Trojaner-Board - Windows Recovery Entfernung unvollständig

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows Recovery Entfernung unvollständig (https://www.trojaner-board.de/99971-windows-recovery-entfernung-unvollstaendig.html)

Windows Recovery Entfernung unvollständig

Hallo liebe Forenmitglieder,

auch ich bin heute leider Opfer von "Windows Recovery" geworden. Ich habe auch bereits Maßnahmen durchgeführt, die ich den Foren entnommen habe.
Im Einzelnen waren dies:

-Ausführen von "rKill"

-Scan mittels "Malwarebytes' Anti-Malware"

-Ausführen von "Unhide" zum Sichtbarmachen der Dateien.

Es verbleiben noch folgende Probleme:

- Schwarzer Desktophintergrund (wohl weniger kritisch)

- Nicht alle installierten Programme werden angezeigt

- Windows Vista Recovery Link auf dem Desktop, verweist auf
C:\ProgramData\37019384.exe, diese Anwendung wird vom Virenprogramm (Sophos) als FakeAVCn-A bzw. FakeAV-F angezeigt

Anbei noch die log-Dateien von Defogger und OTL. Vielen Dank schonmal an alle! Gruß

Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:34 on 05/06/2011 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

OTL.txt:OTL Logfile:

Code:

OTL logfile created on: 05.06.2011 15:55:00 - Run 1

OTL by OldTimer - Version 3.2.23.0 Folder = D:\Diverses

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,75 Gb Total Physical Memory | 0,87 Gb Available Physical Memory | 49,97% Memory free

3,74 Gb Paging File | 2,67 Gb Available in Paging File | 71,27% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 69,05 Gb Total Space | 10,21 Gb Free Space | 14,79% Space Free | Partition Type: NTFS

Drive D: | 70,00 Gb Total Space | 46,68 Gb Free Space | 66,69% Space Free | Partition Type: NTFS

 

Computer Name: HAMMET | User Name: ***** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.06.05 15:47:34 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Diverses\OTL.exe

PRC - [2011.05.11 13:05:40 | 000,235,168 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10p_ActiveX.exe

PRC - [2011.04.12 10:31:49 | 000,748,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe

PRC - [2011.03.03 09:50:11 | 000,230,640 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe

PRC - [2011.03.03 09:50:08 | 000,439,536 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALMon.exe

PRC - [2011.03.03 09:48:26 | 001,541,360 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

PRC - [2011.03.03 09:47:23 | 000,097,520 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe

PRC - [2011.03.03 09:46:33 | 000,163,056 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

PRC - [2010.10.25 15:13:42 | 000,821,144 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

PRC - [2010.06.08 18:00:40 | 002,480,592 | ---- | M] (Vodafone D2 GmbH) -- C:\Programme\ArcorOnline\AOButler.exe

PRC - [2010.04.06 00:41:46 | 000,116,224 | ---- | M] (Brio) -- C:\Programme\FolderSize\FolderSizeSvc.exe

PRC - [2010.01.14 00:44:52 | 000,037,888 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Winamp\winampa.exe

PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

PRC - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.19 09:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2008.01.16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

PRC - [2007.10.11 08:45:56 | 000,051,712 | ---- | M] (ArcSoft) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

PRC - [2007.04.03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2007.02.14 03:54:16 | 000,081,920 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SLUTrayNotifier.exe

PRC - [2007.02.07 06:18:02 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe

PRC - [2007.02.05 20:48:14 | 000,692,224 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe

PRC - [2007.01.24 22:05:20 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

PRC - [2007.01.05 21:31:20 | 000,049,152 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

PRC - [2006.11.09 20:57:00 | 003,784,704 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2006.10.05 22:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.06.05 15:47:34 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Diverses\OTL.exe

MOD - [2011.03.03 09:49:47 | 000,234,408 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll

MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.05.18 11:21:08 | 003,275,864 | ---- | M] () [Auto | Running] -- c:\Programme\Common Files\Akamai\netsession_win_8832f4b.dll -- (Akamai)

SRV - [2011.03.03 09:50:11 | 000,230,640 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)

SRV - [2011.03.03 09:48:26 | 001,541,360 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)

SRV - [2011.03.03 09:47:23 | 000,097,520 | ---- | M] (Sophos Plc) [Unknown | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)

SRV - [2011.03.03 09:46:33 | 000,163,056 | ---- | M] (Sophos Plc) [Unknown | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)

SRV - [2010.04.06 00:41:46 | 000,116,224 | ---- | M] (Brio) [Auto | Running] -- C:\Program Files\FolderSize\FolderSizeSvc.exe -- (FolderSize)

SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)

SRV - [2007.10.11 08:45:56 | 000,051,712 | ---- | M] (ArcSoft) [Auto | Running] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2007.04.03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2007.02.14 03:54:20 | 000,073,728 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)

SRV - [2006.10.05 22:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.03.03 09:49:49 | 000,122,360 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\Windows\System32\drivers\savonaccess.sys -- (SAVOnAccess)

DRV - [2011.03.03 09:46:33 | 000,022,536 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\SophosBootDriver.sys -- (SophosBootDriver)

DRV - [2007.04.03 16:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2007.02.28 20:17:05 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)

DRV - [2007.02.08 10:22:28 | 002,315,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)

DRV - [2007.01.31 13:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)

DRV - [2007.01.24 05:18:32 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2007.01.24 03:03:28 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.01.24 02:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.01.18 14:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2006.12.20 03:01:00 | 000,050,688 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)

DRV - [2006.11.11 00:38:22 | 000,506,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2006.11.09 02:29:44 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2006.11.02 09:30:56 | 002,589,184 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw2v32.sys -- (NETw2v32) Intel(R)

DRV - [2005.02.23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Google"

FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p="

FF - prefs.js..network.proxy.backup.ftp: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.ftp_port: 80

FF - prefs.js..network.proxy.backup.gopher: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.gopher_port: 80

FF - prefs.js..network.proxy.backup.socks: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.socks_port: 80

FF - prefs.js..network.proxy.backup.ssl: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.ssl_port: 80

FF - prefs.js..network.proxy.ftp: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.ftp_port: 80

FF - prefs.js..network.proxy.gopher: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.gopher_port: 80

FF - prefs.js..network.proxy.http: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.http_port: 80

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.socks: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.socks_port: 80

FF - prefs.js..network.proxy.ssl: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.ssl_port: 80

 

FF - HKLM\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011.04.19 13:14:20 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.01 20:57:43 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.19 13:16:09 | 000,000,000 | ---D | M]

 

[2008.09.14 14:49:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions

[2011.04.10 09:48:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\01pqoj9f.default\extensions

[2009.07.11 15:22:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\01pqoj9f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.04.10 09:51:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2007.09.10 20:30:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2010.06.22 08:24:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.16 09:32:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.11.24 10:07:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.24 22:06:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

File not found (No name found) -- 

[2008.07.30 17:10:45 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

[2008.12.09 09:17:05 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

[2009.03.28 19:09:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

[2009.09.02 13:15:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

[2010.03.11 10:35:45 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

[2010.06.22 08:24:40 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.16 09:32:52 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.11.24 10:07:04 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.24 22:06:48 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.05.01 20:57:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Arcor Online] File not found

O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [] File not found

O4 - HKCU..\Run: [Adobe Acrobat Synchronizer] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe (Adobe Systems Incorporated)

O4 - HKCU..\Run: [Arcor Online] File not found

O4 - HKCU..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()

O4 - HKCU..\Run: [updateMgr] File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe ()

O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2008.11.23 14:16:06 | 000,000,000 | ---D | M] - D:\Auto -- [ NTFS ]

O33 - MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\Shell - "" = AutoRun

O33 - MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.06.05 11:30:25 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes

[2011.06.05 11:29:54 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.06.05 11:29:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.06.05 11:29:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.06.05 11:29:43 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.06.05 11:29:42 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.06.05 10:12:34 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery

[2011.06.04 15:11:29 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\ApplicationHistory

[2011.06.04 15:08:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP

[2011.06.03 14:25:36 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\XMedia Recode

[2011.06.03 11:47:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XMedia Recode

[2011.06.03 11:47:38 | 000,000,000 | ---D | C] -- C:\Programme\XMedia Recode

[2007.08.29 19:50:02 | 000,010,752 | ---- | C] (Arcor Online GmbH) -- C:\Users\*****\AppData\Local\cmdial32.dll

[2006.11.25 00:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll

[2006.11.25 00:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.06.05 15:42:03 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.06.05 15:42:02 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.06.05 15:41:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.06.05 15:41:45 | 1877,131,264 | -HS- | M] () -- C:\hiberfil.sys

[2011.06.05 15:40:41 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2011.06.05 14:06:11 | 000,000,022 | ---- | M] () -- C:\Users\*****\AppData\Local\cmdial32.ini

[2011.06.05 11:29:56 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.05 10:54:49 | 000,000,040 | ---- | M] () -- C:\ProgramData\~37019384

[2011.06.05 10:54:48 | 000,000,160 | ---- | M] () -- C:\ProgramData\~37019384r

[2011.06.05 10:39:32 | 000,000,336 | ---- | M] () -- C:\ProgramData\37019384

[2011.06.05 10:33:35 | 000,705,674 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.06.05 10:33:35 | 000,659,664 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.06.05 10:33:35 | 000,159,242 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.06.05 10:33:35 | 000,129,552 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.06.05 10:12:34 | 000,000,595 | ---- | M] () -- C:\Users\*****\Desktop\Windows Vista Recovery.lnk

[2011.06.04 15:13:19 | 000,001,721 | ---- | M] () -- C:\Users\*****\Desktop\dm Digi Foto.lnk

[2011.06.04 15:11:29 | 000,000,094 | ---- | M] () -- C:\Users\*****\AppData\Local\fusioncache.dat

[2011.06.03 13:44:49 | 929,507,328 | ---- | M] () -- C:\Users\*****\Desktop\Janosch_E13.mpeg

[2011.06.03 11:47:39 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\XMedia Recode.lnk

[2011.06.03 11:30:01 | 000,000,700 | ---- | M] () -- C:\Windows\tasks\zeitliche Überprüfung.job

[2011.05.31 19:54:43 | 000,088,576 | ---- | M] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.30 16:23:42 | 000,000,600 | ---- | M] () -- C:\Users\*****\PUTTY.RND

[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.06.05 15:24:16 | 000,001,822 | ---- | C] () -- C:\Users\Public\Desktop\WISO Sparbuch 2009.lnk

[2011.06.05 15:24:16 | 000,001,664 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2011.06.05 15:24:16 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\Picasa 3.lnk

[2011.06.05 15:24:16 | 000,000,883 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular - Screenreadermodus.lnk

[2011.06.05 15:24:16 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\XMedia Recode.lnk

[2011.06.05 15:24:16 | 000,000,839 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular.lnk

[2011.06.05 15:24:16 | 000,000,777 | ---- | C] () -- C:\Users\Public\Desktop\CanoScan Toolbox 4.9.lnk

[2011.06.05 15:24:15 | 000,001,828 | ---- | C] () -- C:\Users\Public\Desktop\Arcor Online.lnk

[2011.06.05 11:29:56 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.05 10:54:48 | 000,000,160 | ---- | C] () -- C:\ProgramData\~37019384r

[2011.06.05 10:54:48 | 000,000,040 | ---- | C] () -- C:\ProgramData\~37019384

[2011.06.05 10:12:34 | 000,000,595 | ---- | C] () -- C:\Users\*****\Desktop\Windows Vista Recovery.lnk

[2011.06.05 10:12:25 | 000,000,336 | ---- | C] () -- C:\ProgramData\37019384

[2011.06.04 15:11:29 | 000,000,094 | ---- | C] () -- C:\Users\*****\AppData\Local\fusioncache.dat

[2011.06.03 11:51:41 | 929,507,328 | ---- | C] () -- C:\Users\*****\Desktop\Janosch_E13.mpeg

[2011.04.13 17:17:26 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll

[2011.04.13 17:17:26 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe

[2009.10.01 09:07:02 | 000,011,264 | ---- | C] () -- C:\Windows\System32\KOAZ8J_L.DLL

[2009.09.19 19:49:26 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.19 19:49:26 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.09.12 13:57:50 | 000,010,567 | R--- | C] () -- C:\Windows\hpwscr19.dat

[2009.09.12 13:55:55 | 000,203,453 | ---- | C] () -- C:\Windows\hpwins19.dat

[2009.03.16 20:48:34 | 000,598,016 | ---- | C] () -- C:\Windows\System32\viscomqtde.dll

[2009.03.16 20:48:34 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll

[2008.10.12 11:57:05 | 000,000,000 | ---- | C] () -- C:\Windows\tm.ini

[2008.08.11 20:31:34 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat

[2008.08.11 20:31:34 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat

[2008.08.11 20:31:34 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat

[2008.08.11 20:31:34 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat

[2008.08.11 20:31:34 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat

[2008.08.11 20:31:34 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat

[2008.08.11 20:31:34 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat

[2008.08.11 20:31:34 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat

[2008.08.11 20:31:34 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat

[2008.08.11 20:31:34 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat

[2008.08.11 20:31:34 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat

[2008.08.11 20:31:34 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat

[2008.08.11 20:31:34 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini

[2008.08.11 20:31:33 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat

[2008.08.11 20:31:33 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat

[2008.08.11 20:31:33 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat

[2008.08.11 20:31:33 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat

[2008.08.11 20:31:33 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat

[2008.08.11 20:31:33 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat

[2008.08.07 14:39:06 | 000,000,052 | ---- | C] () -- C:\Windows\wiseftp.ini

[2008.08.06 15:17:31 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.07.19 13:30:59 | 000,000,791 | ---- | C] () -- C:\Windows\wiso.ini

[2008.02.04 18:23:10 | 000,693,792 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL

[2008.01.07 00:08:10 | 000,000,997 | R--- | C] () -- C:\Windows\hpwmdl19.dat

[2007.12.18 11:44:54 | 000,016,384 | ---- | C] () -- C:\Windows\System32\FileOps.exe

