820  [ 7785DC213270D2FC066538DAF94087E7 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
14:33:57.0675 3820  storflt - ok
14:33:57.0700 3820  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
14:33:57.0711 3820  storvsc - ok
14:33:57.0723 3820  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
14:33:57.0733 3820  swenum - ok
14:33:57.0748 3820  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
14:33:57.0795 3820  swprv - ok
14:33:57.0805 3820  [ C3A39C4079305480972D29C44B868C78 ] Synth3dVsc      C:\Windows\system32\drivers\synth3dvsc.sys
14:33:57.0816 3820  Synth3dVsc - ok
14:33:57.0864 3820  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
14:33:57.0919 3820  SysMain - ok
14:33:57.0941 3820  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
14:33:57.0982 3820  TabletInputService - ok
14:33:58.0005 3820  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
14:33:58.0056 3820  TapiSrv - ok
14:33:58.0070 3820  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
14:33:58.0101 3820  TBS - ok
14:33:58.0170 3820  [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
14:33:58.0206 3820  Tcpip - ok
14:33:58.0236 3820  [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
14:33:58.0271 3820  TCPIP6 - ok
14:33:58.0287 3820  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
14:33:58.0297 3820  tcpipreg - ok
14:33:58.0426 3820  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
14:33:58.0435 3820  TDPIPE - ok
14:33:58.0497 3820  [ AC28A6FCA485821499FF018695CEDE16 ] tdrpman        C:\Windows\system32\DRIVERS\tdrpman.sys
14:33:58.0529 3820  tdrpman - ok
14:33:58.0550 3820  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
14:33:58.0566 3820  TDTCP - ok
14:33:58.0582 3820  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
14:33:58.0609 3820  tdx - ok
14:33:58.0623 3820  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
14:33:58.0633 3820  TermDD - ok
14:33:58.0665 3820  [ 2B5BDFF688EC9871D7EC5837833374E9 ] terminpt        C:\Windows\system32\drivers\terminpt.sys
14:33:58.0675 3820  terminpt - ok
14:33:58.0701 3820  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
14:33:58.0743 3820  TermService - ok
14:33:58.0761 3820  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
14:33:58.0776 3820  Themes - ok
14:33:58.0787 3820  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
14:33:58.0816 3820  THREADORDER - ok
14:33:58.0843 3820  [ DE604462206F7D8C203F767F425FCA8D ] tib            C:\Windows\system32\DRIVERS\tib.sys
14:33:58.0870 3820  tib - ok
14:33:58.0884 3820  [ 8C750FE6DE38AF13506B99EC2F519F79 ] tib_mounter    C:\Windows\system32\DRIVERS\tib_mounter.sys
14:33:58.0896 3820  tib_mounter - ok
14:33:58.0907 3820  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
14:33:58.0943 3820  TrkWks - ok
14:33:58.0988 3820  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:33:59.0024 3820  TrustedInstaller - ok
14:33:59.0037 3820  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
14:33:59.0077 3820  tssecsrv - ok
14:33:59.0100 3820  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
14:33:59.0110 3820  TsUsbFlt - ok
14:33:59.0128 3820  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
14:33:59.0138 3820  TsUsbGD - ok
14:33:59.0141 3820  [ E1748D04AE40118B62BC18AC86032192 ] tsusbhub        C:\Windows\system32\drivers\tsusbhub.sys
14:33:59.0152 3820  tsusbhub - ok
14:33:59.0182 3820  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
14:33:59.0217 3820  tunnel - ok
14:33:59.0234 3820  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
14:33:59.0245 3820  uagp35 - ok
14:33:59.0260 3820  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
14:33:59.0303 3820  udfs - ok
14:33:59.0322 3820  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
14:33:59.0334 3820  UI0Detect - ok
14:33:59.0352 3820  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
14:33:59.0362 3820  uliagpkx - ok
14:33:59.0385 3820  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
14:33:59.0395 3820  umbus - ok
14:33:59.0411 3820  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
14:33:59.0422 3820  UmPass - ok
14:33:59.0456 3820  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll
14:33:59.0476 3820  UmRdpService - ok
14:33:59.0506 3820  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
14:33:59.0550 3820  upnphost - ok
14:33:59.0667 3820  [ C2C5672B001A471FCE195CC15910AED9 ] UrlFilter      C:\Program Files (x86)\IObit\*IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys
14:33:59.0692 3820  UrlFilter - ok
14:33:59.0721 3820  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\drivers\usbccgp.sys
14:33:59.0739 3820  usbccgp - ok
14:33:59.0787 3820  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
14:33:59.0804 3820  usbcir - ok
14:33:59.0847 3820  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
14:33:59.0886 3820  usbehci - ok
14:33:59.0951 3820  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
14:33:59.0992 3820  usbhub - ok
14:34:00.0010 3820  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
14:34:00.0049 3820  usbohci - ok
14:34:00.0063 3820  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\drivers\usbprint.sys
14:34:00.0095 3820  usbprint - ok
14:34:00.0121 3820  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:34:00.0159 3820  USBSTOR - ok
14:34:00.0182 3820  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
14:34:00.0227 3820  usbuhci - ok
14:34:00.0244 3820  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
14:34:00.0309 3820  UxSms - ok
14:34:00.0346 3820  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
14:34:00.0357 3820  VaultSvc - ok
14:34:00.0418 3820  [ AD6D273E646B94BB6668C8CB439CFBD3 ] VBoxDrv        C:\Windows\system32\DRIVERS\VBoxDrv.sys
14:34:00.0431 3820  VBoxDrv - ok
14:34:00.0517 3820  [ B0A8C5BC95689A130F9E05492341833D ] VBoxNetAdp      C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
14:34:00.0530 3820  VBoxNetAdp - ok
14:34:00.0534 3820  VBoxNetFlt - ok
14:34:00.0592 3820  [ E5C140160617B2B0545B4051AA9507FF ] VBoxUSBMon      C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
14:34:00.0604 3820  VBoxUSBMon - ok
14:34:00.0636 3820  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
14:34:00.0648 3820  vdrvroot - ok
14:34:00.0695 3820  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
14:34:00.0762 3820  vds - ok
14:34:00.0804 3820  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
14:34:00.0885 3820  vga - ok
14:34:00.0935 3820  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
14:34:00.0992 3820  VgaSave - ok
14:34:00.0995 3820  VGPU - ok
14:34:01.0050 3820  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
