Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Fakealert-REP Trojan (https://www.trojaner-board.de/99692-fakealert-rep-trojan.html)

HarDsTyLeTyp 29.05.2011 00:26
Fakealert-REP Trojan
 
So ich hab so ziemlich das gleiche Problem, wie ein anderer hier im Forum:
http://www.trojaner-board.de/99261-f...ep-trojan.html
Leider brauch ich nochmal jemanden, der mich an die Hand nimmt und die ganzen schritte durch geht, weil ich mal so ziemlich keine ahnung hab was ich nun alles machen kann oder sollte.

Stinger ist ebenfalls das einzige Programm was mir den "fake alert trojan" anzeigt.
C:\Windows\System32\Macromed\Flash\uninstall_activeX.exe
Found the FakeAlert!fakealert-REP trojan !!!
C:\Windows\System32\Macromed\Flash\uninstall_activeX.exe is infected with the FakeAlert!fakealert-REP virus !!!
C:\Windows\System32\Macromed\Flash\uninstall_activeX.exe could not be repaired.

Als Haupt AntiViren Programm benutze ich Kaspersky Internet Security 11 in der version 11.0.2.556 der findet es leider nicht.

Mit Spybot Search & Destroy, hab ich ebenfalls keine Chance den zu finden.

Was ist aus dem oben genannten forums abschnitt verstanden hab ist Malwarebytes hab ich auch gleich mal durchgeführt.

Log:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6705

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

29.05.2011 01:04:14
mbam-log-2011-05-29 (01-04-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 359675
Laufzeit: 1 Stunde(n), 1 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files\ocrana-irc\ocrana-irc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.


SuperAntiSpyware werd ich gleich mal durchlaufen lassen.


Freu mich jetzt schon auf eine Antwort ;)

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/29/2011 at 03:07 AM

Application Version : 4.53.1000

Core Rules Database Version : 7161
Trace Rules Database Version: 4973

Scan type : Complete Scan
Total Scan Time : 01:34:22

Memory items scanned : 471
Memory threats detected : 0
Registry items scanned : 12554
Registry threats detected : 0
File items scanned : 223964
File threats detected : 46

Adware.Tracking Cookie
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@serving-sys[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@adfarm1.adition[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@bs.serving-sys[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@adserver.traffictrack[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@tracking.quisma[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@adbrite[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@stats.paypal[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@ar.atwola[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@adultfriendfinder[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@yadro[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@adtech[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@atwola[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@imrworldwide[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@ad2.adfarm1.adition[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@atdmt[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@content.yieldmanager[3].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@content.yieldmanager[2].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@adcentriconline[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@tracking.hannoversche[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@paypal.112.2o7[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@hlstatsx[1].txt
C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows\Cookies\hardstyle@weborama[2].txt
cdn-www.pornhub.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
cdn5.specificclick.net [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
ds.serving-sys.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
ia.media-imdb.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
imagesrv.adition.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
media.goodgamestudios.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
media.scanscout.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
media1.break.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
naiadsystems.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
objects.tremormedia.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
pornme.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
pornoprinzen.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
secure-us.imrworldwide.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
static.eporner.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
static.xxxmatch.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
tracker.sextorrents.ru [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
vidii.hardsextube.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.adservercentral.info [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.asianpornlovers.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.euros4click.de [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.pornhub.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.pornme.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.pornoprinzen.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]
www.sexkiste.com [ C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FH6LE9KV ]

cosinus 29.05.2011 15:17
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

HarDsTyLeTyp 29.05.2011 15:25
Nee... ist der einzige den er gemacht hat

cosinus 29.05.2011 15:29
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

HarDsTyLeTyp 29.05.2011 16:04
OTL Logfile:
Code:
OTL logfile created on: 29.05.2011 16:51:29 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = C:\Users\HarDsTyLe\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,33 Gb Available Physical Memory | 79,21% Memory free
16,04 Gb Paging File | 14,49 Gb Available in Paging File | 90,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 172,79 Gb Total Space | 35,08 Gb Free Space | 20,30% Space Free | Partition Type: NTFS
Drive D: | 292,97 Gb Total Space | 292,87 Gb Free Space | 99,97% Space Free | Partition Type: NTFS
Drive E: | 7,05 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: HARDSTYLE-PC | User Name: HarDsTyLe | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.05.29 16:49:12 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\HarDsTyLe\Downloads\OTL.exe
PRC - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.04.07 21:54:52 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.03.28 16:47:30 | 000,246,520 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.09.06 13:38:06 | 000,071,096 | ---- | M] () -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.05.29 16:49:12 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\HarDsTyLe\Downloads\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.05.04 19:55:09 | 000,128,384 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2010.01.15 21:55:42 | 000,842,056 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc)
SRV:64bit: - [2010.01.15 21:55:35 | 000,506,696 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Windows\SysNative\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV:64bit: - [2009.11.16 13:25:48 | 000,035,144 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.05.18 17:57:11 | 003,275,864 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai\netsession_win_8832f4b.dll -- (Akamai)
SRV - [2011.05.13 20:00:39 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.04.07 21:54:52 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.11.02 22:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto | Stopped] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010.06.06 18:32:00 | 003,819,912 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWow64\GameMon.des -- (npggsvc)
SRV - [2010.03.28 16:47:30 | 000,246,520 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.11.16 13:25:48 | 000,029,000 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.09.06 13:38:06 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2009.03.30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.05.13 20:59:18 | 000,556,120 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\DRIVERS\klif.sys -- (KLIF)
DRV:64bit: - [2011.02.22 14:21:54 | 000,404,584 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2010.10.29 18:13:18 | 000,121,432 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\jraid.sys -- (JRAID)
DRV:64bit: - [2010.06.09 16:44:00 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\kl2.sys -- (kl2)
DRV:64bit: - [2010.06.09 16:43:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\kl1.sys -- (KL1)
DRV:64bit: - [2010.04.22 18:07:36 | 000,027,736 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\klim6.sys -- (KLIM6)
DRV:64bit: - [2009.11.02 19:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009.10.01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009.04.09 13:38:26 | 000,167,424 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ZTEusbnet.sys -- (ZTEusbnet)
DRV:64bit: - [2009.04.09 13:38:26 | 000,150,784 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ZTEusbvoice.sys -- (ZTEusbvoice)
DRV:64bit: - [2009.04.09 13:38:26 | 000,150,784 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009.04.09 13:38:26 | 000,150,656 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009.04.09 13:38:26 | 000,150,656 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009.04.09 13:38:26 | 000,011,776 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\massfilter.sys -- (massfilter)
DRV:64bit: - [2006.09.18 23:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\Wbem\ntfs.mof -- (Ntfs)
DRV - [2010.02.17 20:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2010.02.17 20:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
DRV - [2005.01.04 02:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.13 20:09:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.05.29 12:43:30 | 000,000,000 | ---D | M]
 
[2009.10.05 21:34:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Extensions
[2011.05.13 20:58:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Firefox\Profiles\mjtvjdk2.default\extensions
[2009.10.16 14:19:50 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Firefox\Profiles\mjtvjdk2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.05.13 20:57:56 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Firefox\Profiles\mjtvjdk2.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.05.13 20:58:13 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Firefox\Profiles\mjtvjdk2.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.05.13 20:58:14 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Firefox\Profiles\mjtvjdk2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011.05.13 20:57:52 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\HarDsTyLe\AppData\Roaming\mozilla\Firefox\Profiles\mjtvjdk2.default\extensions\engine@conduit.com
[2011.05.28 01:26:53 | 000,000,950 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin-1.xml
[2010.07.25 13:12:47 | 000,000,950 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin-2.xml
[2010.09.11 13:11:04 | 000,000,950 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin-3.xml
[2010.09.17 03:59:55 | 000,000,950 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin-4.xml
[2011.05.13 20:11:36 | 000,000,950 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin-5.xml
[2011.03.14 18:08:40 | 000,000,168 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin.gif
[2011.03.14 18:08:40 | 000,000,618 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin.src
[2010.07.23 13:50:02 | 000,001,056 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\searchplugins\icqplugin.xml
[2011.05.14 11:27:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.05.13 20:09:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.05.08 16:59:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.05 16:03:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.05.13 21:08:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.05.14 11:27:40 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files (x86)\mozilla firefox\extensions\KavAntiBanner@Kaspersky.ru
[2011.05.14 11:27:37 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files (x86)\mozilla firefox\extensions\linkfilter@kaspersky.ru
File not found (No name found) --
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [TaskTray]  File not found
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [Steam] c:\program files (x86)\valve\steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll (Kaspersky Lab ZAO)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll (Kaspersky Lab ZAO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.05.25 06:16:57 | 000,000,046 | -H-- | M] () - E:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Installer.exe -- [2010.05.25 06:16:57 | 002,505,256 | ---- | M] ()
O33 - MountPoints2\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\Shell - "" = AutoRun
O33 - MountPoints2\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{854c0de4-4991-11df-b2df-00a0c6000000}\Shell - "" = AutoRun
O33 - MountPoints2\{854c0de4-4991-11df-b2df-00a0c6000000}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\Shell - "" = AutoRun
O33 - MountPoints2\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
 
