Trojaner-Board - Ramnit.C & HTML/Drop.Agent.AB gefunden; erst Ruhe, nun vereinzelte Meldungen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Ramnit.C & HTML/Drop.Agent.AB gefunden; erst Ruhe, nun vereinzelte Meldungen - Befall? (https://www.trojaner-board.de/96966-ramnit-c-html-drop-agent-ab-gefunden-erst-ruhe-vereinzelte-meldungen-befall.html)

Ramnit.C & HTML/Drop.Agent.AB gefunden; erst Ruhe, nun vereinzelte Meldungen - Befall?

Hallo,
ich habe seit einigen Tagen ein Problem mit den oben genannten Schädlingen.
Es fing an, als ich eine Website besuchte & kurz danach mein Browser (Firefox) abstürzte. Habe mir nichts dabei gedacht, da er desöfteren mal abstürzt. Am nächsten Tag als ich den PC anmachte, kamen dann zum ersten mal Meldungen von AntiVir, dass sowohl Ramnit.C und HTML/Drop.Agent.AB gefunden wurden. Als ich die Meldung entweder mit "Löschen" oder "Zugriff verweigern" schloss, kamen direkt 2 Neue. Es waren immer nur HTML-Dateien. Der Ordner war immer "Temporary Internet Files" in C://Users/***/AppData/blablabla.. Hier war jedoch nichts, darauf entdeckte ich den versteckten Ordner "content.IE5". Google-Recherchen haben ergeben dass dieser Ordner unbedenklich geleert werden kann. Dies habe ich getan und es war Ruhe. Später am selben Tag kamen die Meldungen wieder, diesmal aus einem anderen "Temp" Ordner (ebenfalls ein "Temp. Internet Files" Unterordner war dort drin). Nachdem ich diesen auch geleert habe war wieder Ruhe.
Heute morgen kamen erneut Meldungen, jedoch von einer .EXE Datei in einem weiteren Temp-Ordner. Nachdem ich diese löschte war Ruhe bis jetzt. Alle Funde waren immer in Unterordnern des Verzeichnisses C://Users/***/AppData, nie außerhalb von diesem Verzeichnis.

Ich hoffe ich habe es verständlich genug erklärt, auch wenn es ein wenig verwirrend klingt. Nun würde ich gerne wissen, ob mein System infiziert ist und ich irgendetwas Bösartiges auf dem Rechner habe oder ob ich die vereinzelten Dateien schnell genug entsorgt habe ohne dass sich etwas groß ausgeweitet habe, falls das überhaupt möglich ist.
Mir ist nämlich durchaus klar, dass es nicht unbedingt heißt dass es weg ist, nur weil die Anzeichen und Meldungen dafür weg sind.
Ich habe nun mal die benötigten Scans gemacht und würde mich freuen wenn jemand sich das mal angucken konnte, ob sich da was eingenistet hat.
Windows 7 läuft ca seit einem halben Jahr und habe seitdem noch keine Scans oder so durchgeführt, hatte aber auch noch nie Probleme.

Schon einmal vielen Dank im Vorraus!

Otl.txt

Code:

OTL logfile created on: 29.03.2011 23:52:01 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\*****\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 71,00 Mb Available Physical Memory | 14,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 76,69 Gb Total Space | 8,66 Gb Free Space | 11,30% Space Free | Partition Type: NTFS

 

Computer Name: *****-PC | User Name: ***** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.03.29 23:42:06 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe

PRC - [2011.03.23 20:38:32 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.09.28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

PRC - [2009.09.23 19:14:29 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.09.23 19:14:29 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2007.04.19 16:43:42 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxczcoms.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.03.29 23:42:06 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe

MOD - [2010.12.18 07:29:18 | 000,163,328 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\ieproxy.dll

MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

MOD - [2009.07.14 03:16:16 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.03.04 00:06:52 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Stopped] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)

SRV - [2009.09.28 10:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009.09.23 19:14:29 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.09.23 19:14:29 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.04.19 16:43:42 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxczcoms.exe -- (lxcz_device)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.10.03 15:54:15 | 000,436,792 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.12.07 23:07:06 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.09.23 19:14:29 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)

DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)

DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)

DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)

DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)

DRV - [2009.07.14 00:02:53 | 000,044,032 | ---- | M] (VIA Technologies, Inc.              ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fetnd6.sys -- (FETNDIS)

DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.01.14 12:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ManyCam.sys -- (ManyCam)

DRV - [2007.06.25 11:43:22 | 000,082,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)

DRV - [2006.11.08 04:09:00 | 000,077,772 | R--- | M] (Fuzhou Rockchip Electronics Co,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rockusb.sys -- (rockusb)

DRV - [2006.11.02 01:36:42 | 001,523,200 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2006.09.28 14:10:52 | 000,011,648 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\gggen.sys -- (gggen)

DRV - [2003.10.15 17:52:50 | 000,174,530 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ov519vid.sys -- (ovt519)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1C 7D A3 40 C0 E8 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1

FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.1

FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.5

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2

FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5

FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.2

FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20101009

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2009.10.28 20:51:41 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.23 20:38:38 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.23 20:38:38 | 000,000,000 | ---D | M]

 

[2009.08.24 00:32:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions

[2011.03.29 19:25:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions

[2009.12.28 02:35:46 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}

[2011.01.06 18:55:08 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}

[2011.01.11 13:44:32 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.02.10 19:41:25 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}

[2011.01.06 18:55:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.07.05 21:19:21 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}

[2011.02.10 19:43:37 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

[2011.02.10 19:42:28 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\firebug@software.joehewitt.com

[2011.02.10 19:43:05 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\foxyproxy@eric.h.jung

[2010.10.31 16:39:39 | 000,000,000 | ---D | M] (NASA Night Launch) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\nasanightlaunch@example.com

[2010.10.31 16:39:49 | 000,000,000 | ---D | M] (Personas) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\personas@christopher.beard

[2010.10.24 18:57:25 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\tpowwhbj.default\extensions\vshare@toolbar

[2009.10.28 20:59:19 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2009.08.26 00:08:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

[2010.06.27 13:31:54 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.06.27 13:31:54 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.06.27 13:31:54 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.06.27 13:31:55 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.06.27 13:31:55 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.02.10 22:44:49 | 000,001,190 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O1 - Hosts: 127.0.0.1 serial.alcohol-soft.com # alcohol 120% 

O1 - Hosts: 127.0.0.1 alcohol-soft.com # alcohol 120% 

O1 - Hosts: 127.0.0.1 images.alcohol-soft.com # alcohol 120% 

O1 - Hosts: 127.0.0.1 mermaidconsulting.dk # alcohol 120% 

O1 - Hosts: 127.0.0.1 im.adtech.de

O1 - Hosts: 127.0.0.1 adserver.adtech.de

O1 - Hosts: 127.0.0.1 adtech.de

O1 - Hosts: 127.0.0.1 atwola.com

O1 - Hosts: 127.0.0.1 adserver.71i.de

O1 - Hosts: 127.0.0.1 adicqserver.71i.de

O1 - Hosts: 127.0.0.1 71i.de

O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Cmaudio]  File not found

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation)

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Philips GoGear VIBE Device Manager.lnk - C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe - (Philips)

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: ArcSoft Connection Service - hkey= - key= - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found

MsConfig - StartUpReg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig - StartUpReg: Lexmark 1200 Series - hkey= - key= -  File not found

MsConfig - StartUpReg: NapsterShell - hkey= - key= -  File not found

MsConfig - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found

MsConfig - StartUpReg: Sony Ericsson PC Suite - hkey= - key= - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)

MsConfig - StartUpReg: Steam - hkey= - key= - C:\Program Files\Valve\Steam\Steam.exe (Valve Corporation)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)

MsConfig - State: "startup" - 2
 

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.03.29 23:50:50 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2011.03.29 23:50:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

[2011.03.29 23:50:06 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2011.03.29 23:41:36 | 000,791,393 | ---- | C] (Lars Hederer                                                ) -- C:\Users\*****\Desktop\Erunt-setup.exe

[2011.03.29 23:41:36 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe

[2011.03.29 23:41:36 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\TFC.exe

[2011.03.28 02:59:10 | 000,000,000 | ---D | C] -- C:\Users\*****\kskkabxn

[2011.03.27 22:25:04 | 002,066,439 | ---- | C] (murb.com                                                    ) -- C:\Users\*****\Desktop\ICQ Status Checker 1.7 Setup.exe

[2011.03.15 18:35:48 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\iphone-bilder

[2011.03.06 18:52:53 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Silla - Sillainstinkt (2011)

[2011.03.02 17:23:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES

[2011.03.02 17:20:57 | 000,000,000 | ---D | C] -- C:\Programme\EA GAMES

[2010.03.12 04:47:48 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxczserv.dll

[2010.03.12 04:47:48 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\lxczusb1.dll

[2010.03.12 04:47:48 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxczpmui.dll

[2010.03.12 04:47:48 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxczlmpm.dll

[2010.03.12 04:47:48 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxczinpa.dll

[2010.03.12 04:47:48 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxcziesc.dll

[2010.03.12 04:47:48 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXCZhcp.dll

[2010.03.12 04:47:48 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxczprox.dll

[2010.03.12 04:47:48 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxczpplc.dll

[2010.03.12 04:47:47 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxczhbn3.dll

[2010.03.12 04:47:47 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxczcomc.dll

[2010.03.12 04:47:47 | 000,537,520 | ---- | C] ( ) -- C:\Windows\System32\lxczcoms.exe

[2010.03.12 04:47:47 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxczcomm.dll

[2010.03.12 04:47:47 | 000,385,968 | ---- | C] ( ) -- C:\Windows\System32\lxczih.exe

[2010.03.12 04:47:47 | 000,381,872 | ---- | C] ( ) -- C:\Windows\System32\lxczcfg.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.03.29 23:50:08 | 000,000,894 | ---- | M] () -- C:\Users\*****\Desktop\NTREGOPT.lnk

[2011.03.29 23:50:08 | 000,000,875 | ---- | M] () -- C:\Users\*****\Desktop\ERUNT.lnk

[2011.03.29 23:42:47 | 000,301,568 | ---- | M] () -- C:\Users\*****\Desktop\g2m3e4r.exe

[2011.03.29 23:42:36 | 000,791,393 | ---- | M] (Lars Hederer                                                ) -- C:\Users\*****\Desktop\Erunt-setup.exe

[2011.03.29 23:42:14 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\TFC.exe

[2011.03.29 23:42:06 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe

[2011.03.29 23:37:43 | 000,377,280 | ---- | M] () -- C:\Users\*****\Desktop\Load.exe

[2011.03.29 23:08:08 | 000,019,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.03.29 23:08:08 | 000,019,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.03.29 22:57:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.03.29 22:57:22 | 402,104,320 | -HS- | M] () -- C:\hiberfil.sys

[2011.03.28 16:19:14 | 000,648,466 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.03.28 16:19:14 | 000,611,134 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.03.28 16:19:14 | 000,128,724 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.03.28 16:19:14 | 000,105,314 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.03.28 02:24:05 | 002,092,375 | ---- | M] () -- C:\Users\*****\Desktop\Norris_kittens.gif