14:34:01.0131 3820  vhdmp - ok
14:34:01.0197 3820  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
14:34:01.0209 3820  viaide - ok
14:34:01.0244 3820  [ 35E8A18D1C558D5C2FF2FFED2FD396F6 ] vididr          C:\Windows\system32\DRIVERS\vididr.sys
14:34:01.0267 3820  vididr - ok
14:34:01.0286 3820  [ 0DCD5C8F2E0B3650C4A29F6569C074FD ] vidsflt        C:\Windows\system32\DRIVERS\vidsflt.sys
14:34:01.0298 3820  vidsflt - ok
14:34:01.0323 3820  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus          C:\Windows\system32\drivers\vmbus.sys
14:34:01.0339 3820  vmbus - ok
14:34:01.0362 3820  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
14:34:01.0401 3820  VMBusHID - ok
14:34:01.0428 3820  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
14:34:01.0441 3820  volmgr - ok
14:34:01.0518 3820  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
14:34:01.0540 3820  volmgrx - ok
14:34:01.0609 3820  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
14:34:01.0632 3820  volsnap - ok
14:34:01.0655 3820  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
14:34:01.0677 3820  vsmraid - ok
14:34:01.0803 3820  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
14:34:01.0878 3820  VSS - ok
14:34:01.0891 3820  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
14:34:01.0924 3820  vwifibus - ok
14:34:01.0948 3820  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
14:34:02.0001 3820  W32Time - ok
14:34:02.0023 3820  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
14:34:02.0070 3820  WacomPen - ok
14:34:02.0159 3820  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
14:34:02.0233 3820  WANARP - ok
14:34:02.0236 3820  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
14:34:02.0264 3820  Wanarpv6 - ok
14:34:02.0440 3820  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
14:34:02.0503 3820  wbengine - ok
14:34:02.0569 3820  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
14:34:02.0603 3820  WbioSrvc - ok
14:34:02.0699 3820  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
14:34:02.0760 3820  wcncsvc - ok
14:34:02.0814 3820  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:34:02.0843 3820  WcsPlugInService - ok
14:34:02.0887 3820  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
14:34:02.0908 3820  Wd - ok
14:34:02.0962 3820  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
14:34:02.0986 3820  Wdf01000 - ok
14:34:03.0014 3820  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
14:34:03.0054 3820  WdiServiceHost - ok
14:34:03.0062 3820  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
14:34:03.0077 3820  WdiSystemHost - ok
14:34:03.0121 3820  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
14:34:03.0155 3820  WebClient - ok
14:34:03.0222 3820  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
14:34:03.0283 3820  Wecsvc - ok
14:34:03.0294 3820  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
14:34:03.0325 3820  wercplsupport - ok
14:34:03.0341 3820  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
14:34:03.0385 3820  WerSvc - ok
14:34:03.0401 3820  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
14:34:03.0429 3820  WfpLwf - ok
14:34:03.0443 3820  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
14:34:03.0452 3820  WIMMount - ok
14:34:03.0466 3820  WinDefend - ok
14:34:03.0485 3820  WinHttpAutoProxySvc - ok
14:34:03.0527 3820  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
14:34:03.0558 3820  Winmgmt - ok
14:34:03.0606 3820  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
14:34:03.0661 3820  WinRM - ok
14:34:03.0693 3820  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
14:34:03.0734 3820  Wlansvc - ok
14:34:03.0743 3820  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
14:34:03.0754 3820  WmiAcpi - ok
14:34:03.0775 3820  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
14:34:03.0789 3820  wmiApSrv - ok
14:34:03.0806 3820  WMPNetworkSvc - ok
14:34:03.0825 3820  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
14:34:03.0836 3820  WPCSvc - ok
14:34:03.0851 3820  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
14:34:03.0865 3820  WPDBusEnum - ok
14:34:03.0880 3820  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
14:34:03.0908 3820  ws2ifsl - ok
14:34:03.0927 3820  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
14:34:03.0953 3820  wscsvc - ok
14:34:03.0956 3820  WSearch - ok
14:34:04.0012 3820  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
14:34:04.0060 3820  wuauserv - ok
14:34:04.0086 3820  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
14:34:04.0105 3820  WudfPf - ok
14:34:04.0118 3820  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
14:34:04.0138 3820  WUDFRd - ok
14:34:04.0149 3820  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
14:34:04.0175 3820  wudfsvc - ok
14:34:04.0194 3820  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc        C:\Windows\System32\wwansvc.dll
14:34:04.0207 3820  WwanSvc - ok
14:34:04.0357 3820  [ E1E858AEF2ED420CBB7605D3ECCEC69A ] yukonw7        C:\Windows\system32\DRIVERS\yk62x64.sys
14:34:04.0371 3820  yukonw7 - ok
14:34:04.0400 3820  ================ Scan global ===============================
14:34:04.0430 3820  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
14:34:04.0480 3820  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
14:34:04.0490 3820  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
14:34:04.0522 3820  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
14:34:04.0538 3820  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
14:34:04.0543 3820  [Global] - ok
14:34:04.0544 3820  ================ Scan MBR ==================================
14:34:04.0559 3820  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
14:34:05.0011 3820  \Device\Harddisk0\DR0 - ok
14:34:05.0011 3820  ================ Scan VBR ==================================
14:34:05.0014 3820  [ B473D14F8A83926BB0B59F098D7472E6 ] \Device\Harddisk0\DR0\Partition1
14:34:05.0015 3820  \Device\Harddisk0\DR0\Partition1 - ok
14:34:05.0043 3820  [ 0590F42B128BCB6FFE7A5F51D08080B3 ] \Device\Harddisk0\DR0\Partition2
14:34:05.0044 3820  \Device\Harddisk0\DR0\Partition2 - ok
14:34:05.0069 3820  [ 9D8251A41F079423022DD9FE272BDF3E ] \Device\Harddisk0\DR0\Partition3
14:34:05.0071 3820  \Device\Harddisk0\DR0\Partition3 - ok
14:34:05.0071 3820  ============================================================
14:34:05.0071 3820  Scan finished
14:34:05.0071 3820  ============================================================
14:34:05.0085 3812  Detected object count: 0
14:34:05.0085 3812  Actual detected object count: 0