 
SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: WudfPf - Driver
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\SysWow64\lhacm.acm (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.29 16:40:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2011.05.29 16:38:02 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2011.05.29 16:37:15 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011.05.29 16:37:15 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011.05.29 16:35:08 | 000,404,584 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rtlh64.sys
[2011.05.29 16:32:46 | 000,000,000 | ---D | C] -- C:\RaidTool
[2011.05.29 16:32:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JMicron Technology Corp
[2011.05.29 16:31:51 | 000,000,000 | ---D | C] -- C:\Windows\RaidTool
[2011.05.29 16:31:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2011.05.29 16:22:07 | 000,000,000 | ---D | C] -- C:\Users\HarDsTyLe\Documents\DriverGenius
[2011.05.29 16:21:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Driver-Soft
[2011.05.29 16:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius Professional Edition
[2011.05.29 12:42:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2011.05.29 12:42:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.05.29 01:29:09 | 000,000,000 | ---D | C] -- C:\Users\HarDsTyLe\AppData\Roaming\SUPERAntiSpyware.com
[2011.05.29 01:29:09 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011.05.29 01:29:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011.05.29 01:29:03 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2011.05.29 01:29:01 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2011.05.28 23:56:18 | 000,000,000 | ---D | C] -- C:\Users\HarDsTyLe\AppData\Roaming\Malwarebytes
[2011.05.28 23:56:01 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.05.28 23:56:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.28 23:56:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.28 23:55:55 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.05.28 23:55:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.05.22 17:42:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.05.22 17:42:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.05.22 17:42:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.05.14 19:36:55 | 000,000,000 | ---D | C] -- C:\Riot Games
[2011.05.14 19:36:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011.05.14 18:17:43 | 000,000,000 | ---D | C] -- C:\Users\HarDsTyLe\AppData\Local\PMB Files
[2011.05.14 18:17:40 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011.05.14 18:17:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks
[2011.05.14 11:25:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\WindowsPowerShell
[2011.05.14 11:25:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\WindowsPowerShell
[2011.05.14 03:29:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
[2011.05.13 23:04:48 | 000,000,000 | ---D | C] -- C:\Users\HarDsTyLe\AppData\Roaming\DarksporeData
[2011.05.13 23:04:48 | 000,000,000 | ---D | C] -- C:\Users\HarDsTyLe\Documents\Darkspore
[2011.05.13 22:42:29 | 000,000,000 | ---D | C] -- C:\ProgramData\WeGame
[2011.05.13 21:08:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.05.13 21:02:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2011
[2011.05.13 20:59:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
[2011.05.13 20:59:18 | 000,556,120 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2011.05.13 20:00:08 | 000,179,616 | ---- | C] (<Turtle Entertainment>) -- C:\Windows\SysNative\drivers\ESLWireACD.sys
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.29 16:50:17 | 001,445,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.05.29 16:50:17 | 000,628,504 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.05.29 16:50:17 | 000,595,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.05.29 16:50:17 | 000,126,248 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.05.29 16:50:17 | 000,103,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.05.29 16:44:12 | 000,000,534 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2011.05.29 16:43:50 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.29 16:43:50 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.29 16:43:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.29 16:31:05 | 000,234,676 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.05.29 16:31:05 | 000,234,676 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.05.29 16:21:07 | 000,001,042 | ---- | M] () -- C:\Users\HarDsTyLe\Desktop\Driver Genius Professional Edition.lnk
[2011.05.29 12:43:30 | 000,001,917 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011.05.29 01:29:03 | 000,001,756 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.05.29 01:06:32 | 000,000,680 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Local\d3d9caps.dat
[2011.05.28 23:56:02 | 000,000,948 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.27 13:28:39 | 000,152,233 | ---- | M] () -- C:\Windows\SysNative\drivers\klin.dat
[2011.05.22 17:42:43 | 000,001,097 | ---- | M] () -- C:\Users\HarDsTyLe\Desktop\Spybot - Search & Destroy.lnk
[2011.05.14 19:41:59 | 000,001,670 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011.05.14 11:27:05 | 000,238,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.05.13 21:23:21 | 000,107,075 | ---- | M] () -- C:\Windows\SysNative\drivers\klick.dat
[2011.05.13 20:59:18 | 000,556,120 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2011.05.13 20:10:22 | 000,000,888 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.29 16:35:08 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll
[2011.05.29 16:21:07 | 000,001,042 | ---- | C] () -- C:\Users\HarDsTyLe\Desktop\Driver Genius Professional Edition.lnk
[2011.05.29 12:42:32 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011.05.29 12:42:32 | 000,001,917 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011.05.29 01:29:03 | 000,001,756 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.05.28 23:56:02 | 000,000,948 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.22 17:42:43 | 000,001,097 | ---- | C] () -- C:\Users\HarDsTyLe\Desktop\Spybot - Search & Destroy.lnk
[2011.05.14 19:41:59 | 000,001,670 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011.05.14 03:29:06 | 000,001,241 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
[2011.05.14 03:15:25 | 000,201,184 | ---- | C] () -- C:\Windows\SysWow64\winrm.vbs
[2011.05.14 03:15:25 | 000,201,184 | ---- | C] () -- C:\Windows\SysNative\winrm.vbs
[2011.05.14 03:15:25 | 000,004,675 | ---- | C] () -- C:\Windows\SysWow64\wsmanconfig_schema.xml
[2011.05.14 03:15:25 | 000,004,675 | ---- | C] () -- C:\Windows\SysNative\wsmanconfig_schema.xml
[2011.05.14 03:15:25 | 000,002,426 | ---- | C] () -- C:\Windows\SysWow64\WsmTxt.xsl
[2011.05.14 03:15:25 | 000,002,426 | ---- | C] () -- C:\Windows\SysNative\WsmTxt.xsl
[2011.05.13 21:01:18 | 000,152,233 | ---- | C] () -- C:\Windows\SysNative\drivers\klin.dat
[2011.05.13 21:01:18 | 000,107,075 | ---- | C] () -- C:\Windows\SysNative\drivers\klick.dat
[2011.05.13 20:10:22 | 000,000,900 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.05.13 20:10:22 | 000,000,888 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.01 16:12:58 | 000,071,372 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.07.09 11:52:07 | 000,000,007 | ---- | C] () -- C:\Windows\treeskp.sys
[2010.07.09 11:52:07 | 000,000,007 | ---- | C] () -- C:\Windows\sbacknt.bin
[2010.06.11 22:36:43 | 000,000,164 | ---- | C] () -- C:\ProgramData\{701ACAF9-F102-47c2-8907-36246F4DFB51}
[2010.05.08 17:00:35 | 000,000,680 | ---- | C] () -- C:\Users\HarDsTyLe\AppData\Local\d3d9caps.dat
[2010.02.24 22:06:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.12.01 06:04:09 | 000,007,168 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2009.11.21 03:54:20 | 000,000,066 | ---- | C] () -- C:\Windows\Star Divx Converter.INI
[2009.10.20 09:48:19 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.10.20 09:48:05 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009.10.20 09:47:53 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.10.19 16:14:10 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009.10.06 03:38:31 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2009.10.06 01:07:59 | 000,139,776 | ---- | C] () -- C:\Users\HarDsTyLe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.05 21:46:11 | 000,234,676 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.10.05 21:46:11 | 000,234,676 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.10.05 20:20:27 | 000,000,732 | ---- | C] () -- C:\Users\HarDsTyLe\AppData\Local\d3d9caps64.dat
[2008.01.21 04:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2006.11.02 17:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006.11.02 14:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006.11.02 14:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006.11.02 11:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
 
========== LOP Check ==========
 
[2010.09.17 04:19:26 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Azureus
[2009.10.05 21:09:04 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Blitware
[2010.03.12 22:25:41 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Canneverbe Limited
[2009.12.01 06:04:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Canneverbe_Limited
[2011.05.18 18:22:05 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\DarksporeData
[2010.06.11 22:35:11 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Degener
[2011.05.20 17:57:29 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\ICQ
[2010.05.12 22:11:26 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\LolClient
[2010.03.21 01:11:32 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2009.11.08 05:36:21 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Publish Providers
[2010.01.30 01:07:00 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\shockvoice
[2009.11.08 05:36:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Sony
[2010.05.21 17:17:31 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\TeamViewer
[2011.05.19 17:06:56 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\TS3Client
[2009.10.05 22:01:27 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\TuneUp Software
[2010.07.10 21:19:40 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\vghd
[2010.04.17 21:31:50 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Vodafone
[2011.05.29 16:44:12 | 000,000,534 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2011.05.29 16:42:41 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.03.21 00:52:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Adobe
[2010.09.17 04:19:26 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Azureus
[2009.10.05 21:09:04 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Blitware
[2010.03.12 22:25:41 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Canneverbe Limited
[2009.12.01 06:04:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Canneverbe_Limited
[2011.05.18 18:22:05 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\DarksporeData
[2010.06.11 22:35:11 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Degener
[2009.12.18 15:14:17 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\DivX
[2009.10.11 16:16:01 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\dvdcss
[2010.04.18 17:21:12 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\FLEXnet
[2011.05.20 17:57:29 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\ICQ
[2009.10.05 20:20:35 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Identities
[2010.05.12 22:11:26 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\LolClient
[2010.03.21 01:11:32 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2009.10.05 22:09:43 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Macromedia
[2011.05.28 23:56:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Malwarebytes
[2006.11.02 17:07:25 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Media Center Programs
[2010.05.08 15:47:47 | 000,000,000 | --SD | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Microsoft
[2010.05.29 19:44:49 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\mIRC
[2009.10.05 21:34:16 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Mozilla
[2010.04.23 22:46:05 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\NVIDIA
[2009.11.08 05:36:21 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Publish Providers
[2010.04.02 12:08:01 | 000,000,000 | RH-D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\SecuROM
[2010.01.30 01:07:00 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\shockvoice
[2010.04.16 16:41:40 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\skypePM
[2009.11.08 05:36:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Sony
[2011.05.29 01:29:09 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\SUPERAntiSpyware.com
[2010.02.21 01:07:21 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\teamspeak2
[2010.05.21 17:17:31 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\TeamViewer
[2011.05.19 17:06:56 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\TS3Client
[2009.10.05 22:01:27 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\TuneUp Software
[2009.10.19 16:25:12 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Ventrilo
[2010.07.10 21:19:40 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\vghd
[2010.09.17 02:54:18 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\vlc
[2010.04.17 21:31:50 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\Vodafone
[2009.10.07 06:59:20 | 000,000,000 | ---D | M] -- C:\Users\HarDsTyLe\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.08.27 21:27:40 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Users\HarDsTyLe\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe
[2009.10.11 02:50:45 | 004,619,584 | ---- | M] (Blitware Technology Inc.                                    ) -- C:\Users\HarDsTyLe\AppData\Roaming\Blitware\DriverRobot\updates\c3dc224ad5c16233c710cbe308141999\DriverRobot_Setup.exe
[2010.03.21 00:52:59 | 000,038,784 | ---- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.02.06 16:02:13 | 000,029,926 | R--- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_18be6784.exe
[2010.02.06 16:02:13 | 000,029,422 | R--- | M] () -- C:\Users\HarDsTyLe\AppData\Roaming\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe
[2010.01.29 22:29:49 | 005,889,595 | ---- | M] (Shockvoice GbR                                              ) -- C:\Users\HarDsTyLe\AppData\Roaming\shockvoice\updates\svclient-setup.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\SysNative\drivers\AGP440.sys
[2008.01.21 04:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008.01.21 04:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.01.21 04:46:50 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009.04.11 09:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- C:\Windows\SysNative\drivers\atapi.sys
[2009.04.11 09:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 13:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\SysNative\cngaudit.dll
[2006.11.02 13:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2008.01.21 04:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.01.21 04:51:03 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SysWOW64\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009.04.11 09:11:16 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- C:\Windows\SysNative\netlogon.dll
[2009.04.11 09:11:16 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008.01.21 04:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2008.01.21 04:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\SysNative\drivers\nvstor.sys
[2008.01.21 04:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008.01.21 04:49:49 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SysWOW64\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009.04.11 09:11:23 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- C:\Windows\SysNative\scecli.dll
[2009.04.11 09:11:23 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
[2008.01.21 04:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll
[2009.04.11 08:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\SysWOW64\user32.dll
[2009.04.11 08:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_35972b23573c7daf\user32.dll
[2009.04.11 09:11:27 | 000,820,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysNative\user32.dll
[2009.04.11 09:11:27 | 000,820,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_2b4280d122dbbbb4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 04:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008.01.21 04:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\SysNative\userinit.exe
[2008.01.21 04:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:48:04 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\SysWOW64\wininit.exe
[2008.01.21 04:48:04 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2008.01.21 04:50:23 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\SysNative\wininit.exe
[2008.01.21 04:50:23 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_8d115452bcae17d8\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 09:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\SysNative\winlogon.exe
[2009.04.11 09:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008.01.21 04:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2008.01.21 04:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
--- --- ---

HarDsTyLeTyp 29.05.2011 16:06
ich frag mich echt wie ihr daraus was lesen könnt ^^

cosinus 29.05.2011 16:12
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.05.25 06:16:57 | 000,000,046 | -H-- | M] () - E:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Installer.exe -- [2010.05.25 06:16:57 | 002,505,256 | ---- | M] ()
O33 - MountPoints2\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\Shell - "" = AutoRun
O33 - MountPoints2\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{854c0de4-4991-11df-b2df-00a0c6000000}\Shell - "" = AutoRun
O33 - MountPoints2\{854c0de4-4991-11df-b2df-00a0c6000000}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\Shell - "" = AutoRun
O33 - MountPoints2\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

HarDsTyLeTyp 29.05.2011 16:53
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. E:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b39db24-b1da-11de-a0ec-806e6f6e6963}\ not found.
File move failed. E:\Installer.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{854c0ddf-4991-11df-b2df-001fd0ae6ffa}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{854c0de4-4991-11df-b2df-00a0c6000000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{854c0de4-4991-11df-b2df-00a0c6000000}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{854c0de4-4991-11df-b2df-00a0c6000000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{854c0de4-4991-11df-b2df-00a0c6000000}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8e83659-e272-11de-b4ec-001fd0ae6ffa}\ not found.
File G:\LaunchU3.exe -a not found.
========== COMMANDS ==========
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.23.0 log created on 05292011_175027

