Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Weiterhin Fehler, obwohl Windows Restore vermutlich komplett entfernt wurde (https://www.trojaner-board.de/100378-weiterhin-fehler-obwohl-windows-restore-vermutlich-komplett-entfernt-wurde.html)

blauer_alex 15.06.2011 16:50
Weiterhin Fehler, obwohl Windows Restore vermutlich komplett entfernt wurde
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hi Leute,

ich hatte mir gestern Abend den "Windows Restore"-Virus eingefangen, ihn aber mit Hilfe des Forums hier (http://www.trojaner-board.de/97186-w...entfernen.html) wohl entfernen können. Jedenfalls bekomme ich keine Fehlermeldungen mehr, die auf einen Virus auf meinem System hindeuten. Erst hatte ich auch Angst um meine Daten, aber mit der unhide.exe war das ja alles kein Problem.

Nun bleiben allerdings noch zwei bis drei kleinere Probleme bestehen, bzw. tauchen jetzt erst auf.
Erstens sind nicht alle Verknüpfungen auf dem Desktop wieder aufgetaucht, nachdem ich das Programm hab drüber laufen lassen. Es ist zwar nicht schlimm, dass ich den Papierkorb da nicht habe, er ist ja auch anders zu erreichen, aber es ist verwunderlich, dass er im Windows Explorer unter "Desktop" ganz normal angezeigt wird.
Zweitens fehlen im Startmenü viele Einträge. Unter "Alle Programme" werden vermutlich zwar alle Ordner angezeigt, jedoch viele davon als ganz leer oder mit fehlenden Einträgen. Selbst einfache Programme wie Paint, die dort immer zu finden waren, sind verschwunden.
Und drittens bekomme ich immer eine Fehlermeldung, wenn ich Mozilla, den IE oder den WE in der Taskleiste anklicke, um ihn zu öffnen. Die Fehlermeldung ist im Anhang zu finden (sofern das klappt). Mache ich dann aber zB einen Rechtsklick -> Neuen Tab öffnen, dann geht alles normal.

Da ich mich nicht allzu gut auskenne, weiss ich nicht, welche Daten ich noch mitposten soll. Im Anhang sind die Logfiles von OTL, wenn noch mehr fehlt, bitte nachfragen, ich bin doch eher der Laie, wenn es um sowas geht.

Ich habe im Übrigen ein 32-Bit-Betriebssystem bei Windows 7 Home Premium.


Ich hoffe, das alles ist verständlich, ich kenne mich wie erwähnt nicht allzu gut aus. Dennoch hoffe ich auf hilfreiche Lösungen, denn ihr habt mir auch sonst immer sehr geholfen.


VG
Alex

cosinus 16.06.2011 10:57
Zitat:
Erstens sind nicht alle Verknüpfungen auf dem Desktop wieder aufgetaucht, nachdem ich das Programm hab drüber laufen lassen. Es ist zwar nicht schlimm, dass ich den Papierkorb da nicht habe, er ist ja auch anders zu erreichen, aber es ist verwunderlich, dass er im Windows Explorer unter "Desktop" ganz normal angezeigt wird.
Zweitens fehlen im Startmenü viele Einträge. Unter "Alle Programme" werden vermutlich zwar alle Ordner angezeigt, jedoch viele davon als ganz leer oder mit fehlenden Einträgen. Selbst einfache Programme wie Paint, die dort immer zu finden waren, sind verschwunden.
Du hast auch unhide ausgeführt?


Durch die Infektion wurde dein Startmenü leergefegt, bei mir bisher bekannten Varianten verschiebt der Schädling alle Verknüpfungen nach %tmp%\smtmp

Schau bitte nach ob der Ordner smtmp entweder hier

=> C:\Qoobox\Quarantine\C\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp

oder hier

=> C:\Users\[DEIN_NAME]\AppData\Local\Temp\smtmp

zu finden ist. Stell sicher, dass dir alle Dateien angezeigt werden => http://www.trojaner-board.de/59624-a...-sichtbar.html

blauer_alex 16.06.2011 21:30
Ja genau, unhide hab ich drüberlaufen lassen und sie sichtbar machen lassen, aber ohne Erfolg. Der Ordner existiert, ist aber auch leer.