[2011.03.27 22:24:00 | 002,042,105 | ---- | M] () -- C:\Users\*****\Desktop\icq_status_checker17.zip

[2011.03.24 19:40:39 | 000,349,173 | ---- | M] () -- C:\Users\*****\Desktop\Deutsch_-_Abi_.pdf

[2011.03.22 17:47:29 | 000,407,095 | ---- | M] () -- C:\Users\*****\Desktop\193551_173517192699699_100001242598946_430179_7930050_o.jpg

[2011.03.16 01:03:30 | 000,080,374 | ---- | M] () -- C:\Users\*****\Desktop\01_breno_gross.jpg

[2011.03.15 18:56:02 | 000,613,401 | ---- | M] () -- C:\Users\*****\Desktop\Unbenannt2.png

[2011.03.15 18:50:00 | 000,656,921 | ---- | M] () -- C:\Users\*****\Desktop\Unbenannt.png

[2011.03.15 18:05:00 | 001,128,402 | ---- | M] () -- C:\Users\*****\Desktop\haftbefehl.wav

[2011.03.13 18:01:53 | 000,000,124 | ---- | M] () -- C:\Users\*****\Documents\ax_files.xml

[2011.03.13 13:36:01 | 000,009,241 | ---- | M] () -- C:\Users\*****\Desktop\Anleitung.html

[2011.03.11 23:19:58 | 002,979,245 | ---- | M] () -- C:\Users\*****\Desktop\Echte Musik- H.A.F.T [Full Version_High Quality] Haftbefehl.mp3

[2011.03.11 23:13:31 | 002,855,947 | ---- | M] () -- C:\Users\*****\Desktop\Criz  feat Haftbefehl   Unter Tatverdacht.mp3

[2011.03.11 23:06:27 | 001,235,799 | ---- | M] () -- C:\Users\*****\Desktop\jaftcriut.rar

[2011.03.11 23:05:10 | 006,376,571 | ---- | M] () -- C:\Users\*****\Desktop\Haftbefehl feat. Twin, Criz & Silla - Columbine.mp3

[2011.03.10 20:08:15 | 000,048,286 | ---- | M] () -- C:\Users\*****\Desktop\IMG_0109 (Large).JPG

[2011.03.10 19:48:46 | 002,810,562 | ---- | M] () -- C:\Users\*****\Desktop\IMG_0109.JPG_effected.jpg

[2011.03.10 19:33:05 | 008,559,997 | ---- | M] () -- C:\Users\*****\Desktop\IMG_0109.JPG

[2011.03.08 01:24:39 | 000,005,912 | ---- | M] () -- C:\Users\*****\Desktop\c366cc4f0ddea1a830a8cb42187f7f11.dlc

[2011.03.04 23:22:05 | 166,689,481 | ---- | M] () -- C:\Users\*****\Desktop\Si-Sill.rar

[2011.03.02 17:27:42 | 000,000,532 | ---- | M] () -- C:\Windows\eReg.dat

[2011.03.02 17:27:21 | 000,002,036 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 1942.lnk

 
 ========== Files Created - No Company Name ==========

 

[2011.03.29 23:50:08 | 000,000,894 | ---- | C] () -- C:\Users\*****\Desktop\NTREGOPT.lnk

[2011.03.29 23:50:08 | 000,000,875 | ---- | C] () -- C:\Users\*****\Desktop\ERUNT.lnk

[2011.03.29 23:41:37 | 000,301,568 | ---- | C] () -- C:\Users\*****\Desktop\g2m3e4r.exe

[2011.03.29 23:37:11 | 000,377,280 | ---- | C] () -- C:\Users\*****\Desktop\Load.exe

[2011.03.28 02:24:05 | 002,092,375 | ---- | C] () -- C:\Users\*****\Desktop\Norris_kittens.gif

[2011.03.27 22:22:48 | 002,042,105 | ---- | C] () -- C:\Users\*****\Desktop\icq_status_checker17.zip

[2011.03.24 19:40:33 | 000,349,173 | ---- | C] () -- C:\Users\*****\Desktop\Deutsch_-_Abi_.pdf

[2011.03.22 17:47:08 | 000,407,095 | ---- | C] () -- C:\Users\*****\Desktop\193551_173517192699699_100001242598946_430179_7930050_o.jpg

[2011.03.16 01:03:30 | 000,080,374 | ---- | C] () -- C:\Users\*****\Desktop\01_breno_gross.jpg

[2011.03.15 18:56:01 | 000,613,401 | ---- | C] () -- C:\Users\*****\Desktop\Unbenannt2.png

[2011.03.15 18:47:55 | 000,656,921 | ---- | C] () -- C:\Users\*****\Desktop\Unbenannt.png

[2011.03.15 18:04:59 | 001,128,402 | ---- | C] () -- C:\Users\*****\Desktop\haftbefehl.wav

[2011.03.13 13:41:20 | 000,009,241 | ---- | C] () -- C:\Users\*****\Desktop\Anleitung.html

[2011.03.11 23:19:01 | 002,979,245 | ---- | C] () -- C:\Users\*****\Desktop\Echte Musik- H.A.F.T [Full Version_High Quality] Haftbefehl.mp3

[2011.03.11 23:12:15 | 002,855,947 | ---- | C] () -- C:\Users\*****\Desktop\Criz  feat Haftbefehl   Unter Tatverdacht.mp3

[2011.03.11 23:07:30 | 001,430,288 | ---- | C] () -- C:\Users\*****\Desktop\Criz feat Haftbefehl Unter Tatverdacht.mp3

[2011.03.11 23:06:05 | 001,235,799 | ---- | C] () -- C:\Users\*****\Desktop\jaftcriut.rar

[2011.03.11 23:02:37 | 006,376,571 | ---- | C] () -- C:\Users\*****\Desktop\Haftbefehl feat. Twin, Criz & Silla - Columbine.mp3

[2011.03.10 20:08:14 | 000,048,286 | ---- | C] () -- C:\Users\*****\Desktop\IMG_0109 (Large).JPG

[2011.03.10 19:47:42 | 002,810,562 | ---- | C] () -- C:\Users\*****\Desktop\IMG_0109.JPG_effected.jpg

[2011.03.10 19:29:54 | 008,559,997 | ---- | C] () -- C:\Users\*****\Desktop\IMG_0109.JPG

[2011.03.08 01:24:37 | 000,005,912 | ---- | C] () -- C:\Users\*****\Desktop\c366cc4f0ddea1a830a8cb42187f7f11.dlc

[2011.03.04 22:14:59 | 166,689,481 | ---- | C] () -- C:\Users\*****\Desktop\Si-Sill.rar

[2011.03.02 17:46:39 | 003,462,144 | ---- | C] () -- C:\Users\*****\Desktop\BF1942MiniImage-RixN.mdf

[2011.03.02 17:46:39 | 000,000,682 | ---- | C] () -- C:\Users\*****\Desktop\BF1942MiniImage-RixN.mds

[2011.03.02 17:27:42 | 000,000,532 | ---- | C] () -- C:\Windows\eReg.dat

[2011.03.02 17:27:21 | 000,002,036 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 1942.lnk

[2011.01.31 22:15:06 | 000,000,600 | ---- | C] () -- C:\Users\*****\AppData\Roaming\winscp.rnd

[2010.07.19 21:42:43 | 000,000,871 | ---- | C] () -- C:\Users\*****\AppData\Local\Tempwconfig.vbs

[2010.07.07 15:07:17 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll

[2010.06.11 14:50:28 | 000,200,704 | ---- | C] () -- C:\Windows\sel3110.exe

[2010.06.11 14:50:28 | 000,032,528 | ---- | C] () -- C:\Windows\amcap.exe

[2010.06.11 14:50:27 | 000,040,960 | ---- | C] () -- C:\Windows\CleanDev.exe

[2010.06.09 18:34:21 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll

[2010.04.30 17:42:57 | 000,000,144 | ---- | C] () -- C:\Users\*****\AppData\Roaming\default.pls

[2010.03.12 04:47:48 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxczutil.dll

[2010.03.12 04:47:48 | 000,274,432 | ---- | C] () -- C:\Windows\System32\LXCZinst.dll

[2010.02.23 23:00:41 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2009.09.10 18:42:23 | 000,000,076 | ---- | C] () -- C:\Windows\dellstat.ini

[2009.09.10 18:42:14 | 000,000,092 | ---- | C] () -- C:\Windows\lexstat.ini

[2009.09.06 23:27:13 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI

[2009.09.04 16:32:58 | 000,000,017 | ---- | C] () -- C:\Users\*****\AppData\Local\resmon.resmoncfg

[2009.08.27 21:04:44 | 000,557,003 | ---- | C] () -- C:\Windows\System32\libmplayer.dll

[2009.08.27 21:04:32 | 000,811,835 | ---- | C] () -- C:\Windows\System32\ff_x264.dll

[2009.08.27 21:03:52 | 004,456,201 | ---- | C] () -- C:\Windows\System32\libavcodec.dll

[2009.08.25 20:07:36 | 000,328,334 | ---- | C] () -- C:\Windows\System32\ff_kernelDeint.dll

[2009.08.25 19:38:04 | 000,425,040 | ---- | C] () -- C:\Windows\System32\TomsMoComp_ff.dll

[2009.08.25 18:56:56 | 000,829,781 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2009.08.25 18:37:02 | 000,146,098 | ---- | C] () -- C:\Windows\System32\libmpeg2_ff.dll

[2009.08.23 22:39:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2009.08.23 18:18:43 | 000,233,472 | ---- | C] () -- C:\Windows\System32\cmirmdrv.exe

[2009.08.23 18:18:43 | 000,028,672 | ---- | C] () -- C:\Windows\System32\cmirmdrv.dll

[2009.08.23 18:16:02 | 000,003,305 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

[2009.08.11 22:21:26 | 000,087,552 | ---- | C] () -- C:\Windows\System32\ac3config.exe

[2009.07.14 10:47:43 | 000,648,466 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.07.14 10:47:43 | 000,128,724 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 06:33:53 | 000,285,992 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 04:05:48 | 000,611,134 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 04:05:48 | 000,105,314 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2009.06.02 19:15:44 | 000,113,152 | ---- | C] () -- C:\Windows\System32\ff_unrar.dll

[2009.06.02 19:15:18 | 000,146,944 | ---- | C] () -- C:\Windows\System32\ff_tremor.dll

[2009.06.02 19:15:04 | 000,183,296 | ---- | C] () -- C:\Windows\System32\ff_samplerate.dll

[2009.06.02 19:14:56 | 000,178,688 | ---- | C] () -- C:\Windows\System32\ff_libmad.dll

[2009.06.02 19:14:30 | 000,486,400 | ---- | C] () -- C:\Windows\System32\ff_libfaad2.dll

[2009.06.02 19:13:58 | 000,257,024 | ---- | C] () -- C:\Windows\System32\ff_libdts.dll

[2009.06.02 19:13:50 | 000,142,848 | ---- | C] () -- C:\Windows\System32\ff_liba52.dll

[2009.06.02 19:11:26 | 000,098,304 | ---- | C] () -- C:\Windows\System32\ff_wmv9.dll

[2009.06.02 19:11:16 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2009.01.11 00:17:32 | 000,163,840 | ---- | C] () -- C:\Windows\System32\ts.dll