[2007.12.01 16:27:17 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2007.11.30 19:33:17 | 000,000,022 | ---- | C] () -- C:\Users\*****\AppData\Local\cmdial32.ini

[2007.08.01 16:25:27 | 000,000,389 | ---- | C] () -- C:\Windows\OPLN.INI

[2007.06.24 14:01:30 | 000,088,576 | ---- | C] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.04.03 16:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll

[2007.02.28 20:27:59 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini

[2007.02.28 20:27:59 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini

[2007.02.28 20:27:14 | 000,221,184 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe

[2007.02.28 20:13:14 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2007.02.28 20:10:32 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IhDEV.exe

[2007.02.28 20:10:32 | 000,024,576 | ---- | C] () -- C:\Windows\System32\IhINF.exe

[2007.02.28 20:09:05 | 000,002,744 | ---- | C] () -- C:\Windows\System32\drivers\HDACfg.dat

[2007.02.28 20:09:04 | 000,049,152 | ---- | C] () -- C:\Windows\System32\ChCfg.exe

[2007.02.28 19:48:18 | 000,705,674 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2007.02.28 19:48:18 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2007.02.28 19:48:18 | 000,159,242 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2007.02.28 19:48:18 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2007.02.28 19:39:32 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll

[2007.02.28 19:39:25 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2007.02.28 19:39:20 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat

[2007.02.28 19:39:19 | 000,145,112 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2007.02.16 02:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll

[2006.11.30 03:00:30 | 000,045,056 | ---- | C] () -- C:\Windows\System32\MAWebControl.exe

[2006.11.30 03:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll

[2006.11.21 23:43:46 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll

[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:37 | 000,388,832 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:33:01 | 000,659,664 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,129,552 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.10.09 20:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll

[2001.11.14 22:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

 

< End of report >

--- --- ---

Extras.txt:OTL Logfile:

Code:

OTL Extras logfile created on: 05.06.2011 15:55:00 - Run 1

OTL by OldTimer - Version 3.2.23.0 Folder = D:\Diverses

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,75 Gb Total Physical Memory | 0,87 Gb Available Physical Memory | 49,97% Memory free

3,74 Gb Paging File | 2,67 Gb Available in Paging File | 71,27% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 69,05 Gb Total Space | 10,21 Gb Free Space | 14,79% Space Free | Partition Type: NTFS

Drive D: | 70,00 Gb Total Space | 46,68 Gb Free Space | 66,69% Space Free | Partition Type: NTFS

 

Computer Name: HAMMET | User Name: ****** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.bat [@ = batfile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

"" = 

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{77427A9D-75D5-4F52-9915-0F34512C3D80}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 

"{80A6FE1E-6AA9-41FE-9C49-E82D90A99923}" = lport=49167 | protocol=6 | dir=in | name=akamai netsession interface | 

"{90A18BC7-3304-4916-972F-8E5D13AFF24E}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{435A4548-961E-4AF6-8C4E-C5D7C61BDAE5}" = protocol=6 | dir=in | app=c:\program files\sophos\sophos anti-virus\savmain.exe | 

"{4CF4F79B-AD04-43FC-83B0-F25C82FFBE98}" = protocol=17 | dir=in | app=c:\program files\sophos\sophos anti-virus\savmain.exe | 

"{57D44031-3B53-4EEF-B5EA-9C8DB1752DDD}" = protocol=6 | dir=in | app=c:\program files\cyanide\gamecenter\gamecenter.exe | 

"{830894BE-6843-42A2-AEE7-63EC3E60EDBE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{B434C09B-A2CD-47BB-AC6F-33943A20D596}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{D7A6F8B4-4DEF-44DF-80FD-1DABE8D6728D}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{D84C0C00-D5E0-46EE-902D-2C3743F7803D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{F3264A17-74BC-4B83-878D-A37948908699}" = protocol=17 | dir=in | app=c:\program files\cyanide\gamecenter\gamecenter.exe | 

"{F637C13C-BDC9-4943-8ED3-15B54BFF61E0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"TCP Query User{02880F23-4D96-4923-BA76-8F297A34C2FC}C:\cygwin\bin\xwin.exe" = protocol=6 | dir=in | app=c:\cygwin\bin\xwin.exe | 

"TCP Query User{52562863-EBF7-413A-B0F0-1C0DAA90A8E6}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{549F1FD4-3180-4649-BE8E-310961D02215}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 

"TCP Query User{77F1C523-4219-4B56-B00F-0040F0AA21D4}C:\users\******\desktop\duke\2.0\dukesterx.exe" = protocol=6 | dir=in | app=c:\users\******\desktop\duke\2.0\dukesterx.exe | 

"TCP Query User{96F83688-FC26-4916-BEA6-5D6303A07235}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"TCP Query User{AC5FE184-402C-492F-96BD-B39DB1578E46}C:\program files\winscp\winscp.exe" = protocol=6 | dir=in | app=c:\program files\winscp\winscp.exe | 

"UDP Query User{3B2965A9-AC71-4DD0-B14C-0D0E8EA129DE}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 

"UDP Query User{481218D3-84DE-4753-AB21-E5A66BF90507}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{4F3424CC-4C17-47E6-A29D-0C56FFB4EB0B}C:\program files\winscp\winscp.exe" = protocol=17 | dir=in | app=c:\program files\winscp\winscp.exe | 

"UDP Query User{A48C2227-A0DA-44EB-A290-6C342688C12E}C:\users\******\desktop\duke\2.0\dukesterx.exe" = protocol=17 | dir=in | app=c:\users\******\desktop\duke\2.0\dukesterx.exe | 

"UDP Query User{B5570F74-C985-4A07-B305-DFDF3EBE6516}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{DBA75355-3188-4738-BC1B-AA503E57043C}C:\cygwin\bin\xwin.exe" = protocol=17 | dir=in | app=c:\cygwin\bin\xwin.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Sparbuch 2009

"{0212BFBB-50BA-C4FA-D700-DFBB40A9F1AF}" = Catalyst Control Center Localization Arabic

"{0219FD21-8B2E-240B-3D35-997EE0E3F81B}" = Catalyst Control Center Localization Arabic

"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

"{047ACAF8-7642-4940-8EC6-4694E0E60B40}" = CCC Help French

"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{06F42C96-A96C-F579-B0FA-F44BBA118C51}" = ccc-core-static

"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)

"{0A5825FD-0FB7-4e45-9037-858D463F2943}" = BPDSoftware

"{0BB96994-EA3F-D659-6A3B-D2D73FEBD8E4}" = ccc-utility

"{0C1D06CD-D5D1-A718-5C8F-27D089C5C39C}" = Catalyst Control Center Localization Finnish

"{0DF36AB1-1B4C-CAEC-A23E-EFA25738B60A}" = CCC Help Greek

"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox

"{110D7DC8-9237-47D3-AB39-50651A10304C}" = SamsungScreensaver

"{12080F61-1225-BCDE-EFE2-3452E826D9AD}" = Catalyst Control Center Graphics Light

"{143539DF-6F6E-9E25-3EDF-0906C7F533B7}" = CCC Help Korean

"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution II

"{148806DB-3E2E-4A2E-D7F8-223EFA43C350}" = Catalyst Control Center Graphics Full New

"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate

"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager

"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService

"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter

"{195F2C6C-A343-4b10-B1A4-3F00AB9E9DD9}" = Fax

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20CD8D4B-74ED-BED9-805C-6F4FBE6B4F01}" = ccc-localization-da

"{262DA23B-4BAB-463F-B1DC-9B5287CAB5CA}}_is1" = Deinstallation der Arcor Online Software

"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 23

"{2951A232-69BA-4925-BB9A-CEEB72B18B4F}" = BPDSoftware_Ini

"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support

"{31ACBC65-C234-BD71-3FCE-520EC0138635}" = CCC Help Norwegian

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor

"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant

"{398E8625-6F3A-4C54-B54C-28F0ABB89774}" = BPD_HPSU

"{3AB54293-0366-7D73-D97E-3DB689A72E4A}" = CCC Help Danish

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3DC4A72C-B683-5733-8A2C-136FBB5619D6}" = Catalyst Control Center Localization German

"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager

"{47EDD638-F882-A248-FBA5-B0CCBB9175D8}" = CCC Help Spanish

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2

"{4D6125BF-2586-9175-24FE-854DD6F6F08F}" = CCC Help Hungarian

"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0

"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies

"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC

"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery

"{52FE8F38-057E-26C5-DF29-935DE6E218E0}" = Catalyst Control Center Localization Japanese

"{5579A7B8-F48A-C2F5-75D0-F67CDFD68461}" = Catalyst Control Center Core Implementation

"{572F2A62-70CD-4429-8758-6D4D6DC696E1}" = 4500_Help

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5A4BB8B6-8BE7-A8AF-528C-55A50DD18497}" = Catalyst Control Center Localization Arabic

"{5AA05616-21D6-63D5-CA68-73200B161599}" = CCC Help Czech

"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp

"{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan

"{5E99C53A-D37E-CEA5-0398-329F15494618}" = Catalyst Control Center Graphics Full Existing

"{64536DB8-3247-4489-6BC3-BCD0DCC74810}" = Catalyst Control Center Localization Spanish

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6697D99E-E550-4498-B793-4A8DD8A1821F}" = ProductContext

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{6815FCDD-401D-481E-BA88-31B4754C2B46}" = Macromedia Flash Player 8

"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus

"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6BD4EDE4-053E-FC85-AFC2-58306952BDBD}" = Catalyst Control Center Localization French

"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder

"{6F6D2DE6-44FA-EAF4-0028-7FAE37A76B4C}" = CCC Help Turkish

"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager

"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}" = SSH Secure Shell

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{78E2F10D-4A74-A354-3D41-CF439A501AE5}" = CCC Help Italian

"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan

"{8448A09D-0E2A-4EFA-6A16-AFA374AE088F}" = Catalyst Control Center Graphics Previews Vista

"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{87858FF1-3D1C-301A-0C62-62F977659969}" = Catalyst Control Center Localization Italian

"{8799B11A-0E01-1729-B527-802A3513BEE7}" = CCC Help Polish

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A51FE4C-7DC6-8C9B-67D7-8536B7413BFE}" = Catalyst Control Center Localization Korean

"{8A92CE03-CEEB-145D-1F8D-FBC0DDE0CDEF}" = CCC Help Finnish

"{8ED71B2B-8228-EFF8-B566-890D771A6A98}" = CCC Help Swedish

"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007

"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0015-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0410-0000-0000000FF1CE}_PROPLUS_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}_PROPLUS_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0407-0000-0000000FF1CE}_PROPLUS_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs

"{903194A5-E1E4-E56B-8B3C-C52664CD6A65}" = CCC Help Japanese

"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components

"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}" = Adobe Illustrator CS

"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation

"{95CCAA64-028C-FF26-B553-3401EA3B137B}" = CCC Help Chinese Standard

"{98C0E007-7225-550C-BD4D-16A53171FA5B}" = CCC Help Chinese Traditional

"{99825ADC-3BAC-40C6-3FA1-A80496C5FE4D}" = CCC Help German

"{99FBF341-96A4-6E6B-F098-F5318F74FD8B}" = Catalyst Control Center Localization Hungarian

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-

"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus

"{9AEE384F-4CEB-9FD4-0ECA-5A2A5FF3FC65}" = Catalyst Control Center Localization Arabic

"{A0A703E5-975D-8426-B654-A3C86EEA771F}" = Catalyst Control Center Localization Greek

"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status

"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175

"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3400

"{A2E2B102-C07F-2D6A-F826-FBE911583029}" = Catalyst Control Center Localization Arabic

"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter

"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AB8465B2-8971-83AA-72AC-08C870CAB14B}" = CCC Help English

"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch

"{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}" = Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista

"{B57D54D5-BE8F-152A-3DDA-2CCC34916ABB}" = Catalyst Control Center Localization Czech

"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply

"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide

"{C2F84222-A797-3ADB-F73F-F9FEA356365E}" = Catalyst Control Center Localization Chinese Standard

"{C5DC24CC-98D8-3714-20DE-F3154692CAC1}" = CCC Help Portuguese

"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = CanoScan Toolbox Ver4.9

"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg

"{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340

"{CD0773D5-C18E-495c-B39B-21A96415EDD5}" = HP Officejet J4500 Series

"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D142FE39-3386-4d82-9AD3-36D4A92AC3C2}" = DocMgr

"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch

"{D6339BC5-BD2E-580C-0A9E-EF09B768C891}" = CCC Help Thai

"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component

"{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update

"{DDFA8768-E4A8-4EFA-637B-DF23DC3EFD04}" = Catalyst Control Center Localization Chinese Traditional

"{DF1F4246-C7DF-7C15-6BBD-211E768EB715}" = Catalyst Control Center Localization Arabic

"{E481BC06-6BBB-093B-728A-C8EEB98E1E47}" = Catalyst Control Center Localization Arabic

"{E5BED6AE-BEF7-8504-38DB-F881A526F5C2}" = Skins

"{EC69E8A3-A20F-E735-968A-CE6D4E1FA857}" = CCC Help Russian

"{ED8EACD0-3B35-AA21-DA10-6372AB6D19CA}" = CCC Help Dutch

"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer

"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client

"{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}" = Folder Size for Windows

"{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now

"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer

"{FDEC11CC-4BD6-4a8c-A398-3CCD8E43EACA}" = J4500

"{FF602681-E2E7-9FFF-9752-3B0F8E7D38F1}" = Catalyst Control Center Localization Arabic

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"Agere Systems Soft Modem" = Agere Systems HDA Modem

"Akamai" = Akamai NetSession Interface

"ATI Uninstaller" = ATI Uninstaller

"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2

"dm Digi Foto" = dm Digi Foto

"DSMT6" = MathType 6

"Dukester X 2.0 (Preview 1.3)_is1" = DukesterX 2.0.13

"easy-AAA Version 10.02_is1" = easy-AAA Version 10.02 (03.06.2010)

"easy-AZA Version 11.03_is1" = easy-AZA Version 11.03 (15.02.2011)

"ElsterFormular für Privatanwender und Unternehmer 11.5.3.5585" = ElsterFormular für Privatanwender und Unternehmer

"German Cym Team DB v1.1" = German Cym Team DB v1.1

"HP Document Manager" = HP Document Manager 1.0

"HP Imaging Device Functions" = HP Imaging Device Functions 10.0

"HP Smart Web Printing" = HP Smart Web Printing

"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0

"HPExtendedCapabilities" = HP Customer Participation Program 10.0

"HPOCR" = OCR Software by I.R.I.S. 10.0

"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0

"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus

"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation

"InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft SQL Server 2005" = Microsoft SQL Server 2005

"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)

"PartyPokerNet" = PartyPokerNet

"PDFTK Builder_is1" = PDFTK Builder 3.5.3

"Picasa 3" = Picasa 3

"PROHYBRIDR" = 2007 Microsoft Office system

"PROPLUS" = Microsoft Office Professional Plus 2007

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Shop for HP Supplies" = Shop for HP Supplies

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Unlocker" = Unlocker 1.8.7

"VLC media player" = VideoLAN VLC media player 0.8.6c

"Winamp" = Winamp

"WinRAR archiver" = WinRAR

"winscp3_is1" = WinSCP 4.0.3

"XMedia Recode" = XMedia Recode 2.3.3.3

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Winamp Detect" = Winamp Erkennungs-Plug-in

 
 ========== Last 10 Event Log Errors ==========

 

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

 

< End of report >

--- --- ---

Poste bitte alle Logs von malwarebytes.
Außerdem bräuchten wir einen OTL-CustomScan, du hast "nur" einen normalen gemacht. Die Logs entweder anhängen oder per CODE-Tags umschlossen posten.