bmell 05.06.2013 14:05
Ich habe zufällig noch eben einen "ADS"-Stream Check mit HijackThis gemacht und musste feststellen dass genau die Files die in Frage kommen, exakt dieselben MD5 Checks. habe:
Auszug:

Code:

C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$R3WTJUJ.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$R8ILY4N.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RCJTGT1.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RFDO46M.dvl : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RFMI2PX.jpg : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RFROCJA.14 : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RHUDW6A\GoogleUpdateSetup.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RLVFIVY.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RMX0W2G.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RP3VZY5\English.lng : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RQR6HPK.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RTVRYTO.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RVLXPE0.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RX0CZMB.rtf : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RXWYYQV.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RZ6EAK1.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\$RECYCLE.BIN\S-1-5-21-2330493419-2886327782-1176343205-1000\$RZP1GDN.rtf : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\firefox.com : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\firefox.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\firefox.pif : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\firefox.scr : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.com : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.pif : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.scr : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\rundll32.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\chameleon.chm : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\chameleon.chm : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\firefox.com : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\firefox.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\firefox.pif : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\firefox.scr : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\iexplore.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\mbam-chameleon.com : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\mbam-chameleon.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\mbam-chameleon.pif : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\mbam-chameleon.scr : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\rundll32.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\svchost.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\Chameleon\winlogon.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\chameleon.chm : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\firefox.com : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\firefox.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\firefox.pif : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\firefox.scr : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\iexplore.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\mbam-chameleon.com : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\mbam-chameleon.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\mbam-chameleon.pif : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\mbam-chameleon.scr : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\rundll32.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\svchost.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Malwarebytes' Anti-Malware232\winlogon.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Avion - Chatviews.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Avion - Themes.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Controls - Cards.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Controls - Contact List.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Controls - Private Message.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Controls - Profile Tools.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Controls - Socials.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Controls.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\desc.ini : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\Files.xml : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Button.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Button_trans.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatcount.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\AvionSepLocal.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\AvionSepRemote.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\ChatAvionLocal.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\ChatAvionRemote.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\Nameback.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\preview-Avion.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\Thumbs.db : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\Avion\typing.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\BigBubbles\ChatViewLocal.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\BigBubbles\ChatViewRemote.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\BigBubbles\DisplayTypingRemote.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Program Files (x86)\Trillian\skins\Avion Pro 5\images\Chatviews\BigBubbles\preview-bigbubbles.png : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
...
C:\Users\PanIngo\Downloads\mbam-setup-1.75.0.1300(1).exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbam-setup-1.75.0.1300.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\Data\actions.ref : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\Data\Configuration\build.conf : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\Data\Configuration\config.conf : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\Data\Configuration\manifest.conf : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\imageformats\qico4.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\imageformats\qicod4.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\mbam.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\mbamcore.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\mbamnet.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\mbar.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\msvcp100.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\msvcr100.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\Plugins\fixdamage.exe : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\QtCore4.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar\QtGui4.dll : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
C:\Users\PanIngo\Downloads\mbar-1.05.0.1001.zip : Zone.Identifier  (26 bytes, MD5 D41D8CD98F00B204E9800998ECF8427E)
Und was ist mit diesem Dir : "C:\Users\PanIngo\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC ~1\A pplication Data" ? - Da bricht doch jeder Scanner (vermutlich) ab ... ;(

t'john 05.06.2013 14:08
Alles sauber.

letzter Check:
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

bmell 05.06.2013 15:30
Liste der Anhänge anzeigen (Anzahl: 1)
Habe ich grade gemacht ;) Aber was musste ich feststellen:

Die Dateigrösse ist inkorrekt = das File kompromitiert anscheinend (siehe Bild).
Meine ist 4.6 MB und sie sollte eig. viel kleiner sein!

So sieht das sicherlich bei allen Scanner-Setups aus ;(


Bitte John glaub mir, das ist ne ganz dicke Nummer - ich trau mich hier kaum das inet anzumachen um dir die Updates zu posten ;(

Hier mal ein Systemlook Abgleich - da sind etliche Files drin im system.ini die da niemals drin sein sollten?

Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 16:25 on 05/06/2013 by PanIngo
Administrator - Elevation successful

========== contents ==========

C:\Windows\System32\drivers\etc\Hosts - Opened succesfully.

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97    rhino.acme.com          # source server
#      38.25.63.10    x.acme.com              # x client host
# localhost name resolution is handled within DNS itself.
#        127.0.0.1      localhost
#        ::1            localhost


C:\Windows\win.ini - Opened succesfully.

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
3g2=MPEGVideo
3gp=MPEGVideo
3gp2=MPEGVideo
3gpp=MPEGVideo
aac=MPEGVideo
adt=MPEGVideo
adts=MPEGVideo
m2t=MPEGVideo
m2ts=MPEGVideo
m2v=MPEGVideo
m4a=MPEGVideo
m4v=MPEGVideo
mod=MPEGVideo
mov=MPEGVideo
mp4=MPEGVideo
mp4v=MPEGVideo
mts=MPEGVideo
ts=MPEGVideo
tts=MPEGVideo


C:\Windows\system.ini - Opened succesfully.

; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]


========== regfind ==========

Searching for "system.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini]

Searching for "userinit"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-userinit.resources_31bf3856ad364e35_de-de_635fca450b465527]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-userinit.resources_31bf3856ad364e35_en-us_903c6331299f704a]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-userinit_31bf3856ad364e35_none_a11115c99b789ded]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-userinit.resources_31bf3856ad364e35_de-de_07412ec152e8e3f1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-userinit.resources_31bf3856ad364e35_en-us_341dc7ad7141ff14]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-userinit_31bf3856ad364e35_none_44f27a45e31b2cb7]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,"

-= EOF =-
Und genau diese Files sind in meinem langen %appdata% Dir drin, bzw. in:
C:\Users\PanIngo\AppData\Local\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\AP PLIC~1\VirtualStore\Windows -> sys2em.ini system.ini win.ini. Da sind auch die Einträge mit EGA80WOA.FON - mit dazugehörigem driver wohl ? wave=mmdrv.dll
timer=timer.drv - das riecht doch zum Himmel... Nur wo liegt der Casus Knacktus ?