[2009.01.11 00:16:56 | 000,148,480 | ---- | C] () -- C:\Windows\System32\mkx.dll

[2009.01.11 00:16:50 | 000,108,032 | ---- | C] () -- C:\Windows\System32\avi.dll

[2009.01.11 00:16:14 | 000,141,312 | ---- | C] () -- C:\Windows\System32\mp4.dll

[2009.01.11 00:16:04 | 000,335,872 | ---- | C] () -- C:\Windows\System32\gdsmux.exe

[2009.01.11 00:15:54 | 000,120,832 | ---- | C] () -- C:\Windows\System32\ogm.dll

[2009.01.11 00:15:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\mmfinfo.dll

[2009.01.11 00:15:36 | 000,103,424 | ---- | C] () -- C:\Windows\System32\dsmux.exe

[2009.01.11 00:15:32 | 000,102,400 | ---- | C] () -- C:\Windows\System32\avss.dll

[2009.01.11 00:15:28 | 000,246,784 | ---- | C] () -- C:\Windows\System32\dxr.dll

[2009.01.11 00:15:12 | 000,097,280 | ---- | C] () -- C:\Windows\System32\avs.dll

[2009.01.11 00:15:06 | 000,135,168 | ---- | C] () -- C:\Windows\System32\mkv2vfr.exe

[2009.01.11 00:14:08 | 000,079,360 | ---- | C] () -- C:\Windows\System32\mkzlib.dll

[2009.01.11 00:14:06 | 000,023,552 | ---- | C] () -- C:\Windows\System32\mkunicode.dll

[2008.12.04 00:11:50 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll

[2007.10.13 11:30:20 | 000,000,137 | ---- | C] () -- C:\Windows\System32\Registration.ini

[2007.02.07 19:58:12 | 000,039,899 | ---- | C] () -- C:\Windows\System32\rtsicis.ini

[2006.06.07 15:23:04 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxczcnv7.dll

[2006.03.07 13:59:04 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxczcnv6.dll

[2006.01.10 19:11:06 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxczcnv5.dll

[2006.01.10 19:11:06 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxczcnv4.dll

[2002.08.08 06:11:30 | 000,319,488 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe

[2000.03.29 16:17:42 | 000,005,824 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS

[1999.01.22 20:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL

 
 ========== LOP Check ==========

 

[2010.10.23 18:43:38 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Audacity

[2010.07.03 12:53:44 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Bump Technologies, Inc

[2010.01.05 21:21:27 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\CoSoSys

[2010.07.07 15:01:13 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DAEMON Tools Lite

[2010.02.24 00:04:35 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Dev-Cpp

[2010.03.08 20:34:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\flightgear.org

[2010.03.08 20:47:50 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\fltk.org

[2009.10.19 22:18:36 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\GrabPro

[2011.03.29 18:28:02 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQ

[2010.04.15 23:15:25 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ImgBurn

[2010.03.16 16:44:11 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ManyCam

[2009.09.16 21:49:19 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\MyPhoneExplorer

[2009.10.19 22:44:00 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Orbit

[2010.11.18 23:27:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Weaverslave

[2011.02.06 18:40:39 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2011.03.29 19:13:16 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2010.02.19 15:45:25 | 000,000,000 | ---D | M] -- C:\0e43fd6a2253abe81638137a78ad3e

[2011.03.28 21:52:44 | 000,000,000 | ---D | M] -- C:\1f5e52860a533b3ecbc90fbfae094d7a

[2009.10.15 01:47:26 | 000,000,000 | ---D | M] -- C:\ATI

[2009.08.23 18:35:52 | 000,000,000 | -HSD | M] -- C:\Boot

[2010.09.28 12:52:21 | 000,000,000 | ---D | M] -- C:\c1743efabefd10f84ef0

[2009.07.14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2009.08.23 17:46:27 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2009.10.19 22:36:10 | 000,000,000 | ---D | M] -- C:\downloads

[2010.03.12 04:46:41 | 000,000,000 | ---D | M] -- C:\lexmark

[2009.07.14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2009.10.28 20:49:42 | 000,000,000 | ---D | M] -- C:\Philips

[2011.03.29 23:50:06 | 000,000,000 | R--D | M] -- C:\Programme

[2010.11.13 19:50:27 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2009.08.23 17:46:27 | 000,000,000 | -HSD | M] -- C:\Programme

[2009.08.23 17:46:28 | 000,000,000 | -HSD | M] -- C:\Recovery

[2011.03.29 18:40:47 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2009.10.28 20:58:12 | 000,000,000 | ---D | M] -- C:\temp

[2009.08.23 17:46:53 | 000,000,000 | R--D | M] -- C:\Users

[2011.03.29 23:50:50 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: EXPLORER.EXE  >

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

 
 < MD5 for: USERINIT.EXE  >

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-29 16:41:22

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0
 

< End of report >

Extras.txt

Code:

OTL Extras logfile created on: 29.03.2011 23:52:01 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\*****\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 71,00 Mb Available Physical Memory | 14,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 76,69 Gb Total Space | 8,66 Gb Free Space | 11,30% Space Free | Partition Type: NTFS

 

Computer Name: *****-PC | User Name: ***** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam(TM)

"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.4 Build #4561 Banner Remover 1.1

"{17424F35-8B77-4ADF-BC63-BF9B81418539}" = Apple Application Support

"{1CA7ACD6-B21B-4240-AA05-4FC55F6E1031}" = Nero 8 Ultra Edition HD

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15

"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 3.106.00

"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support

"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup

"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call

"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{71414EC2-0684-4A15-A85A-E0E259D117AF}" = Microangelo Toolset 6

"{71702641-2849-45A4-8E62-4B85974B24A0}_is1" = BumpTop

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B0A8A6F-FC9E-796F-CC5D-290161F8E92A}" = ATI Catalyst Install Manager

"{9E012857-0B5E-40A0-A36A-36751966A79B}_is1" = ICQ Status Checker 1.7

"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch

"{AF7EA205-4E09-4889-B58F-16B02707E841}" = SmartStore.biz 3.5

"{C1A80F67-656F-4DF3-A6C4-DE18A47477C5}_is1" = ICQ Away Reader 1.4

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1" = Shutdown Manager

"{CC8E0363-B20C-4792-8A1C-8DF5E01B68A6}" = GoGear VIBE Device Manager

"{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}" = Counter-Strike(TM)

"{E623BB3F-F7ED-4148-BEB5-A0D1DB28B4DE}" = Media Converter for Philips

"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime

"{E8843212-F0FC-4C3B-BFF3-D51829CB4F19}" = iTunes

"{E9A5B341-167D-4042-8854-46F671F94049}" = Medieval CUE Splitter

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F1B1BB41-2494-4FC2-BEF7-9C282B6815A8}" = Image Resizer Powertoy Clone for Windows

"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)

"AVIConverter" = AVIConverter 5.1.6

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Cheat Engine 5.6_is1" = Cheat Engine 5.6

"C-Media Audio Driver" = C-Media WDM Audio Driver

"DivX Setup.divx.com" = DivX-Setup

"D-Link VGA Webcam" = D-Link VGA Webcam

"Easy Video Downloader_is1" = Easy Video Downloader v. 2.0

"EAX Unified" = EAX Unified

"ERUNT_is1" = ERUNT 1.1j

"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20

"FLV Player" = FLV Player 2.0 (build 25)

"GoldWave v5.50" = GoldWave v5.50

"Gordon's Gate Flash Driver" = Gordon's Gate Flash Driver 1.1.0.12

"ImgBurn" = ImgBurn

"JDownloader" = JDownloader

"Lexmark 1200 Series" = Lexmark 1200 Series

"MacroX" = MacroX 3.1

"Mafia" = Mafia

"Mafia Game" = Mafia Game

"ManyCam" = ManyCam 2.4 (remove only)

"Media Player - Codec Pack" = Media Player Codec Pack 3.8.0

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)

"Pflanzen gegen Zombies" = Pflanzen gegen Zombies  

"Polipo" = Polipo 1.0.4.1

"QIP 2005 8095 Jeak-Edition" = QIP 2005 8095 Jeak-Edition

"San Andreas Radio_is1" = San Andreas Radio V1.0

"SopCast" = SopCast 3.3.2

"ThiefGoldDeinstallKey" = Dark Project: Der Meisterdieb Director's Cut

"Tor" = Tor 0.2.1.26

"Vidalia" = Vidalia 0.2.9

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

"winscp3_is1" = WinSCP 4.2.9

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 24.03.2011 13:47:56 | Computer Name = *****-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 9.0.0.2823,

 Zeitstempel: 0x3720dbd6  Name des fehlerhaften Moduls: WINWORD.EXE, Version: 9.0.0.2823,

 Zeitstempel: 0x3720dbd6  Ausnahmecode: 0xc0000094  Fehleroffset: 0x003889d7  ID des fehlerhaften

 Prozesses: 0xc80  Startzeit der fehlerhaften Anwendung: 0x01cbea4b83f906fd  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Microsoft Office\Office\WINWORD.EXE  Pfad

 des fehlerhaften Moduls: C:\Program Files\Microsoft Office\Office\WINWORD.EXE  Berichtskennung:

 d968acb4-563e-11e0-b147-00138f4a0910

 

Error - 24.03.2011 15:52:09 | Computer Name = *****-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 25.03.2011 11:20:14 | Computer Name = *****-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 27.03.2011 20:59:37 | Computer Name = *****-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.4095,

 Zeitstempel: 0x000707f3  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16695,

 Zeitstempel: 0x4cc7ab44  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00028ab2  ID des fehlerhaften

 Prozesses: 0x13c  Startzeit der fehlerhaften Anwendung: 0x01cbecaf461daf0c  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\firefox.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: a6a42c2a-58d6-11e0-80f2-00138f4a0910

 

Error - 28.03.2011 11:17:20 | Computer Name = *****-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 28.03.2011 12:21:21 | Computer Name = *****-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: ICQ.exe, Version: 7.4.0.4561, Zeitstempel:

 0x000707f3  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:

 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x20041b06  ID des fehlerhaften Prozesses:

 0x8cc  Startzeit der fehlerhaften Anwendung: 0x01cbed5236c6b7e4  Pfad der fehlerhaften

 Anwendung: C:\Program Files\ICQ7.4\ICQ.exe  Pfad des fehlerhaften Moduls: unknown

Berichtskennung:

 6a876746-5957-11e0-8903-00138f4a0910

 

Error - 28.03.2011 14:52:52 | Computer Name = *****-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 9.0.0.2823,

 Zeitstempel: 0x000707f3  Name des fehlerhaften Moduls: WINWORD.EXE, Version: 9.0.0.2823,

 Zeitstempel: 0x000707f3  Ausnahmecode: 0xc0000005  Fehleroffset: 0x003a2a74  ID des fehlerhaften

 Prozesses: 0x850  Startzeit der fehlerhaften Anwendung: 0x01cbed79499cacec  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Microsoft Office\Office\WINWORD.EXE  Pfad

 des fehlerhaften Moduls: C:\Program Files\Microsoft Office\Office\WINWORD.EXE  Berichtskennung:

 9575f3da-596c-11e0-a0f2-00138f4a0910

 

Error - 28.03.2011 15:55:07 | Computer Name = *****-PC | Source = System Restore | ID = 8210

Description = 

 

Error - 29.03.2011 12:22:50 | Computer Name = *****-PC | Source = System Restore | ID = 8210

Description = 

 

Error - 29.03.2011 13:02:29 | Computer Name = *****-PC | Source = System Restore | ID = 8209

Description = 

 

[ System Events ]

Error - 29.03.2011 12:30:57 | Computer Name = *****-PC | Source = Service Control Manager | ID = 7022

Description = Der Dienst "Windows Defender" wurde nicht richtig gestartet.