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hallo Arne,

danke für die schnelle Antwort. Hier also die log-files von MBAM:

Code:

Malwarebytes' Anti-Malware 1.51.0.1200

Malwarebytes : Free anti-malware, anti-virus and spyware removal download
 

Datenbank Version: 6774
 

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421
 

05.06.2011 13:58:27

mbam-log-2011-06-05 (13-58-27).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Durchsuchte Objekte: 331976

Laufzeit: 2 Stunde(n), 25 Minute(n), 28 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 1

Infizierte Dateiobjekte der Registrierung: 1

Infizierte Verzeichnisse: 0

Infizierte Dateien: 3
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UjwpqfVIXBAeRvl (Trojan.FakeMS) -> Value: UjwpqfVIXBAeRvl -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\programdata\ujwpqfvixbaervl.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\programdata\37019384.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\Windows\System32\drivers\616B5E0.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.

Code:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org
 

Datenbank Version: 6774
 

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421
 

05.06.2011 14:24:15

mbam-log-2011-06-05 (14-24-15).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 159095

Laufzeit: 14 Minute(n), 39 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Nun noch das log-file des CustomScan mit OTL:

OTL Logfile:

Code:

OTL logfile created on: 05.06.2011 22:13:23 - Run 2

OTL by OldTimer - Version 3.2.23.0     Folder = D:\Diverses

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,75 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 57,56% Memory free

3,74 Gb Paging File | 2,43 Gb Available in Paging File | 64,90% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 69,05 Gb Total Space | 9,94 Gb Free Space | 14,40% Space Free | Partition Type: NTFS

Drive D: | 70,00 Gb Total Space | 46,68 Gb Free Space | 66,69% Space Free | Partition Type: NTFS

 

Computer Name: HAMMET | User Name: ****** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.06.05 15:47:34 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Diverses\OTL.exe

PRC - [2011.05.11 13:05:40 | 000,235,168 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10p_ActiveX.exe

PRC - [2011.03.03 09:50:11 | 000,230,640 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe

PRC - [2011.03.03 09:50:08 | 000,439,536 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\AutoUpdate\ALMon.exe

PRC - [2011.03.03 09:48:26 | 001,541,360 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

PRC - [2011.03.03 09:47:23 | 000,097,520 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe

PRC - [2011.03.03 09:46:33 | 000,163,056 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

PRC - [2010.10.25 15:13:42 | 000,821,144 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

PRC - [2010.10.25 15:13:40 | 000,329,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe

PRC - [2010.06.08 18:00:40 | 002,480,592 | ---- | M] (Vodafone D2 GmbH) -- C:\Programme\ArcorOnline\AOButler.exe

PRC - [2010.04.06 00:41:46 | 000,116,224 | ---- | M] (Brio) -- C:\Programme\FolderSize\FolderSizeSvc.exe

PRC - [2010.01.14 00:44:52 | 000,037,888 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Winamp\winampa.exe

PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

PRC - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.19 09:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2008.01.16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

PRC - [2007.10.11 08:45:56 | 000,051,712 | ---- | M] (ArcSoft) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

PRC - [2007.04.03 16:18:14 | 001,537,064 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\vpngui.exe

PRC - [2007.04.03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2007.02.14 03:54:16 | 000,081,920 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SLUTrayNotifier.exe

PRC - [2007.02.07 06:18:02 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe

PRC - [2007.02.05 20:48:14 | 000,692,224 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe

PRC - [2007.01.24 22:05:20 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

PRC - [2007.01.05 21:31:20 | 000,049,152 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

PRC - [2006.11.09 20:57:00 | 003,784,704 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2006.10.05 22:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.06.05 15:47:34 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Diverses\OTL.exe

MOD - [2011.03.03 09:49:47 | 000,234,408 | ---- | M] (Sophos Plc) -- C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll

MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.05.18 11:21:08 | 003,275,864 | ---- | M] () [Auto | Running] -- c:\Programme\Common Files\Akamai\netsession_win_8832f4b.dll -- (Akamai)

SRV - [2011.03.03 09:50:11 | 000,230,640 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)

SRV - [2011.03.03 09:48:26 | 001,541,360 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)

SRV - [2011.03.03 09:47:23 | 000,097,520 | ---- | M] (Sophos Plc) [Unknown | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)

SRV - [2011.03.03 09:46:33 | 000,163,056 | ---- | M] (Sophos Plc) [Unknown | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)

SRV - [2010.04.06 00:41:46 | 000,116,224 | ---- | M] (Brio) [Auto | Running] -- C:\Program Files\FolderSize\FolderSizeSvc.exe -- (FolderSize)

SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)

SRV - [2007.10.11 08:45:56 | 000,051,712 | ---- | M] (ArcSoft) [Auto | Running] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2007.04.03 16:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2007.02.14 03:54:20 | 000,073,728 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)

SRV - [2006.10.05 22:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.03.03 09:49:49 | 000,122,360 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\Windows\System32\drivers\savonaccess.sys -- (SAVOnAccess)

DRV - [2011.03.03 09:46:33 | 000,022,536 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\SophosBootDriver.sys -- (SophosBootDriver)

DRV - [2007.04.03 16:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2007.02.28 20:17:05 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)

DRV - [2007.02.08 10:22:28 | 002,315,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)

DRV - [2007.01.31 13:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)

DRV - [2007.01.24 05:18:32 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2007.01.24 03:03:28 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.01.24 02:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.01.18 14:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2006.12.20 03:01:00 | 000,050,688 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)

DRV - [2006.11.11 00:38:22 | 000,506,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2006.11.09 02:29:44 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2006.11.02 09:30:56 | 002,589,184 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw2v32.sys -- (NETw2v32) Intel(R)

DRV - [2005.02.23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Google"

FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p="

FF - prefs.js..network.proxy.backup.ftp: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.ftp_port: 80

FF - prefs.js..network.proxy.backup.gopher: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.gopher_port: 80

FF - prefs.js..network.proxy.backup.socks: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.socks_port: 80

FF - prefs.js..network.proxy.backup.ssl: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.backup.ssl_port: 80

FF - prefs.js..network.proxy.ftp: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.ftp_port: 80

FF - prefs.js..network.proxy.gopher: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.gopher_port: 80

FF - prefs.js..network.proxy.http: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.http_port: 80

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.socks: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.socks_port: 80

FF - prefs.js..network.proxy.ssl: "proxy.tu-darmstadt.de"

FF - prefs.js..network.proxy.ssl_port: 80

 

FF - HKLM\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011.04.19 13:14:20 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.01 20:57:43 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.19 13:16:09 | 000,000,000 | ---D | M]

 

[2008.09.14 14:49:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Extensions

[2011.04.10 09:48:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\01pqoj9f.default\extensions

[2009.07.11 15:22:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\01pqoj9f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.04.10 09:51:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2007.09.10 20:30:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2010.06.22 08:24:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.16 09:32:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.11.24 10:07:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.24 22:06:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

File not found (No name found) -- 

[2008.07.30 17:10:45 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

[2008.12.09 09:17:05 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

[2009.03.28 19:09:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

[2009.09.02 13:15:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

[2010.03.11 10:35:45 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

[2010.06.22 08:24:40 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.16 09:32:52 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.11.24 10:07:04 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.24 22:06:48 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.05.01 20:57:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Arcor Online]  File not found

O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: []  File not found

O4 - HKCU..\Run: [Adobe Acrobat Synchronizer] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe (Adobe Systems Incorporated)

O4 - HKCU..\Run: [Arcor Online]  File not found

O4 - HKCU..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()

O4 - HKCU..\Run: [updateMgr]  File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe ()

O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2008.11.23 14:16:06 | 000,000,000 | ---D | M] - D:\Auto -- [ NTFS ]

O33 - MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\Shell - "" = AutoRun

O33 - MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: ccc-core-static - msiexec /fums {06F42C96-A96C-F579-B0FA-F44BBA118C51} /qb

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.06.05 11:30:25 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Roaming\Malwarebytes

[2011.06.05 11:29:54 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.06.05 11:29:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.06.05 11:29:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.06.05 11:29:43 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.06.05 11:29:42 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.06.05 10:12:34 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery

[2011.06.04 15:11:29 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Local\ApplicationHistory

[2011.06.04 15:08:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP

[2011.06.03 14:25:36 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Roaming\XMedia Recode

[2011.06.03 11:47:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XMedia Recode

[2011.06.03 11:47:38 | 000,000,000 | ---D | C] -- C:\Programme\XMedia Recode

[2007.08.29 19:50:02 | 000,010,752 | ---- | C] (Arcor Online GmbH) -- C:\Users\******\AppData\Local\cmdial32.dll

[2006.11.25 00:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll

[2006.11.25 00:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.06.05 22:07:30 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.06.05 22:07:30 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.06.05 22:07:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.06.05 16:34:11 | 000,000,000 | ---- | M] () -- C:\Users\******\defogger_reenable

[2011.06.05 15:41:45 | 1877,131,264 | -HS- | M] () -- C:\hiberfil.sys

[2011.06.05 15:40:41 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2011.06.05 14:06:11 | 000,000,022 | ---- | M] () -- C:\Users\******\AppData\Local\cmdial32.ini

[2011.06.05 11:29:56 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.05 10:33:35 | 000,705,674 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.06.05 10:33:35 | 000,659,664 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.06.05 10:33:35 | 000,159,242 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.06.05 10:33:35 | 000,129,552 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.06.05 10:12:34 | 000,000,595 | ---- | M] () -- C:\Users\******\Desktop\Windows Vista Recovery.lnk

[2011.06.04 15:13:19 | 000,001,721 | ---- | M] () -- C:\Users\******\Desktop\dm Digi Foto.lnk

[2011.06.04 15:11:29 | 000,000,094 | ---- | M] () -- C:\Users\******\AppData\Local\fusioncache.dat

[2011.06.03 13:44:49 | 929,507,328 | ---- | M] () -- C:\Users\******\Desktop\Janosch_E13.mpeg

[2011.06.03 11:47:39 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\XMedia Recode.lnk

[2011.06.03 11:30:01 | 000,000,700 | ---- | M] () -- C:\Windows\tasks\zeitliche Überprüfung.job

[2011.05.31 19:54:43 | 000,088,576 | ---- | M] () -- C:\Users\******\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.30 16:23:42 | 000,000,600 | ---- | M] () -- C:\Users\******\PUTTY.RND

[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.06.05 16:34:11 | 000,000,000 | ---- | C] () -- C:\Users\******\defogger_reenable

[2011.06.05 15:24:16 | 000,001,822 | ---- | C] () -- C:\Users\Public\Desktop\WISO Sparbuch 2009.lnk

[2011.06.05 15:24:16 | 000,001,664 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2011.06.05 15:24:16 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\Picasa 3.lnk

[2011.06.05 15:24:16 | 000,000,883 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular - Screenreadermodus.lnk

[2011.06.05 15:24:16 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\XMedia Recode.lnk

[2011.06.05 15:24:16 | 000,000,839 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular.lnk

[2011.06.05 15:24:16 | 000,000,777 | ---- | C] () -- C:\Users\Public\Desktop\CanoScan Toolbox 4.9.lnk

[2011.06.05 15:24:15 | 000,001,828 | ---- | C] () -- C:\Users\Public\Desktop\Arcor Online.lnk

[2011.06.05 11:29:56 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.06.05 10:12:34 | 000,000,595 | ---- | C] () -- C:\Users\******\Desktop\Windows Vista Recovery.lnk

[2011.06.04 15:11:29 | 000,000,094 | ---- | C] () -- C:\Users\******\AppData\Local\fusioncache.dat

[2011.06.03 11:51:41 | 929,507,328 | ---- | C] () -- C:\Users\******\Desktop\Janosch_E13.mpeg

[2011.04.13 17:17:26 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll

[2011.04.13 17:17:26 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe

[2009.10.01 09:07:02 | 000,011,264 | ---- | C] () -- C:\Windows\System32\KOAZ8J_L.DLL

[2009.09.19 19:49:26 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.19 19:49:26 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.09.12 13:57:50 | 000,010,567 | R--- | C] () -- C:\Windows\hpwscr19.dat