cosinus 16.06.2011 21:54
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{687b0688-da06-11df-a08c-001f163189d5}\Shell - "" = AutoRun
O33 - MountPoints2\{687b0688-da06-11df-a08c-001f163189d5}\Shell\AutoRun\command - "" = E:\Setup.exe
O33 - MountPoints2\{7a23d36d-dc87-11df-8b59-001f163189d5}\Shell - "" = AutoRun
O33 - MountPoints2\{7a23d36d-dc87-11df-8b59-001f163189d5}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{d7c38c47-dad8-11df-9efd-001f163189d5}\Shell - "" = AutoRun
O33 - MountPoints2\{d7c38c47-dad8-11df-9efd-001f163189d5}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{d7c38c56-dad8-11df-9efd-001f163189d5}\Shell - "" = AutoRun
O33 - MountPoints2\{d7c38c56-dad8-11df-9efd-001f163189d5}\Shell\AutoRun\command - "" = G:\AutoRun.exe
[2011.06.13 04:09:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Selapy
[2011.06.13 04:09:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Qiygbo
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

blauer_alex 24.06.2011 04:59
Liste der Anhänge anzeigen (Anzahl: 1)
Code:
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{687b0688-da06-11df-a08c-001f163189d5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687b0688-da06-11df-a08c-001f163189d5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{687b0688-da06-11df-a08c-001f163189d5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687b0688-da06-11df-a08c-001f163189d5}\ not found.
File E:\Setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a23d36d-dc87-11df-8b59-001f163189d5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a23d36d-dc87-11df-8b59-001f163189d5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a23d36d-dc87-11df-8b59-001f163189d5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a23d36d-dc87-11df-8b59-001f163189d5}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7c38c47-dad8-11df-9efd-001f163189d5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7c38c47-dad8-11df-9efd-001f163189d5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7c38c47-dad8-11df-9efd-001f163189d5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7c38c47-dad8-11df-9efd-001f163189d5}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7c38c56-dad8-11df-9efd-001f163189d5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7c38c56-dad8-11df-9efd-001f163189d5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7c38c56-dad8-11df-9efd-001f163189d5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7c38c56-dad8-11df-9efd-001f163189d5}\ not found.
File G:\AutoRun.exe not found.
C:\Users\***\AppData\Roaming\Selapy folder moved successfully.
C:\Users\***\AppData\Roaming\Qiygbo folder moved successfully.
========== COMMANDS ==========
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.24.0 log created on 06242011_053949

Also, die Sache mit den nicht funktionierdenden Verknüpfungen in der Taskleiste hab ich eigentlich behoben. Habe jene Verknüpfungen gelöscht und mir die Anwendungen erneut aus dem Dateipfad geholt und dorthin verschoben. Heißt zwar jetzt z.B. "Mozilla Firefix (2)", aber das ist mir relativ egal, funktioniert ja.
Den Papierkorb habe ich aber immer noch nicht auf dem Desktop. Ist ja auch nicht weiter schlimm, aber umständlich, wenn man wissen will was drin ist.
Und das Starmenü, bzw. deren Ordner bleiben leer. Ich weiss nicht woher das kommen kann... Bild dazu ist im Anhang.

VG

cosinus 24.06.2011 09:01
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

blauer_alex 24.06.2011 14:23
Okay, das Tool führe ich bei Gelegenheit mal aus.

Und zu den fehlenden Einträgen: Wie ich oben schon geschrieben habe, hatte ich Unhide schon ausgeführt, auch nach weiteren Versuchen bleiben die Ordner leer.