 

Error - 29.03.2011 12:33:17 | Computer Name = *****-PC | Source = Service Control Manager | ID = 7043

Description = Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements

 nicht richtig heruntergefahren werden.

 

Error - 29.03.2011 12:35:14 | Computer Name = *****-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

Error - 29.03.2011 12:35:18 | Computer Name = *****-PC | Source = ati2mtag | ID = 52225

Description = 

 

Error - 29.03.2011 16:57:28 | Computer Name = *****-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?29.?03.?2011 um 20:44:28 unerwartet heruntergefahren.

 

Error - 29.03.2011 16:57:16 | Computer Name = *****-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

Error - 29.03.2011 16:57:24 | Computer Name = *****-PC | Source = ati2mtag | ID = 52225

Description = 

 

Error - 29.03.2011 17:14:50 | Computer Name = *****-PC | Source = Service Control Manager | ID = 7034

Description = Dienst "PLFlash DeviceIoControl Service" wurde unerwartet beendet.

 Dies ist bereits 1 Mal passiert.

 

Error - 29.03.2011 17:18:01 | Computer Name = *****-PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 29.03.2011 17:20:35 | Computer Name = *****-PC | Source = Service Control Manager | ID = 7034

Description = Dienst "StarWind AE Service" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

 

< End of report >

gmer.log

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-03-30 00:39:22

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ExcelStor_Technology_J880 rev.PF2OA21B

Running: g2m3e4r.exe; Driver: C:\Users\*****\AppData\Local\Temp\ugloipog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            8DFFA3CC                                                                                                            ZwCreateThread

SSDT            8DFFA3B8                                                                                                            ZwOpenProcess

SSDT            8DFFA3BD                                                                                                            ZwOpenThread

SSDT            8DFFA3C7                                                                                                            ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13BD                                                                                     82A45589 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              82A6A092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!RtlSidHashLookup + 34C                                                                                 82A7195C 4 Bytes  [CC, A3, FF, 8D]

.text           ntkrnlpa.exe!RtlSidHashLookup + 4E8                                                                                 82A71AF8 4 Bytes  [B8, A3, FF, 8D]

.text           ntkrnlpa.exe!RtlSidHashLookup + 508                                                                                 82A71B18 4 Bytes  [BD, A3, FF, 8D]

.text           ntkrnlpa.exe!RtlSidHashLookup + 7B8                                                                                 82A71DC8 4 Bytes  [C7, A3, FF, 8D]

.text           sptd.sys                                                                                                            86A03000 8 Bytes  [A6, F1, E1, 82, A0, 57, E1, ...]

.text           sptd.sys                                                                                                            86A03009 23 Bytes  [57, E1, 82, 48, 7B, E1, 82, ...]

.text           sptd.sys                                                                                                            86A03024 4 Bytes  [32, 25, B3, 86]

.text           sptd.sys                                                                                                            86A0302C 188 Bytes  [4C, 3D, C6, 82, 15, 44, C0, ...]

.text           sptd.sys                                                                                                            86A030E9 235 Bytes  [0B, A4, 82, 1C, 8E, AB, 82, ...]

.text           ...                                                                                                                 

.sptd2          C:\Windows\System32\Drivers\sptd.sys                                                                                entry point in ".sptd2" section [0x86AFAD38]

?               C:\Windows\System32\Drivers\sptd.sys                                                                                Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

.text           USBPORT.SYS!DllUnload                                                                                               8C825CA0 5 Bytes  JMP 85113410 
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                              83FDA1F8

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    85117430

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    85117430

Device          \Driver\ACPI_HAL \Device\00000045                                                                                   halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    85117430

Device          \Driver\usbuhci \Device\USBPDO-3                                                                                    85117430

Device          \Driver\usbehci \Device\USBPDO-4                                                                                    8511B430
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\cdrom \Device\CdRom0                                                                                        8505B430

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                         83FD71F8

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  83FD71F8

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  83FD71F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2                                                                         83FD71F8

Device          \Driver\cdrom \Device\CdRom1                                                                                        8505B430

Device          \Driver\cdrom \Device\CdRom2                                                                                        8505B430

Device          \Driver\cdrom \Device\CdRom3                                                                                        8505B430

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                             8508F430

Device          \Driver\PCI_PNP1390 \Device\0000004b                                                                                sptd.sys

Device          \Driver\vsmraid \Device\RaidPort0                                                                                   83FD81F8

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    85117430

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    85117430

Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    85117430

Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    85117430

Device          \Driver\usbehci \Device\USBFDO-4                                                                                    8511B430

Device          \Driver\asfjs438 \Device\Scsi\asfjs4381Port3Path0Target1Lun0                                                        85133430

Device          \Driver\asfjs438 \Device\Scsi\asfjs4381Port3Path0Target0Lun0                                                        85133430

Device          \Driver\asfjs438 \Device\Scsi\asfjs4381                                                                             85133430

Device          \Driver\asfjs438 \Device\Scsi\asfjs4381Port3Path0Target2Lun0                                                        85133430
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                 C:\Program Files\Alcohol Soft\Alcohol 120\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xD2 0x47 0x6D 0x11 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x66 0x13 0xAD 0x7C ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x69 0x93 0x5F 0x97 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0x6B 0xD6 0xBC 0xF7 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                0x2E 0x89 0x3B 0x4B ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                     C:\Program Files\Alcohol Soft\Alcohol 120\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xC7 0x7C 0x03 0xAB ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x66 0x13 0xAD 0x7C ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x69 0x93 0x5F 0x97 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x6B 0xD6 0xBC 0xF7 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                    0x2E 0x89 0x3B 0x4B ...
 

---- Files - GMER 1.0.15 ----
 

File            C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb                                                              0 bytes
 

---- EOF - GMER 1.0.15 ----

Malwarebytes Anti-Malware Quick Scan

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6209
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

30.03.2011 01:33:38

mbam-log-2011-03-30 (01-33-38).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 146292

Laufzeit: 11 Minute(n), 0 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Nein, das war das erste Mal, dass ich einen Scan durchgeführt habe, ältere Logs existieren nicht. Habe aber nochmal einen Vollscan durchgeführt, da der aus dem ersten Post nur ein Quickscan war.

Habe die ICQ-Nummern in den Ordnernamen unkenntlich gemacht, ist aber eigentlich nur eines von diesen Scherzprogrammen, dass ich schon seit Jahren im ICQ Ordner habe.

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6224
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

31.03.2011 17:55:34

mbam-log-2011-03-31 (17-55-34).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Durchsuchte Objekte: 252813

Laufzeit: 1 Stunde(n), 24 Minute(n), 40 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Users\*****\Desktop\Sachen\ICQ Lite\*****\*****\spass.exe (PUP.Joke.Schock) -> Quarantined and deleted successfully.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

:OTL

@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0

[2010.02.19 15:45:25 | 000,000,000 | ---D | M] -- C:\0e43fd6a2253abe81638137a78ad3e

[2011.03.28 21:52:44 | 000,000,000 | ---D | M] -- C:\1f5e52860a533b3ecbc90fbfae094d7a

[2010.09.28 12:52:21 | 000,000,000 | ---D | M] -- C:\c1743efabefd10f84ef0

[2010.06.11 14:50:28 | 000,200,704 | ---- | C] () -- C:\Windows\sel3110.exe

[2010.06.11 14:50:28 | 000,032,528 | ---- | C] () -- C:\Windows\amcap.exe

[2010.06.11 14:50:27 | 000,040,960 | ---- | C] () -- C:\Windows\CleanDev.exe

[2010.07.19 21:42:43 | 000,000,871 | ---- | C] () -- C:\Users\*****\AppData\Local\Tempwconfig.vbs

[2011.03.28 02:59:10 | 000,000,000 | ---D | C] -- C:\Users\*****\kskkabxn

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hier der Log nach dem OTL-Fix:

Code:

All processes killed

========== OTL ==========

ADS C:\ProgramData\TEMP:8FF81EB0 deleted successfully.

C:\0e43fd6a2253abe81638137a78ad3e folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\Graphics folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\Client folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\3082 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\3076 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\2070 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\2052 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1055 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1053 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1049 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1046 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1045 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1044 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1043 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1042 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1041 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1040 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1038 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1037 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1036 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1035 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1033 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1032 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1031 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1030 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1029 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1028 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a\1025 folder moved successfully.

C:\1f5e52860a533b3ecbc90fbfae094d7a folder moved successfully.

C:\c1743efabefd10f84ef0 folder moved successfully.

C:\Windows\sel3110.exe moved successfully.

C:\Windows\amcap.exe moved successfully.

C:\Windows\CleanDev.exe moved successfully.

C:\Users\*****\AppData\Local\Tempwconfig.vbs moved successfully.

C:\Users\*****\kskkabxn folder moved successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: *****

->Temp folder emptied: 377936 bytes

->Temporary Internet Files folder emptied: 30793747 bytes

->Java cache emptied: 618636 bytes

->FireFox cache emptied: 101440857 bytes

->Flash cache emptied: 4060 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1824 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 127,00 mb

 

 

OTL by OldTimer - Version 3.2.22.3 log created on 03312011_233627
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hier die Log von ComboFix:

Code:

ComboFix 11-03-31.04 - ***** 01.04.2011  14:56:31.1.1 - x86

Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.511.164 [GMT 2:00]

ausgeführt von:: c:\users\*****\Desktop\cofi.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-03-01 bis 2011-04-01  ))))))))))))))))))))))))))))))

.

.