Files\Folders moved on Reboot...
File move failed. E:\autorun.inf scheduled to be moved on reboot.
File move failed. E:\Installer.exe scheduled to be moved on reboot.
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 29.05.2011 17:25
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

HarDsTyLeTyp 29.05.2011 17:52
2011/05/29 18:49:59.0077 5896 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
2011/05/29 18:49:59.0288 5896 ================================================================================
2011/05/29 18:49:59.0288 5896 SystemInfo:
2011/05/29 18:49:59.0288 5896
2011/05/29 18:49:59.0288 5896 OS Version: 6.0.6002 ServicePack: 2.0
2011/05/29 18:49:59.0288 5896 Product type: Workstation
2011/05/29 18:49:59.0288 5896 ComputerName: HARDSTYLE-PC
2011/05/29 18:49:59.0288 5896 UserName: HarDsTyLe
2011/05/29 18:49:59.0288 5896 Windows directory: C:\Windows
2011/05/29 18:49:59.0288 5896 System windows directory: C:\Windows
2011/05/29 18:49:59.0288 5896 Running under WOW64
2011/05/29 18:49:59.0288 5896 Processor architecture: Intel x64
2011/05/29 18:49:59.0288 5896 Number of processors: 8
2011/05/29 18:49:59.0288 5896 Page size: 0x1000
2011/05/29 18:49:59.0288 5896 Boot type: Normal boot
2011/05/29 18:49:59.0288 5896 ================================================================================
2011/05/29 18:50:00.0277 5896 Initialize success
2011/05/29 18:50:01.0458 3820 ================================================================================
2011/05/29 18:50:01.0458 3820 Scan started
2011/05/29 18:50:01.0458 3820 Mode: Manual;
2011/05/29 18:50:01.0458 3820 ================================================================================
2011/05/29 18:50:02.0665 3820 ACPI (1965aaffab07e3fb03c77f81beba3547) C:\Windows\system32\drivers\acpi.sys
2011/05/29 18:50:02.0711 3820 adp94xx (f14215e37cf124104575073f782111d2) C:\Windows\system32\drivers\adp94xx.sys
2011/05/29 18:50:02.0737 3820 adpahci (7d05a75e3066861a6610f7ee04ff085c) C:\Windows\system32\drivers\adpahci.sys
2011/05/29 18:50:02.0754 3820 adpu160m (820a201fe08a0c345b3bedbc30e1a77c) C:\Windows\system32\drivers\adpu160m.sys
2011/05/29 18:50:02.0795 3820 adpu320 (9b4ab6854559dc168fbb4c24fc52e794) C:\Windows\system32\drivers\adpu320.sys
2011/05/29 18:50:02.0869 3820 AFD (12415ccfd3e7cec55b5184e67b039fe4) C:\Windows\system32\drivers\afd.sys
2011/05/29 18:50:02.0900 3820 agp440 (f6f6793b7f17b550ecfdbd3b229173f7) C:\Windows\system32\drivers\agp440.sys
2011/05/29 18:50:02.0922 3820 aic78xx (222cb641b4b8a1d1126f8033f9fd6a00) C:\Windows\system32\drivers\djsvs.sys
2011/05/29 18:50:02.0968 3820 aliide (157d0898d4b73f075ce9fa26b482df98) C:\Windows\system32\drivers\aliide.sys
2011/05/29 18:50:02.0976 3820 amdide (970fa5059e61e30d25307b99903e991e) C:\Windows\system32\drivers\amdide.sys
2011/05/29 18:50:03.0002 3820 AmdK8 (cdc3632a3a5ea4dbb83e46076a3165a1) C:\Windows\system32\drivers\amdk8.sys
2011/05/29 18:50:03.0032 3820 arc (ba8417d4765f3988ff921f30f630e303) C:\Windows\system32\drivers\arc.sys
2011/05/29 18:50:03.0046 3820 arcsas (9d41c435619733b34cc16a511e644b11) C:\Windows\system32\drivers\arcsas.sys
2011/05/29 18:50:03.0081 3820 AsyncMac (22d13ff3dafec2a80634752b1eaa2de6) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/05/29 18:50:03.0108 3820 atapi (e68d9b3a3905619732f7fe039466a623) C:\Windows\system32\drivers\atapi.sys
2011/05/29 18:50:03.0153 3820 blbdrive (79feeb40056683f8f61398d81dda65d2) C:\Windows\system32\drivers\blbdrive.sys
2011/05/29 18:50:03.0184 3820 bowser (2348447a80920b2493a9b582a23e81e1) C:\Windows\system32\DRIVERS\bowser.sys
2011/05/29 18:50:03.0210 3820 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\brfiltlo.sys
2011/05/29 18:50:03.0225 3820 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\brfiltup.sys
2011/05/29 18:50:03.0246 3820 Brserid (f0f0ba4d815be446aa6a4583ca3bca9b) C:\Windows\system32\drivers\brserid.sys
2011/05/29 18:50:03.0264 3820 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\system32\drivers\brserwdm.sys
2011/05/29 18:50:03.0277 3820 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\system32\drivers\brusbmdm.sys
2011/05/29 18:50:03.0379 3820 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\system32\drivers\brusbser.sys
2011/05/29 18:50:03.0407 3820 BTHMODEM (e0777b34e05f8a82a21856efc900c29f) C:\Windows\system32\drivers\bthmodem.sys
2011/05/29 18:50:03.0439 3820 cdfs (b4d787db8d30793a4d4df9feed18f136) C:\Windows\system32\DRIVERS\cdfs.sys
2011/05/29 18:50:03.0466 3820 cdrom (c025aa69be3d0d25c7a2e746ef6f94fc) C:\Windows\system32\DRIVERS\cdrom.sys
2011/05/29 18:50:03.0508 3820 circlass (02ea568d498bbdd4ba55bf3fce34d456) C:\Windows\system32\drivers\circlass.sys
2011/05/29 18:50:03.0535 3820 CLFS (3dca9a18b204939cfb24bea53e31eb48) C:\Windows\system32\CLFS.sys
2011/05/29 18:50:03.0581 3820 cmdide (e5d5499a1c50a54b5161296b6afe6192) C:\Windows\system32\drivers\cmdide.sys
2011/05/29 18:50:03.0592 3820 Compbatt (7fb8ad01db0eabe60c8a861531a8f431) C:\Windows\system32\drivers\compbatt.sys
2011/05/29 18:50:03.0616 3820 crcdisk (a8585b6412253803ce8efcbd6d6dc15c) C:\Windows\system32\drivers\crcdisk.sys
2011/05/29 18:50:03.0683 3820 DfsC (36cd31121f228e7e79bae60aa45764c6) C:\Windows\system32\Drivers\dfsc.sys
2011/05/29 18:50:03.0733 3820 disk (b0107e40ecdb5fa692ebf832f295d905) C:\Windows\system32\drivers\disk.sys
2011/05/29 18:50:03.0777 3820 drmkaud (f1a78a98cfc2ee02144c6bec945447e6) C:\Windows\system32\drivers\drmkaud.sys
2011/05/29 18:50:04.0180 3820 DXGKrnl (b8e554e502d5123bc111f99d6a2181b4) C:\Windows\System32\drivers\dxgkrnl.sys
2011/05/29 18:50:04.0347 3820 E1G60 (264cee7b031a9d6c827f3d0cb031f2fe) C:\Windows\system32\DRIVERS\E1G6032E.sys
2011/05/29 18:50:04.0396 3820 Ecache (5f94962be5a62db6e447ff6470c4f48a) C:\Windows\system32\drivers\ecache.sys
2011/05/29 18:50:04.0554 3820 elxstor (c4636d6e10469404ab5308d9fd45ed07) C:\Windows\system32\drivers\elxstor.sys
2011/05/29 18:50:04.0589 3820 ErrDev (bc3a58e938bb277e46bf4b3003b01abd) C:\Windows\system32\drivers\errdev.sys
2011/05/29 18:50:04.0647 3820 exfat (486844f47b6636044a42454614ed4523) C:\Windows\system32\drivers\exfat.sys
2011/05/29 18:50:04.0706 3820 fastfat (1a4bee34277784619ddaf0422c0c6e23) C:\Windows\system32\drivers\fastfat.sys
2011/05/29 18:50:04.0729 3820 fdc (81b79b6df71fa1d2c6d688d830616e39) C:\Windows\system32\DRIVERS\fdc.sys
2011/05/29 18:50:04.0770 3820 FileInfo (457b7d1d533e4bd62a99aed9c7bb4c59) C:\Windows\system32\drivers\fileinfo.sys
2011/05/29 18:50:04.0792 3820 Filetrace (d421327fd6efccaf884a54c58e1b0d7f) C:\Windows\system32\drivers\filetrace.sys
2011/05/29 18:50:04.0815 3820 flpydisk (230923ea2b80f79b0f88d90f87b87ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/05/29 18:50:04.0981 3820 FltMgr (e3041bc26d6930d61f42aedb79c91720) C:\Windows\system32\drivers\fltmgr.sys
2011/05/29 18:50:05.0035 3820 Fs_Rec (29d99e860a1ca0a03c6a733fdd0da703) C:\Windows\system32\drivers\Fs_Rec.sys
2011/05/29 18:50:05.0149 3820 gagp30kx (c8e416668d3dc2be3d4fe4c79224997f) C:\Windows\system32\drivers\gagp30kx.sys
2011/05/29 18:50:05.0205 3820 HdAudAddService (68e732382b32417ff61fd663259b4b09) C:\Windows\system32\drivers\HdAudio.sys
2011/05/29 18:50:05.0330 3820 HDAudBus (f942c5820205f2fb453243edfec82a3d) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/05/29 18:50:05.0356 3820 HidBth (b4881c84a180e75b8c25dc1d726c375f) C:\Windows\system32\drivers\hidbth.sys
2011/05/29 18:50:05.0484 3820 HidIr (4e77a77e2c986e8f88f996bb3e1ad829) C:\Windows\system32\drivers\hidir.sys
2011/05/29 18:50:05.0538 3820 HidUsb (443bdd2d30bb4f00795c797e2cf99edf) C:\Windows\system32\DRIVERS\hidusb.sys
2011/05/29 18:50:05.0578 3820 HpCISSs (d7109a1e6bd2dfdbcba72a6bc626a13b) C:\Windows\system32\drivers\hpcisss.sys
2011/05/29 18:50:05.0748 3820 HTTP (098f1e4e5c9cb5b0063a959063631610) C:\Windows\system32\drivers\HTTP.sys
2011/05/29 18:50:05.0852 3820 i2omp (da94c854cea5fac549d4e1f6e88349e8) C:\Windows\system32\drivers\i2omp.sys
2011/05/29 18:50:05.0972 3820 i8042prt (cbb597659a2713ce0c9cc20c88c7591f) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/05/29 18:50:05.0992 3820 iaStorV (3e3bf3627d886736d0b4e90054f929f6) C:\Windows\system32\drivers\iastorv.sys
2011/05/29 18:50:06.0031 3820 iirsp (8c3951ad2fe886ef76c7b5027c3125d3) C:\Windows\system32\drivers\iirsp.sys
2011/05/29 18:50:06.0068 3820 intelide (df797a12176f11b2d301c5b234bb200e) C:\Windows\system32\drivers\intelide.sys
2011/05/29 18:50:06.0089 3820 intelppm (bfd84af32fa1bad6231c4585cb469630) C:\Windows\system32\DRIVERS\intelppm.sys
2011/05/29 18:50:06.0124 3820 IpFilterDriver (d8aabc341311e4780d6fce8c73c0ad81) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/05/29 18:50:06.0172 3820 IPMIDRV (9c2ee2e6e5a7203bfae15c299475ec67) C:\Windows\system32\drivers\ipmidrv.sys
2011/05/29 18:50:06.0202 3820 IPNAT (b7e6212f581ea5f6ab0c3a6ceeeb89be) C:\Windows\system32\DRIVERS\ipnat.sys
2011/05/29 18:50:06.0219 3820 IRENUM (8c42ca155343a2f11d29feca67faa88d) C:\Windows\system32\drivers\irenum.sys
2011/05/29 18:50:06.0237 3820 isapnp (0672bfcedc6fc468a2b0500d81437f4f) C:\Windows\system32\drivers\isapnp.sys