[2009.09.12 13:55:55 | 000,203,453 | ---- | C] () -- C:\Windows\hpwins19.dat

[2009.03.16 20:48:34 | 000,598,016 | ---- | C] () -- C:\Windows\System32\viscomqtde.dll

[2009.03.16 20:48:34 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll

[2008.10.12 11:57:05 | 000,000,000 | ---- | C] () -- C:\Windows\tm.ini

[2008.08.11 20:31:34 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat

[2008.08.11 20:31:34 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat

[2008.08.11 20:31:34 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat

[2008.08.11 20:31:34 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat

[2008.08.11 20:31:34 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat

[2008.08.11 20:31:34 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat

[2008.08.11 20:31:34 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat

[2008.08.11 20:31:34 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat

[2008.08.11 20:31:34 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat

[2008.08.11 20:31:34 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat

[2008.08.11 20:31:34 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat

[2008.08.11 20:31:34 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat

[2008.08.11 20:31:34 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini

[2008.08.11 20:31:33 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat

[2008.08.11 20:31:33 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat

[2008.08.11 20:31:33 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat

[2008.08.11 20:31:33 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat

[2008.08.11 20:31:33 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat

[2008.08.11 20:31:33 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat

[2008.08.07 14:39:06 | 000,000,052 | ---- | C] () -- C:\Windows\wiseftp.ini

[2008.08.06 15:17:31 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.07.19 13:30:59 | 000,000,791 | ---- | C] () -- C:\Windows\wiso.ini

[2008.02.04 18:23:10 | 000,693,792 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL

[2008.01.07 00:08:10 | 000,000,997 | R--- | C] () -- C:\Windows\hpwmdl19.dat

[2007.12.18 11:44:54 | 000,016,384 | ---- | C] () -- C:\Windows\System32\FileOps.exe

[2007.12.01 16:27:17 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2007.11.30 19:33:17 | 000,000,022 | ---- | C] () -- C:\Users\******\AppData\Local\cmdial32.ini

[2007.08.01 16:25:27 | 000,000,389 | ---- | C] () -- C:\Windows\OPLN.INI

[2007.06.24 14:01:30 | 000,088,576 | ---- | C] () -- C:\Users\******\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.04.03 16:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll

[2007.02.28 20:27:59 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini

[2007.02.28 20:27:59 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini

[2007.02.28 20:27:14 | 000,221,184 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe

[2007.02.28 20:13:14 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2007.02.28 20:10:32 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IhDEV.exe

[2007.02.28 20:10:32 | 000,024,576 | ---- | C] () -- C:\Windows\System32\IhINF.exe

[2007.02.28 20:09:05 | 000,002,744 | ---- | C] () -- C:\Windows\System32\drivers\HDACfg.dat

[2007.02.28 20:09:04 | 000,049,152 | ---- | C] () -- C:\Windows\System32\ChCfg.exe

[2007.02.28 19:48:18 | 000,705,674 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2007.02.28 19:48:18 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2007.02.28 19:48:18 | 000,159,242 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2007.02.28 19:48:18 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2007.02.28 19:39:32 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll

[2007.02.28 19:39:25 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2007.02.28 19:39:20 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat

[2007.02.28 19:39:19 | 000,145,112 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2007.02.16 02:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll

[2006.11.30 03:00:30 | 000,045,056 | ---- | C] () -- C:\Windows\System32\MAWebControl.exe

[2006.11.30 03:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll

[2006.11.21 23:43:46 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll

[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:37 | 000,388,832 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:33:01 | 000,659,664 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,129,552 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.10.09 20:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll

[2001.11.14 22:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

 
 ========== LOP Check ==========

 

[2008.07.19 12:48:17 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Buhl Data Service

[2007.07.19 16:36:53 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Canon

[2008.02.14 14:07:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Design Science

[2011.01.07 19:19:54 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\elsterformular

[2010.11.25 15:05:23 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\FileZilla

[2011.06.04 15:13:37 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Imaxel

[2007.10.06 20:27:42 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\NCH Swift Sound

[2008.08.11 21:08:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Panasonic

[2011.02.14 18:29:15 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\PixelPlanet

[2008.05.29 23:04:40 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Pro Cycling Manager 2007

[2011.06.03 14:25:36 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\XMedia Recode

[2011.06.05 15:40:43 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011.06.03 11:30:01 | 000,000,700 | ---- | M] () -- C:\Windows\Tasks\zeitliche Überprüfung.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.05.13 14:35:47 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Adobe

[2007.06.28 10:09:58 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\AdobeUM

[2009.09.26 16:38:52 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Apple Computer

[2007.06.23 22:22:07 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\ATI

[2008.07.19 12:48:17 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Buhl Data Service

[2007.07.19 16:36:53 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Canon

[2008.04.21 20:38:19 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\CyberLink

[2008.02.14 14:07:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Design Science

[2011.01.07 19:19:54 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\elsterformular

[2010.11.25 15:05:23 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\FileZilla

[2009.09.14 16:59:47 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\HP

[2011.04.25 20:34:40 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\HpUpdate

[2007.06.23 21:58:07 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Identities

[2011.06.04 15:13:37 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Imaxel

[2007.06.28 08:45:42 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Macromedia

[2011.06.05 11:30:25 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Malwarebytes

[2010.05.13 19:32:16 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Media Center Programs

[2011.02.16 10:00:21 | 000,000,000 | --SD | M] -- C:\Users\******\AppData\Roaming\Microsoft

[2008.09.14 14:49:35 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Mozilla

[2007.10.06 20:27:42 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\NCH Swift Sound

[2008.08.11 21:08:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Panasonic

[2011.02.14 18:29:15 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\PixelPlanet

[2008.05.29 23:04:40 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Pro Cycling Manager 2007

[2007.09.10 20:31:04 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Talkback

[2009.06.05 17:06:26 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\U3

[2007.09.26 18:45:58 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\vlc

[2011.06.03 17:18:27 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Winamp

[2007.09.05 21:33:14 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\WinRAR

[2011.06.03 14:25:36 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\XMedia Recode

[2009.09.12 14:07:37 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Yahoo!

 
 < %APPDATA%\*.exe /s >

[2008.03.13 10:53:16 | 023,813,608 | ---- | M] (                            ) -- C:\Users\******\AppData\Roaming\Adobe\Acrobat\7.0\Updater\AdbeRdr709_de_DE.exe

[2011.02.16 10:00:21 | 000,010,134 | R--- | M] () -- C:\Users\******\AppData\Roaming\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.02.28 20:46:39 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys

[2007.02.28 20:46:39 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys

[2007.02.28 20:46:39 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2007.02.28 20:47:17 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys

[2007.02.28 20:47:17 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys

[2007.02.28 20:47:17 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys

[2008.02.13 22:57:09 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2008.02.13 22:57:09 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2008.02.13 22:57:08 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.07.11 14:27:32 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

[2007.07.11 14:27:33 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\******\AppData\Local\Temp\RarSFX0\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\******\AppData\Local\Temp\RarSFX0\winlogon.exe

[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2008.01.19 09:35:15 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\msvbvm60.dll
 

< End of report >

--- --- ---
Vielen Dank für die Hilfe und Gruß,
Christian

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Arcor Online]  File not found

O4 - HKCU..\Run: []  File not found

OO4 - HKCU..\Run: [updateMgr]  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2008.11.23 14:16:06 | 000,000,000 | ---D | M] - D:\Auto -- [ NTFS ]

O33 - MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\Shell - "" = AutoRun

O33 - MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

ActiveX: ccc-core-static - msiexec /fums {06F42C96-A96C-F579-B0FA-F44BBA118C51} /qb

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hallo Arne, anbei das log-file von OTL nach dem Fix.
Viele Grüße, Christian

Code:

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Arcor Online deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

File  not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df4c97fd-4e9d-11de-b132-0013773787e1}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df4c97fd-4e9d-11de-b132-0013773787e1}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df4c97fd-4e9d-11de-b132-0013773787e1}\ not found.

File F:\LaunchU3.exe -a not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ccc-core-static - msiexec /fums {06F42C96-A96C-F579-B0FA-F44BBA118C51}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\ccc-core-static - msiexec /fums {06F42C96-A96C-F579-B0FA-F44BBA118C51}\ not found.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.23.0 log created on 06062011_164812

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hi Arne,
danke für die turbo-Antwort! Anbei das log-file von Kaspersky.
Gruß, Christian

Code:

2011/06/06 17:17:29.0229 0724        TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24

2011/06/06 17:17:29.0448 0724        ================================================================================

2011/06/06 17:17:29.0448 0724        SystemInfo:

2011/06/06 17:17:29.0448 0724        

2011/06/06 17:17:29.0448 0724        OS Version: 6.0.6002 ServicePack: 2.0

2011/06/06 17:17:29.0448 0724        Product type: Workstation

2011/06/06 17:17:29.0448 0724        ComputerName: HAMMET

2011/06/06 17:17:29.0448 0724        UserName: ******

2011/06/06 17:17:29.0448 0724        Windows directory: C:\Windows

2011/06/06 17:17:29.0448 0724        System windows directory: C:\Windows

2011/06/06 17:17:29.0448 0724        Processor architecture: Intel x86

2011/06/06 17:17:29.0448 0724        Number of processors: 2

2011/06/06 17:17:29.0448 0724        Page size: 0x1000

2011/06/06 17:17:29.0448 0724        Boot type: Normal boot

2011/06/06 17:17:29.0448 0724        ================================================================================

2011/06/06 17:17:31.0101 0724        Initialize success

2011/06/06 17:17:34.0533 3184        ================================================================================

2011/06/06 17:17:34.0533 3184        Scan started

2011/06/06 17:17:34.0533 3184        Mode: Manual; 

2011/06/06 17:17:34.0533 3184        ================================================================================

2011/06/06 17:17:36.0936 3184        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2011/06/06 17:17:37.0076 3184        adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

2011/06/06 17:17:37.0232 3184        adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

2011/06/06 17:17:37.0372 3184        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

2011/06/06 17:17:37.0482 3184        adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

2011/06/06 17:17:37.0653 3184        Afc             (a7b8a3a79d35215d798a300df49ed23f) C:\Windows\system32\drivers\Afc.sys

2011/06/06 17:17:37.0840 3184        AFD             (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys

2011/06/06 17:17:38.0028 3184        AgereSoftModem  (a19871ae65a769c65034b4dc44c29023) C:\Windows\system32\DRIVERS\AGRSM.sys

2011/06/06 17:17:38.0246 3184        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

2011/06/06 17:17:38.0386 3184        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2011/06/06 17:17:38.0527 3184        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys

2011/06/06 17:17:38.0698 3184        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

2011/06/06 17:17:38.0839 3184        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys

2011/06/06 17:17:38.0979 3184        AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

2011/06/06 17:17:39.0120 3184        AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

2011/06/06 17:17:39.0338 3184        arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

2011/06/06 17:17:39.0447 3184        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

2011/06/06 17:17:39.0603 3184        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/06/06 17:17:39.0759 3184        atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2011/06/06 17:17:39.0853 3184        athr            (889e7f06279fd16549b77628918ff666) C:\Windows\system32\DRIVERS\athr.sys

2011/06/06 17:17:40.0134 3184        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2011/06/06 17:17:40.0352 3184        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

2011/06/06 17:17:40.0461 3184        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2011/06/06 17:17:40.0633 3184        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2011/06/06 17:17:40.0773 3184        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2011/06/06 17:17:40.0914 3184        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2011/06/06 17:17:41.0116 3184        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2011/06/06 17:17:41.0288 3184        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

2011/06/06 17:17:41.0413 3184        BthEnum         (064fbc56921051de1075495d628b815f) C:\Windows\system32\DRIVERS\BthEnum.sys

2011/06/06 17:17:41.0522 3184        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2011/06/06 17:17:41.0709 3184        BthPan          (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys

2011/06/06 17:17:41.0850 3184        BTHPORT         (b24757d9154cca035e1bbd3db92966d7) C:\Windows\system32\Drivers\BTHport.sys

2011/06/06 17:17:41.0990 3184        BTHUSB          (d42cf5f0c7635b3f1578810fe34d9e41) C:\Windows\system32\Drivers\BTHUSB.sys

2011/06/06 17:17:42.0193 3184        btwaudio        (0cf62c498d60253a4fc3b2aff0e6373e) C:\Windows\system32\drivers\btwaudio.sys

2011/06/06 17:17:42.0286 3184        btwavdt         (d094142ade0da18463609ae656b1f3ed) C:\Windows\system32\drivers\btwavdt.sys

2011/06/06 17:17:42.0411 3184        btwrchid        (511159fcb07fd7442e7f399c94a3b408) C:\Windows\system32\DRIVERS\btwrchid.sys

2011/06/06 17:17:42.0567 3184        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/06/06 17:17:42.0723 3184        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2011/06/06 17:17:42.0879 3184        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

2011/06/06 17:17:43.0051 3184        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2011/06/06 17:17:43.0285 3184        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/06/06 17:17:43.0441 3184        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys

2011/06/06 17:17:43.0597 3184        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

2011/06/06 17:17:43.0737 3184        crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

2011/06/06 17:17:43.0846 3184        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

2011/06/06 17:17:44.0018 3184        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys

2011/06/06 17:17:44.0236 3184        CVPNDRVA        (1c2999966f0f36aa44eaecbee70cf770) C:\Windows\system32\Drivers\CVPNDRVA.sys

2011/06/06 17:17:44.0595 3184        DfsC            (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys

2011/06/06 17:17:44.0798 3184        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2011/06/06 17:17:44.0907 3184        DNE             (7b4fdfbe97c047175e613aa96f3de987) C:\Windows\system32\DRIVERS\dne2000.sys

2011/06/06 17:17:45.0063 3184        Dot4            (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys

2011/06/06 17:17:45.0235 3184        Dot4Print       (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys

2011/06/06 17:17:45.0344 3184        dot4usb         (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys

2011/06/06 17:17:45.0516 3184        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2011/06/06 17:17:45.0625 3184        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

2011/06/06 17:17:45.0750 3184        E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

2011/06/06 17:17:46.0015 3184        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2011/06/06 17:17:46.0171 3184        elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

2011/06/06 17:17:46.0374 3184        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2011/06/06 17:17:46.0514 3184        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2011/06/06 17:17:46.0670 3184        fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

2011/06/06 17:17:46.0873 3184        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2011/06/06 17:17:47.0076 3184        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2011/06/06 17:17:47.0200 3184        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/06/06 17:17:47.0325 3184        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2011/06/06 17:17:47.0497 3184        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2011/06/06 17:17:47.0653 3184        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

2011/06/06 17:17:47.0793 3184        GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

2011/06/06 17:17:47.0980 3184        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

2011/06/06 17:17:48.0168 3184        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/06/06 17:17:48.0292 3184        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2011/06/06 17:17:48.0370 3184        HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2011/06/06 17:17:48.0526 3184        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2011/06/06 17:17:48.0667 3184        HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

2011/06/06 17:17:48.0854 3184        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

2011/06/06 17:17:48.0979 3184        i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

2011/06/06 17:17:49.0166 3184        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/06/06 17:17:49.0291 3184        iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

2011/06/06 17:17:49.0494 3184        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2011/06/06 17:17:49.0743 3184        IntcAzAudAddService (a47b2875680ad67b35c6150bd0203056) C:\Windows\system32\drivers\RTKVHDA.sys

2011/06/06 17:17:49.0993 3184        intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys

2011/06/06 17:17:50.0180 3184        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

2011/06/06 17:17:50.0336 3184        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/06/06 17:17:50.0539 3184        IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

2011/06/06 17:17:50.0710 3184        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2011/06/06 17:17:50.0851 3184        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2011/06/06 17:17:50.0960 3184        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

2011/06/06 17:17:51.0210 3184        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/06/06 17:17:51.0350 3184        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2011/06/06 17:17:51.0490 3184        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2011/06/06 17:17:51.0600 3184        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/06/06 17:17:51.0740 3184        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/06/06 17:17:51.0849 3184        KMDFMEMIO       (ebc507f129df8f0e0ca270dcfc0cf87f) C:\Windows\system32\DRIVERS\kmdfmemio.sys

2011/06/06 17:17:52.0036 3184        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

2011/06/06 17:17:52.0270 3184        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/06/06 17:17:52.0426 3184        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

2011/06/06 17:17:52.0567 3184        LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

2011/06/06 17:17:52.0660 3184        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

2011/06/06 17:17:52.0785 3184        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2011/06/06 17:17:52.0941 3184        megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

2011/06/06 17:17:53.0175 3184        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2011/06/06 17:17:53.0347 3184        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2011/06/06 17:17:53.0472 3184        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2011/06/06 17:17:53.0596 3184        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

2011/06/06 17:17:53.0752 3184        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2011/06/06 17:17:54.0018 3184        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

2011/06/06 17:17:54.0205 3184        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2011/06/06 17:17:54.0314 3184        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2011/06/06 17:17:54.0439 3184        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2011/06/06 17:17:54.0548 3184        mrxsmb          (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/06/06 17:17:54.0751 3184        mrxsmb10        (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/06/06 17:17:54.0844 3184        mrxsmb20        (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/06/06 17:17:54.0922 3184        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys

2011/06/06 17:17:55.0016 3184        msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

2011/06/06 17:17:55.0156 3184        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2011/06/06 17:17:55.0328 3184        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2011/06/06 17:17:55.0468 3184        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2011/06/06 17:17:55.0593 3184        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/06/06 17:17:55.0843 3184        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2011/06/06 17:17:56.0014 3184        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2011/06/06 17:17:56.0155 3184        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/06/06 17:17:56.0264 3184        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2011/06/06 17:17:56.0389 3184        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2011/06/06 17:17:56.0576 3184        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2011/06/06 17:17:56.0716 3184        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2011/06/06 17:17:56.0950 3184        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/06/06 17:17:57.0091 3184        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/06/06 17:17:57.0200 3184        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/06/06 17:17:57.0309 3184        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2011/06/06 17:17:57.0403 3184        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2011/06/06 17:17:57.0574 3184        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2011/06/06 17:17:58.0167 3184        NETw2v32        (6e9edc1020b319e7676387b8cdf2398c) C:\Windows\system32\DRIVERS\NETw2v32.sys

2011/06/06 17:17:58.0510 3184        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2011/06/06 17:17:58.0635 3184        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2011/06/06 17:17:58.0822 3184        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2011/06/06 17:17:59.0181 3184        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2011/06/06 17:17:59.0400 3184        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2011/06/06 17:17:59.0571 3184        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2011/06/06 17:17:59.0696 3184        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys

2011/06/06 17:17:59.0774 3184        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

2011/06/06 17:17:59.0914 3184        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

2011/06/06 17:18:00.0117 3184        ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys

2011/06/06 17:18:00.0289 3184        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

2011/06/06 17:18:00.0398 3184        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2011/06/06 17:18:00.0554 3184        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

2011/06/06 17:18:00.0694 3184        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2011/06/06 17:18:00.0788 3184        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

2011/06/06 17:18:01.0006 3184        pcmcia          (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys

2011/06/06 17:18:01.0256 3184        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2011/06/06 17:18:01.0599 3184        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2011/06/06 17:18:01.0724 3184        Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

2011/06/06 17:18:01.0927 3184        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2011/06/06 17:18:02.0067 3184        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

2011/06/06 17:18:02.0364 3184        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2011/06/06 17:18:02.0504 3184        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2011/06/06 17:18:02.0738 3184        R300            (1fd94b167a03c4e9909f6e28a6320019) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/06/06 17:18:02.0956 3184        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2011/06/06 17:18:03.0081 3184        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/06/06 17:18:03.0331 3184        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/06/06 17:18:03.0424 3184        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2011/06/06 17:18:03.0565 3184        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2011/06/06 17:18:03.0674 3184        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/06/06 17:18:03.0861 3184        rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

2011/06/06 17:18:03.0955 3184        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2011/06/06 17:18:04.0126 3184        RDPWD           (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

2011/06/06 17:18:04.0282 3184        RFCOMM          (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys

2011/06/06 17:18:04.0438 3184        rimmptsk        (b39f1bd472e4992382875baf0b645c6d) C:\Windows\system32\DRIVERS\rimmptsk.sys

2011/06/06 17:18:04.0548 3184        rimsptsk        (a4216c71dd4f60b26418ccfd99cd0815) C:\Windows\system32\DRIVERS\rimsptsk.sys

2011/06/06 17:18:04.0641 3184        rismxdp         (c663af77e2f4eabf8eb08b388d2f1f36) C:\Windows\system32\DRIVERS\rixdptsk.sys

2011/06/06 17:18:04.0766 3184        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2011/06/06 17:18:04.0922 3184        RTL8023xp       (f7a8c9024e82534cec50613d87e88645) C:\Windows\system32\DRIVERS\Rtnicxp.sys

2011/06/06 17:18:05.0156 3184        SAVOnAccess     (ae668d3f43fc90bc17f62e08ff82a446) C:\Windows\system32\DRIVERS\savonaccess.sys

2011/06/06 17:18:05.0312 3184        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2011/06/06 17:18:05.0468 3184        sdbus           (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

2011/06/06 17:18:05.0593 3184        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/06/06 17:18:05.0718 3184        Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys

2011/06/06 17:18:05.0858 3184        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

2011/06/06 17:18:06.0014 3184        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2011/06/06 17:18:06.0232 3184        sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/06/06 17:18:06.0388 3184        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

2011/06/06 17:18:06.0498 3184        sffp_sd         (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/06/06 17:18:06.0591 3184        sfloppy         (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys

2011/06/06 17:18:06.0763 3184        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

2011/06/06 17:18:06.0856 3184        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

2011/06/06 17:18:06.0997 3184        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

2011/06/06 17:18:07.0231 3184        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2011/06/06 17:18:07.0418 3184        SophosBootDriver (f2b7bd04146b3e6a895a1919e1f5da89) C:\Windows\system32\DRIVERS\SophosBootDriver.sys

2011/06/06 17:18:07.0574 3184        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2011/06/06 17:18:07.0730 3184        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

2011/06/06 17:18:07.0839 3184        srv2            (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys

2011/06/06 17:18:07.0948 3184        srvnet          (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys

2011/06/06 17:18:08.0245 3184        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2011/06/06 17:18:08.0401 3184        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2011/06/06 17:18:08.0526 3184        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2011/06/06 17:18:08.0635 3184        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2011/06/06 17:18:08.0806 3184        SynTP           (c7dd991423d364d06fc2dd1b00b53dce) C:\Windows\system32\DRIVERS\SynTP.sys

2011/06/06 17:18:09.0072 3184        Tcpip           (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys

2011/06/06 17:18:09.0337 3184        Tcpip6          (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys

2011/06/06 17:18:09.0446 3184        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

2011/06/06 17:18:09.0555 3184        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2011/06/06 17:18:09.0649 3184        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2011/06/06 17:18:09.0820 3184        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2011/06/06 17:18:09.0976 3184        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2011/06/06 17:18:10.0179 3184        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/06/06 17:18:10.0335 3184        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2011/06/06 17:18:10.0444 3184        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2011/06/06 17:18:10.0554 3184        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

2011/06/06 17:18:10.0663 3184        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2011/06/06 17:18:10.0866 3184        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

2011/06/06 17:18:10.0990 3184        uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

2011/06/06 17:18:11.0131 3184        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2011/06/06 17:18:11.0240 3184        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2011/06/06 17:18:11.0396 3184        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2011/06/06 17:18:11.0490 3184        UnlockerDriver5 (4847639d852763ee39415c929470f672) C:\Program Files\Unlocker\UnlockerDriver5.sys

2011/06/06 17:18:11.0677 3184        USBAAPL         (d4fb6ecc60a428564ba8768b0e23c0fc) C:\Windows\system32\Drivers\usbaapl.sys

2011/06/06 17:18:11.0848 3184        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/06/06 17:18:12.0004 3184        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2011/06/06 17:18:12.0176 3184        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2011/06/06 17:18:12.0285 3184        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2011/06/06 17:18:12.0410 3184        usbohci         (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

2011/06/06 17:18:12.0519 3184        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

2011/06/06 17:18:12.0660 3184        usbscan         (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

2011/06/06 17:18:12.0816 3184        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/06/06 17:18:13.0003 3184        usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/06/06 17:18:13.0143 3184        vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/06/06 17:18:13.0268 3184        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2011/06/06 17:18:13.0393 3184        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

2011/06/06 17:18:13.0486 3184        ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

2011/06/06 17:18:13.0627 3184        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys

2011/06/06 17:18:13.0736 3184        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2011/06/06 17:18:13.0923 3184        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2011/06/06 17:18:14.0142 3184        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2011/06/06 17:18:14.0282 3184        vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

2011/06/06 17:18:14.0438 3184        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2011/06/06 17:18:14.0563 3184        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/06/06 17:18:14.0625 3184        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/06/06 17:18:14.0781 3184        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

2011/06/06 17:18:14.0906 3184        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2011/06/06 17:18:15.0218 3184        WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

2011/06/06 17:18:15.0452 3184        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

2011/06/06 17:18:15.0592 3184        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/06/06 17:18:15.0795 3184        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/06/06 17:18:15.0936 3184        MBR (0x1B8)     (c31400769defc61154f08815bcb5e020) \Device\Harddisk0\DR0

2011/06/06 17:18:16.0341 3184        ================================================================================

2011/06/06 17:18:16.0341 3184        Scan finished

2011/06/06 17:18:16.0341 3184        ================================================================================

2011/06/06 17:18:16.0372 1428        Detected object count: 0

2011/06/06 17:18:16.0372 1428        Actual detected object count: 0

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hallo Arne,

scan durchgeführt, hier das log-file:

Code:

ComboFix 11-06-06.01 - ****** 06.06.2011  20:10:04.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1789.871 [GMT 2:00]

ausgeführt von:: c:\users\******\Desktop\cofi.exe

AV: Sophos Anti-Virus *Disabled/Updated* {479CCF92-4960-B3E0-7373-BF453B467D2C}

SP: Sophos Anti-Virus *Disabled/Updated* {FCFD2E76-6F5A-BC6E-49C3-843740C13791}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery

c:\users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery\Uninstall Windows Vista Recovery.lnk

c:\users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery\Windows Vista Recovery.lnk

c:\users\******\Desktop\Windows Vista Recovery.lnk

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-05-06 bis 2011-06-06  ))))))))))))))))))))))))))))))

.

.