blauer_alex 30.06.2011 01:40
Code:
2011/06/30 02:36:11.0532 5732        TDSS rootkit removing tool 2.5.8.0 Jun 28 2011 19:12:16
2011/06/30 02:36:11.0742 5732        ================================================================================
2011/06/30 02:36:11.0742 5732        SystemInfo:
2011/06/30 02:36:11.0742 5732       
2011/06/30 02:36:11.0742 5732        OS Version: 6.1.7601 ServicePack: 1.0
2011/06/30 02:36:11.0742 5732        Product type: Workstation
2011/06/30 02:36:11.0742 5732        ComputerName: ***
2011/06/30 02:36:11.0742 5732        UserName: ***
2011/06/30 02:36:11.0742 5732        Windows directory: C:\windows
2011/06/30 02:36:11.0742 5732        System windows directory: C:\windows
2011/06/30 02:36:11.0742 5732        Processor architecture: Intel x86
2011/06/30 02:36:11.0742 5732        Number of processors: 2
2011/06/30 02:36:11.0742 5732        Page size: 0x1000
2011/06/30 02:36:11.0742 5732        Boot type: Normal boot
2011/06/30 02:36:11.0742 5732        ================================================================================
2011/06/30 02:36:13.0342 5732        Initialize success
2011/06/30 02:36:17.0212 3608        ================================================================================
2011/06/30 02:36:17.0212 3608        Scan started
2011/06/30 02:36:17.0212 3608        Mode: Manual;
2011/06/30 02:36:17.0212 3608        ================================================================================
2011/06/30 02:36:18.0652 3608        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\windows\system32\drivers\1394ohci.sys
2011/06/30 02:36:18.0852 3608        acedrv11        (e6f53d6c0dea3d375362265e175ca638) C:\windows\system32\drivers\acedrv11.sys
2011/06/30 02:36:18.0962 3608        ACPI            (cea80c80bed809aa0da6febc04733349) C:\windows\system32\drivers\ACPI.sys
2011/06/30 02:36:19.0102 3608        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\windows\system32\drivers\acpipmi.sys
2011/06/30 02:36:19.0152 3608        ACPIVPC        (87114efedeb94af49323ca61f344716d) C:\windows\system32\DRIVERS\AcpiVpc.sys
2011/06/30 02:36:19.0302 3608        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys
2011/06/30 02:36:19.0422 3608        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys
2011/06/30 02:36:19.0482 3608        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys
2011/06/30 02:36:19.0592 3608        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\windows\system32\drivers\afd.sys
2011/06/30 02:36:19.0742 3608        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\drivers\agp440.sys
2011/06/30 02:36:19.0862 3608        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys
2011/06/30 02:36:19.0952 3608        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\drivers\aliide.sys
2011/06/30 02:36:20.0099 3608        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\drivers\amdagp.sys
2011/06/30 02:36:20.0115 3608        amdide          (cd5914170297126b6266860198d1d4f0) C:\windows\system32\drivers\amdide.sys
2011/06/30 02:36:20.0177 3608        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys
2011/06/30 02:36:20.0286 3608        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys
2011/06/30 02:36:20.0364 3608        amdsata        (d320bf87125326f996d4904fe24300fc) C:\windows\system32\drivers\amdsata.sys
2011/06/30 02:36:20.0489 3608        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys
2011/06/30 02:36:20.0551 3608        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\windows\system32\drivers\amdxata.sys
2011/06/30 02:36:20.0739 3608        AppID          (aea177f783e20150ace5383ee368da19) C:\windows\system32\drivers\appid.sys
2011/06/30 02:36:20.0926 3608        arc            (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys
2011/06/30 02:36:20.0957 3608        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys
2011/06/30 02:36:21.0019 3608        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys
2011/06/30 02:36:21.0113 3608        atapi          (338c86357871c167a96ab976519bf59e) C:\windows\system32\drivers\atapi.sys
2011/06/30 02:36:21.0285 3608        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys
2011/06/30 02:36:21.0409 3608        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\windows\system32\DRIVERS\b57nd60x.sys
2011/06/30 02:36:21.0550 3608        BCM43XX        (f9ce9b5e049efc66b8e6c73c18ee8438) C:\windows\system32\DRIVERS\bcmwl6.sys
2011/06/30 02:36:21.0768 3608        Beep            (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys
2011/06/30 02:36:21.0942 3608        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys
2011/06/30 02:36:22.0112 3608        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\windows\system32\DRIVERS\bowser.sys