2011-04-01 13:11 . 2011-04-01 13:11        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-03-29 21:50 . 2011-03-29 21:50        --------        d-----w-        c:\program files\ERUNT

2011-03-29 16:21 . 2011-04-01 12:28        --------        d-----w-        c:\windows\system32\wbem\repository

2011-03-09 17:23 . 2010-12-18 05:30        2690560        ----a-w-        c:\windows\system32\mstscax.dll

2011-03-09 17:23 . 2010-12-18 05:26        1034240        ----a-w-        c:\windows\system32\mstsc.exe

2011-03-09 17:22 . 2011-02-19 05:33        802304        ----a-w-        c:\windows\system32\FntCache.dll

2011-03-09 17:22 . 2011-02-19 05:32        1074176        ----a-w-        c:\windows\system32\DWrite.dll

2011-03-09 17:22 . 2011-02-19 05:32        739840        ----a-w-        c:\windows\system32\d2d1.dll

2011-03-09 17:22 . 2010-12-23 05:28        642048        ----a-w-        c:\windows\system32\CPFilters.dll

2011-03-09 17:22 . 2010-12-23 05:28        850432        ----a-w-        c:\windows\system32\sbe.dll

2011-03-09 17:22 . 2010-12-23 05:28        534528        ----a-w-        c:\windows\system32\EncDec.dll

2011-03-09 17:22 . 2010-12-23 05:24        199680        ----a-w-        c:\windows\system32\mpg2splt.ax

2011-03-02 15:26 . 1998-06-17 17:07        57344        ----a-w-        c:\windows\system32\Mfc42loc.dll

2011-03-02 15:20 . 2011-03-02 15:22        --------        d-----w-        c:\program files\EA GAMES

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-03 05:45 . 2011-02-09 13:08        219008        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2011-02-02 17:11 . 2009-10-03 13:48        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-01-07 07:31 . 2011-02-23 11:45        442880        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-01-07 07:31 . 2011-02-23 11:45        288256        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-01-07 07:27 . 2011-02-09 13:09        34304        ----a-w-        c:\windows\system32\atmlib.dll

2011-01-07 05:33 . 2011-02-09 13:09        294400        ----a-w-        c:\windows\system32\atmfd.dll

2011-01-05 05:37 . 2011-02-09 13:12        428032        ----a-w-        c:\windows\system32\vbscript.dll

2011-01-05 03:37 . 2011-02-09 13:12        2329088        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

"ICQ"="c:\program files\ICQ7.4\ICQ.exe" [2011-02-10 119608]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Philips GoGear VIBE Device Manager.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Philips GoGear VIBE Device Manager.lnk

backup=c:\windows\pss\Philips GoGear VIBE Device Manager.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 15:10        35696        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]

2009-10-10 12:32        203264        ----a-w-        c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2010-06-03 00:50        1144104        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2008-12-12 06:31        1840424        ----a-w-        c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-11-10 23:40        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]

2008-12-02 13:29        2221352        ----a-w-        c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 09:50        155648        ----a-w-        c:\windows\System32\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]

2007-11-20 13:29        360448        ----a-w-        c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

2010-11-17 17:42        1242448        ----a-w-        c:\program files\Valve\Steam\Steam.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-08-25 22:08        149280        ----a-w-        c:\program files\Java\jre6\bin\jusched.exe

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 AMDMSRIO;AMDMSRIO;c:\users\*****\AppData\Local\Temp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys [x]

R3 gggen;Generic USB Flash Driver;c:\windows\system32\DRIVERS\gggen.sys [2006-09-28 11648]

R3 rockusb;Driver for rockusb Device;c:\windows\system32\DRIVERS\rockusb.sys [2006-11-08 77772]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-03 436792]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-09-23 108289]

S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]

.

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = *.local

IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe

FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\tpowwhbj.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

FF - Ext: NASA Night Launch: nasanightlaunch@example.com - %profile%\extensions\nasanightlaunch@example.com

FF - Ext: ChatZilla: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2} - %profile%\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard

FF - Ext: FoxyProxy Standard: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung

FF - Ext: FoxyProxy Basic: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung

FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com

FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}

FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-Cmaudio - cmicnfg.cpl

MSConfigStartUp-ICQ - c:\program files\ICQ7.0\ICQ.exe

MSConfigStartUp-Lexmark 1200 Series - c:\program files\Lexmark 1200 Series\lxczbmgr.exe

MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe

AddRemove-D-Link VGA Webcam - c:\windows\CleanDev.exe

AddRemove-NeroVision!UninstallKey - c:\windows\UNNeroVision.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-04-01  15:16:04

ComboFix-quarantined-files.txt  2011-04-01 13:16

.

Vor Suchlauf: 11 Verzeichnis(se), 12.238.970.880 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 12.021.170.176 Bytes frei

.

- - End Of File - - 91D76EE8A5ACD7EC70594C183F6F303A

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

1 wurde entdeckt, habe aber nichts gemacht und das bei skip gelassen.

Code:

2011/04/01 15:52:34.0836 1960        TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28

2011/04/01 15:52:35.0649 1960        ================================================================================

2011/04/01 15:52:35.0649 1960        SystemInfo:

2011/04/01 15:52:35.0649 1960        

2011/04/01 15:52:35.0649 1960        OS Version: 6.1.7600 ServicePack: 0.0

2011/04/01 15:52:35.0649 1960        Product type: Workstation

2011/04/01 15:52:35.0649 1960        ComputerName: *****-PC

2011/04/01 15:52:35.0649 1960        UserName: *****

2011/04/01 15:52:35.0649 1960        Windows directory: C:\Windows

2011/04/01 15:52:35.0649 1960        System windows directory: C:\Windows

2011/04/01 15:52:35.0649 1960        Processor architecture: Intel x86

2011/04/01 15:52:35.0649 1960        Number of processors: 1

2011/04/01 15:52:35.0649 1960        Page size: 0x1000

2011/04/01 15:52:35.0649 1960        Boot type: Normal boot

2011/04/01 15:52:35.0649 1960        ================================================================================

2011/04/01 15:52:46.0946 1960        Initialize success

2011/04/01 15:52:56.0508 3636        ================================================================================

2011/04/01 15:52:56.0508 3636        Scan started

2011/04/01 15:52:56.0508 3636        Mode: Manual; 

2011/04/01 15:52:56.0508 3636        ================================================================================

2011/04/01 15:52:56.0915 3636        1394ohci        (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys

2011/04/01 15:52:57.0102 3636        ACPI            (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys

2011/04/01 15:52:57.0243 3636        AcpiPmi         (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys

2011/04/01 15:52:57.0383 3636        adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys

2011/04/01 15:52:57.0540 3636        adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys

2011/04/01 15:52:57.0665 3636        adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys

2011/04/01 15:52:57.0836 3636        AFD             (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys

2011/04/01 15:52:57.0961 3636        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys

2011/04/01 15:52:58.0086 3636        aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys

2011/04/01 15:52:58.0258 3636        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys

2011/04/01 15:52:58.0368 3636        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys

2011/04/01 15:52:58.0477 3636        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys

2011/04/01 15:52:58.0618 3636        AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys

2011/04/01 15:52:58.0852 3636        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys

2011/04/01 15:52:58.0977 3636        amdsata         (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys

2011/04/01 15:52:59.0133 3636        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys

2011/04/01 15:52:59.0274 3636        amdxata         (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys

2011/04/01 15:52:59.0430 3636        AppID           (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys

2011/04/01 15:52:59.0649 3636        arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys

2011/04/01 15:52:59.0758 3636        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys

2011/04/01 15:52:59.0899 3636        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/04/01 15:53:00.0008 3636        atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys

2011/04/01 15:53:00.0196 3636        ati2mtag        (e36d69e40c1db6a0f6ae9e3e68ba775a) C:\Windows\system32\DRIVERS\ati2mtag.sys

2011/04/01 15:53:00.0430 3636        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys

2011/04/01 15:53:00.0555 3636        avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys

2011/04/01 15:53:00.0696 3636        avipbb          (6d52060b59e7d79cd2a044b6add1f1ef) C:\Windows\system32\DRIVERS\avipbb.sys

2011/04/01 15:53:00.0883 3636        b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys

2011/04/01 15:53:01.0040 3636        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

2011/04/01 15:53:01.0211 3636        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

2011/04/01 15:53:01.0477 3636        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

2011/04/01 15:53:01.0633 3636        bowser          (fcafaef6798d7b51ff029f99a9898961) C:\Windows\system32\DRIVERS\bowser.sys

2011/04/01 15:53:01.0758 3636        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys

2011/04/01 15:53:01.0883 3636        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys

2011/04/01 15:53:02.0024 3636        Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

2011/04/01 15:53:02.0149 3636        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

2011/04/01 15:53:02.0258 3636        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

2011/04/01 15:53:02.0399 3636        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

2011/04/01 15:53:02.0524 3636        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

2011/04/01 15:53:02.0790 3636        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

2011/04/01 15:53:02.0930 3636        cdrom           (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys

2011/04/01 15:53:03.0086 3636        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys

2011/04/01 15:53:03.0196 3636        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

2011/04/01 15:53:03.0383 3636        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/04/01 15:53:03.0508 3636        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys

2011/04/01 15:53:03.0680 3636        cmuda           (e5adeef2c0db43964223f408f1fcc97e) C:\Windows\system32\drivers\cmuda.sys

2011/04/01 15:53:03.0852 3636        CNG             (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys

2011/04/01 15:53:03.0993 3636        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys

2011/04/01 15:53:04.0133 3636        CompositeBus    (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys

2011/04/01 15:53:04.0274 3636        crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys

2011/04/01 15:53:04.0446 3636        CSC             (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys

2011/04/01 15:53:04.0633 3636        DfsC            (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys

2011/04/01 15:53:04.0774 3636        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

2011/04/01 15:53:04.0930 3636        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

2011/04/01 15:53:05.0118 3636        drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

2011/04/01 15:53:05.0258 3636        DXGKrnl         (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys

2011/04/01 15:53:05.0524 3636        ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys

2011/04/01 15:53:05.0821 3636        elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys

2011/04/01 15:53:05.0946 3636        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys

2011/04/01 15:53:06.0118 3636        exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

2011/04/01 15:53:06.0243 3636        fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

2011/04/01 15:53:06.0368 3636        fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys

2011/04/01 15:53:06.0555 3636        FETNDIS         (f5cb6cb6d12f495516be27cffccde4bf) C:\Windows\system32\DRIVERS\fetnd6.sys

2011/04/01 15:53:06.0665 3636        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

2011/04/01 15:53:06.0805 3636        Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

2011/04/01 15:53:06.0915 3636        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/04/01 15:53:07.0102 3636        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

2011/04/01 15:53:07.0274 3636        FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

2011/04/01 15:53:07.0399 3636        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys

2011/04/01 15:53:07.0540 3636        fvevol          (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys

2011/04/01 15:53:07.0665 3636        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys

2011/04/01 15:53:07.0821 3636        GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

2011/04/01 15:53:07.0961 3636        gggen           (47740536b261eeb6fae5c16ef2fd769c) C:\Windows\system32\DRIVERS\gggen.sys

2011/04/01 15:53:08.0086 3636        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

2011/04/01 15:53:08.0211 3636        HDAudBus        (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/04/01 15:53:08.0336 3636        HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys

2011/04/01 15:53:08.0446 3636        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

2011/04/01 15:53:08.0602 3636        HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys

2011/04/01 15:53:08.0743 3636        HidUsb          (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys

2011/04/01 15:53:08.0915 3636        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys

2011/04/01 15:53:09.0040 3636        HTTP            (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys

2011/04/01 15:53:09.0180 3636        hwpolicy        (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys

2011/04/01 15:53:09.0305 3636        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/04/01 15:53:09.0461 3636        iaStorV         (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys

2011/04/01 15:53:09.0618 3636        iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys

2011/04/01 15:53:09.0774 3636        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys

2011/04/01 15:53:09.0883 3636        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

2011/04/01 15:53:10.0024 3636        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/04/01 15:53:10.0165 3636        IPMIDRV         (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys

2011/04/01 15:53:10.0305 3636        IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