2011/05/29 18:50:06.0263 3820 iScsiPrt (e4fdf99599f27ec25d2cf6d754243520) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/05/29 18:50:06.0286 3820 iteatapi (63c766cdc609ff8206cb447a65abba4a) C:\Windows\system32\drivers\iteatapi.sys
2011/05/29 18:50:06.0317 3820 iteraid (1281fe73b17664631d12f643cbea3f59) C:\Windows\system32\drivers\iteraid.sys
2011/05/29 18:50:06.0360 3820 JRAID (e86d4e8663efebd7c4e2a43f80cb1339) C:\Windows\system32\DRIVERS\jraid.sys
2011/05/29 18:50:06.0381 3820 kbdclass (423696f3ba6472dd17699209b933bc26) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/05/29 18:50:06.0398 3820 kbdhid (dbdf75d51464fbc47d0104ec3d572c05) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/05/29 18:50:06.0453 3820 KL1 (8d7120743a0973ceab548b475c9d4289) C:\Windows\system32\DRIVERS\kl1.sys
2011/05/29 18:50:06.0491 3820 kl2 (cd146d8e525d6eebdcaf24120a8ab9ce) C:\Windows\system32\DRIVERS\kl2.sys
2011/05/29 18:50:06.0550 3820 KLIF (c1786c2f8de0f62e076f7ef8dea4e87a) C:\Windows\system32\DRIVERS\klif.sys
2011/05/29 18:50:06.0571 3820 KLIM6 (2a64b3a9eed93a2e96537b67c079fc96) C:\Windows\system32\DRIVERS\klim6.sys
2011/05/29 18:50:06.0581 3820 klmouflt (9468d07e91ba136d82415f5dfc1fe168) C:\Windows\system32\DRIVERS\klmouflt.sys
2011/05/29 18:50:06.0602 3820 KSecDD (476e2c1dcea45895994bef11c2a98715) C:\Windows\system32\Drivers\ksecdd.sys
2011/05/29 18:50:06.0622 3820 ksthunk (1d419cf43db29396ecd7113d129d94eb) C:\Windows\system32\drivers\ksthunk.sys
2011/05/29 18:50:06.0659 3820 LGBusEnum (fa529fb35694c24bf98a9ef67c1cd9d0) C:\Windows\system32\drivers\LGBusEnum.sys
2011/05/29 18:50:06.0707 3820 LGVirHid (94b29ce153765e768f004fb3440be2b0) C:\Windows\system32\drivers\LGVirHid.sys
2011/05/29 18:50:06.0726 3820 lltdio (96ece2659b6654c10a0c310ae3a6d02c) C:\Windows\system32\DRIVERS\lltdio.sys
2011/05/29 18:50:06.0841 3820 LSI_FC (acbe1af32d3123e330a07bfbc5ec4a9b) C:\Windows\system32\drivers\lsi_fc.sys
2011/05/29 18:50:06.0972 3820 LSI_SAS (799ffb2fc4729fa46d2157c0065b3525) C:\Windows\system32\drivers\lsi_sas.sys
2011/05/29 18:50:07.0013 3820 LSI_SCSI (f445ff1daad8a226366bfaf42551226b) C:\Windows\system32\drivers\lsi_scsi.sys
2011/05/29 18:50:07.0033 3820 luafv (52f87b9cc8932c2a7375c3b2a9be5e3e) C:\Windows\system32\drivers\luafv.sys
2011/05/29 18:50:07.0071 3820 massfilter (b5e86524918ef32b32d1032e0c8e92a3) C:\Windows\system32\DRIVERS\massfilter.sys
2011/05/29 18:50:07.0101 3820 megasas (5c5cd6aaced32fb26c3fb34b3dcf972f) C:\Windows\system32\drivers\megasas.sys
2011/05/29 18:50:07.0133 3820 MegaSR (859bc2436b076c77c159ed694acfe8f8) C:\Windows\system32\drivers\megasr.sys
2011/05/29 18:50:07.0211 3820 Modem (59848d5cc74606f0ee7557983bb73c2e) C:\Windows\system32\drivers\modem.sys
2011/05/29 18:50:07.0252 3820 monitor (c247cc2a57e0a0c8c6dccf7807b3e9e5) C:\Windows\system32\DRIVERS\monitor.sys
2011/05/29 18:50:07.0264 3820 mouclass (9367304e5e412b120cf5f4ea14e4e4f1) C:\Windows\system32\DRIVERS\mouclass.sys
2011/05/29 18:50:07.0277 3820 mouhid (c2c2bd5c5ce5aaf786ddd74b75d2ac69) C:\Windows\system32\DRIVERS\mouhid.sys
2011/05/29 18:50:07.0299 3820 MountMgr (11bc9b1e8801b01f7f6adb9ead30019b) C:\Windows\system32\drivers\mountmgr.sys
2011/05/29 18:50:07.0327 3820 mpio (f8276eb8698142884498a528dfea8478) C:\Windows\system32\drivers\mpio.sys
2011/05/29 18:50:07.0342 3820 mpsdrv (c92b9abdb65a5991e00c28f13491dba2) C:\Windows\system32\drivers\mpsdrv.sys
2011/05/29 18:50:07.0367 3820 Mraid35x (3c200630a89ef2c0864d515b7a75802e) C:\Windows\system32\drivers\mraid35x.sys
2011/05/29 18:50:07.0525 3820 MRxDAV (7c1de4aa96dc0c071611f9e7de02a68d) C:\Windows\system32\drivers\mrxdav.sys
2011/05/29 18:50:07.0557 3820 mrxsmb (dc434b4769e18da09ce1b7755d4c64e9) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/05/29 18:50:07.0570 3820 mrxsmb10 (64713fcfe3de8881d62f8f3f2f794241) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/05/29 18:50:07.0675 3820 mrxsmb20 (0005c599a2abf767a815afcd32e523e3) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/05/29 18:50:07.0690 3820 msahci (1ac860612b85d8e85ee257d372e39f4d) C:\Windows\system32\drivers\msahci.sys
2011/05/29 18:50:07.0719 3820 msdsm (264bbb4aaf312a485f0e44b65a6b7202) C:\Windows\system32\drivers\msdsm.sys
2011/05/29 18:50:07.0833 3820 Msfs (704f59bfc4512d2bb0146aec31b10a7c) C:\Windows\system32\drivers\Msfs.sys
2011/05/29 18:50:07.0852 3820 msisadrv (00ebc952961664780d43dca157e79b27) C:\Windows\system32\drivers\msisadrv.sys
2011/05/29 18:50:07.0915 3820 MSKSSRV (0ea73e498f53b96d83dbfca074ad4cf8) C:\Windows\system32\drivers\MSKSSRV.sys
2011/05/29 18:50:07.0943 3820 MSPCLOCK (52e59b7e992a58e740aa63f57edbae8b) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/05/29 18:50:07.0957 3820 MSPQM (49084a75bae043ae02d5b44d02991bb2) C:\Windows\system32\drivers\MSPQM.sys
2011/05/29 18:50:07.0974 3820 MsRPC (dc6ccf440cdede4293db41c37a5060a5) C:\Windows\system32\drivers\MsRPC.sys
2011/05/29 18:50:08.0022 3820 mssmbios (855796e59df77ea93af46f20155bf55b) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/05/29 18:50:08.0060 3820 MSTEE (86d632d75d05d5b7c7c043fa3564ae86) C:\Windows\system32\drivers\MSTEE.sys
2011/05/29 18:50:08.0080 3820 Mup (0cc49f78d8aca0877d885f149084e543) C:\Windows\system32\Drivers\mup.sys
2011/05/29 18:50:08.0128 3820 NativeWifiP (2007b826c4acd94ae32232b41f0842b9) C:\Windows\system32\DRIVERS\nwifi.sys
2011/05/29 18:50:08.0185 3820 NDIS (65950e07329fcee8e6516b17c8d0abb6) C:\Windows\system32\drivers\ndis.sys
2011/05/29 18:50:08.0222 3820 NdisTapi (64df698a425478e321981431ac171334) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/05/29 18:50:08.0240 3820 Ndisuio (8baa43196d7b5bb972c9a6b2bbf61a19) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/05/29 18:50:08.0274 3820 NdisWan (f8158771905260982ce724076419ef19) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/05/29 18:50:08.0288 3820 NDProxy (9cb77ed7cb72850253e973a2d6afdf49) C:\Windows\system32\drivers\NDProxy.sys
2011/05/29 18:50:08.0314 3820 NetBIOS (a499294f5029a7862adc115bda7371ce) C:\Windows\system32\DRIVERS\netbios.sys
2011/05/29 18:50:08.0414 3820 netbt (fc2c792ebddc8e28df939d6a92c83d61) C:\Windows\system32\DRIVERS\netbt.sys
2011/05/29 18:50:08.0543 3820 nfrd960 (4ac08bd6af2df42e0c3196d826c8aea7) C:\Windows\system32\drivers\nfrd960.sys
2011/05/29 18:50:08.0600 3820 Npfs (b298874f8e0ea93f06ec40aa8d146478) C:\Windows\system32\drivers\Npfs.sys
2011/05/29 18:50:08.0638 3820 nsiproxy (1523af19ee8b030ba682f7a53537eaeb) C:\Windows\system32\drivers\nsiproxy.sys
2011/05/29 18:50:08.0717 3820 Ntfs (bac869dfb98e499ba4d9bb1fb43270e1) C:\Windows\system32\drivers\Ntfs.sys
2011/05/29 18:50:08.0846 3820 Null (dd5d684975352b85b52e3fd5347c20cb) C:\Windows\system32\drivers\Null.sys
2011/05/29 18:50:09.0620 3820 nvlddmkm (a963c2c276a97b088ded5d7a83be8052) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/05/29 18:50:09.0748 3820 nvraid (2c040b7ada5b06f6facadac8514aa034) C:\Windows\system32\drivers\nvraid.sys
2011/05/29 18:50:09.0764 3820 nvstor (f7ea0fe82842d05eda3efdd376dbfdba) C:\Windows\system32\drivers\nvstor.sys
2011/05/29 18:50:09.0798 3820 nv_agp (19067ca93075ef4823e3938a686f532f) C:\Windows\system32\drivers\nv_agp.sys
2011/05/29 18:50:09.0858 3820 ohci1394 (b5b1ce65ac15bbd11c0619e3ef7cfc28) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/05/29 18:50:09.0880 3820 Parport (aecd57f94c887f58919f307c35498ea0) C:\Windows\system32\drivers\parport.sys
2011/05/29 18:50:09.0906 3820 partmgr (f9b5eda4c17a2be7663f064dbf0fe254) C:\Windows\system32\drivers\partmgr.sys
2011/05/29 18:50:09.0935 3820 pci (47ab1e0fc9d0e12bb53ba246e3a0906d) C:\Windows\system32\drivers\pci.sys
2011/05/29 18:50:09.0980 3820 pciide (2657f6c0b78c36d95034be109336e382) C:\Windows\system32\drivers\pciide.sys
2011/05/29 18:50:10.0006 3820 pcmcia (037661f3d7c507c9993b7010ceee6288) C:\Windows\system32\drivers\pcmcia.sys
2011/05/29 18:50:10.0032 3820 PEAUTH (58865916f53592a61549b04941bfd80d) C:\Windows\system32\drivers\peauth.sys
2011/05/29 18:50:10.0079 3820 PptpMiniport (23386e9952025f5f21c368971e2e7301) C:\Windows\system32\DRIVERS\raspptp.sys
2011/05/29 18:50:10.0097 3820 Processor (5080e59ecee0bc923f14018803aa7a01) C:\Windows\system32\drivers\processr.sys
2011/05/29 18:50:10.0128 3820 PSched (c5ab7f0809392d0da027f4a2a81bfa31) C:\Windows\system32\DRIVERS\pacer.sys
2011/05/29 18:50:10.0158 3820 ql2300 (0b83f4e681062f3839be2ec1d98fd94a) C:\Windows\system32\drivers\ql2300.sys
2011/05/29 18:50:10.0182 3820 ql40xx (e1c80f8d4d1e39ef9595809c1369bf2a) C:\Windows\system32\drivers\ql40xx.sys
2011/05/29 18:50:10.0202 3820 QWAVEdrv (e8d76edab77ec9c634c27b8eac33adc5) C:\Windows\system32\drivers\qwavedrv.sys
2011/05/29 18:50:10.0214 3820 RasAcd (1013b3b663a56d3ddd784f581c1bd005) C:\Windows\system32\DRIVERS\rasacd.sys
2011/05/29 18:50:10.0231 3820 Rasl2tp (ac7bc4d42a7e558718dfdec599bbfc2c) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/05/29 18:50:10.0247 3820 RasPppoe (4517fbf8b42524afe4ede1de102aae3e) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/05/29 18:50:10.0281 3820 RasSstp (c6a593b51f34c33e5474539544072527) C:\Windows\system32\DRIVERS\rassstp.sys
2011/05/29 18:50:10.0300 3820 rdbss (322db5c6b55e8d8ee8d6f358b2aaabb1) C:\Windows\system32\DRIVERS\rdbss.sys