2011-06-06 18:26 . 2011-06-06 18:31        --------        d-----w-        c:\users\******\AppData\Local\temp

2011-06-06 18:26 . 2011-06-06 18:26        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-06-06 18:05 . 2011-06-06 18:05        --------        d-----w-        C:\32788R22FWJFW

2011-06-05 09:30 . 2011-06-05 09:30        --------        d-----w-        c:\users\******\AppData\Roaming\Malwarebytes

2011-06-05 09:29 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-05 09:29 . 2011-06-05 09:29        --------        d-----w-        c:\programdata\Malwarebytes

2011-06-05 09:29 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-06-05 09:29 . 2011-06-05 09:30        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-06-04 13:11 . 2011-06-05 17:58        --------        d-----w-        c:\users\******\AppData\Local\ApplicationHistory

2011-06-04 13:08 . 2011-06-04 13:08        --------        d-----w-        c:\windows\system32\URTTEMP

2011-06-03 12:25 . 2011-06-03 12:25        --------        d-----w-        c:\users\******\AppData\Roaming\XMedia Recode

2011-06-03 09:47 . 2011-06-03 09:47        --------        d-----w-        c:\program files\XMedia Recode

2011-06-03 07:51 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6EC9FCCC-AC9F-47E0-91FD-F63DF2D14A3B}\mpengine.dll

2011-05-10 19:37 . 2011-04-07 12:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 22:40 . 2011-04-13 22:40        4284416        ----a-w-        c:\windows\system32\GPhotos.scr

2011-04-12 08:31 . 2011-04-12 08:31        161792        ----a-w-        c:\windows\system32\msls31.dll

2011-04-12 08:31 . 2011-04-12 08:31        1126912        ----a-w-        c:\windows\system32\wininet.dll

2011-04-12 08:31 . 2011-04-12 08:31        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2011-04-12 08:31 . 2011-04-12 08:31        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2011-04-12 08:31 . 2011-04-12 08:31        86528        ----a-w-        c:\windows\system32\iesysprep.dll

2011-04-12 08:31 . 2011-04-12 08:31        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2011-04-12 08:31 . 2011-04-12 08:31        63488        ----a-w-        c:\windows\system32\tdc.ocx

2011-04-12 08:31 . 2011-04-12 08:31        367104        ----a-w-        c:\windows\system32\html.iec

2011-04-12 08:31 . 2011-04-12 08:31        74752        ----a-w-        c:\windows\system32\iesetup.dll

2011-04-12 08:31 . 2011-04-12 08:31        23552        ----a-w-        c:\windows\system32\licmgr10.dll

2011-04-12 08:31 . 2011-04-12 08:31        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-04-12 08:31 . 2011-04-12 08:31        152064        ----a-w-        c:\windows\system32\wextract.exe

2011-04-12 08:31 . 2011-04-12 08:31        150528        ----a-w-        c:\windows\system32\iexpress.exe

2011-04-12 08:31 . 2011-04-12 08:31        420864        ----a-w-        c:\windows\system32\vbscript.dll

2011-04-12 08:31 . 2011-04-12 08:31        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2011-04-12 08:31 . 2011-04-12 08:31        142848        ----a-w-        c:\windows\system32\ieUnatt.exe

2011-04-12 08:31 . 2011-04-12 08:31        11776        ----a-w-        c:\windows\system32\mshta.exe

2011-04-12 08:31 . 2011-04-12 08:31        101888        ----a-w-        c:\windows\system32\admparse.dll

2011-04-12 08:31 . 2011-04-12 08:31        35840        ----a-w-        c:\windows\system32\imgutil.dll

2011-04-12 08:31 . 2011-04-12 08:31        1797632        ----a-w-        c:\windows\system32\jscript9.dll

2011-04-12 08:31 . 2011-04-12 08:31        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll

2011-03-12 21:55 . 2011-04-27 06:42        876032        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-03-10 17:03 . 2011-04-14 19:45        1162240        ----a-w-        c:\windows\system32\mfc42u.dll

2011-03-10 17:03 . 2011-04-14 19:45        1136640        ----a-w-        c:\windows\system32\mfc42.dll

2011-05-01 18:57 . 2011-04-10 07:51        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"Adobe Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe" [2011-01-30 1219488]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-12-09 815104]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-01-30 36760]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-01-30 821144]

"NetFxUpdate_v1.1.4322"="c:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 106496]

"Sophos AutoUpdate Monitor"="c:\program files\Sophos\AutoUpdate\almon.exe" [2011-03-03 439536]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"NoHotStart"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Sophos\SOPHOS~1\sophos_detoured.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 NETw2v32;Intel(R) PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 SophosBootDriver;SophosBootDriver;c:\windows\system32\DRIVERS\SophosBootDriver.sys [2011-03-03 22536]

S1 SAVOnAccess;SAVOnAccess;c:\windows\system32\DRIVERS\savonaccess.sys [2011-03-03 122360]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]

S2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\DRIVERS\kmdfmemio.sys [2007-02-28 13312]

S2 SAVAdminService;Sophos Anti-Virus Statusreporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2011-03-03 163056]

S2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [2011-03-03 97520]

S2 swi_service;Sophos Web Intelligence Service;c:\program files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2011-03-03 1541360]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

2011-06-03 c:\windows\Tasks\zeitliche Überprüfung.job

- c:\program files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2011-03-03 07:46]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.arcor.de

mWindow Title = Arcor AG & Co. KG

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: Interfaces\{C73B4F7C-7AA5-4121-87EF-C68A412D2C29}: NameServer = 130.83.187.173,130.83.22.60

FF - ProfilePath - c:\users\******\AppData\Roaming\Mozilla\Firefox\Profiles\01pqoj9f.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

HKCU-Run-Arcor Online - (no file)

HKLM_ActiveSetup-ccc-core-static - msiexec

AddRemove-Dukester X 2.0 (Preview 1.3)_is1 - c:\users\******\Desktop\Duke\2.0\unins000.exe

AddRemove-PDFTK Builder_is1 - d:\ekt\AGTurb2020\PDFTK Builder\unins000.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-06-06 20:31

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

Zeit der Fertigstellung: 2011-06-06  20:38:54

ComboFix-quarantined-files.txt  2011-06-06 18:38

.

Vor Suchlauf: 20 Verzeichnis(se), 18.743.508.992 Bytes frei

Nach Suchlauf: 23 Verzeichnis(se), 20.077.768.704 Bytes frei

.

- - End Of File - - 87E24FD7EEA0266E0321A95BBF271D2F

Danke und Gruß,
Christian

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Hi Arne,

habe alle beschriebenen Schritte durchgeführt. Anbei die log-files.

GMER:

Code:

GMER 1.0.15.15640 - hxxp://www.gmer.net

Rootkit scan 2011-06-07 16:18:07

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2160BH_PL rev.0000001C

Running: 9ktlei8h.exe; Driver: C:\Users\klewer\AppData\Local\Temp\ugldipoc.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                           Das System kann die angegebene Datei nicht finden. !

?               C:\Users\klewer\AppData\Local\Temp\catchme.sys                                                       Das System kann die angegebene Datei nicht finden. !
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusShutdown]                [74687817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCloneImage]                 [746DA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDrawImageRectI]             [7468BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipSetInterpolationMode]       [7467F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusStartup]                 [746875E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateFromHDC]              [7467E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [746B8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateBitmapFromStream]     [7468DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipGetImageHeight]             [7467FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipGetImageWidth]              [7467FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDisposeImage]               [746771CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipLoadImageFromFileICM]       [7470CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipLoadImageFromFile]          [746AC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDeleteGraphics]             [7467D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipFree]                       [74676853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipAlloc]                      [7467687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\explorer.exe[2204] @ C:\Windows\explorer.exe [gdiplus.dll!GdipSetCompositingMode]         [74682AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027873b61e                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016cfe759b3                          

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00027873b61e (not active ControlSet)      

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0016cfe759b3 (not active ControlSet)      
 

---- EOF - GMER 1.0.15 ----

OSAM:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 16:28:57 on 07.06.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Sophos Plc" - C:\PROGRA~1\Sophos\SOPHOS~1\sophos_detoured.dll
 

[Common]

-----( %SystemRoot%\Tasks )-----

"zeitliche Überprüfung.job" - "Sophos Plc" - C:\Program Files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"AdobeGamma" - ? - %CommonFiles%\Adobe\Callibration\Adobe Gamma.cpl  (File not found)

"Folder Size" - "Brio" - C:\Program Files\FolderSize\FolderSize.cpl

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\Users\klewer\AppData\Local\Temp\catchme.sys  (File not found)

"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\Windows\system32\Drivers\CVPNDRVA.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"mbr" (mbr) - ? - C:\cofi\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"PPdus ASPI Shell" (Afc) - "Arcsoft, Inc." - C:\Windows\System32\drivers\Afc.sys

"SAVOnAccess" (SAVOnAccess) - "Sophos Plc" - C:\Windows\System32\DRIVERS\savonaccess.sys

"ugldipoc" (ugldipoc) - ? - C:\Users\klewer\AppData\Local\Temp\ugldipoc.sys  (Hidden registry entry, rootkit activity | File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{04DAAD08-70EF-450E-834A-DCFAF9B48748} "{04DAAD08-70EF-450E-834A-DCFAF9B48748}" - "Brio" - C:\Program Files\FolderSize\FolderSizeColumn.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 10.0\Acrobat Elements\ContextMenu.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{A3A1D8A1-006D-4B93-BA27-6F6B4C9C4F1D} "ContextMenuHandler Class" - "Sophos Plc" - C:\Program Files\Sophos\Sophos Anti-Virus\SavShellExt.dll

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - C:\Program Files\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Intelligente Auswahl" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

"PartyPoker.net" - ? - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{F4971EE7-DAA0-4053-9964-665D8EE6A077} "SmartSelect Class" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} "Sophos Web Content Scanner" - "Sophos Plc" - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll

{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\klewer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Acrobat Synchronizer" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe"

"StartCCC" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  (File found, but it contains no detailed information)

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Acrobat Assistant 8.0" - "Adobe Systems Inc." - "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

"Adobe Acrobat Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LanguageShortcut" - ? - "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

"NetFxUpdate_v1.1.4322" - "Microsoft" - "C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" 1 v1.1.4322 GAC + NI NID

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"RemoteControl" - "Cyberlink Corp." - "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

"Sophos AutoUpdate Monitor" - "Sophos Plc" - C:\Program Files\Sophos\AutoUpdate\almon.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Adobe PDF Port Monitor" - "Adobe Systems Inc" - C:\Windows\system32\AdobePDF.dll

"C360SeriesPCL Language Monitor" - "KONICA MINOLTA BUSINESS TECHNOLOGIES, INC." - C:\Windows\system32\KOAZ8J_L.DLL

"PCL hpz3l5mu" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l5mu.dll

"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_8832f4b.dll  (File found, but it contains no detailed information)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft" - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"Folder Size" (FolderSize) - "Brio" - C:\Program Files\FolderSize\FolderSizeSvc.exe

"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll

"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll

"Samsung Update Plus" (Samsung Update Plus) - ? - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe  (File found, but it contains no detailed information)

"Sophos Anti-Virus" (SAVService) - "Sophos Plc" - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

"Sophos Anti-Virus Statusreporter" (SAVAdminService) - "Sophos Plc" - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

"Sophos AutoUpdate Service" (Sophos AutoUpdate Service) - "Sophos Plc" - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

"Sophos Web Intelligence Service" (swi_service) - "Sophos Plc" - C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

"SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

"SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBRCheck:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows Vista Home Premium Edition

Windows Information:                Service Pack 2 (build 6002), 32-bit

Base Board Manufacturer:        SAMSUNG ELECTRONICS CO., LTD.

BIOS Manufacturer:                Phoenix Technologies LTD

System Manufacturer:                SAMSUNG ELECTRONICS CO., LTD.

System Product Name:                R40P/R41P

Logical Drives Mask:                0x0000001c
 

Kernel Drivers (total 147):

  0x8243D000 \SystemRoot\system32\ntoskrnl.exe

  0x8240A000 \SystemRoot\system32\hal.dll

  0x87406000 \SystemRoot\system32\kdcom.dll

  0x8740D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x8747D000 \SystemRoot\system32\PSHED.dll

  0x8748E000 \SystemRoot\system32\BOOTVID.dll

  0x87496000 \SystemRoot\system32\CLFS.SYS

  0x874D7000 \SystemRoot\system32\CI.dll

  0x875B7000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x87633000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x87640000 \SystemRoot\system32\drivers\acpi.sys

  0x87686000 \SystemRoot\system32\drivers\WMILIB.SYS

  0x8768F000 \SystemRoot\system32\drivers\msisadrv.sys

  0x87697000 \SystemRoot\system32\drivers\pci.sys

  0x876BE000 \SystemRoot\System32\drivers\partmgr.sys

  0x876CD000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x876D0000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x876DA000 \SystemRoot\system32\drivers\volmgr.sys

  0x876E9000 \SystemRoot\System32\drivers\volmgrx.sys

  0x87733000 \SystemRoot\system32\drivers\pciide.sys

  0x8773A000 \SystemRoot\system32\drivers\PCIIDEX.SYS

  0x87748000 \SystemRoot\system32\DRIVERS\pcmcia.sys

  0x87775000 \SystemRoot\System32\drivers\mountmgr.sys

  0x87785000 \SystemRoot\system32\drivers\atapi.sys

  0x8778D000 \SystemRoot\system32\drivers\ataport.SYS

  0x877AB000 \SystemRoot\system32\drivers\fltmgr.sys

  0x877DD000 \SystemRoot\system32\drivers\fileinfo.sys

  0x87802000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x87873000 \SystemRoot\system32\drivers\ndis.sys

  0x8797E000 \SystemRoot\system32\drivers\msrpc.sys

  0x879A9000 \SystemRoot\system32\drivers\NETIO.SYS

  0x879E4000 \SystemRoot\System32\drivers\tcpip.sys

  0x87ACE000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x87AE9000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x87C03000 \SystemRoot\system32\drivers\volsnap.sys

  0x87C3C000 \SystemRoot\System32\Drivers\spldr.sys

  0x87C44000 \SystemRoot\System32\Drivers\mup.sys

  0x87C53000 \SystemRoot\System32\drivers\ecache.sys

  0x87C7A000 \SystemRoot\system32\drivers\disk.sys

  0x87C8B000 \SystemRoot\system32\drivers\CLASSPNP.SYS

  0x87CAC000 \SystemRoot\system32\drivers\crcdisk.sys

  0x87CD5000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x87CE0000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0x87CE9000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x87CF8000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x8BC06000 \SystemRoot\system32\DRIVERS\atikmdag.sys

  0x87CFC000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x8C38E000 \SystemRoot\System32\drivers\watchdog.sys

  0x8C39A000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0x8C3A4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8C3E2000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8C3F1000 \SystemRoot\system32\drivers\Afc.sys

  0x87D9C000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8C3F9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x87DB4000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x87E41000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x87E54000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x87E5F000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0x8BC00000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x87E8A000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x87E95000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