2011/04/01 15:53:10.0446 3636        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

2011/04/01 15:53:10.0571 3636        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys

2011/04/01 15:53:10.0696 3636        iScsiPrt        (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/04/01 15:53:10.0836 3636        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/04/01 15:53:10.0961 3636        kbdhid          (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/04/01 15:53:11.0102 3636        KSecDD          (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys

2011/04/01 15:53:11.0227 3636        KSecPkg         (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys

2011/04/01 15:53:11.0430 3636        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/04/01 15:53:11.0602 3636        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys

2011/04/01 15:53:11.0743 3636        LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys

2011/04/01 15:53:11.0883 3636        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys

2011/04/01 15:53:12.0008 3636        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys

2011/04/01 15:53:12.0149 3636        luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

2011/04/01 15:53:12.0336 3636        ManyCam         (c6d085c7045200143528136a43a65fde) C:\Windows\system32\DRIVERS\ManyCam.sys

2011/04/01 15:53:12.0493 3636        megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys

2011/04/01 15:53:12.0633 3636        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys

2011/04/01 15:53:12.0790 3636        Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

2011/04/01 15:53:12.0946 3636        monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

2011/04/01 15:53:13.0071 3636        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

2011/04/01 15:53:13.0227 3636        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

2011/04/01 15:53:13.0336 3636        mountmgr        (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys

2011/04/01 15:53:13.0461 3636        mpio            (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys

2011/04/01 15:53:13.0586 3636        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

2011/04/01 15:53:13.0743 3636        MRxDAV          (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys

2011/04/01 15:53:13.0868 3636        mrxsmb          (f1b6aa08497ea86ca6ef6f7a08b0bfb8) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/04/01 15:53:14.0008 3636        mrxsmb10        (5613358b4050f46f5a9832da8050d6e4) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/04/01 15:53:14.0149 3636        mrxsmb20        (25c9792778d80feb4c8201e62281bfdf) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/04/01 15:53:14.0274 3636        msahci          (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys

2011/04/01 15:53:14.0399 3636        msdsm           (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys

2011/04/01 15:53:14.0571 3636        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

2011/04/01 15:53:14.0696 3636        mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

2011/04/01 15:53:14.0821 3636        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys

2011/04/01 15:53:14.0977 3636        MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

2011/04/01 15:53:15.0102 3636        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/04/01 15:53:15.0243 3636        MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

2011/04/01 15:53:15.0368 3636        MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

2011/04/01 15:53:15.0508 3636        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/04/01 15:53:15.0618 3636        MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

2011/04/01 15:53:15.0743 3636        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys

2011/04/01 15:53:15.0868 3636        Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

2011/04/01 15:53:16.0008 3636        NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

2011/04/01 15:53:16.0149 3636        NDIS            (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys

2011/04/01 15:53:16.0305 3636        NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

2011/04/01 15:53:16.0430 3636        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/04/01 15:53:16.0555 3636        Ndisuio         (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/04/01 15:53:16.0680 3636        NdisWan         (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/04/01 15:53:16.0836 3636        NDProxy         (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys

2011/04/01 15:53:16.0993 3636        NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

2011/04/01 15:53:17.0149 3636        NetBT           (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys

2011/04/01 15:53:17.0352 3636        nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys

2011/04/01 15:53:17.0540 3636        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

2011/04/01 15:53:17.0665 3636        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

2011/04/01 15:53:17.0852 3636        Ntfs            (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys

2011/04/01 15:53:17.0993 3636        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

2011/04/01 15:53:18.0118 3636        nvraid          (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys

2011/04/01 15:53:18.0243 3636        nvstor          (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys

2011/04/01 15:53:18.0383 3636        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys

2011/04/01 15:53:18.0508 3636        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys

2011/04/01 15:53:18.0649 3636        ovt519          (4cdadec3dc1300ee1d313ea5494e6472) C:\Windows\system32\Drivers\ov519vid.sys

2011/04/01 15:53:18.0821 3636        Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys

2011/04/01 15:53:18.0930 3636        partmgr         (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys

2011/04/01 15:53:19.0071 3636        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys

2011/04/01 15:53:19.0211 3636        pci             (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys

2011/04/01 15:53:19.0336 3636        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys

2011/04/01 15:53:19.0461 3636        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys

2011/04/01 15:53:19.0602 3636        pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

2011/04/01 15:53:19.0727 3636        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

2011/04/01 15:53:20.0055 3636        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

2011/04/01 15:53:20.0180 3636        Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys

2011/04/01 15:53:20.0336 3636        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

2011/04/01 15:53:20.0508 3636        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys

2011/04/01 15:53:20.0665 3636        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys

2011/04/01 15:53:20.0790 3636        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

2011/04/01 15:53:20.0915 3636        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

2011/04/01 15:53:21.0040 3636        RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

2011/04/01 15:53:21.0180 3636        Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/04/01 15:53:21.0321 3636        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/04/01 15:53:21.0446 3636        RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

2011/04/01 15:53:21.0571 3636        rdbss           (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys

2011/04/01 15:53:21.0711 3636        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

2011/04/01 15:53:21.0852 3636        RDPCDD          (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/04/01 15:53:21.0993 3636        RDPDR           (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys

2011/04/01 15:53:22.0133 3636        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

2011/04/01 15:53:22.0274 3636        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

2011/04/01 15:53:22.0399 3636        RDPWD           (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys

2011/04/01 15:53:22.0540 3636        rdyboost        (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys

2011/04/01 15:53:22.0711 3636        rockusb         (068832f52bc5926f8c7833915d6dcaa5) C:\Windows\system32\DRIVERS\rockusb.sys

2011/04/01 15:53:22.0883 3636        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

2011/04/01 15:53:23.0055 3636        s117bus         (1f561844318914e7eb6e54673a4cc54c) C:\Windows\system32\DRIVERS\s117bus.sys

2011/04/01 15:53:23.0180 3636        s3cap           (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys

2011/04/01 15:53:23.0321 3636        sbp2port        (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys

2011/04/01 15:53:23.0446 3636        scfilter        (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys

2011/04/01 15:53:23.0618 3636        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/04/01 15:53:23.0805 3636        Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

2011/04/01 15:53:23.0930 3636        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys

2011/04/01 15:53:24.0040 3636        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys

2011/04/01 15:53:24.0211 3636        sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/04/01 15:53:24.0321 3636        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys

2011/04/01 15:53:24.0446 3636        sffp_sd         (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/04/01 15:53:24.0555 3636        sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys

2011/04/01 15:53:24.0711 3636        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys

2011/04/01 15:53:24.0821 3636        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys

2011/04/01 15:53:24.0946 3636        Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

2011/04/01 15:53:25.0118 3636        spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

2011/04/01 15:53:25.0352 3636        sptd            (a199171385be17973fd800fa91f8f78a) C:\Windows\system32\Drivers\sptd.sys

2011/04/01 15:53:25.0352 3636        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: a199171385be17973fd800fa91f8f78a

2011/04/01 15:53:25.0383 3636        sptd - detected Locked file (1)

2011/04/01 15:53:25.0508 3636        srv             (2dbedfb1853f06110ec2aa7f3213c89f) C:\Windows\system32\DRIVERS\srv.sys

2011/04/01 15:53:25.0649 3636        srv2            (db37131d1027c50ea7ee21c8bb4536aa) C:\Windows\system32\DRIVERS\srv2.sys

2011/04/01 15:53:25.0790 3636        srvnet          (f5980b74124db9233b33f86fc5ebbb4f) C:\Windows\system32\DRIVERS\srvnet.sys

2011/04/01 15:53:25.0946 3636        ssmdrv          (5ec550b8952882ee856b862cf648522d) C:\Windows\system32\DRIVERS\ssmdrv.sys

2011/04/01 15:53:26.0133 3636        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys

2011/04/01 15:53:26.0274 3636        storflt         (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys

2011/04/01 15:53:26.0399 3636        storvsc         (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys

2011/04/01 15:53:26.0524 3636        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys

2011/04/01 15:53:26.0758 3636        Tcpip           (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers\tcpip.sys

2011/04/01 15:53:26.0961 3636        TCPIP6          (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS\tcpip.sys

2011/04/01 15:53:27.0133 3636        tcpipreg        (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys

2011/04/01 15:53:27.0243 3636        TDPIPE          (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys

2011/04/01 15:53:27.0352 3636        TDTCP           (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys

2011/04/01 15:53:27.0477 3636        tdx             (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys

2011/04/01 15:53:27.0586 3636        TermDD          (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys

2011/04/01 15:53:27.0805 3636        tssecsrv        (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/04/01 15:53:27.0946 3636        tunnel          (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys

2011/04/01 15:53:28.0055 3636        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys

2011/04/01 15:53:28.0180 3636        udfs            (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys

2011/04/01 15:53:28.0336 3636        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys

2011/04/01 15:53:28.0477 3636        umbus           (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys

2011/04/01 15:53:28.0586 3636        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys

2011/04/01 15:53:28.0774 3636        USBAAPL         (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys

2011/04/01 15:53:28.0930 3636        usbaudio        (2436a42aab4ad48a9b714e5b0f344627) C:\Windows\system32\drivers\usbaudio.sys

2011/04/01 15:53:29.0196 3636        usbccgp         (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/04/01 15:53:29.0540 3636        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys

2011/04/01 15:53:29.0665 3636        usbehci         (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys

2011/04/01 15:53:29.0805 3636        usbhub          (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys

2011/04/01 15:53:29.0946 3636        usbohci         (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys

2011/04/01 15:53:30.0071 3636        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys

2011/04/01 15:53:30.0196 3636        usbscan         (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys

2011/04/01 15:53:30.0305 3636        USBSTOR         (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/04/01 15:53:30.0430 3636        usbuhci         (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/04/01 15:53:30.0571 3636        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys

2011/04/01 15:53:30.0711 3636        vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/04/01 15:53:30.0836 3636        VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

2011/04/01 15:53:30.0961 3636        vhdmp           (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys

2011/04/01 15:53:31.0102 3636        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys

2011/04/01 15:53:31.0211 3636        ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys

2011/04/01 15:53:31.0368 3636        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys

2011/04/01 15:53:31.0493 3636        vmbus           (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys

2011/04/01 15:53:31.0618 3636        VMBusHID        (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys

2011/04/01 15:53:31.0743 3636        volmgr          (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys

2011/04/01 15:53:31.0868 3636        volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

2011/04/01 15:53:31.0993 3636        volsnap         (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys

2011/04/01 15:53:32.0133 3636        vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys

2011/04/01 15:53:32.0274 3636        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys

2011/04/01 15:53:32.0430 3636        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys

2011/04/01 15:53:32.0571 3636        WANARP          (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

2011/04/01 15:53:32.0602 3636        Wanarpv6        (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

2011/04/01 15:53:32.0790 3636        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys

2011/04/01 15:53:32.0915 3636        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

2011/04/01 15:53:33.0165 3636        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

2011/04/01 15:53:33.0274 3636        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

2011/04/01 15:53:33.0524 3636        WinUsb          (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUsb.sys