2011/06/30 02:36:22.0162 3608        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys
2011/06/30 02:36:22.0192 3608        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys
2011/06/30 02:36:22.0302 3608        Bridge0        (b35bb97b6dd9913093579f5c83962636) C:\windows\system32\drivers\WDBridge.sys
2011/06/30 02:36:22.0362 3608        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys
2011/06/30 02:36:22.0472 3608        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys
2011/06/30 02:36:22.0512 3608        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys
2011/06/30 02:36:22.0542 3608        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys
2011/06/30 02:36:22.0692 3608        BthEnum        (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\drivers\BthEnum.sys
2011/06/30 02:36:22.0742 3608        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys
2011/06/30 02:36:22.0872 3608        BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys
2011/06/30 02:36:22.0962 3608        BTHPORT        (195c41cc67e9e1cedd960ccb74925920) C:\windows\System32\Drivers\BTHport.sys
2011/06/30 02:36:23.0122 3608        BTHUSB          (43b3206dd654e783aa7e4ead340a43b8) C:\windows\System32\Drivers\BTHUSB.sys
2011/06/30 02:36:23.0202 3608        BTMCOM          (e4b498c101b60eafb46f1ed6241b359f) C:\windows\system32\Drivers\btmcom.sys
2011/06/30 02:36:23.0312 3608        BTMUSB          (3dfa219b02227edd1a1608a7fefe3e6c) C:\windows\system32\Drivers\btmusb.sys
2011/06/30 02:36:23.0432 3608        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys
2011/06/30 02:36:23.0692 3608        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\windows\system32\drivers\cdrom.sys
2011/06/30 02:36:23.0932 3608        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys
2011/06/30 02:36:23.0962 3608        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys
2011/06/30 02:36:24.0112 3608        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys
2011/06/30 02:36:24.0182 3608        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\drivers\cmdide.sys
2011/06/30 02:36:24.0302 3608        CNG            (1b675691ed940766149c93e8f4488d68) C:\windows\system32\Drivers\cng.sys
2011/06/30 02:36:24.0352 3608        Compbatt        (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys
2011/06/30 02:36:24.0512 3608        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\windows\system32\drivers\CompositeBus.sys
2011/06/30 02:36:24.0582 3608        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys
2011/06/30 02:36:24.0802 3608        DfsC            (f024449c97ec1e464aaffda18593db88) C:\windows\system32\Drivers\dfsc.sys
2011/06/30 02:36:24.0862 3608        discache        (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys
2011/06/30 02:36:24.0982 3608        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys
2011/06/30 02:36:25.0042 3608        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys
2011/06/30 02:36:25.0172 3608        dtsoftbus01    (555e54ac2f601a8821cef58961653991) C:\windows\system32\DRIVERS\dtsoftbus01.sys
2011/06/30 02:36:25.0272 3608        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\windows\System32\drivers\dxgkrnl.sys
2011/06/30 02:36:25.0473 3608        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys
2011/06/30 02:36:25.0707 3608        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys
2011/06/30 02:36:25.0848 3608        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\drivers\errdev.sys
2011/06/30 02:36:26.0004 3608        ewusbnet        (dafc7e1b2ffa35ccbddf95ae3e31bfae) C:\windows\system32\DRIVERS\ewusbnet.sys
2011/06/30 02:36:26.0066 3608        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys
2011/06/30 02:36:26.0207 3608        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys
2011/06/30 02:36:26.0331 3608        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys
2011/06/30 02:36:26.0394 3608        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys
2011/06/30 02:36:26.0519 3608        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys
2011/06/30 02:36:26.0597 3608        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys
2011/06/30 02:36:26.0690 3608        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys
2011/06/30 02:36:26.0784 3608        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys
2011/06/30 02:36:26.0885 3608        FsUsbExDisk    (790a4ca68f44be35967b3df61f3e4675) C:\windows\system32\FsUsbExDisk.SYS
2011/06/30 02:36:27.0005 3608        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\windows\system32\drivers\Fs_Rec.sys
2011/06/30 02:36:27.0105 3608        funfrm          (f626f291e3f56e8969e35945552feca3) C:\windows\system32\drivers\funfrm.sys