asw:
Code:
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-06-05 16:13:27
-----------------------------
16:13:27.239    OS Version: Windows x64 6.1.7601 Service Pack 1
16:13:27.239    Number of processors: 4 586 0x1707
16:13:27.239    ComputerName: PANINGO-PC  UserName: PanIngo
16:13:29.002    Initialize success
16:13:37.941    AVAST engine defs: 13060501
16:13:58.439    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4
16:13:58.455    Disk 0 Vendor: SAMSUNG_HD103SI 1AG01118 Size: 953869MB BusType: 3
16:13:58.845    Disk 0 MBR read successfully
16:13:58.845    Disk 0 MBR scan
16:13:58.861    Disk 0 Windows 7 default MBR code
16:13:58.892    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
16:13:58.907    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      497904 MB offset 206848
16:13:58.907    Disk 0 Partition - 00    05    Extended            455862 MB offset 1019916276
16:13:58.985    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      455862 MB offset 1019916288
16:13:59.188    Disk 0 scanning C:\Windows\system32\drivers
16:14:27.065    Service scanning
16:14:41.673    Modules scanning
16:14:41.673    Disk 0 trace - called modules:
16:14:41.736    ntoskrnl.exe CLASSPNP.SYS disk.sys vidsflt.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
16:14:42.048    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007abe790]
16:14:42.048    3 CLASSPNP.SYS[fffff8800143b43f] -> nt!IofCallDriver -> [0xfffffa800790bb40]
16:14:42.048    5 vidsflt.sys[fffff88000fec5f1] -> nt!IofCallDriver -> [0xfffffa8007454670]
16:14:42.063    7 ACPI.sys[fffff88000f427a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-4[0xfffffa800780b060]
16:14:44.294    AVAST engine scan C:\
16:36:42.079    Scan finished successfully
16:38:57.752    Disk 0 MBR has been saved successfully to "C:\Users\PanIngo\Downloads\MBR.dat"
16:38:57.752    The log file has been saved successfully to "C:\Users\PanIngo\Downloads\aswMBRf.txt"

HJT:
Code:
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 14:51:57, on 05.06.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16483)

FIREFOX: 21.0 (de)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\*msc\mbamgui.exe
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\PanIngo\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search.yahoo.com?type=800236&fr=spigot-yhp-ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\7.1\iobitappsToolbarIE.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\7.1\iobitappsToolbarIE.dll
O3 - Toolbar: IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\7.1\iobitappsToolbarIE.dll
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
O9 - Extra button: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{B98EE5A0-1356-4E02-A17B-C1CA23743F45}: NameServer = 208.67.222.222,208.67.220.220
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
O23 - Service: ASUS HM Com Service (asHmComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
O23 - Service: devolo Network Service (DevoloNetworkService) - devolo AG - C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files (x86)\IObit\*IObit Malware Fighter\IMFsrv.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\*msc\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\*msc\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

bmell 05.06.2013 15:53
Habe mir mal von der GMER Seite weniger bekannte AV Soft gezogen, so kleine MiniTools - und siehe da der Code ist manipuliert:

C:\Windows\system32>C:/Users/PanIngo/Downloads/catchme.exe
detected NTDLL code modification:
ZwEnumerateKey 0 != 47, ZwQueryKey 0 != 19, ZwOpenKey 0 != 15, ZwClose 0 != 1
ZwEnumerateValueKey 0 != 16, ZwQueryValueKey 0 != 20, ZwOpenFile 0 != 48, ZwQ
yDirectoryFile 0 != 50, ZwQuerySystemInformation 0 != 51Initialization error

Und mbr.exe:

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer
.net
Windows 6.1.7601

device: opened successfully
user: error reading MBR
error: Read Das Handle ist ung³ltig.
kernel: error reading MBR

Und MbrScan listet alle Treiber auf die versteckt sind?, feines Tool.

Bitte hilf mir , bei der Liste kriege ich echt Angst!

Code:
MBRScan v1.1.1

OS            : Windows 7 Service Pack 1 (64 bit)
PROCESSOR      : Intel64 Family 6 Model 23 Stepping 7, GenuineIntel
BOOT          : Normal Boot
DATE          : 2013/06/05 (ISO 8601) at 16:59:01
________________________________________________________________________________

DISK          : Device\Harddisk0\DR0 __SAMSUNG HD103SI (1AG01118)
BUS_TYPE      : (0x03)  P-ATA
USE_PIO        : NO
MAX_TRANSFER  : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________

Device\Harddisk0\DR0        931.5 Go  [Fixed] ==> 7 MBR Code

MBR_MD5  : 9029DE2AB50CAC328DC53169FEC8BD3C
MBR_SHA1  : DBB3B625F164438AF0A2ED798F7A29193A58091E

Device\Harddisk0\Partition1        100.0 Mo          0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition2        486.2 Go          0x07 NTFS / HPFS
Device\Harddisk0\Partition3        445.2 Go          0x07 NTFS / HPFS
________________________________________________________________________________

############################### Additional scan ################################

DRIVER  : C:\Windows\system32\hal.dll => Invisible on the disk
ADDRESS : 0x031E7000
SIZE    : 292.0 Ko

DRIVER  : C:\Windows\system32\kdcom.dll => Invisible on the disk
ADDRESS : 0x00BA8000
SIZE    : 40.0 Ko

DRIVER  : C:\Windows\system32\mcupdate_GenuineIntel.dll => Invisible on the disk
ADDRESS : 0x00C4B000
SIZE    : 316.0 Ko

DRIVER  : C:\Windows\system32\CLFS.SYS => Invisible on the disk
ADDRESS : 0x00CAE000
SIZE    : 376.0 Ko

DRIVER  : C:\Windows\system32\CI.dll => Invisible on the disk
ADDRESS : 0x00D0C000
SIZE    : 768.0 Ko

DRIVER  : C:\Windows\system32\drivers\Wdf01000.sys => Invisible on the disk
ADDRESS : 0x00E65000
SIZE    : 776.0 Ko

DRIVER  : C:\Windows\system32\drivers\WDFLDR.SYS => Invisible on the disk
ADDRESS : 0x00F27000
SIZE    : 64.0 Ko

DRIVER  : C:\Windows\system32\drivers\ACPI.sys => Invisible on the disk
ADDRESS : 0x00F37000
SIZE    : 348.0 Ko

DRIVER  : C:\Windows\system32\drivers\WMILIB.SYS => Invisible on the disk
ADDRESS : 0x00F8E000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\drivers\msisadrv.sys => Invisible on the disk
ADDRESS : 0x00F97000
SIZE    : 40.0 Ko

DRIVER  : C:\Windows\system32\drivers\pci.sys => Invisible on the disk
ADDRESS : 0x00FA1000
SIZE    : 204.0 Ko

DRIVER  : C:\Windows\system32\drivers\vdrvroot.sys => Invisible on the disk
ADDRESS : 0x00FD4000
SIZE    : 52.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\vidsflt.sys => Invisible on the disk
ADDRESS : 0x00FE1000
SIZE    : 124.0 Ko

DRIVER  : C:\Windows\System32\drivers\partmgr.sys => Invisible on the disk
ADDRESS : 0x00E00000
SIZE    : 84.0 Ko