2011/04/01 15:53:33.0649 3636        WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys

2011/04/01 15:53:33.0852 3636        ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/04/01 15:53:34.0024 3636        WudfPf          (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys

2011/04/01 15:53:34.0165 3636        WUDFRd          (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/04/01 15:53:34.0305 3636        ================================================================================

2011/04/01 15:53:34.0305 3636        Scan finished

2011/04/01 15:53:34.0305 3636        ================================================================================

2011/04/01 15:53:34.0352 2072        Detected object count: 1

2011/04/01 15:54:04.0008 2072        Locked file(sptd) - User select action: Skip 

2011/04/01 15:54:08.0524 2840        ================================================================================

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

So, habe alle drei Scans durchgeführt. Bei Osam war einiges Rot gefärbt, hoffe mal ist nichts schlimmes :confused:

Gmer-Log:

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-04-01 19:25:53

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ExcelStor_Technology_J880 rev.PF2OA21B

Running: g2m3e4r.exe; Driver: C:\Users\*****\AppData\Local\Temp\ugloipog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            8C92C314                                                                                                            ZwCreateThread

SSDT            8C92C300                                                                                                            ZwOpenProcess

SSDT            8C92C305                                                                                                            ZwOpenThread

SSDT            8C92C30F                                                                                                            ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13BD                                                                                     82A4F589 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              82A74092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!RtlSidHashLookup + 34C                                                                                 82A7B95C 4 Bytes  [14, C3, 92, 8C]

.text           ntkrnlpa.exe!RtlSidHashLookup + 4E8                                                                                 82A7BAF8 4 Bytes  [00, C3, 92, 8C]

.text           ntkrnlpa.exe!RtlSidHashLookup + 508                                                                                 82A7BB18 1 Byte  [05]

.text           ntkrnlpa.exe!RtlSidHashLookup + 508                                                                                 82A7BB18 4 Bytes  [05, C3, 92, 8C]

.text           ntkrnlpa.exe!RtlSidHashLookup + 7B8                                                                                 82A7BDC8 4 Bytes  [0F, C3, 92, 8C]

.text           sptd.sys                                                                                                            86A34000 8 Bytes  [A6, 91, E2, 82, A0, F7, E1, ...]

.text           sptd.sys                                                                                                            86A34009 23 Bytes  [F7, E1, 82, 48, 1B, E2, 82, ...]

.text           sptd.sys                                                                                                            86A34024 4 Bytes  [32, 35, B6, 86]

.text           sptd.sys                                                                                                            86A3402C 188 Bytes  [4C, DD, C6, 82, 15, E4, C0, ...]

.text           sptd.sys                                                                                                            86A340E9 235 Bytes  [AB, A4, 82, 1C, 2E, AC, 82, ...]

.text           ...                                                                                                                 

.sptd2          C:\Windows\System32\Drivers\sptd.sys                                                                                entry point in ".sptd2" section [0x86B2BD38]

?               C:\Windows\System32\Drivers\sptd.sys                                                                                Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

.text           USBPORT.SYS!DllUnload                                                                                               8BEF9CA0 5 Bytes  JMP 850EF410 

?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                          Das System kann die angegebene Datei nicht finden. !

?               C:\Users\*****\AppData\Local\Temp\catchme.sys                                                                       Das System kann die angegebene Datei nicht finden. !
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                              83FDA1F8

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    850F3430

Device          \Driver\ACPI_HAL \Device\00000045                                                                                   halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    850F3430

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    850F3430

Device          \Driver\usbuhci \Device\USBPDO-3                                                                                    850F3430

Device          \Driver\usbehci \Device\USBPDO-4                                                                                    850FB430
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\cdrom \Device\CdRom0                                                                                        8503F430

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                         83FD71F8

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  83FD71F8

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  83FD71F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2                                                                         83FD71F8

Device          \Driver\cdrom \Device\CdRom1                                                                                        8503F430

Device          \Driver\cdrom \Device\CdRom2                                                                                        8503F430

Device          \Driver\cdrom \Device\CdRom3                                                                                        8503F430

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                             85073430

Device          \Driver\PCI_PNP6372 \Device\0000004b                                                                                sptd.sys

Device          \Driver\vsmraid \Device\RaidPort0                                                                                   83FD81F8

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    850F3430

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    850F3430

Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    850F3430

Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    850F3430

Device          \Driver\usbehci \Device\USBFDO-4                                                                                    850FB430

Device          \Driver\NetBT \Device\NetBT_Tcpip_{209D62F5-A7AB-4BC9-9B13-5BF7B985813A}                                            85073430

Device          \Driver\a1e6jqqg \Device\Scsi\a1e6jqqg1Port3Path0Target2Lun0                                                        85103430

Device          \Driver\a1e6jqqg \Device\Scsi\a1e6jqqg1Port3Path0Target0Lun0                                                        85103430

Device          \Driver\a1e6jqqg \Device\Scsi\a1e6jqqg1                                                                             85103430

Device          \Driver\a1e6jqqg \Device\Scsi\a1e6jqqg1Port3Path0Target1Lun0                                                        85103430
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                 C:\Program Files\Alcohol Soft\Alcohol 120\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xF8 0x1D 0xAC 0x9E ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x66 0x13 0xAD 0x7C ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x69 0x93 0x5F 0x97 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0x6B 0xD6 0xBC 0xF7 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                0x2E 0x89 0x3B 0x4B ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                     C:\Program Files\Alcohol Soft\Alcohol 120\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xC3 0xF2 0xE0 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x66 0x13 0xAD 0x7C ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x69 0x93 0x5F 0x97 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x6B 0xD6 0xBC 0xF7 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                    0x2E 0x89 0x3B 0x4B ...
 

---- EOF - GMER 1.0.15 ----

Osam-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:36:01 on 01.04.2011
 

OS: Windows 7 Ultimate Edition (Build 7600), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.16
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"AxSWindC.cpl" - "Alcohol Soft Development Team" - C:\Windows\system32\AxSWindC.cpl

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"vp6dec_settings.cpl" - ? - C:\Windows\system32\vp6dec_settings.cpl  (File found, but it contains no detailed information)

"vp7dec_settings.cpl" - ? - C:\Windows\system32\vp7dec_settings.cpl  (File found, but it contains no detailed information)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"a1e6jqqg" (a1e6jqqg) - "Advanced Micro Devices" - C:\Windows\system32\drivers\a1e6jqqg.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)

"AMDMSRIO" (AMDMSRIO) - ? - C:\Users\*****\AppData\Local\Temp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys  (File not found)

"ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\Windows\System32\DRIVERS\ati2mtag.sys

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\*****\AppData\Local\Temp\catchme.sys  (File not found)

"Driver for rockusb Device" (rockusb) - "Fuzhou Rockchip Electronics Co,Ltd." - C:\Windows\System32\DRIVERS\rockusb.sys

"Generic USB Flash Driver" (gggen) - "Sony Ericsson Mobile Communications" - C:\Windows\System32\DRIVERS\gggen.sys

"mbr" (mbr) - ? - C:\cofi\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"ugloipog" (ugloipog) - ? - C:\Users\*****\AppData\Local\Temp\ugloipog.sys  (Hidden registry entry, rootkit activity | File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL

{4CF20B46-D006-4B90-A64B-DBAA9470EFBE} "PhotoToysClone" - "Brice Lambson" - C:\Program Files\Brice Lambson\PhotoToysClone\PhotoToysClone.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7.4" - "ICQ, LLC." - C:\Program Files\ICQ7.4\ICQ.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{11222041-111B-46E3-BD29-EFB2449479B1} "IEPlugin Class" - "ArcSoft, Inc." - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

"ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"1200 Series Port" - " " - C:\Windows\system32\lxczlmpm.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"lxcz_device" (lxcz_device) - " " - C:\Windows\system32\lxczcoms.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe

"StarWind AE Service" (StarWindServiceAE) - "StarWind Software" - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBRCheck:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows 7 Ultimate Edition

Windows Information:                 (build 7600), 32-bit

Logical Drives Mask:                0x0000007c
 

Kernel Drivers (total 192):

  0x82A0C000 \SystemRoot\system32\ntkrnlpa.exe

  0x82E1C000 \SystemRoot\system32\halmacpi.dll

  0x80B9D000 \SystemRoot\system32\kdcom.dll

  0x86813000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll

  0x8681E000 \SystemRoot\system32\PSHED.dll

  0x8682F000 \SystemRoot\system32\BOOTVID.dll

  0x86837000 \SystemRoot\system32\CLFS.SYS

  0x86879000 \SystemRoot\system32\CI.dll

  0x86924000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x86995000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x86A33000 \SystemRoot\System32\Drivers\sptd.sys

  0x86B46000 \SystemRoot\System32\Drivers\WMILIB.SYS

  0x86B4F000 \SystemRoot\System32\Drivers\SCSIPORT.SYS

  0x86B75000 \SystemRoot\system32\DRIVERS\ACPI.sys

  0x86BBD000 \SystemRoot\system32\DRIVERS\msisadrv.sys

  0x86BC5000 \SystemRoot\system32\DRIVERS\vdrvroot.sys

  0x86BD0000 \SystemRoot\system32\DRIVERS\pci.sys

  0x86A00000 \SystemRoot\System32\drivers\partmgr.sys

  0x86A11000 \SystemRoot\system32\DRIVERS\volmgr.sys

  0x869A3000 \SystemRoot\System32\drivers\volmgrx.sys

  0x86A21000 \SystemRoot\system32\DRIVERS\viaide.sys

  0x869EE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

  0x86C35000 \SystemRoot\System32\drivers\mountmgr.sys

  0x86C4B000 \SystemRoot\system32\DRIVERS\atapi.sys

  0x86C54000 \SystemRoot\system32\DRIVERS\ataport.SYS

  0x86C77000 \SystemRoot\system32\DRIVERS\vsmraid.sys

  0x86C9C000 \SystemRoot\system32\DRIVERS\storport.sys

  0x86CE3000 \SystemRoot\system32\DRIVERS\amdxata.sys

  0x86CEC000 \SystemRoot\system32\drivers\fltmgr.sys

  0x86D20000 \SystemRoot\system32\drivers\fileinfo.sys

  0x86E03000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x86F32000 \SystemRoot\System32\Drivers\msrpc.sys

  0x86F5D000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x86F70000 \SystemRoot\System32\Drivers\cng.sys

  0x86FCD000 \SystemRoot\System32\drivers\pcw.sys

  0x86FDB000 \SystemRoot\System32\Drivers\Fs_Rec.sys

  0x86D31000 \SystemRoot\system32\drivers\ndis.sys

  0x87003000 \SystemRoot\system32\drivers\NETIO.SYS

  0x87041000 \SystemRoot\System32\Drivers\ksecpkg.sys

  0x87066000 \SystemRoot\System32\drivers\tcpip.sys

  0x871AF000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x871E0000 \SystemRoot\system32\DRIVERS\vmstorfl.sys