  0x87EA6000 \SystemRoot\system32\DRIVERS\athr.sys

  0x87F27000 \SystemRoot\system32\DRIVERS\sdbus.sys

  0x87F41000 \SystemRoot\system32\DRIVERS\rimmptsk.sys

  0x87F50000 \SystemRoot\system32\DRIVERS\rimsptsk.sys

  0x87F64000 \SystemRoot\system32\DRIVERS\rixdptsk.sys

  0x87FB5000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0x8C40A000 \SystemRoot\system32\DRIVERS\msiscsi.sys

  0x8C439000 \SystemRoot\system32\DRIVERS\storport.sys

  0x8C47A000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8C485000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8C49C000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8C4A7000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8C4CA000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8C4D9000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8C4ED000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x8C502000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8C512000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x8C514000 \SystemRoot\system32\DRIVERS\ks.sys

  0x8C53E000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8C548000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8C555000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x8C58A000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x8C59B000 \SystemRoot\system32\DRIVERS\AGRSM.sys

  0x8C6B7000 \SystemRoot\system32\drivers\modem.sys

  0x8CC04000 \SystemRoot\system32\drivers\RTKVHDA.sys

  0x8CD95000 \SystemRoot\system32\drivers\portcls.sys

  0x8CDC2000 \SystemRoot\system32\drivers\drmk.sys

  0x8CDE7000 \SystemRoot\system32\DRIVERS\savonaccess.sys

  0x8CE0D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0x8CE16000 \SystemRoot\System32\Drivers\Null.SYS

  0x8CE1D000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8CE2D000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x8CE34000 \SystemRoot\System32\drivers\vga.sys

  0x8CE40000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8CE61000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8CE69000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8CE71000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8CE7C000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8CE8A000 \SystemRoot\System32\DRIVERS\rasacd.sys

  0x8CE93000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8CEA9000 \SystemRoot\system32\DRIVERS\smb.sys

  0x8CEBD000 \SystemRoot\system32\drivers\afd.sys

  0x8CF05000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8CF37000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8CF4D000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8CF5B000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8CF6E000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8CFAA000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8CFB4000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8CFCB000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8CFD8000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x8CFE3000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0x96000000 \SystemRoot\System32\win32k.sys

  0x8CFEB000 \SystemRoot\System32\drivers\Dxapi.sys

  0x8C6C4000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x96220000 \SystemRoot\System32\TSDDD.dll

  0x96240000 \SystemRoot\System32\cdd.dll

  0x8C6D3000 \SystemRoot\system32\drivers\luafv.sys

  0x8CFF5000 \SystemRoot\system32\DRIVERS\kmdfmemio.sys

  0x8C6EE000 \SystemRoot\system32\drivers\spsys.sys

  0x8C79E000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x8C7AE000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x8C7D8000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x8C7E2000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x9C403000 \SystemRoot\system32\drivers\HTTP.sys

  0x9C470000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x9C48D000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x9C4A6000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x9C4BB000 \SystemRoot\system32\drivers\mrxdav.sys

  0x9C4DC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x9C4FB000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x9C534000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x9C54C000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x9C574000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9C5C3000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys

  0x9C653000 \SystemRoot\system32\drivers\peauth.sys

  0x9C731000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x9C73B000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9C747000 \SystemRoot\system32\DRIVERS\cdfs.sys

  0x9C75D000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS

  0x9C75F000 \??\C:\Users\******\AppData\Local\Temp\catchme.sys

  0x9C76E000 \SystemRoot\system32\DRIVERS\udfs.sys

  0x962B0000 \SystemRoot\System32\ATMFD.DLL

  0x9C7ED000 \SystemRoot\system32\DRIVERS\asyncmac.sys

  0x9C7BC000 \??\C:\Users\******\AppData\Local\Temp\ugldipoc.sys

  0x777B0000 \Windows\System32\ntdll.dll
 

Processes (total 78):

       0 System Idle Process

       4 System

     488 C:\Windows\System32\smss.exe

     620 csrss.exe

     672 C:\Windows\System32\wininit.exe

     684 csrss.exe

     716 C:\Windows\System32\services.exe

     728 C:\Windows\System32\lsass.exe

     736 C:\Windows\System32\lsm.exe

     796 C:\Windows\System32\winlogon.exe

     928 C:\Windows\System32\svchost.exe

     988 C:\Windows\System32\svchost.exe

    1024 C:\Windows\System32\svchost.exe

    1124 C:\Windows\System32\Ati2evxx.exe

    1144 C:\Windows\System32\svchost.exe

    1208 C:\Windows\System32\svchost.exe

    1228 C:\Windows\System32\svchost.exe

    1308 C:\Windows\System32\audiodg.exe

    1332 C:\Windows\System32\svchost.exe

    1352 C:\Windows\System32\SLsvc.exe

    1408 C:\Windows\System32\svchost.exe

    1476 C:\Windows\System32\Ati2evxx.exe

    1612 C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

    1884 C:\Windows\System32\dwm.exe

     508 C:\Windows\System32\svchost.exe

     980 C:\Windows\System32\spoolsv.exe

    1452 C:\Windows\System32\svchost.exe

    1244 C:\Windows\System32\taskeng.exe

    1808 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

     436 C:\Windows\System32\taskeng.exe

    2280 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

    2312 C:\Windows\System32\agrsmsvc.exe

    2324 C:\Windows\System32\svchost.exe

    2336 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    2352 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

    2368 C:\Program Files\Bonjour\mDNSResponder.exe

    2380 C:\Windows\System32\svchost.exe

    2392 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    2420 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

    2460 C:\Program Files\FolderSize\FolderSizeSvc.exe

    2480 C:\Windows\System32\svchost.exe

    2696 C:\Windows\System32\svchost.exe

    2724 C:\Program Files\CyberLink\Shared Files\RichVideo.exe

    2832 C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

    2864 C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

    2916 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

    2952 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

    2992 C:\Windows\System32\svchost.exe

    3048 C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

    3172 C:\Windows\System32\svchost.exe

    3228 C:\Windows\System32\SearchIndexer.exe

    1132 C:\Windows\System32\taskeng.exe

    3772 C:\Program Files\Windows Defender\MSASCui.exe

    3364 C:\Windows\RtHDVCpl.exe

    2244 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    1288 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    3896 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

    3776 C:\Program Files\Common Files\Java\Java Update\jusched.exe

    2208 C:\Program Files\iTunes\iTunesHelper.exe

    4044 C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

    1904 C:\Program Files\Sophos\AutoUpdate\ALMon.exe

    3544 C:\Windows\ehome\ehtray.exe

    3856 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    3932 C:\Windows\ehome\ehmsas.exe

    2252 C:\Program Files\iPod\bin\iPodService.exe

    3464 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    4384 C:\Windows\System32\svchost.exe

    4544 C:\Program Files\Windows Media Player\wmpnscfg.exe

    4280 C:\Program Files\Windows Media Player\wmpnetwk.exe

    4600 C:\Windows\System32\verclsid.exe

    4848 C:\Windows\System32\conime.exe

    2204 C:\Windows\explorer.exe

    4168 C:\Program Files\Internet Explorer\iexplore.exe

    4164 C:\Program Files\Internet Explorer\iexplore.exe

    4056 taskeng.exe

    1156 C:\Windows\System32\SearchProtocolHost.exe

    4876 C:\Windows\System32\SearchFilterHost.exe

    5264 C:\Users\******\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000013`c3300000  (NTFS)
 

PhysicalDrive0 Model Number: FUJITSUMHW2160BHPL, Rev: 0000001C
 

      Size  Device Name          MBR Status

  --------------------------------------------

    149 GB  \\.\PhysicalDrive0   Unknown MBR code

            SHA1: A2D287FA4F944275462643BCFFB6129A056114F3
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Vielen Dank und Gruß,

Christian

Zitat:

149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: A2D287FA4F944275462643BCFFB6129A056114F3

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

Hi Arne!

Ist es ausreichend, die Daten von Partition C: nach Partition D: zu kopieren oder könnte diese Partition ebenfalls von einem datenverlust betroffen sein?

Viele Grüße,
Christian

Besser auf externe Platte kopieren. Wenn man sichern will, dann macht man ein richtiges Backup und das ist nur der Fall wenn man die Daten auf ein physisch anderes Medium sichert. Nur ne andere Partition ist kein physisch anderes Medium.

Hallo Arne

Sorry, habe einen Moment gebraucht, um die Daten zu sichern. Ich habe ein Problem:Kennst du noch einen anderen Link für die iso-Datei? Wenn ich sie speichere, wird daraus immer ein Winzip-Archiv. Danke und Gruß,
Christian

Hi Arne,

hab es dann doch noch hinbekommen. Also nun anbei die logs:

Gmer:

Code:

GMER 1.0.15.15640 - hxxp://www.gmer.net

Rootkit scan 2011-06-11 13:10:15

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2160BH_PL rev.0000001C

Running: 9ktlei8h.exe; Driver: C:\Users\klewer\AppData\Local\Temp\ugldipoc.sys
 
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [744B7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [7450A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [744BBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [744AF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [744B75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [744AE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [744E8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [744BDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [744AFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [744AFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [744A71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [7453CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [744DC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [744AD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [744A6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [744A687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[2012] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [744B2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027873b61e                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016cfe759b3                          

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00027873b61e (not active ControlSet)      

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0016cfe759b3 (not active ControlSet)      
 

---- EOF - GMER 1.0.15 ----

MBR:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows Vista Home Premium Edition

Windows Information:                Service Pack 2 (build 6002), 32-bit

Base Board Manufacturer:        SAMSUNG ELECTRONICS CO., LTD.

BIOS Manufacturer:                Phoenix Technologies LTD

System Manufacturer:                SAMSUNG ELECTRONICS CO., LTD.

System Product Name:                R40P/R41P

Logical Drives Mask:                0x0000001c
 

Kernel Drivers (total 141):

  0x8244F000 \SystemRoot\system32\ntoskrnl.exe

  0x8241C000 \SystemRoot\system32\hal.dll

  0x87401000 \SystemRoot\system32\kdcom.dll

  0x87408000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x87478000 \SystemRoot\system32\PSHED.dll

  0x87489000 \SystemRoot\system32\BOOTVID.dll

  0x87491000 \SystemRoot\system32\CLFS.SYS

  0x874D2000 \SystemRoot\system32\CI.dll

  0x875B2000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x8762E000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x8763B000 \SystemRoot\system32\drivers\acpi.sys

  0x87681000 \SystemRoot\system32\drivers\WMILIB.SYS

  0x8768A000 \SystemRoot\system32\drivers\msisadrv.sys

  0x87692000 \SystemRoot\system32\drivers\pci.sys

  0x876B9000 \SystemRoot\System32\drivers\partmgr.sys

  0x876C8000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x876CB000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x876D5000 \SystemRoot\system32\drivers\volmgr.sys

  0x876E4000 \SystemRoot\System32\drivers\volmgrx.sys

  0x8772E000 \SystemRoot\system32\drivers\pciide.sys

  0x87735000 \SystemRoot\system32\drivers\PCIIDEX.SYS

  0x87743000 \SystemRoot\system32\DRIVERS\pcmcia.sys

  0x87770000 \SystemRoot\System32\drivers\mountmgr.sys

  0x87780000 \SystemRoot\system32\drivers\atapi.sys

  0x87788000 \SystemRoot\system32\drivers\ataport.SYS

  0x877A6000 \SystemRoot\system32\drivers\fltmgr.sys

  0x877D8000 \SystemRoot\system32\drivers\fileinfo.sys

  0x87804000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x87875000 \SystemRoot\system32\drivers\ndis.sys

  0x87980000 \SystemRoot\system32\drivers\msrpc.sys

  0x879AB000 \SystemRoot\system32\drivers\NETIO.SYS

  0x879E6000 \SystemRoot\System32\drivers\tcpip.sys

  0x87AD0000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x87AEB000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x87C0F000 \SystemRoot\system32\drivers\volsnap.sys

  0x87C48000 \SystemRoot\System32\Drivers\spldr.sys

  0x87C50000 \SystemRoot\System32\Drivers\mup.sys

  0x87C5F000 \SystemRoot\System32\drivers\ecache.sys

  0x87C86000 \SystemRoot\system32\drivers\disk.sys

  0x87C97000 \SystemRoot\system32\drivers\CLASSPNP.SYS

  0x87CB8000 \SystemRoot\system32\drivers\crcdisk.sys

  0x87CE1000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x87CEC000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0x87CF5000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x87D04000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x8B404000 \SystemRoot\system32\DRIVERS\atikmdag.sys

  0x87D08000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x8BB8C000 \SystemRoot\System32\drivers\watchdog.sys

  0x8BB98000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0x8BBA2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8BBE0000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8BBEF000 \SystemRoot\system32\drivers\Afc.sys

  0x87DA8000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8BBF7000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x87DC0000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x87E4D000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x87E60000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x87E6B000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0x8BBFD000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x87E96000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x87EA1000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

  0x87EB2000 \SystemRoot\system32\DRIVERS\athr.sys

  0x87F33000 \SystemRoot\system32\DRIVERS\sdbus.sys

  0x87F4D000 \SystemRoot\system32\DRIVERS\rimmptsk.sys

  0x87F5C000 \SystemRoot\system32\DRIVERS\rimsptsk.sys

  0x87F70000 \SystemRoot\system32\DRIVERS\rixdptsk.sys

  0x87FC1000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0x8BC0A000 \SystemRoot\system32\DRIVERS\msiscsi.sys

  0x8BC39000 \SystemRoot\system32\DRIVERS\storport.sys

  0x8BC7A000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8BC85000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8BC9C000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8BCA7000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8BCCA000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8BCD9000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8BCED000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x8BD02000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8BD12000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x8BD14000 \SystemRoot\system32\DRIVERS\ks.sys

  0x8BD3E000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8BD48000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8BD55000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x8BD8A000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x8BD9B000 \SystemRoot\system32\DRIVERS\AGRSM.sys