2011/05/29 18:50:10.0312 3820 RDPCDD (603900cc05f6be65ccbf373800af3716) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/05/29 18:50:10.0343 3820 rdpdr (c045d1fb111c28df0d1be8d4bda22c06) C:\Windows\system32\drivers\rdpdr.sys
2011/05/29 18:50:10.0352 3820 RDPENCDD (cab9421daf3d97b33d0d055858e2c3ab) C:\Windows\system32\drivers\rdpencdd.sys
2011/05/29 18:50:10.0381 3820 RDPWD (b1d741c87cea8d7282146366cc9c3f81) C:\Windows\system32\drivers\RDPWD.sys
2011/05/29 18:50:10.0425 3820 rspndr (22a9cb08b1a6707c1550c6bf099aae73) C:\Windows\system32\DRIVERS\rspndr.sys
2011/05/29 18:50:10.0453 3820 RTL8169 (e3aa12faa3192d1090b9069c3925373b) C:\Windows\system32\DRIVERS\Rtlh64.sys
2011/05/29 18:50:10.0544 3820 SASDIFSV (99df79c258b3342b6c8a5f802998de56) C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
2011/05/29 18:50:10.0556 3820 SASKUTIL (2859c35c0651e8eb0d86d48e740388f2) C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
2011/05/29 18:50:10.0591 3820 sbp2port (cd9c693589c60ad59bbbcfb0e524e01b) C:\Windows\system32\drivers\sbp2port.sys
2011/05/29 18:50:10.0638 3820 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/05/29 18:50:10.0657 3820 Serenum (f71bfe7ac6c52273b7c82cbf1bb2a222) C:\Windows\system32\drivers\serenum.sys
2011/05/29 18:50:10.0674 3820 Serial (e62fac91ee288db29a9696a9d279929c) C:\Windows\system32\drivers\serial.sys
2011/05/29 18:50:10.0698 3820 sermouse (a842f04833684bceea7336211be478df) C:\Windows\system32\drivers\sermouse.sys
2011/05/29 18:50:10.0729 3820 sffdisk (14d4b4465193a87c127933978e8c4106) C:\Windows\system32\drivers\sffdisk.sys
2011/05/29 18:50:10.0747 3820 sffp_mmc (7073aee3f82f3d598e3825962aa98ab2) C:\Windows\system32\drivers\sffp_mmc.sys
2011/05/29 18:50:10.0761 3820 sffp_sd (35e59ebe4a01a0532ed67975161c7b82) C:\Windows\system32\drivers\sffp_sd.sys
2011/05/29 18:50:10.0776 3820 sfloppy (6b7838c94135768bd455cbdc23e39e5f) C:\Windows\system32\drivers\sfloppy.sys
2011/05/29 18:50:10.0797 3820 SiSRaid2 (7a5de502aeb719d4594c6471060a78b3) C:\Windows\system32\drivers\sisraid2.sys
2011/05/29 18:50:10.0815 3820 SiSRaid4 (3a2f769fab9582bc720e11ea1dfb184d) C:\Windows\system32\drivers\sisraid4.sys
2011/05/29 18:50:10.0852 3820 Smb (290b6f6a0ec4fcdfc90f5cb6d7020473) C:\Windows\system32\DRIVERS\smb.sys
2011/05/29 18:50:10.0888 3820 spldr (386c3c63f00a7040c7ec5e384217e89d) C:\Windows\system32\drivers\spldr.sys
2011/05/29 18:50:10.0939 3820 srv (880a57fccb571ebd063d4dd50e93e46d) C:\Windows\system32\DRIVERS\srv.sys
2011/05/29 18:50:10.0965 3820 srv2 (fa36d119249bf27bc4c0079734e1f33b) C:\Windows\system32\DRIVERS\srv2.sys
2011/05/29 18:50:11.0066 3820 srvnet (cfe7bc92d52c7e79427545909a0182f8) C:\Windows\system32\DRIVERS\srvnet.sys
2011/05/29 18:50:11.0104 3820 StarOpen (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
2011/05/29 18:50:11.0132 3820 swenum (8a851ca908b8b974f89c50d2e18d4f0c) C:\Windows\system32\DRIVERS\swenum.sys
2011/05/29 18:50:11.0156 3820 Symc8xx (2f26a2c6fc96b29beff5d8ed74e6625b) C:\Windows\system32\drivers\symc8xx.sys
2011/05/29 18:50:11.0165 3820 Sym_hi (a909667976d3bccd1df813fed517d837) C:\Windows\system32\drivers\sym_hi.sys
2011/05/29 18:50:11.0174 3820 Sym_u3 (36887b56ec2d98b9c362f6ae4de5b7b0) C:\Windows\system32\drivers\sym_u3.sys
2011/05/29 18:50:11.0224 3820 Tcpip (973658a2ea9c06b2976884b9046dfc6c) C:\Windows\system32\drivers\tcpip.sys
2011/05/29 18:50:11.0257 3820 Tcpip6 (973658a2ea9c06b2976884b9046dfc6c) C:\Windows\system32\DRIVERS\tcpip.sys
2011/05/29 18:50:11.0284 3820 tcpipreg (c7e72a4071ee0200e3c075dacfb2b334) C:\Windows\system32\drivers\tcpipreg.sys
2011/05/29 18:50:11.0302 3820 TDPIPE (1d8bf4aaa5fb7a2761475781dc1195bc) C:\Windows\system32\drivers\tdpipe.sys
2011/05/29 18:50:11.0330 3820 TDTCP (7f7e00cdf609df657f4cda02dd1c9bb1) C:\Windows\system32\drivers\tdtcp.sys
2011/05/29 18:50:11.0352 3820 tdx (458919c8c42e398dc4802178d5ffee27) C:\Windows\system32\DRIVERS\tdx.sys
2011/05/29 18:50:11.0381 3820 TermDD (8c19678d22649ec002ef2282eae92f98) C:\Windows\system32\DRIVERS\termdd.sys
2011/05/29 18:50:11.0418 3820 tssecsrv (9e5409cd17c8bef193aad498f3bc2cb8) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/05/29 18:50:11.0444 3820 tunmp (89ec74a9e602d16a75a4170511029b3c) C:\Windows\system32\DRIVERS\tunmp.sys
2011/05/29 18:50:11.0471 3820 tunnel (30a9b3f45ad081bffc3bcaa9c812b609) C:\Windows\system32\DRIVERS\tunnel.sys
2011/05/29 18:50:11.0492 3820 uagp35 (fec266ef401966311744bd0f359f7f56) C:\Windows\system32\drivers\uagp35.sys
2011/05/29 18:50:11.0519 3820 udfs (faf2640a2a76ed03d449e443194c4c34) C:\Windows\system32\DRIVERS\udfs.sys
2011/05/29 18:50:11.0555 3820 uliagpkx (4ec9447ac3ab462647f60e547208ca00) C:\Windows\system32\drivers\uliagpkx.sys
2011/05/29 18:50:11.0580 3820 uliahci (697f0446134cdc8f99e69306184fbbb4) C:\Windows\system32\drivers\uliahci.sys
2011/05/29 18:50:11.0601 3820 UlSata (31707f09846056651ea2c37858f5ddb0) C:\Windows\system32\drivers\ulsata.sys
2011/05/29 18:50:11.0622 3820 ulsata2 (85e5e43ed5b48c8376281bab519271b7) C:\Windows\system32\drivers\ulsata2.sys
2011/05/29 18:50:11.0645 3820 umbus (46e9a994c4fed537dd951f60b86ad3f4) C:\Windows\system32\DRIVERS\umbus.sys
2011/05/29 18:50:11.0697 3820 usbaudio (c6ba890de6e41857fbe84175519cae7d) C:\Windows\system32\drivers\usbaudio.sys
2011/05/29 18:50:11.0726 3820 usbccgp (07e3498fc60834219d2356293da0fecc) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/05/29 18:50:11.0750 3820 usbcir (9247f7e0b65852c1f6631480984d6ed2) C:\Windows\system32\drivers\usbcir.sys
2011/05/29 18:50:11.0770 3820 usbehci (827e44de934a736ea31e91d353eb126f) C:\Windows\system32\DRIVERS\usbehci.sys
2011/05/29 18:50:11.0798 3820 usbhub (bb35cd80a2ececfadc73569b3d70c7d1) C:\Windows\system32\DRIVERS\usbhub.sys
2011/05/29 18:50:11.0819 3820 usbohci (eba14ef0c07cec233f1529c698d0d154) C:\Windows\system32\drivers\usbohci.sys
2011/05/29 18:50:11.0836 3820 usbprint (acfee697af477021bb3ec78c5431fed2) C:\Windows\system32\drivers\usbprint.sys
2011/05/29 18:50:11.0866 3820 USBSTOR (b854c1558fca0c269a38663e8b59b581) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/05/29 18:50:11.0882 3820 usbuhci (b2872cbf9f47316abd0e0c74a1aba507) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/05/29 18:50:11.0909 3820 vga (916b94bcf1e09873fff2d5fb11767bbc) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/05/29 18:50:11.0918 3820 VgaSave (b83ab16b51feda65dd81b8c59d114d63) C:\Windows\System32\drivers\vga.sys
2011/05/29 18:50:11.0939 3820 viaide (8294b6c3fdb6c33f24e150de647ecdaa) C:\Windows\system32\drivers\viaide.sys
2011/05/29 18:50:11.0971 3820 volmgr (2b7e885ed951519a12c450d24535dfca) C:\Windows\system32\drivers\volmgr.sys
2011/05/29 18:50:12.0005 3820 volmgrx (cec5ac15277d75d9e5dec2e1c6eaf877) C:\Windows\system32\drivers\volmgrx.sys
2011/05/29 18:50:12.0021 3820 volsnap (5280aada24ab36b01a84a6424c475c8d) C:\Windows\system32\drivers\volsnap.sys
2011/05/29 18:50:12.0042 3820 vsmraid (a68f455ed2673835209318dd61bfbb0e) C:\Windows\system32\drivers\vsmraid.sys
2011/05/29 18:50:12.0064 3820 WacomPen (fef8fe5923fead2cee4dfabfce3393a7) C:\Windows\system32\drivers\wacompen.sys
2011/05/29 18:50:12.0103 3820 Wanarp (b8e7049622300d20ba6d8be0c47c0cfd) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/29 18:50:12.0110 3820 Wanarpv6 (b8e7049622300d20ba6d8be0c47c0cfd) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/29 18:50:12.0138 3820 Wd (0c17a0816f65b89e362e682ad5e7266e) C:\Windows\system32\drivers\wd.sys
2011/05/29 18:50:12.0166 3820 Wdf01000 (d02e7e4567da1e7582fbf6a91144b0df) C:\Windows\system32\drivers\Wdf01000.sys
2011/05/29 18:50:12.0216 3820 WmiAcpi (e18aebaaa5a773fe11aa2c70f65320f5) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/05/29 18:50:12.0254 3820 WpdUsb (5e2401b3fc1089c90e081291357371a9) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/05/29 18:50:12.0307 3820 ws2ifsl (8a900348370e359b6bff6a550e4649e1) C:\Windows\system32\drivers\ws2ifsl.sys
2011/05/29 18:50:12.0351 3820 WUDFRd (501a65252617b495c0f1832f908d54d8) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/05/29 18:50:12.0367 3820 ZTEusbmdm6k (31db70a61814e4f33181d48190d46845) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
2011/05/29 18:50:12.0398 3820 ZTEusbnet (01cbeea25aa78c0f0272654048d61f34) C:\Windows\system32\DRIVERS\ZTEusbnet.sys
2011/05/29 18:50:12.0428 3820 ZTEusbnmea (c9ada887bf326d8413e81fe80b1be7eb) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
2011/05/29 18:50:12.0442 3820 ZTEusbser6k (31db70a61814e4f33181d48190d46845) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
2011/05/29 18:50:12.0461 3820 ZTEusbvoice (c9ada887bf326d8413e81fe80b1be7eb) C:\Windows\system32\DRIVERS\ZTEusbvoice.sys
2011/05/29 18:50:12.0488 3820 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/05/29 18:50:12.0496 3820 ================================================================================
2011/05/29 18:50:12.0496 3820 Scan finished
2011/05/29 18:50:12.0496 3820 ================================================================================
2011/05/29 18:50:12.0502 5460 Detected object count: 0
2011/05/29 18:50:12.0502 5460 Actual detected object count: 0