  0x87233000 \SystemRoot\system32\DRIVERS\volsnap.sys

  0x87272000 \SystemRoot\System32\Drivers\spldr.sys

  0x8727A000 \SystemRoot\System32\drivers\rdyboost.sys

  0x872A7000 \SystemRoot\System32\Drivers\mup.sys

  0x872B7000 \SystemRoot\System32\drivers\hwpolicy.sys

  0x872BF000 \SystemRoot\system32\DRIVERS\gagp30kx.sys

  0x872D0000 \SystemRoot\System32\DRIVERS\fvevol.sys

  0x87302000 \SystemRoot\system32\DRIVERS\disk.sys

  0x87313000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS

  0x8736A000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x87389000 \SystemRoot\System32\Drivers\Null.SYS

  0x87390000 \SystemRoot\System32\Drivers\Beep.SYS

  0x87397000 \SystemRoot\System32\drivers\vga.sys

  0x873A3000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x873C4000 \SystemRoot\System32\drivers\watchdog.sys

  0x873D1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x873D9000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x873E1000 \SystemRoot\system32\drivers\rdprefmp.sys

  0x873E9000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x87200000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8720E000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x87225000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8BC3F000 \SystemRoot\system32\drivers\afd.sys

  0x8BC99000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8BCCB000 \SystemRoot\system32\DRIVERS\wfplwf.sys

  0x8BCD2000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8BCF1000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8BD19000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8BD2C000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8BD3C000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0x8BD42000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8BD83000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8BD8D000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8BD97000 \SystemRoot\System32\drivers\discache.sys

  0x8BE0C000 \SystemRoot\system32\drivers\csc.sys

  0x8BE70000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8BE88000 \SystemRoot\system32\DRIVERS\blbdrive.sys

  0x8BE96000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x8BEB2000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys

  0x8BEB4000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x8AC33000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0x8ADB6000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x8ADBC000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x8BED5000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8ADC7000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8C01F000 \SystemRoot\system32\drivers\cmuda.sys

  0x8C165000 \SystemRoot\system32\drivers\portcls.sys

  0x8C194000 \SystemRoot\system32\drivers\drmk.sys

  0x8C1AD000 \SystemRoot\system32\drivers\ks.sys

  0x8C1E1000 \SystemRoot\system32\DRIVERS\fetnd6.sys

  0x8BF20000 \SystemRoot\System32\Drivers\a1e6jqqg.SYS

  0x8C1EC000 \SystemRoot\system32\DRIVERS\amdk8.sys

  0x8C000000 \SystemRoot\system32\DRIVERS\CompositeBus.sys

  0x8C00D000 \SystemRoot\system32\DRIVERS\ManyCam.sys

  0x8ADD6000 \SystemRoot\system32\DRIVERS\STREAM.SYS

  0x8ADE4000 \SystemRoot\system32\DRIVERS\AgileVpn.sys

  0x8AC00000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8C013000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8BF59000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8AC18000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8BF7B000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8BF92000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x8ADF6000 \SystemRoot\system32\DRIVERS\rdpbus.sys

  0x8BFA9000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x8BFB6000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x8C1FE000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x8BFC3000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8BDA3000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x8BFD1000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x8BFE2000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8BFEF000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x8BE00000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0x8BDE7000 \SystemRoot\System32\Drivers\dump_dumpfve.sys

  0x96300000 \SystemRoot\System32\win32k.sys

  0x8BC00000 \SystemRoot\System32\drivers\Dxapi.sys

  0x96550000 \SystemRoot\System32\drivers\dxg.sys

  0x8BC0A000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x96580000 \SystemRoot\System32\TSDDD.dll

  0x96290000 \SystemRoot\System32\ati2dvag.dll

  0x96590000 \SystemRoot\System32\ati2cqag.dll

  0x96200000 \SystemRoot\System32\atikvmag.dll

  0x88500000 \SystemRoot\System32\ati3duag.dll

  0x888A0000 \SystemRoot\System32\ativvaxx.dll

  0x8BC15000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x8BC20000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x8BC33000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x8AC30000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x8BCFF000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x87338000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0x8BD0A000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0x8734F000 \SystemRoot\system32\drivers\luafv.sys

  0x871E9000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x86FE4000 \SystemRoot\system32\drivers\WudfPf.sys

  0x86DE8000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x86C00000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x97A0C000 \SystemRoot\system32\drivers\HTTP.sys

  0x97A91000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x97AAA000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x97ABC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x97ADF000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x97B1A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x97B4D000 \SystemRoot\system32\drivers\peauth.sys

  0x97BE4000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x86C13000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x97BEE000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9E829000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x9E878000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9E933000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS

  0x9E935000 \??\C:\Users\*****\AppData\Local\Temp\catchme.sys

  0x9E9C0000 \??\C:\Users\*****\AppData\Local\Temp\ugloipog.sys

  0x77D00000 \Windows\System32\ntdll.dll

  0x48260000 \Windows\System32\smss.exe

  0x77F40000 \Windows\System32\apisetschema.dll

  0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll

  0x00B70000 \Windows\System32\autochk.exe

  0x77F10000 \Windows\System32\sechost.dll

  0x77B00000 \Windows\System32\iertutil.dll

  0x77E60000 \Windows\System32\rpcrt4.dll

  0x779C0000 \Windows\System32\urlmon.dll

  0x77930000 \Windows\System32\clbcatq.dll

  0x77E50000 \Windows\System32\nsi.dll

  0x77910000 \Windows\System32\imm32.dll

  0x77840000 \Windows\System32\msctf.dll

  0x777B0000 \Windows\System32\oleaut32.dll

  0x77750000 \Windows\System32\difxapi.dll

  0x76B00000 \Windows\System32\shell32.dll

  0x76A60000 \Windows\System32\advapi32.dll

  0x77E40000 \Windows\System32\lpk.dll

  0x76A10000 \Windows\System32\Wldap32.dll

  0x76A00000 \Windows\System32\psapi.dll

  0x769F0000 \Windows\System32\normaliz.dll

  0x76920000 \Windows\System32\user32.dll

  0x76870000 \Windows\System32\msvcrt.dll

  0x76830000 \Windows\System32\ws2_32.dll

  0x76750000 \Windows\System32\kernel32.dll

  0x76700000 \Windows\System32\gdi32.dll

  0x76680000 \Windows\System32\comdlg32.dll

  0x76650000 \Windows\System32\imagehlp.dll

  0x764F0000 \Windows\System32\ole32.dll

  0x763F0000 \Windows\System32\wininet.dll

  0x76350000 \Windows\System32\usp10.dll

  0x761B0000 \Windows\System32\setupapi.dll

  0x76150000 \Windows\System32\shlwapi.dll

  0x76120000 \Windows\System32\cfgmgr32.dll

  0x760F0000 \Windows\System32\wintrust.dll

  0x76060000 \Windows\System32\comctl32.dll

  0x76040000 \Windows\System32\devobj.dll

  0x75F20000 \Windows\System32\crypt32.dll

  0x75ED0000 \Windows\System32\KernelBase.dll

  0x75EC0000 \Windows\System32\msasn1.dll
 

Processes (total 44):

       0 System Idle Process

       4 System

     264 C:\Windows\System32\smss.exe

     348 csrss.exe

     388 C:\Windows\System32\wininit.exe

     396 csrss.exe

     436 C:\Windows\System32\winlogon.exe

     480 C:\Windows\System32\services.exe

     492 C:\Windows\System32\lsass.exe

     500 C:\Windows\System32\lsm.exe

     600 C:\Windows\System32\svchost.exe

     676 C:\Windows\System32\svchost.exe

     724 C:\Windows\System32\svchost.exe

     804 C:\Windows\System32\svchost.exe

     844 C:\Windows\System32\svchost.exe

    1040 C:\Windows\System32\svchost.exe

    1188 C:\Windows\System32\svchost.exe

    1280 C:\Windows\System32\spoolsv.exe

    1320 C:\Program Files\Avira\AntiVir Desktop\sched.exe

    1340 C:\Windows\System32\svchost.exe

    1440 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

    1464 C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    1488 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    1532 C:\Program Files\Bonjour\mDNSResponder.exe

    1584 C:\Windows\System32\svchost.exe

    1624 C:\Windows\System32\lxczcoms.exe

    1648 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    1720 C:\Windows\System32\IoctlSvc.exe

    1748 C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

    1784 C:\Windows\System32\svchost.exe

    2088 C:\Windows\System32\taskhost.exe

    2200 C:\Windows\System32\dwm.exe

    2408 C:\Windows\System32\rundll32.exe

    2424 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    2600 C:\Windows\System32\SearchIndexer.exe

    2804 C:\Program Files\Windows Media Player\wmpnetwk.exe

    3040 C:\Windows\System32\svchost.exe

    3976 C:\Windows\System32\svchost.exe

    1472 C:\Windows\explorer.exe

     880 C:\Program Files\Mozilla Firefox\firefox.exe

    3688 C:\Windows\System32\audiodg.exe

     672 C:\Users\*****\Desktop\MBRCheck.exe

    3500 C:\Windows\System32\conhost.exe

    3672 C:\Windows\System32\dllhost.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
 

PhysicalDrive0 Model Number: ExcelStorTechnologyJ880, Rev: PF2OA21B
 

      Size  Device Name          MBR Status

  --------------------------------------------

     76 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected

            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
 
 

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Das Programm SUPER AntiSpyware ist bei mir jedes Mal nach dem Starten abgestürzt. Es hat sich immer wieder beim Update-Fenster aufgehangen, deshalb konnte ich den Scan nicht durchführen.
MBAM hat beim Vollscan nichts gefunden, während des Scans kamen jedoch Meldungen von AntiVir, danach habe ich AntiVir ausgeschaltet. Die Meldungen von AntiVir poste ich hier ebenfalls mit.

MBAM:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6240
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

02.04.2011 00:51:07

mbam-log-2011-04-02 (00-51-07).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Durchsuchte Objekte: 255811

Laufzeit: 2 Stunde(n), 24 Minute(n), 50 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

AntiVir Meldungen:

Code:

In der Datei 'C:\lexmark\drivers\1200\Applications\AIOC\LXCZcfg.dll'

wurde ein Virus oder unerwünschtes Programm 'W32/Ramnit.C' [virus] gefunden.

Ausgeführte Aktion: Zugriff verweigern

In der Datei 'C:\lexmark\drivers\1200\Applications\AIOC\LXCZcfg.dll'

wurde ein Virus oder unerwünschtes Programm 'W32/Ramnit.C' [virus] gefunden.

Ausgeführte Aktion: Zugriff verweigern

In der Datei 'C:\lexmark\drivers\1200\drivers\win_xp2k\i386\LXCZcoin.dll'

wurde ein Virus oder unerwünschtes Programm 'W32/Ramnit.C' [virus] gefunden.

Ausgeführte Aktion: Zugriff verweigern

In der Datei 'C:\lexmark\drivers\1200\drivers\win_xp2k\i386\LXCZhcp.dll'

wurde ein Virus oder unerwünschtes Programm 'W32/Ramnit.C' [virus] gefunden.

Ausgeführte Aktion: Zugriff verweigern

AntiVir Guard wurde deaktiviert.

Sind Fehlalarme => Treiber von Lexmark! Hast du was von Lexmark, Drucker/Scanner?

Ja, hatte mal einen Lexmark Drucker, da der aber nicht mehr existiert, hab ich die Treiber & das Programm nun gelöscht.