  0x8BEB7000 \SystemRoot\system32\drivers\modem.sys

  0x8C402000 \SystemRoot\system32\drivers\RTKVHDA.sys

  0x8C593000 \SystemRoot\system32\drivers\portcls.sys

  0x8C5C0000 \SystemRoot\system32\drivers\drmk.sys

  0x8C5E5000 \SystemRoot\system32\DRIVERS\savonaccess.sys

  0x8C60B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0x8C614000 \SystemRoot\System32\Drivers\Null.SYS

  0x8C61B000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8C62B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x8C632000 \SystemRoot\System32\drivers\vga.sys

  0x8C63E000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8C65F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8C667000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8C66F000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8C67A000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8C688000 \SystemRoot\System32\DRIVERS\rasacd.sys

  0x8C691000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8C6A7000 \SystemRoot\system32\DRIVERS\smb.sys

  0x8C6BB000 \SystemRoot\system32\drivers\afd.sys

  0x8C703000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8C735000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8C74B000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8C759000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8C76C000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8C7A8000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8C7B2000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8C7C9000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8C7D6000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x8C7E1000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0x95CE0000 \SystemRoot\System32\win32k.sys

  0x8C7E9000 \SystemRoot\System32\drivers\Dxapi.sys

  0x8BEC4000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x95F00000 \SystemRoot\System32\TSDDD.dll

  0x95F20000 \SystemRoot\System32\cdd.dll

  0x8BED3000 \SystemRoot\system32\drivers\luafv.sys

  0x8C7F3000 \SystemRoot\system32\DRIVERS\kmdfmemio.sys

  0x8BEEE000 \SystemRoot\system32\drivers\spsys.sys

  0x8BF9E000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x8BFAE000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x8BFD8000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x8BFE2000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x9C80E000 \SystemRoot\system32\drivers\HTTP.sys

  0x9C87B000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x9C898000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x9C8B1000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x9C8C6000 \SystemRoot\system32\drivers\mrxdav.sys

  0x9C8E7000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x9C906000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x9C93F000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x9C957000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x9C97F000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9C9CE000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys

  0x9CA5E000 \SystemRoot\system32\drivers\peauth.sys

  0x9CB3C000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x9CB46000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9CB52000 \SystemRoot\system32\DRIVERS\cdfs.sys

  0x77600000 \Windows\System32\ntdll.dll
 

Processes (total 79):

       0 System Idle Process

       4 System

     480 C:\Windows\System32\smss.exe

     548 csrss.exe

     600 C:\Windows\System32\wininit.exe

     616 csrss.exe

     648 C:\Windows\System32\services.exe

     660 C:\Windows\System32\lsass.exe

     668 C:\Windows\System32\lsm.exe

     712 C:\Windows\System32\winlogon.exe

     860 C:\Windows\System32\svchost.exe

     924 C:\Windows\System32\svchost.exe

     964 C:\Windows\System32\svchost.exe

    1064 C:\Windows\System32\Ati2evxx.exe

    1080 C:\Windows\System32\svchost.exe

    1144 C:\Windows\System32\svchost.exe

    1168 C:\Windows\System32\svchost.exe

    1248 C:\Windows\System32\audiodg.exe

    1268 C:\Windows\System32\svchost.exe

    1288 C:\Windows\System32\SLsvc.exe

    1336 C:\Windows\System32\svchost.exe

    1400 C:\Windows\System32\Ati2evxx.exe

    1488 C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

    1956 C:\Windows\System32\dwm.exe

    2012 C:\Windows\explorer.exe

     264 C:\Windows\System32\svchost.exe

    1156 C:\Windows\System32\spoolsv.exe

    1392 C:\Windows\System32\svchost.exe

    1448 C:\Windows\System32\taskeng.exe

    1364 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

    1388 C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

     772 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

    1904 C:\Windows\System32\taskeng.exe

    2064 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

    2176 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

    2208 C:\Windows\System32\agrsmsvc.exe

    2220 C:\Windows\System32\svchost.exe

    2232 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    2248 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

    2268 C:\Program Files\Bonjour\mDNSResponder.exe

    2280 C:\Windows\System32\svchost.exe

    2292 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    2320 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

    2356 C:\Program Files\FolderSize\FolderSizeSvc.exe

    2376 C:\Windows\System32\svchost.exe

    2480 C:\Windows\System32\svchost.exe

    2580 C:\Windows\System32\svchost.exe

    2604 C:\Windows\System32\svchost.exe

    2640 C:\Program Files\CyberLink\Shared Files\RichVideo.exe

    2656 C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe

    2700 C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

    2732 C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

    2808 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

    2848 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

    2884 C:\Windows\System32\svchost.exe

    2912 C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

    3036 C:\Windows\System32\svchost.exe

    3120 C:\Windows\System32\SearchIndexer.exe

    4024 C:\Windows\System32\taskeng.exe

    2756 C:\Windows\System32\SearchProtocolHost.exe

    3836 C:\Windows\RtHDVCpl.exe

    3708 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    2772 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    2792 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

    3924 C:\Program Files\Common Files\Java\Java Update\jusched.exe

    3816 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    1096 C:\Program Files\iTunes\iTunesHelper.exe

    2560 C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

    2112 C:\Program Files\Sophos\AutoUpdate\ALMon.exe

    1928 C:\Program Files\Windows Sidebar\sidebar.exe

    4072 C:\Windows\ehome\ehtray.exe

    2568 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    2496 C:\Windows\ehome\ehmsas.exe

    3828 C:\Program Files\iPod\bin\iPodService.exe

    3624 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    1944 WmiPrvSE.exe

    4152 C:\Windows\System32\SearchFilterHost.exe

    4456 C:\Users\klewer\Desktop\Trojaner\MBRCheck.exe

    4468 C:\Windows\System32\conime.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000013`c3300000  (NTFS)
 

PhysicalDrive0 Model Number: FUJITSUMHW2160BHPL, Rev: 0000001C
 

      Size  Device Name          MBR Status

  --------------------------------------------

    149 GB  \\.\PhysicalDrive0   Windows 2008 MBR code detected

            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
 
 

Done!

Viele Grüße, Christian

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hi Arne, sorry war ne Weile untätig... Hier nun erstmal die logs von Malwarebytes und Superantispyware. Laut Superantispyware gibt es wohl doch noch Probleme... Vielleicht ist es an der Zeit, den Rechner neu aufzusetzen? Danke und viele Grüße,

Christian

Malware:

Code:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org
 

Datenbank Version: 6936
 

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421
 

24.06.2011 12:03:27

mbam-log-2011-06-24 (12-03-27).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Durchsuchte Objekte: 336078

Laufzeit: 2 Stunde(n), 3 Minute(n), 4 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Superantispyware:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 06/25/2011 at 09:30 PM
 

Application Version : 4.54.1000
 

Core Rules Database Version : 7327

Trace Rules Database Version: 5139
 

Scan type       : Complete Scan

Total Scan Time : 03:40:52
 

Memory items scanned      : 840

Memory threats detected   : 0

Registry items scanned    : 10509

Registry threats detected : 0

File items scanned        : 175786

File threats detected     : 161
 

Adware.Tracking Cookie

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ads.creative-serving[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adform[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad3.adfarm1.adition[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.ad-srv[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@track.webtrekk[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.etracker[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@smartadserver[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@statse.webtrendslive[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@paypal.112.2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@apmebf[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@specificclick[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ww251.smartadserver[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tacoda.at.atwola[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.adnet[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@atwola[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[4].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adserv.chirurgie-portal[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@atdmt[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@poobieseuropebv.solution.weborama[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tracking.dc-storm[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@track.effiliation[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@r1-ads.ace.advertising[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ads.neudesicmediagroup[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@track.effiliation[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@invitemedia[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@fr.sitestat[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.zanox[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@content.yieldmanager[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ads.immobilienscout24[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad1.chefkoch[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@advertising[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@guj.122.2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adsrv1.admediate[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@eas.apm.emediate[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.burstnet[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@mediaplex[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@eas4.emediate[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@burstnet[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@imrworldwide[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@xiti[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@loccitane.solution.weborama[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tracking.quisma[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@bs.serving-sys[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adfarm1.adition[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad4.adfarm1.adition[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@hotelreservationservice.122.2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@stepstone.112.2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.active-tracking[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@traffictrack[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@stats.adwmainz[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@azjmp[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@zbox.zanox[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@serving-sys[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adtech[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@revsci[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.googleadservices[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@yieldmanager[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@doubleclick[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.yieldmanager[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.adc-serv[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@zanox[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@content.yieldmanager[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www6.addfreestats[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.adserver01[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.traffictrack[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@vodafonegroup.122.2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@secmedia[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad4.adfarm1.adition[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad2.adfarm1.adition[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@generaltracking[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ads.quartermedia[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tribalfusion[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[5].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@zanox-affiliate[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@fastclick[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@trackmatics[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@realmedia[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.360yield[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tradedoubler[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@at.atwola[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adviva[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@webmasterplan[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad1.adfarm1.adition[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@nl.sitestat[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adx.chip[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tto2.traffictrack[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@a.revenuemax[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adserv.quality-channel[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tracking.hannoversche[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.dyntracker[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.zanox-affiliate[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adxpose[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[8].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@statcounter[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adt.traffictrack[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.googleadservices[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@zieltrack[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@im.banner.t-online[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@unitymedia[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adfarm1.adition[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@overture[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@fr.sitestat[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@account.nokia[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@adserver.ep-solutions[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ads.webme[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[6].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@track.adform[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@weborama[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@tracking.hrs[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@in.getclicky[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@hansenet.122.2o7[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@powerhitz[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@dmtracker[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ads.spinsoft[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@22.zieltrack[2].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.discounter-strom[1].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@www.googleadservices[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@de.sitestat[7].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@fr.sitestat[3].txt

        C:\Users\******\AppData\Roaming\Microsoft\Windows\Cookies\******@ad.dyntracker[2].txt

        acvs.mediaonenetwork.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        ad.de.doubleclick.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        banners.securedataimages.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        bc.youporn.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        cdn-www.pornhub.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        cdn1.eyewonder.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        cdn4.specificclick.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        cdn5.specificclick.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        creatives.doubleclick.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        ds.serving-sys.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        edge.media-server.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        imagesrv.adition.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        m.de.2mdn.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        maxporn.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        naiadsystems.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        pornoprinzen.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        pornotube.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        s-sec.slutload-media.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        s0.2mdn.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        spe.atdmt.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        static.sexsearch.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        track.webgains.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        udn.specificclick.net [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        vht.tradedoubler.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        vidii.hardsextube.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.ardmediathek.de [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.fuckme.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.mofosex.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.naiadsystems.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.pornhub.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.pornoprinzen.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.porntelecast.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.secmedia.de [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.sunporno.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        www.ziporn.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        wwwstatic.megaporn.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

        youporn.videobox.com [ C:\Users\******\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\MMFJR8VQ ]

Das sind nur harmlose Cookies!
Mach bitte noch den Durchgang mit ESET!

Hi Arne!
Hab den Durchgang mit ESET gemacht. Das Programm hat 2 infizierte Files gefunden, dies wird aus der log-Datei jedoch nicht ersichtlich. Anbei das Ergebnis:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

Danke und Gruß,

Christian

Das sieht eher unauffällig aus, obwohl ich aus diesen 2 Zweilen keine Funde ablieten kann :dummguck:
Rechner ansonsten wieder im Lot?

Hi Arne,

ansonsten läuft der Rechner ganz gut, bis auf eine Ausnahme: Das Startmenü ist leer bzw. dort sind keine Verknüpfungen mehr vorhanden so dass ich für den Start eines Programms immer in den jeweiligen Ordner gehen muss. Ist dieses Problem bekannt? Viele Grüße,

Christian

Schau bitte nach ob der Ordner smtmp entweder hier

=> C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp

oder hier

=> C:\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp

zu finden ist. Stell sicher, dass dir alle Dateien angezeigt werden => http://www.trojaner-board.de/59624-a...-sichtbar.html

Hi Arne,

der Ordner ist sichtbar und ich habe die beschriebenen Schritte durchgeführt, es hat sich aber nichts verändert.

Gruß, Christian

Äh, ich wollte wissen wo smtmp ist. In

C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp

oder in

C:\Users\[DEIN_NAME]\AppData\Local\Temp

oh ja, verstanden, er liegt unter Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp
Gruß, Christian

Code:

robocopy C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp\4 "%userprofile%\desktop" /E /a-:h

robocopy C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp\1 "c:\ProgramData\Microsoft\Windows\Start Menu" /E /a-:h

robocopy C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp\2 "%userprofile%\Appdata\Roaming\Microsoft\Windows\Start Menu" /E /a-:h

Kopier den obenstehenden Text in eine Textdatei, diese zB als smtmp.bat abspeichern. Es ist dann eine Batchdatei, diese nach Doppelklick die o.g. drei Befehle ausführt.
Die Zeichenkette [DEIN_NAME] musst du vorher natürlich passend editieren!!!

Danach die Batchdatei smtmp.bat per Doppelklick ausführen und prüfen ob alle Symbole wieder an Ort und Stelle sind.

Hi Arne,

auf meinem Desktop sind jetzt alle Verknüpfungen wiederhergestellt. Die Startmenüeinträge sind jedoch noch leer. Bei dem Ausführen des Skripts gab es noch das Problem, dass die Datei "desktop.ini" anscheinend nicht kopiert werden konnte.

Gruß, Christian

Existiert dieser Ordner => C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp\1

Wenn ja, beinhaltet der Dateien/Verknüpfungen?

Hi,
der Ordner 1 existiert und enthält den Ordner "Programme" (leer), den Ordner "Programs" (hier befinden sich die Unterordner mit den Programmnamen, diese sind aber leer) und noch drei Verknüpfungen: Default programs, HP solution center, windows update.
Viele Grüße,
Christian

Zitat:

(hier befinden sich die Unterordner mit den Programmnamen, diese sind aber leer)

Dann sind die Verknüpfungen weg...

Hi Arne,

naja, das ist ja weniger dramatisch... Ansonsten vielen Dank für die tatkräftige Unterstützung!

Christian

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.