2011/06/30 02:36:27.0225 3608        fvevol          (8a73e79089b282100b9393b644cb853b) C:\windows\system32\DRIVERS\fvevol.sys
2011/06/30 02:36:27.0345 3608        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys
2011/06/30 02:36:27.0515 3608        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\windows\system32\DRIVERS\GEARAspiWDM.sys
2011/06/30 02:36:27.0675 3608        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys
2011/06/30 02:36:27.0825 3608        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\windows\system32\drivers\HdAudio.sys
2011/06/30 02:36:27.0905 3608        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\windows\system32\drivers\HDAudBus.sys
2011/06/30 02:36:27.0955 3608        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys
2011/06/30 02:36:28.0035 3608        HidBth          (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys
2011/06/30 02:36:28.0085 3608        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys
2011/06/30 02:36:28.0215 3608        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\windows\system32\drivers\hidusb.sys
2011/06/30 02:36:28.0305 3608        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\drivers\HpSAMD.sys
2011/06/30 02:36:28.0435 3608        HTTP            (871917b07a141bff43d76d8844d48106) C:\windows\system32\drivers\HTTP.sys
2011/06/30 02:36:28.0585 3608        hwdatacard      (1fc7a63148e4f2bd831dab0dc732026d) C:\windows\system32\DRIVERS\ewusbmdm.sys
2011/06/30 02:36:28.0655 3608        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\windows\system32\drivers\hwpolicy.sys
2011/06/30 02:36:28.0795 3608        hwusbdev        (a259d3619aa23d4562581067f85e2006) C:\windows\system32\DRIVERS\ewusbdev.sys
2011/06/30 02:36:29.0145 3608        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\drivers\i8042prt.sys
2011/06/30 02:36:29.0335 3608        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\windows\system32\drivers\iaStorV.sys
2011/06/30 02:36:29.0635 3608        igfx            (a70c995199a47f326eef4f9f5e6267a1) C:\windows\system32\DRIVERS\igdkmd32.sys
2011/06/30 02:36:29.0875 3608        iirsp          (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys
2011/06/30 02:36:30.0085 3608        IntcAzAudAddService (94b1ff5d243d34b31380a2f79fc48959) C:\windows\system32\drivers\RTKVHDA.sys
2011/06/30 02:36:30.0285 3608        IntcHdmiAddService (e63cd0d9aa8d406cabde5aa718936f40) C:\windows\system32\drivers\IntcHdmi.sys
2011/06/30 02:36:30.0365 3608        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\drivers\intelide.sys
2011/06/30 02:36:30.0503 3608        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys
2011/06/30 02:36:30.0550 3608        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys
2011/06/30 02:36:30.0690 3608        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\windows\system32\drivers\IPMIDrv.sys
2011/06/30 02:36:30.0737 3608        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys
2011/06/30 02:36:30.0862 3608        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys
2011/06/30 02:36:30.0924 3608        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\drivers\isapnp.sys
2011/06/30 02:36:31.0065 3608        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\windows\system32\drivers\msiscsi.sys
2011/06/30 02:36:31.0127 3608        k57nd60x        (c4c95805b85bce1eb9d20f4a02fc5f9b) C:\windows\system32\DRIVERS\k57nd60x.sys
2011/06/30 02:36:31.0283 3608        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\drivers\kbdclass.sys
2011/06/30 02:36:31.0377 3608        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\windows\system32\drivers\kbdhid.sys
2011/06/30 02:36:31.0501 3608        KSecDD          (412cea1aa78cc02a447f5c9e62b32ff1) C:\windows\system32\Drivers\ksecdd.sys
2011/06/30 02:36:31.0564 3608        KSecPkg        (26c046977e85b95036453d7b88ba1820) C:\windows\system32\Drivers\ksecpkg.sys
2011/06/30 02:36:31.0689 3608        L1C            (a158cea8644b8a5c1ec0e9a81b70f65a) C:\windows\system32\DRIVERS\L1C62x86.sys
2011/06/30 02:36:32.0157 3608        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys
2011/06/30 02:36:32.0313 3608        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys
2011/06/30 02:36:32.0469 3608        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys
2011/06/30 02:36:32.0682 3608        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys
2011/06/30 02:36:32.0762 3608        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys
2011/06/30 02:36:32.0922 3608        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys
2011/06/30 02:36:32.0982 3608        MBAMProtector  (3d2c13377763eeac0ca6fb46f57217ed) C:\windows\system32\drivers\mbam.sys