cosinus 29.05.2011 18:00
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

HarDsTyLeTyp 29.05.2011 20:16
Combofix Logfile:
Code:
ComboFix 11-05-28.01 - HarDsTyLe 29.05.2011  21:07:53.1.8 - x64
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.8189.6508 [GMT 2:00]
ausgeführt von:: c:\users\HarDsTyLe\Desktop\cofi.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\program files (x86)\valve\steam\Steam.exe
c:\users\HarDsTyLe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Softonic-Eng7_EN.exe
c:\users\HarDsTyLe\AppData\Local\Microsoft\Windows\Temporary Internet Files\udRemove.exe
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-04-28 bis 2011-05-29  ))))))))))))))))))))))))))))))
.
.
2011-05-29 16:16 . 2011-05-29 16:16        --------        d-----w-        c:\users\HarDsTyLe\AppData\Local\Logitech
2011-05-29 16:14 . 2011-05-29 16:15        --------        d-----w-        c:\windows\LastGood
2011-05-29 16:14 . 2011-05-29 16:14        374792        ----a-w-        c:\windows\system32\drivers\UMDF\lgSSQVGA.dll
2011-05-29 16:14 . 2011-05-29 16:14        157704        ----a-w-        c:\windows\system32\drivers\UMDF\lgSSBW.dll
2011-05-29 16:14 . 2011-05-29 16:14        22408        ----a-w-        c:\windows\system32\drivers\LGBusEnum.sys
2011-05-29 16:14 . 2011-05-29 16:14        16008        ----a-w-        c:\windows\system32\drivers\LGVirHid.sys
2011-05-29 16:14 . 2011-05-29 16:14        --------        d-----w-        c:\program files\Logitech Gaming Software
2011-05-29 15:50 . 2011-05-29 15:50        --------        d-----w-        C:\_OTL
2011-05-29 14:41 . 2011-05-29 14:41        --------        d-----w-        c:\users\UpdatusUser
2011-05-29 14:38 . 2011-05-29 14:38        --------        d-----w-        c:\programdata\NVIDIA Corporation
2011-05-29 14:35 . 2011-02-22 12:21        74272        ----a-w-        c:\windows\system32\RtNicProp64.dll
2011-05-29 14:35 . 2011-02-22 12:21        404584        ----a-w-        c:\windows\system32\drivers\Rtlh64.sys
2011-05-29 14:32 . 2011-05-29 14:32        --------        d-----w-        C:\RaidTool
2011-05-29 14:32 . 2010-09-07 15:40        1976920        ----a-w-        c:\windows\SysWow64\xRaidSetup.exe
2011-05-29 14:32 . 2010-09-07 15:40        162392        ----a-w-        c:\windows\SysWow64\xRaidAPI.dll
2011-05-29 14:31 . 2011-05-29 14:32        --------        d-----w-        c:\windows\RaidTool
2011-05-29 14:31 . 2011-05-29 14:31        --------        d-----w-        c:\program files (x86)\Common Files\InstallShield
2011-05-29 14:21 . 2011-05-29 14:21        --------        d-----w-        c:\program files (x86)\Driver-Soft
2011-05-29 10:42 . 2011-05-29 10:42        --------        d-----w-        c:\program files (x86)\Common Files\Adobe
2011-05-28 23:29 . 2011-05-28 23:29        --------        d-----w-        c:\users\HarDsTyLe\AppData\Roaming\SUPERAntiSpyware.com
2011-05-28 23:29 . 2011-05-28 23:29        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com
2011-05-28 23:29 . 2011-05-28 23:29        --------        d-----w-        c:\programdata\!SASCORE
2011-05-28 23:29 . 2011-05-28 23:29        --------        d-----w-        c:\program files\SUPERAntiSpyware
2011-05-28 21:56 . 2011-05-28 21:56        --------        d-----w-        c:\users\HarDsTyLe\AppData\Roaming\Malwarebytes
2011-05-28 21:56 . 2011-05-28 21:56        --------        d-----w-        c:\programdata\Malwarebytes
2011-05-28 21:56 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-28 21:55 . 2010-12-20 16:08        24152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-05-28 21:55 . 2011-05-28 21:56        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-27 11:22 . 2011-05-09 22:00        8718160        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DDEB03F4-0812-4EFC-8DDA-7071BEA3B01D}\mpengine.dll
2011-05-22 15:42 . 2011-05-22 16:27        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2011-05-22 15:42 . 2011-05-22 15:42        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy
2011-05-14 17:36 . 2011-05-14 17:36        --------        d-----w-        C:\Riot Games
2011-05-14 16:17 . 2011-05-29 19:02        --------        d-----w-        c:\users\HarDsTyLe\AppData\Local\PMB Files
2011-05-14 16:17 . 2011-05-29 19:02        --------        d-----w-        c:\programdata\PMB Files
2011-05-14 16:17 . 2011-05-14 16:17        --------        d-----w-        c:\program files (x86)\Pando Networks
2011-05-14 14:26 . 2011-03-12 22:52        1653760        ----a-w-        c:\windows\system32\XpsPrint.dll
2011-05-14 14:26 . 2011-03-12 21:55        876032        ----a-w-        c:\windows\SysWow64\XpsPrint.dll
2011-05-14 09:36 . 2011-03-03 15:59        32256        ----a-w-        c:\windows\system32\Apphlpdm.dll
2011-05-14 09:36 . 2011-03-03 15:40        28672        ----a-w-        c:\windows\SysWow64\Apphlpdm.dll
2011-05-14 09:36 . 2011-03-03 14:00        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll
2011-05-14 09:36 . 2011-03-03 13:35        4240384        ----a-w-        c:\windows\SysWow64\GameUXLegacyGDFs.dll
2011-05-14 09:27 . 2010-10-05 18:26        109240        ----a-w-        c:\program files (x86)\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\components\abhelperxpcom.dll
2011-05-14 09:27 . 2010-10-05 18:27        150200        ----a-w-        c:\program files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll
2011-05-13 21:04 . 2011-05-18 16:22        --------        d-----w-        c:\users\HarDsTyLe\AppData\Roaming\DarksporeData
2011-05-13 20:42 . 2011-05-13 20:42        --------        d-----w-        c:\programdata\WeGame
2011-05-13 19:08 . 2011-05-13 19:08        --------        d-----w-        c:\program files (x86)\Common Files\Java
2011-05-13 18:59 . 2011-05-13 18:59        --------        d-----w-        c:\program files (x86)\Kaspersky Lab
2011-05-13 18:29 . 2010-08-31 15:46        954752        ----a-w-        c:\windows\SysWow64\mfc40.dll
2011-05-13 18:29 . 2010-08-31 15:46        954288        ----a-w-        c:\windows\SysWow64\mfc40u.dll
2011-05-13 18:29 . 2011-02-18 14:18        450560        ----a-w-        c:\windows\system32\drivers\srv.sys
2011-05-13 18:29 . 2011-02-18 14:17        176128        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-05-13 18:29 . 2011-02-18 14:17        145920        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-05-13 18:29 . 2010-05-04 19:40        316928        ----a-w-        c:\windows\system32\msshsq.dll
2011-05-13 18:29 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\SysWow64\msshsq.dll
2011-05-13 18:29 . 2010-08-26 17:46        189952        ----a-w-        c:\windows\system32\t2embed.dll
2011-05-13 18:29 . 2010-08-26 16:37        157184        ----a-w-        c:\windows\SysWow64\t2embed.dll
2011-05-13 18:29 . 2010-08-31 17:27        633856        ----a-w-        c:\windows\system32\comctl32.dll
2011-05-13 18:29 . 2010-08-31 15:44        531968        ----a-w-        c:\windows\SysWow64\comctl32.dll
2011-05-13 18:27 . 2011-04-07 12:02        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2011-05-13 18:26 . 2010-10-18 15:35        87552        ----a-w-        c:\windows\system32\consent.exe
2011-05-13 18:24 . 2010-11-06 11:18        500224        ----a-w-        c:\windows\system32\wmicmiplugin.dll
2011-05-13 18:24 . 2010-11-06 11:18        655872        ----a-w-        c:\windows\system32\taskschd.dll
2011-05-13 18:24 . 2010-11-06 11:18        410112        ----a-w-        c:\windows\system32\taskcomp.dll
2011-05-13 18:24 . 2010-11-06 11:18        855040        ----a-w-        c:\windows\system32\schedsvc.dll
2011-05-13 18:24 . 2010-11-04 23:58        267776        ----a-w-        c:\windows\system32\taskeng.exe
2011-05-13 18:24 . 2010-11-04 18:55        352768        ----a-w-        c:\windows\SysWow64\taskschd.dll
2011-05-13 18:24 . 2010-11-04 18:55        270336        ----a-w-        c:\windows\SysWow64\taskcomp.dll
2011-05-13 18:24 . 2010-11-04 16:34        171520        ----a-w-        c:\windows\SysWow64\taskeng.exe
2011-05-13 18:09 . 2011-04-14 16:40        142296        ----a-w-        c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-05-13 18:09 . 2011-04-14 16:40        89048        ----a-w-        c:\program files (x86)\Mozilla Firefox\libEGL.dll
2011-05-13 18:09 . 2011-04-14 16:40        781272        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-05-13 18:09 . 2011-04-14 16:40        465880        ----a-w-        c:\program files (x86)\Mozilla Firefox\libGLESv2.dll
2011-05-13 18:09 . 2011-04-14 16:40        1874904        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozjs.dll
2011-05-13 18:09 . 2011-04-14 16:40        15832        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozalloc.dll
2011-05-13 18:09 . 2010-01-01 08:00        1974616        ----a-w-        c:\program files (x86)\Mozilla Firefox\D3DCompiler_42.dll
2011-05-13 18:09 . 2010-01-01 08:00        1892184        ----a-w-        c:\program files (x86)\Mozilla Firefox\d3dx9_42.dll
2011-05-13 18:00 . 2011-04-14 10:43        179616        ----a-w-        c:\windows\system32\drivers\ESLWireACD.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-15 14:00 . 2009-10-05 18:43        53248        ----a-w-        c:\windows\SysWow64\CSVer.dll
2011-04-09 16:55 . 2011-04-09 16:55        15453336        ----a-w-        c:\windows\SysWow64\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55        13642904        ----a-w-        c:\windows\SysWow64\xlivefnt.dll
2011-04-08 05:14 . 2010-04-03 20:55        2034280        ----a-w-        c:\windows\SysWow64\nvapi.dll
2011-04-08 05:14 . 2009-09-27 14:12        2273896        ----a-w-        c:\windows\system32\nvapi64.dll
2011-04-07 21:19 . 2011-04-07 21:19        2582120        ----a-w-        c:\windows\system32\nvsvcr.dll
2011-04-07 21:19 . 2011-04-07 21:19        117864        ----a-w-        c:\windows\system32\nvmctray.dll
2011-04-07 21:19 . 2011-04-07 21:19        1012328        ----a-w-        c:\windows\system32\nvvsvc.exe
2011-04-07 21:19 . 2011-04-07 21:19        797288        ----a-w-        c:\windows\system32\easyUpdatusAPIU64.dll
2011-04-07 21:19 . 2011-04-07 21:19        6338152        ----a-w-        c:\windows\system32\nvcpl.dll
2011-04-07 21:18 . 2011-04-07 21:18        3041384        ----a-w-        c:\windows\system32\nvsvc64.dll
2011-03-03 15:59 . 2011-05-14 09:36        100352        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2011-03-03 15:59 . 2011-05-14 09:36        331776        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 15:59 . 2011-05-14 09:36        284672        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2011-03-03 15:40 . 2011-05-14 09:36        173056        ----a-w-        c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-05-14 09:36        542720        ----a-w-        c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-05-14 09:36        458752        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-05-14 09:36        2159616        ----a-w-        c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"ICQ"="c:\program files (x86)\ICQ7.2\ICQ.exe" [2011-01-05 133432]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~2\KASPER~1\KASPER~1\sbhook.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\Gameforge4D\CABAL Online\GameGuard\dump_wmimmc.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [x]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 27648]
S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-03-28 246520]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-07 378472]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 70973984
*NewlyCreated* - 72916993
*Deregistered* - 70973984
*Deregistered* - 72916993
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-29 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files (x86)\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 11:45]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2010-11-16 104008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\x64\kloehk.dll c:\progra~2\KASPER~1\KASPER~1\x64\sbhook64.dll
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/
mLocal Page = %SystemRoot%\system32\blank.htm
TCP: DhcpNameServer = 192.168.2.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\HarDsTyLe\AppData\Roaming\Mozilla\Firefox\Profiles\mjtvjdk2.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Steam - c:\program files (x86)\valve\steam\steam.exe
Wow6432Node-HKLM-Run-TaskTray - (no file)
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-Steam App 99890 - c:\program files (x86)\Valve\Steam\steam.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-227888889-2763386097-3148371341-1000\Software\SecuROM\License information*]
"datasecu"=hex:67,ae,96,6a,17,1f,7a,5b,bf,c9,dc,8f,a6,f1,56,67,3b,e7,74,47,9b,
  0e,b2,b9,24,a1,92,0a,31,16,c3,6d,e4,66,d9,bb,e8,17,ec,dd,e8,a9,db,cd,62,44,\
"rkeysecu"=hex:82,0f,0a,a5,e4,e4,da,86,8c,47,dd,36,8e,4e,e2,1a
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Flash\\FlashUtil9f.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Flash\\FlashUtil9f.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
  00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-05-29  21:15:04
ComboFix-quarantined-files.txt  2011-05-29 19:15
.
Vor Suchlauf: 14 Verzeichnis(se), 42.074.791.936 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 41.820.139.520 Bytes frei
.
Current=1 Default=1 Failed=0 LastKnownGood=3 Sets=1,2,3,26
- - End Of File - - 0A2F0AA7CCDB45DD4400301952670DCC
--- --- ---