DRIVER  : C:\Windows\system32\drivers\volmgr.sys => Invisible on the disk
ADDRESS : 0x00E15000
SIZE    : 84.0 Ko

DRIVER  : C:\Windows\System32\drivers\volmgrx.sys => Invisible on the disk
ADDRESS : 0x0105E000
SIZE    : 368.0 Ko

DRIVER  : C:\Windows\system32\drivers\pciide.sys => Invisible on the disk
ADDRESS : 0x010BA000
SIZE    : 28.0 Ko

DRIVER  : C:\Windows\system32\drivers\PCIIDEX.SYS => Invisible on the disk
ADDRESS : 0x010C1000
SIZE    : 64.0 Ko

DRIVER  : C:\Windows\System32\drivers\mountmgr.sys => Invisible on the disk
ADDRESS : 0x010D1000
SIZE    : 104.0 Ko

DRIVER  : C:\Windows\system32\drivers\atapi.sys => Invisible on the disk
ADDRESS : 0x010EB000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\drivers\ataport.SYS => Invisible on the disk
ADDRESS : 0x010F4000
SIZE    : 168.0 Ko

DRIVER  : C:\Windows\system32\drivers\msahci.sys => Invisible on the disk
ADDRESS : 0x0111E000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\system32\drivers\amdxata.sys => Invisible on the disk
ADDRESS : 0x01129000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\system32\drivers\fltmgr.sys => Invisible on the disk
ADDRESS : 0x01134000
SIZE    : 304.0 Ko

DRIVER  : C:\Windows\system32\drivers\fileinfo.sys => Invisible on the disk
ADDRESS : 0x01180000
SIZE    : 80.0 Ko

DRIVER  : C:\Windows\System32\Drivers\Ntfs.sys => Invisible on the disk
ADDRESS : 0x01249000
SIZE    : 1.63 Mo

DRIVER  : C:\Windows\System32\Drivers\msrpc.sys => Invisible on the disk
ADDRESS : 0x01194000
SIZE    : 376.0 Ko

DRIVER  : C:\Windows\System32\Drivers\ksecdd.sys => Invisible on the disk
ADDRESS : 0x01200000
SIZE    : 108.0 Ko

DRIVER  : C:\Windows\System32\Drivers\cng.sys => Invisible on the disk
ADDRESS : 0x014AF000
SIZE    : 456.0 Ko

DRIVER  : C:\Windows\System32\drivers\pcw.sys => Invisible on the disk
ADDRESS : 0x01521000
SIZE    : 68.0 Ko

DRIVER  : C:\Windows\System32\Drivers\Fs_Rec.sys => Invisible on the disk
ADDRESS : 0x01532000
SIZE    : 40.0 Ko

DRIVER  : C:\Windows\system32\drivers\ndis.sys => Invisible on the disk
ADDRESS : 0x01697000
SIZE    : 968.0 Ko

DRIVER  : C:\Windows\system32\drivers\NETIO.SYS => Invisible on the disk
ADDRESS : 0x01789000
SIZE    : 384.0 Ko

DRIVER  : C:\Windows\System32\Drivers\ksecpkg.sys => Invisible on the disk
ADDRESS : 0x01600000
SIZE    : 168.0 Ko

DRIVER  : C:\Windows\System32\drivers\tcpip.sys => Invisible on the disk
ADDRESS : 0x01800000
SIZE    : 2.00 Mo

DRIVER  : C:\Windows\System32\drivers\fwpkclnt.sys => Invisible on the disk
ADDRESS : 0x0162A000
SIZE    : 292.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\vididr.sys => Invisible on the disk
ADDRESS : 0x0153C000
SIZE    : 168.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\tib_mounter.sys => Invisible on the disk
ADDRESS : 0x01566000
SIZE    : 192.0 Ko

DRIVER  : C:\Windows\system32\drivers\vmstorfl.sys => Invisible on the disk
ADDRESS : 0x01673000
SIZE    : 64.0 Ko

DRIVER  : C:\Windows\system32\drivers\volsnap.sys => Invisible on the disk
ADDRESS : 0x01596000
SIZE    : 304.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\tib.sys => Invisible on the disk
ADDRESS : 0x01AC1000
SIZE    : 1.07 Mo

DRIVER  : C:\Windows\System32\Drivers\spldr.sys => Invisible on the disk
ADDRESS : 0x01BD4000
SIZE    : 32.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\snapman.sys => Invisible on the disk
ADDRESS : 0x01A00000
SIZE    : 236.0 Ko

DRIVER  : C:\Windows\System32\drivers\rdyboost.sys => Invisible on the disk
ADDRESS : 0x01A3B000
SIZE    : 232.0 Ko

DRIVER  : C:\Windows\System32\Drivers\mup.sys => Invisible on the disk
ADDRESS : 0x01A75000
SIZE    : 72.0 Ko

DRIVER  : C:\Windows\System32\drivers\hwpolicy.sys => Invisible on the disk
ADDRESS : 0x01A87000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\fltsrv.sys => Invisible on the disk
ADDRESS : 0x01A90000
SIZE    : 116.0 Ko

DRIVER  : C:\Windows\System32\DRIVERS\fvevol.sys => Invisible on the disk
ADDRESS : 0x01400000
SIZE    : 232.0 Ko

DRIVER  : C:\Windows\system32\drivers\disk.sys => Invisible on the disk
ADDRESS : 0x01BDC000
SIZE    : 88.0 Ko

DRIVER  : C:\Windows\system32\drivers\CLASSPNP.SYS => Invisible on the disk
ADDRESS : 0x0143A000
SIZE    : 192.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\cdrom.sys => Invisible on the disk
ADDRESS : 0x0146A000
SIZE    : 168.0 Ko

DRIVER  : C:\Windows\System32\Drivers\Null.SYS => Invisible on the disk
ADDRESS : 0x0168C000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\System32\Drivers\Beep.SYS => Invisible on the disk
ADDRESS : 0x01AB9000
SIZE    : 28.0 Ko

DRIVER  : C:\Windows\System32\drivers\vga.sys => Invisible on the disk
ADDRESS : 0x01494000
SIZE    : 56.0 Ko

DRIVER  : C:\Windows\System32\drivers\VIDEOPRT.SYS => Invisible on the disk
ADDRESS : 0x0121B000
SIZE    : 148.0 Ko

DRIVER  : C:\Windows\System32\drivers\watchdog.sys => Invisible on the disk
ADDRESS : 0x015E2000
SIZE    : 64.0 Ko

DRIVER  : C:\Windows\System32\DRIVERS\RDPCDD.sys => Invisible on the disk
ADDRESS : 0x015F2000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\drivers\rdpencdd.sys => Invisible on the disk
ADDRESS : 0x014A2000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\drivers\rdprefmp.sys => Invisible on the disk
ADDRESS : 0x01240000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\System32\Drivers\Msfs.SYS => Invisible on the disk
ADDRESS : 0x013EB000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\System32\Drivers\Npfs.SYS => Invisible on the disk
ADDRESS : 0x01000000
SIZE    : 68.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\tdx.sys => Invisible on the disk
ADDRESS : 0x01011000
SIZE    : 136.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\TDI.SYS => Invisible on the disk
ADDRESS : 0x01033000
SIZE    : 52.0 Ko

DRIVER  : C:\Windows\system32\drivers\afd.sys => Invisible on the disk
ADDRESS : 0x03E9B000
SIZE    : 548.0 Ko

DRIVER  : C:\Windows\System32\DRIVERS\netbt.sys => Invisible on the disk
ADDRESS : 0x03F24000
SIZE    : 276.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\wfplwf.sys => Invisible on the disk
ADDRESS : 0x03F69000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\pacer.sys => Invisible on the disk
ADDRESS : 0x03F72000
SIZE    : 152.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\netbios.sys => Invisible on the disk
ADDRESS : 0x03F98000
SIZE    : 60.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\serial.sys => Invisible on the disk
ADDRESS : 0x03FA7000
SIZE    : 116.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\wanarp.sys => Invisible on the disk
ADDRESS : 0x03FC4000
SIZE    : 108.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\VBoxUSBMon.sys => Invisible on the disk
ADDRESS : 0x03E00000
SIZE    : 144.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\VBoxDrv.sys => Invisible on the disk
ADDRESS : 0x03E24000
SIZE    : 252.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\termdd.sys => Invisible on the disk
ADDRESS : 0x03E63000
SIZE    : 80.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\rdbss.sys => Invisible on the disk
ADDRESS : 0x0405F000
SIZE    : 324.0 Ko

DRIVER  : C:\Windows\system32\drivers\nsiproxy.sys => Invisible on the disk
ADDRESS : 0x040B0000
SIZE    : 48.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\mssmbios.sys => Invisible on the disk
ADDRESS : 0x040BC000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\System32\drivers\discache.sys => Invisible on the disk
ADDRESS : 0x040C7000
SIZE    : 60.0 Ko

DRIVER  : C:\Windows\system32\drivers\csc.sys => Invisible on the disk
ADDRESS : 0x040D6000
SIZE    : 524.0 Ko

DRIVER  : C:\Windows\System32\Drivers\dfsc.sys => Invisible on the disk
ADDRESS : 0x04159000
SIZE    : 120.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\blbdrive.sys => Invisible on the disk
ADDRESS : 0x04177000
SIZE    : 68.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\tunnel.sys => Invisible on the disk
ADDRESS : 0x0418E000
SIZE    : 152.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\intelppm.sys => Invisible on the disk
ADDRESS : 0x041B4000
SIZE    : 88.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\nvlddmkm.sys => Invisible on the disk
ADDRESS : 0x04A7F000
SIZE    : 10.65 Mo

DRIVER  : C:\Windows\System32\drivers\dxgkrnl.sys => Invisible on the disk
ADDRESS : 0x03CDD000
SIZE    : 976.0 Ko

DRIVER  : C:\Windows\System32\drivers\dxgmms1.sys => Invisible on the disk
ADDRESS : 0x03C00000
SIZE    : 280.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\usbuhci.sys => Invisible on the disk
ADDRESS : 0x03C46000
SIZE    : 52.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\USBPORT.SYS => Invisible on the disk
ADDRESS : 0x03C53000
SIZE    : 344.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\usbehci.sys => Invisible on the disk
ADDRESS : 0x03CA9000
SIZE    : 68.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\HDAudBus.sys => Invisible on the disk
ADDRESS : 0x03DD1000
SIZE    : 144.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\yk62x64.sys => Invisible on the disk
ADDRESS : 0x05526000
SIZE    : 404.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\1394ohci.sys => Invisible on the disk
ADDRESS : 0x0558B000
SIZE    : 248.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\fdc.sys => Invisible on the disk
ADDRESS : 0x03CBA000
SIZE    : 52.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\ASACPI.sys => Invisible on the disk
ADDRESS : 0x03CC7000
SIZE    : 32.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\serenum.sys => Invisible on the disk
ADDRESS : 0x03CCF000
SIZE    : 48.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\i8042prt.sys => Invisible on the disk
ADDRESS : 0x055C9000
SIZE    : 120.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\kbdclass.sys => Invisible on the disk
ADDRESS : 0x055E7000
SIZE    : 60.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\mouclass.sys => Invisible on the disk
ADDRESS : 0x04A00000
SIZE    : 60.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\CompositeBus.sys => Invisible on the disk
ADDRESS : 0x04A0F000
SIZE    : 64.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\AgileVpn.sys => Invisible on the disk
ADDRESS : 0x04A1F000
SIZE    : 88.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\rasl2tp.sys => Invisible on the disk
ADDRESS : 0x04A35000
SIZE    : 144.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\ndistapi.sys => Invisible on the disk
ADDRESS : 0x04A59000
SIZE    : 48.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\ndiswan.sys => Invisible on the disk
ADDRESS : 0x041CA000
SIZE    : 188.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\raspppoe.sys => Invisible on the disk
ADDRESS : 0x04000000
SIZE    : 108.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\raspptp.sys => Invisible on the disk
ADDRESS : 0x0401B000
SIZE    : 132.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\rassstp.sys => Invisible on the disk
ADDRESS : 0x04A65000
SIZE    : 104.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\rdpbus.sys => Invisible on the disk
ADDRESS : 0x03DF5000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\swenum.sys => Invisible on the disk
ADDRESS : 0x03CDB000
SIZE    : 8.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\ks.sys => Invisible on the disk
ADDRESS : 0x00C00000
SIZE    : 268.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\umbus.sys => Invisible on the disk
ADDRESS : 0x0403C000
SIZE    : 72.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\usbhub.sys => Invisible on the disk
ADDRESS : 0x05ABF000
SIZE    : 360.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\flpydisk.sys => Invisible on the disk
ADDRESS : 0x05B19000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\System32\Drivers\NDProxy.SYS => Invisible on the disk
ADDRESS : 0x05B24000
SIZE    : 84.0 Ko