HarDsTyLeTyp 29.05.2011 20:59
so ich sag schonmal danke, aber der mist ist laut stinger immer noch da ;/
ich fahr jetzt zum bund und mach das nechste dann am mittwoch

cosinus 30.05.2011 10:55
Bitte nun Logs mit GMER und mbrcheck erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg

Anleitung zu mbrcheck:
Downloade Dir MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

HarDsTyLeTyp 01.06.2011 21:34
mir ist gerade aufgefallen das irgendeins dieser progs wohl mein steam gelöscht hat ;(

HarDsTyLeTyp 01.06.2011 22:03
so das lock von gmer ist ja ich nenns mal leer also gibt nix

HarDsTyLeTyp 01.06.2011 22:06
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 64-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: EX58-UD5
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 141):
0x03E06000 \SystemRoot\system32\ntoskrnl.exe
0x0431E000 \SystemRoot\system32\hal.dll
0x00601000 \SystemRoot\system32\kdcom.dll
0x0060B000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00646000 \SystemRoot\system32\PSHED.dll
0x0065A000 \SystemRoot\system32\CLFS.SYS
0x006B7000 \SystemRoot\system32\CI.dll
0x00801000 \SystemRoot\system32\drivers\Wdf01000.sys
0x008DB000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x008E9000 \SystemRoot\system32\drivers\acpi.sys
0x0093F000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00948000 \SystemRoot\system32\drivers\msisadrv.sys
0x00952000 \SystemRoot\system32\drivers\pci.sys
0x00982000 \SystemRoot\System32\drivers\partmgr.sys
0x00997000 \SystemRoot\system32\drivers\volmgr.sys
0x00769000 \SystemRoot\System32\drivers\volmgrx.sys
0x009AB000 \SystemRoot\system32\drivers\pciide.sys
0x009B2000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x009C2000 \SystemRoot\system32\DRIVERS\jraid.sys
0x007CF000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x009E3000 \SystemRoot\System32\drivers\mountmgr.sys
0x009F6000 \SystemRoot\system32\drivers\atapi.sys
0x00A0A000 \SystemRoot\system32\drivers\ataport.SYS
0x00A2E000 \SystemRoot\system32\drivers\fltmgr.sys
0x00A75000 \SystemRoot\system32\drivers\fileinfo.sys
0x00A89000 \SystemRoot\System32\Drivers\ksecdd.sys
0x00C05000 \SystemRoot\system32\drivers\ndis.sys
0x00B10000 \SystemRoot\system32\drivers\msrpc.sys
0x00B60000 \SystemRoot\system32\drivers\NETIO.SYS
0x00E05000 \SystemRoot\System32\drivers\tcpip.sys
0x00F7B000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x0100D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0118D000 \SystemRoot\system32\drivers\volsnap.sys
0x011D1000 \SystemRoot\System32\Drivers\spldr.sys
0x011D9000 \SystemRoot\System32\Drivers\mup.sys
0x01208000 \SystemRoot\system32\DRIVERS\kl1.sys
0x01967000 \SystemRoot\System32\drivers\ecache.sys
0x01993000 \SystemRoot\system32\drivers\disk.sys
0x019A7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x019D3000 \SystemRoot\system32\drivers\crcdisk.sys
0x011EB000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x01000000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x00FA7000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x0300D000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x03CBB000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x03CC0000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x03DA3000 \SystemRoot\System32\drivers\watchdog.sys
0x03DB3000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x00FBA000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x03DBF000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x03E0A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x03EF7000 \SystemRoot\system32\DRIVERS\Rtlh64.sys
0x03F5C000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x03F6E000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x03F7E000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x03F9A000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x03FA3000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x0400A000 \SystemRoot\system32\DRIVERS\storport.sys
0x04067000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x04074000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04097000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x040A3000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x040D4000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x040E4000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04102000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x0411A000 \SystemRoot\system32\DRIVERS\termdd.sys
0x0412D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x0413B000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x041B3000 \SystemRoot\system32\DRIVERS\swenum.sys
0x041B5000 \SystemRoot\system32\DRIVERS\ks.sys
0x041E9000 \SystemRoot\system32\drivers\LGBusEnum.sys
0x041ED000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x04147000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04157000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x0419F000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x05A04000 \SystemRoot\system32\drivers\HdAudio.sys
0x05A4D000 \SystemRoot\system32\drivers\portcls.sys
0x05A88000 \SystemRoot\system32\drivers\drmk.sys
0x05AAB000 \SystemRoot\system32\drivers\ksthunk.sys
0x05AB1000 \SystemRoot\system32\DRIVERS\klif.sys
0x05B47000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x05B51000 \SystemRoot\System32\Drivers\Null.SYS
0x05B65000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x05B6D000 \SystemRoot\System32\drivers\vga.sys
0x05B7B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x05BA0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x05BA9000 \SystemRoot\system32\drivers\rdpencdd.sys
0x05BB2000 \SystemRoot\System32\Drivers\Msfs.SYS
0x05BBD000 \SystemRoot\System32\Drivers\Npfs.SYS
0x05BCE000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x05BD7000 \SystemRoot\system32\DRIVERS\tdx.sys
0x05BF4000 \SystemRoot\system32\DRIVERS\kl2.sys
0x03FDC000 \SystemRoot\system32\DRIVERS\smb.sys
0x05C0B000 \SystemRoot\system32\drivers\afd.sys
0x05C76000 \SystemRoot\System32\DRIVERS\netbt.sys
0x05CBA000 \SystemRoot\system32\DRIVERS\pacer.sys
0x05CD8000 \SystemRoot\system32\DRIVERS\klim6.sys
0x05CE1000 \SystemRoot\system32\DRIVERS\netbios.sys
0x05CF0000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x05D0B000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
0x05D15000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
0x05D1F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x05D6C000 \SystemRoot\system32\drivers\nsiproxy.sys
0x05D78000 \SystemRoot\System32\Drivers\dfsc.sys
0x05D95000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x05DB1000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x05DB3000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x05DBC000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x05DCE000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x05DD9000 \SystemRoot\system32\DRIVERS\klmouflt.sys
0x05DE3000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x05E04000 \SystemRoot\system32\DRIVERS\udfs.sys
0x05E52000 \SystemRoot\System32\Drivers\crashdmp.sys
0x05E60000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x05E6C000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x00010000 \SystemRoot\System32\win32k.sys
0x05E74000 \SystemRoot\System32\drivers\Dxapi.sys
0x05E80000 \SystemRoot\system32\DRIVERS\monitor.sys
0x004F0000 \SystemRoot\System32\TSDDD.dll
0x006B0000 \SystemRoot\System32\cdd.dll
0x05E93000 \SystemRoot\system32\drivers\luafv.sys
0x05EB5000 \SystemRoot\system32\drivers\spsys.sys
0x05F4F000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x05F63000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x05F7B000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x05F9B000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x09E0A000 \SystemRoot\system32\drivers\HTTP.sys
0x09EAD000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x09ED6000 \SystemRoot\system32\DRIVERS\bowser.sys
0x09EF4000 \SystemRoot\System32\drivers\mpsdrv.sys
0x09F0E000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x09F37000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x09F80000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x09F9F000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0A00F000 \SystemRoot\System32\DRIVERS\srv.sys
0x0A0A2000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x0A0AD000 \SystemRoot\system32\drivers\peauth.sys
0x0A163000 \SystemRoot\System32\Drivers\secdrv.SYS
0x0A16E000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0A17E000 \SystemRoot\system32\drivers\LGVirHid.sys
0x76F30000 \Windows\System32\ntdll.dll