DRIVER  : C:\Windows\system32\drivers\RTKVHD64.sys => Invisible on the disk
ADDRESS : 0x0660C000
SIZE    : 3.22 Mo

DRIVER  : C:\Windows\system32\drivers\portcls.sys => Invisible on the disk
ADDRESS : 0x06944000
SIZE    : 244.0 Ko

DRIVER  : C:\Windows\system32\drivers\drmk.sys => Invisible on the disk
ADDRESS : 0x06981000
SIZE    : 136.0 Ko

DRIVER  : C:\Windows\system32\drivers\ksthunk.sys => Invisible on the disk
ADDRESS : 0x069A3000
SIZE    : 24.0 Ko

DRIVER  : C:\Windows\System32\win32k.sys => Invisible on the disk
ADDRESS : 0x000C0000
SIZE    : 3.09 Mo

DRIVER  : C:\Windows\System32\drivers\Dxapi.sys => Invisible on the disk
ADDRESS : 0x069A9000
SIZE    : 48.0 Ko

DRIVER  : C:\Windows\System32\Drivers\crashdmp.sys => Invisible on the disk
ADDRESS : 0x069B5000
SIZE    : 56.0 Ko

DRIVER  : C:\Windows\System32\Drivers\dump_dumpata.sys => Invisible on the disk
ADDRESS : 0x069C3000
SIZE    : 48.0 Ko

DRIVER  : C:\Windows\System32\Drivers\dump_atapi.sys => Invisible on the disk
ADDRESS : 0x069CF000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\System32\Drivers\dump_dumpfve.sys => Invisible on the disk
ADDRESS : 0x069D8000
SIZE    : 76.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\hidusb.sys => Invisible on the disk
ADDRESS : 0x069EB000
SIZE    : 56.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\HIDCLASS.SYS => Invisible on the disk
ADDRESS : 0x05B39000
SIZE    : 100.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\HIDPARSE.SYS => Invisible on the disk
ADDRESS : 0x06600000
SIZE    : 36.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\USBD.SYS => Invisible on the disk
ADDRESS : 0x06609000
SIZE    : 8.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\mouhid.sys => Invisible on the disk
ADDRESS : 0x05B52000
SIZE    : 52.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\monitor.sys => Invisible on the disk
ADDRESS : 0x05B5F000
SIZE    : 56.0 Ko

DRIVER  : C:\Windows\System32\TSDDD.dll => Invisible on the disk
ADDRESS : 0x00540000
SIZE    : 40.0 Ko

DRIVER  : C:\Windows\System32\cdd.dll => Invisible on the disk
ADDRESS : 0x00730000
SIZE    : 156.0 Ko

DRIVER  : C:\Windows\system32\drivers\luafv.sys => Invisible on the disk
ADDRESS : 0x05B6D000
SIZE    : 140.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\lltdio.sys => Invisible on the disk
ADDRESS : 0x05B9A000
SIZE    : 84.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\rspndr.sys => Invisible on the disk
ADDRESS : 0x05BAF000
SIZE    : 96.0 Ko

DRIVER  : C:\Windows\system32\drivers\HTTP.sys => Invisible on the disk
ADDRESS : 0x042AF000
SIZE    : 804.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\bowser.sys => Invisible on the disk
ADDRESS : 0x04378000
SIZE    : 120.0 Ko

DRIVER  : C:\Windows\System32\drivers\mpsdrv.sys => Invisible on the disk
ADDRESS : 0x04396000
SIZE    : 96.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\mrxsmb.sys => Invisible on the disk
ADDRESS : 0x043AE000
SIZE    : 180.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\mrxsmb10.sys => Invisible on the disk
ADDRESS : 0x04200000
SIZE    : 312.0 Ko

DRIVER  : C:\Windows\system32\DRIVERS\mrxsmb20.sys => Invisible on the disk
ADDRESS : 0x0424E000
SIZE    : 144.0 Ko

DRIVER  : C:\Windows\system32\drivers\peauth.sys => Invisible on the disk
ADDRESS : 0x05A00000
SIZE    : 664.0 Ko

DRIVER  : C:\Windows\System32\Drivers\secdrv.SYS => Invisible on the disk
ADDRESS : 0x0427E000
SIZE    : 44.0 Ko

DRIVER  : C:\Windows\System32\DRIVERS\srvnet.sys => Invisible on the disk
ADDRESS : 0x05BC7000
SIZE    : 196.0 Ko

DRIVER  : C:\Windows\System32\drivers\tcpipreg.sys => Invisible on the disk
ADDRESS : 0x04289000
SIZE    : 72.0 Ko

DRIVER  : C:\Windows\System32\DRIVERS\srv2.sys => Invisible on the disk
ADDRESS : 0x05636000
SIZE    : 420.0 Ko

DRIVER  : C:\Windows\System32\DRIVERS\srv.sys => Invisible on the disk
ADDRESS : 0x0569F000
SIZE    : 608.0 Ko

DRIVER  : C:\Windows\system32\drivers\mbamchameleon.sys => Invisible on the disk
ADDRESS : 0x057EE000
SIZE    : 52.0 Ko

DRIVER  : C:\Users\PanIngo\AppData\Local\Temp\aswMBR.sys => Invisible on the disk
ADDRESS : 0x05600000
SIZE    : 60.0 Ko

DRIVER  : C:\Windows\System32\smss.exe => Invisible on the disk
ADDRESS : 0x475D0000
SIZE    : 128.0 Ko