Processes (total 67):
0 System Idle Process
4 System
504 C:\Windows\System32\smss.exe
572 csrss.exe
640 C:\Windows\System32\wininit.exe
660 csrss.exe
696 C:\Windows\System32\services.exe
712 C:\Windows\System32\lsass.exe
720 C:\Windows\System32\lsm.exe
824 C:\Windows\System32\winlogon.exe
916 C:\Windows\System32\svchost.exe
960 C:\Windows\System32\nvvsvc.exe
972 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
1008 C:\Windows\System32\svchost.exe
316 C:\Windows\System32\svchost.exe
356 C:\Windows\System32\svchost.exe
448 C:\Windows\System32\svchost.exe
512 C:\Windows\System32\svchost.exe
716 C:\Windows\System32\audiodg.exe
904 C:\Windows\System32\SLsvc.exe
1076 C:\Windows\System32\svchost.exe
1180 C:\Windows\System32\svchost.exe
1296 WUDFHost.exe
1444 C:\Windows\System32\spoolsv.exe
1468 C:\Windows\System32\svchost.exe
1564 WUDFHost.exe
1820 C:\Program Files\SUPERAntiSpyware\SASCore64.exe
1864 C:\Windows\SysWOW64\svchost.exe
1876 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
1924 C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
1476 C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
2056 C:\Windows\System32\svchost.exe
2120 C:\Windows\System32\TUProgSt.exe
2152 C:\Windows\System32\svchost.exe
2184 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2224 C:\Windows\System32\SearchIndexer.exe
2540 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2700 C:\Windows\System32\taskeng.exe
3188 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
3204 C:\Windows\System32\nvvsvc.exe
3556 C:\Windows\System32\taskeng.exe
3600 C:\Windows\System32\dwm.exe
3640 C:\Windows\System32\taskeng.exe
3672 C:\Windows\explorer.exe
4068 C:\Program Files\Logitech Gaming Software\LCore.exe
4076 C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
3712 C:\Program Files (x86)\ICQ7.2\ICQ.exe
3844 C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
3056 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
3404 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
3580 C:\Program Files\Windows Media Player\wmpnscfg.exe
2896 C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
3164 C:\Program Files\Windows Media Player\wmpnetwk.exe
4528 C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
4564 C:\Program Files (x86)\Windows Media Player\wmplayer.exe
4928 C:\Program Files\Logitech Gaming Software\plugins\LCDAppletsMono-1.00.027\Applets\x64\LCDClock.exe
4484 taskeng.exe
5056 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
4940 C:\Windows\System32\svchost.exe
4356 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtblfs.exe
4640 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
2444 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
2620 C:\Windows\System32\wbem\WMIADAP.exe
4448 WmiPrvSE.exe
4436 C:\Windows\System32\SearchProtocolHost.exe
4752 C:\Windows\System32\SearchFilterHost.exe
4324 C:\Users\HarDsTyLe\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000002b`32b00000 (NTFS)

PhysicalDrive0 Model Number: WDCWD5002ABYS-01B1B0, Rev: 02.03B02

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

cosinus 02.06.2011 00:16
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


HarDsTyLeTyp 02.06.2011 01:59
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6750

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

02.06.2011 02:57:09
mbam-log-2011-06-02 (02-57-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 394796
Laufzeit: 1 Stunde(n), 3 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

HarDsTyLeTyp 02.06.2011 13:19
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/02/2011 at 02:01 PM

Application Version : 4.53.1000

Core Rules Database Version : 7182
Trace Rules Database Version: 4994

Scan type : Complete Scan
Total Scan Time : 01:38:40

Memory items scanned : 518
Memory threats detected : 0
Registry items scanned : 12686
Registry threats detected : 0
File items scanned : 239215
File threats detected : 1

Trojan.Unclassified/Dropper
C:\WINDOWS\SYSWOW64\NVSTREAMING.EXE

HarDsTyLeTyp 02.06.2011 17:14
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=bd049eacb0402e4b9a0708f3f88bb527
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-02 01:08:20
# local_time=2011-06-02 03:08:20 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1280 16777215 100 0 1704802 1704802 0 0
# compatibility_mode=5892 16776573 100 56 58908 144541889 0 0
# compatibility_mode=8192 67108863 100 0 122 122 0 0
# scanned=136309
# found=3
# cleaned=3
# scan_time=2116
C:\Program Files\OCRANA-IRC\programs\QuikLock.exe probably a variant of Win32/Agent.BAVVBWO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\OCRANA-IRC\system\bin\dll\nHTMLn_2.9.dll probably a variant of Win32/Adware.Agent.CZTDWWN application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\56bf0f5a-6aba8527 probably a variant of Win32/Agent.RPSVWU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=bd049eacb0402e4b9a0708f3f88bb527
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-02 03:46:55
# local_time=2011-06-02 05:46:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1280 16777215 100 0 1706995 1706995 0 0
# compatibility_mode=5892 16776573 100 56 61101 144544082 0 0
# compatibility_mode=8192 67108863 100 0 2315 2315 0 0
# scanned=236367
# found=4
# cleaned=0
# scan_time=9460
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\34524d4e-5d624d68 a variant of Java/Agent.AF trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19e4c9d4-50d2ff17 probably a variant of Java/Agent.BR trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\77ca675a-6293836a a variant of Java/Agent.BR trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3184dc7b-1d67fed3 a variant of Java/Exploit.Agent.W trojan (unable to clean) 00000000000000000000000000000000 I

cosinus 03.06.2011 10:13
Zitat:
C:\Program Files\OCRANA-IRC\programs\QuikLock.exe probably a variant of Win32/Agent.BAVVBWO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\OCRANA-IRC\system\bin\dll\nHTMLn_2.9.dll probably a variant of Win32/Adware.Agent.CZTDWWN application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
Wo hast du das eigentlich her? Ocrana IRC? :wtf:

HarDsTyLeTyp 03.06.2011 11:55
öhm ocrana irc ist wie mirc nur hübscher ^^ aber wenn man sich das heute saugt sind nur noch trojaner dabei :)
ist von nem berühmten clan gebaut wurden hxxp://www.ocrana.com/

cosinus 03.06.2011 14:37
Ich würde von sowas lieber die Finger lassen.
xchat ist zum chatten ganz gut und quelloffen => XChat ? Wikipedia

HarDsTyLeTyp 03.06.2011 17:26
ja ich habs damals für meine counterstrike zeit gebraucht nu benutz ich das aber auch nicht mehr :)
wie gehts denn nun weiter ? :)

cosinus 03.06.2011 19:11
Es wurden nur ein paar Überreste gefunden. Rechner wieder im Lot? Oder noch Probleme offen bzw. andere Funde in der Zwischenzeit?

HarDsTyLeTyp 03.06.2011 21:44
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\34524d4e-5d624d68 a variant of Java/Agent.AF trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19e4c9d4-50d2ff17 probably a variant of Java/Agent.BR trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\77ca675a-6293836a a variant of Java/Agent.BR trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\HarDsTyLe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3184dc7b-1d67fed3 a variant of Java/Exploit.Agent.W trojan (unable to clean) 00000000000000000000000000000000 I

das ist nix was eset gefunden hatte ?

cosinus 03.06.2011 22:39
Ich hab doch geschrieben ÜBERRESTE! Oder tauchen die jedesmal neu auf ohne dein Zutun=

HarDsTyLeTyp 03.06.2011 23:07
achso das solln überreste sein ^^ wust ich nicht öhm keine ahnung ob des immer wieder auftaucht :(
hab grad stinger wieder laufen lassen der meint das fake ding ist immer noch da ;/

hxxp://imageshack.us/photo/my-images/850/unbenanntpar.jpg/

cosinus 04.06.2011 11:44
Auf dem Bild kann ich nichts erkennen. Geht es auch größer? Statt imageshack annst du auch http://saved.im nutzen

HarDsTyLeTyp 04.06.2011 11:59
hxxp://saved.im/mtgzmzkwbgm3/unbenannt.html

cosinus 04.06.2011 12:25
Ich bin mir nicht sicher ob der Stinger sich da einen Fehlalarm geleistet hat. Den Stinger verwende ich nie.
Werte mal die vom Stinger jetzt angemeckerten Dateien bei Virustotal aus und poste die Ergebnislinks.

HarDsTyLeTyp 04.06.2011 15:51
File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:
MD5: f43a50b2fd91e872089f50dac29bf4e9
Date first seen: 2010-03-09 18:17:14 (UTC)
Date last seen: 2011-05-27 15:54:25 (UTC)
Detection ratio: 0/42

What do you wish to do?


Antivirus Version Last Update Result
AhnLab-V3 2011.06.04.00 2011.06.03 -
AntiVir 7.11.9.24 2011.06.04 -
Antiy-AVL 2.0.3.7 2011.06.04 -
Avast 4.8.1351.0 2011.06.04 -
Avast5 5.0.677.0 2011.06.04 -
AVG 10.0.0.1190 2011.06.04 -
BitDefender 7.2 2011.06.04 -
CAT-QuickHeal 11.00 2011.06.04 -
ClamAV 0.97.0.0 2011.06.04 -
Commtouch 5.3.2.6 2011.06.04 -
Comodo 8947 2011.06.04 -
DrWeb 5.0.2.03300 2011.06.04 -
Emsisoft 5.1.0.5 2011.06.04 -
eSafe 7.0.17.0 2011.06.02 -
eTrust-Vet 36.1.8366 2011.06.03 -
F-Prot 4.6.2.117 2011.06.03 -
F-Secure 9.0.16440.0 2011.06.04 -
Fortinet 4.2.257.0 2011.06.04 -
GData 22 2011.06.04 -
Ikarus T3.1.1.104.0 2011.06.04 -
Jiangmin 13.0.900 2011.06.01 -
K7AntiVirus 9.104.4763 2011.06.03 -
Kaspersky 9.0.0.837 2011.06.04 -
McAfee 5.400.0.1158 2011.06.04 -
McAfee-GW-Edition 2010.1D 2011.06.04 -
Microsoft 1.6903 2011.06.04 -
NOD32 6179 2011.06.04 -
Norman 6.07.07 2011.06.04 -
nProtect 2011-06-04.01 2011.06.04 -
Panda 10.0.3.5 2011.06.04 -
PCTools 7.0.3.5 2011.06.03 -
Prevx 3.0 2011.06.04 -
Rising 23.60.03.09 2011.06.03 -
Sophos 4.66.0 2011.06.04 -
SUPERAntiSpyware 4.40.0.1006 2011.06.04 -
Symantec 20111.1.0.186 2011.06.04 -
TheHacker 6.7.0.1.215 2011.06.02 -
TrendMicro 9.200.0.1012 2011.06.04 -
TrendMicro-HouseCall 9.200.0.1012 2011.06.04 -
VBA32 3.12.16.0 2011.06.03 -
VIPRE 9482 2011.06.04 -
ViRobot 2011.6.4.4496 2011.06.04 -
VirusBuster 14.0.67.1 2011.06.04 -

HarDsTyLeTyp 04.06.2011 15:52
k kp scheint nix zu sein °_°

cosinus 05.06.2011 12:16
Dann vergiss diesen Stinger mal schnell.
Rechner wieder im Lot?

HarDsTyLeTyp 05.06.2011 15:04
joa ich denke schon :)

frag mich nur warum das scheiss prog was anzeigt was gar nicht da ist

cosinus 05.06.2011 15:43
Sowas nennt man Fehlalarm.

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:47 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131