SystemStartOptions :  NOEXECUTE=OPTIN

________________________________________________________________________________

_______MBR  \Device\Harddisk0\DR0 

0x00000000  33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00  3À.м.|.À.ؾ.|¿.
0x00000010  06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00  .¹..üó¤Ph..Ëû¹..
0x00000020  BD BE 07 80 7E 00 00 7C 0B 0F 85 0E 01 83 C5 10  ½¾..~..|......Å.
0x00000030  E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00  âñÍ..V.UÆF..ÆF..
0x00000040  B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09  ´A»ªUÍ.]r..ûUªu.
0x00000050  F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74  ÷Á..t.þF.f`.~..t
0x00000060  26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00  &fh....f.v.h..h.
0x00000070  7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13  |h..h..´B.V..ôÍ.
0x00000080  9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00  ..Ä..ë.¸..».|.V.
0x00000090  8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1C FE  .v..N..n.Í.fas.þ
0x000000A0  4E 11 75 0C 80 7E 00 80 0F 84 8A 00 B2 80 EB 84  N.u..~......².ë.
0x000000B0  55 32 E4 8A 56 00 CD 13 5D EB 9E 81 3E FE 7D 55  U2ä.V.Í.]ë..>þ}U
0x000000C0  AA 75 6E FF 76 00 E8 8D 00 75 17 FA B0 D1 E6 64  ªun.v.è..u.ú°Ñæd
0x000000D0  E8 83 00 B0 DF E6 60 E8 7C 00 B0 FF E6 64 E8 75  è..°ßæ`è|.°.ædèu
0x000000E0  00 FB B8 00 BB CD 1A 66 23 C0 75 3B 66 81 FB 54  .û¸.»Í.f#Àu;f.ûT
0x000000F0  43 50 41 75 32 81 F9 02 01 72 2C 66 68 07 BB 00  CPAu2.ù..r,fh.».
0x00000100  00 66 68 00 02 00 00 66 68 08 00 00 00 66 53 66  .fh....fh....fSf
0x00000110  53 66 55 66 68 00 00 00 00 66 68 00 7C 00 00 66  SfUfh....fh.|..f
0x00000120  61 68 00 00 07 CD 1A 5A 32 F6 EA 00 7C 00 00 CD  ah...Í.Z2öê.|..Í
0x00000130  18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07 32 E4  ..·.ë..¶.ë..µ.2ä
0x00000140  05 00 07 8B F0 AC 3C 00 74 09 BB 07 00 B4 0E CD  ....ð¬<.t.»..´.Í
0x00000150  10 EB F2 F4 EB FD 2B C9 E4 64 EB 00 24 02 E0 F8  .ëòôëý+Éädë.$.àø
0x00000160  24 02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69  $.ÃInvalid parti
0x00000170  74 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72  tion table.Error
0x00000180  20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69    loading operati
0x00000190  6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E  ng system.Missin
0x000001A0  67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  g operating syst
0x000001B0  65 6D 00 00 00 63 7B 9A C8 A9 94 D1 F6 F6 80 08  em...c{.È©.Ñöö..
0x000001C0  01 1C 07 11 C4 FF 00 08 00 00 00 20 03 00 00 10  ....Ä...... ....
0x000001D0  C1 FF 07 11 C4 FF 00 28 03 00 00 80 C7 3C 00 0F  Á...Ä..(....Ç<..
0x000001E0  C1 FF 05 11 C4 FF F4 AF CA 3C 0C B0 A5 37 00 00  Á...Ä.ô¯Ê<.°¥7..
0x000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  ..............Uª

t'john 05.06.2013 18:22
Alles bestens.

Aber wenn du von Rootkits ausgehst, warum kauft du nicht eine neue Festplatte und setzt neu auf?
Dann kann es ja keine mehr gebe, oder? ;)

Jetzt im Ernst, es ist alles Bestens.

bmell 05.06.2013 20:01
Ich gehe nicht davon aus - ich möchte wissen woher diese rootkits kommen. Wir haben hier Kinder im Haus und mit sowas ist nicht zu spassen.
Ich kanns einfach nicht fassen: Wieso werden die AV Tools geclont und unscharf gemacht Wieso die etlichen invisible files, nur .sys ? Denk ich mir das nur aus? Das mein Browser nur japanisch anzeigt, mein Windows aussieht wie .. zu 3.11er Zeiten und seltsame Umrahmungen hat - das alles bilde ich mir nur ein? Ne, also so ganz deppert bin ich noch nicht, ehrlich. Wäre es möglich da nochmal einen Kollegen drübergucken zu lassen ? ich schau gleich nochmal rein wenn ich Windows hochgefahren habe. Danke für Deine Mühen ...

t'john 06.06.2013 18:20
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


dann:


Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


bmell 06.06.2013 21:28
Liste der Anhänge anzeigen (Anzahl: 3)
Hi John,

Ich finde es schade, dass Du nicht auf eines meiner Argumente mal eingehst und wir nur
das Standart-Procedere durchmachen. Ich werde die Logs erstellen, möchte Dich aber vorher Bitten, mich mir bei einer Beweisführung zu unterstützen. Es kann hier nicht nur primär darum gehen, Content für Google zu schaffen um so den Wert des Boards zu steigern. Oberste Prio sollten die "sauberen" Rechner der Kunden,bzw. User haben. Das siehst Du sicherlich genauso. Mit "Kauf Dir eine neue Platte" werden wir dem Anspruch des Boards nicht gerecht. Wäre dem so, wäre das Forum leer.


1. Dem angehangenen Bild screenshot15 ist zu entnehmen, dass Malwarebytes-Anti-MW aus dem Verzeichniss "C:\Program files (x86)\ msc" heraus aufgerufen wird.

2. Weder im normalen explorer noch im total commander kann ich das Verzeichniss
sehen. Wie erklärst Du Dir diesen Umstand ?

bmell 06.06.2013 21:52
Gmer hat eben folgendes gefunden - glaubst Du mir nun etwas mehr ?

GMER Logfile:
Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-06 22:45:12
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 SAMSUNG_HD103SI rev.1AG01118 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\PanIngo\AppData\Local\Temp\awtiyfod.sys


---- Registry - GMER 2.1 ----

Reg  HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\PanIngo\Pictures\\xa0tdbild\imfv2-setup.exe  1

---- EOF - GMER 2.1 ----
--- --- ---

test

t'john 07.06.2013 13:00
Du hast bis jetzt keine meiner Anweisungen ausgefuehrt.

Ich kann dir so nicht helfen.

bmell 07.06.2013 13:19
Hallo,

Weisst Du wieso? Weil der Bot den ganzen Kram umgeleitet hat auf localhost -> clientscript. Ich bin froh, dass es mir überhaupt aufgefallen ist, da ich dachte Du ignorierst mich die ganze Zeit. Kranke Welt. Was soll posten Bitte? Ich habe nämlich zu mir selbst 3 Seiten geposted - wenns nicht so traurig wäre ;L(

Hallo,

Weisst Du wieso? Weil der Bot den ganzen Kram umgeleitet hat auf localhost -> clientscript. Ich bin froh, dass es mir überhaupt aufgefallen ist, da ich dachte Du ignorierst mich die ganze Zeit. Kranke Welt. Was soll posten Bitte? Ich habe nämlich zu mir selbst 3 Seiten geposted - wenns nicht so traurig wäre ;L(

Kommt diese Nachricht an John?

t'john 08.06.2013 18:50
http://www.trojaner-board.de/134660-...ml#post1079555


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:25 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20