2011/06/30 02:36:33.0152 3608        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys
2011/06/30 02:36:33.0202 3608        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys
2011/06/30 02:36:33.0262 3608        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys
2011/06/30 02:36:33.0392 3608        monitor        (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys
2011/06/30 02:36:33.0472 3608        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\drivers\mouclass.sys
2011/06/30 02:36:33.0602 3608        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys
2011/06/30 02:36:33.0662 3608        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\windows\system32\drivers\mountmgr.sys
2011/06/30 02:36:33.0722 3608        MpFilter        (7e34bfa1a7b60bba1da03d677f16cd63) C:\windows\system32\DRIVERS\MpFilter.sys
2011/06/30 02:36:33.0862 3608        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\windows\system32\drivers\mpio.sys
2011/06/30 02:36:34.0172 3608        MpKsl279e1724  (5f53edfead46fa7adb78eee9ecce8fdf) C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C27C77CA-DD77-4FC0-AB12-06755A5888BD}\MpKsl279e1724.sys
2011/06/30 02:36:34.0362 3608        MpKsl3061b855  (5f53edfead46fa7adb78eee9ecce8fdf) C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C27C77CA-DD77-4FC0-AB12-06755A5888BD}\MpKsl3061b855.sys
2011/06/30 02:36:34.0662 3608        MpNWMon        (f32e2d6a1640a469a9ed4f1929a4a861) C:\windows\system32\DRIVERS\MpNWMon.sys
2011/06/30 02:36:34.0712 3608        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys
2011/06/30 02:36:34.0852 3608        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\windows\system32\drivers\mrxdav.sys
2011/06/30 02:36:34.0942 3608        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\windows\system32\DRIVERS\mrxsmb.sys
2011/06/30 02:36:35.0092 3608        mrxsmb10        (a70c828a93cce4c11617f6249f4d87fc) C:\windows\system32\DRIVERS\mrxsmb10.sys
2011/06/30 02:36:35.0152 3608        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\windows\system32\DRIVERS\mrxsmb20.sys
2011/06/30 02:36:35.0222 3608        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\windows\system32\drivers\msahci.sys
2011/06/30 02:36:35.0362 3608        msdsm          (55055f8ad8be27a64c831322a780a228) C:\windows\system32\drivers\msdsm.sys
2011/06/30 02:36:35.0442 3608        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys
2011/06/30 02:36:35.0542 3608        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys
2011/06/30 02:36:35.0602 3608        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\drivers\msisadrv.sys
2011/06/30 02:36:35.0792 3608        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys
2011/06/30 02:36:35.0932 3608        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys
2011/06/30 02:36:35.0962 3608        MSPQM          (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys
2011/06/30 02:36:36.0002 3608        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys
2011/06/30 02:36:36.0143 3608        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\drivers\mssmbios.sys
2011/06/30 02:36:36.0221 3608        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys
2011/06/30 02:36:36.0314 3608        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys
2011/06/30 02:36:36.0345 3608        Mup            (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys
2011/06/30 02:36:36.0486 3608        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys
2011/06/30 02:36:36.0642 3608        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\windows\system32\drivers\ndis.sys
2011/06/30 02:36:36.0782 3608        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys
2011/06/30 02:36:36.0845 3608        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys
2011/06/30 02:36:36.0969 3608        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\windows\system32\DRIVERS\ndisuio.sys
2011/06/30 02:36:37.0083 3608        NdisWan        (38fbe267e7e6983311179230facb1017) C:\windows\system32\DRIVERS\ndiswan.sys
2011/06/30 02:36:37.0203 3608        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\windows\system32\drivers\NDProxy.sys
2011/06/30 02:36:37.0283 3608        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys
2011/06/30 02:36:37.0403 3608        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\windows\system32\DRIVERS\netbt.sys
2011/06/30 02:36:37.0653 3608        netw5v32        (58218ec6b61b1169cf54aab0d00f5fe2) C:\windows\system32\DRIVERS\netw5v32.sys
2011/06/30 02:36:37.0873 3608        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys
2011/06/30 02:36:37.0923 3608        NisDrv          (17e2c08c5ecfbe94a7c67b1c275ee9d9) C:\windows\system32\DRIVERS\NisDrvWFP.sys
2011/06/30 02:36:38.0063 3608        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys
2011/06/30 02:36:38.0103 3608        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys
2011/06/30 02:36:38.0213 3608        Ntfs            (81189c3d7763838e55c397759d49007a) C:\windows\system32\drivers\Ntfs.sys
2011/06/30 02:36:38.0343 3608        Null            (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys
2011/06/30 02:36:38.0433 3608        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\windows\system32\drivers\nvraid.sys
2011/06/30 02:36:38.0663 3608        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\windows\system32\drivers\nvstor.sys
2011/06/30 02:36:38.0793 3608        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\drivers\nv_agp.sys
2011/06/30 02:36:38.0843 3608        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\drivers\ohci1394.sys
2011/06/30 02:36:38.0933 3608        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys
2011/06/30 02:36:39.0053 3608        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\windows\system32\drivers\partmgr.sys
2011/06/30 02:36:39.0113 3608        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys
2011/06/30 02:36:39.0283 3608        pccsmcfd        (175cc28dcf819f78caa3fbd44ad9e52a) C:\windows\system32\DRIVERS\pccsmcfd.sys
2011/06/30 02:36:39.0353 3608        pci            (673e55c3498eb970088e812ea820aa8f) C:\windows\system32\drivers\pci.sys
2011/06/30 02:36:39.0393 3608        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\drivers\pciide.sys
2011/06/30 02:36:39.0503 3608        pcmcia          (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys
2011/06/30 02:36:39.0553 3608        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys
2011/06/30 02:36:39.0603 3608        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys
2011/06/30 02:36:39.0803 3608        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys
2011/06/30 02:36:39.0833 3608        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys
2011/06/30 02:36:39.0973 3608        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys
2011/06/30 02:36:40.0053 3608        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys
2011/06/30 02:36:40.0183 3608        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys
2011/06/30 02:36:40.0223 3608        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys
2011/06/30 02:36:40.0253 3608        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys
2011/06/30 02:36:40.0383 3608        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys
2011/06/30 02:36:40.0443 3608        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys
2011/06/30 02:36:40.0543 3608        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys
2011/06/30 02:36:40.0603 3608        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys
2011/06/30 02:36:40.0673 3608        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\windows\system32\DRIVERS\rdbss.sys
2011/06/30 02:36:40.0753 3608        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys
2011/06/30 02:36:40.0831 3608        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\windows\system32\DRIVERS\RDPCDD.sys
2011/06/30 02:36:40.0971 3608        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys
2011/06/30 02:36:41.0018 3608        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys
2011/06/30 02:36:41.0096 3608        RDPWD          (288b06960d78428ff89e811632684e20) C:\windows\system32\drivers\RDPWD.sys
2011/06/30 02:36:41.0283 3608        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\windows\system32\drivers\rdyboost.sys
2011/06/30 02:36:41.0502 3608        RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys
2011/06/30 02:36:41.0658 3608        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys
2011/06/30 02:36:41.0798 3608        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\windows\system32\drivers\sbp2port.sys
2011/06/30 02:36:41.0939 3608        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\windows\system32\DRIVERS\scfilter.sys
2011/06/30 02:36:42.0032 3608        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys
2011/06/30 02:36:42.0157 3608        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys
2011/06/30 02:36:42.0188 3608        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys
2011/06/30 02:36:42.0251 3608        sermouse        (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys
2011/06/30 02:36:42.0453 3608        sfdrv01        (b7018644e132a8dfb12ed90106e06739) C:\windows\system32\drivers\sfdrv01.sys
2011/06/30 02:36:42.0625 3608        sfdrv01a        (bfcd2450dc6eeda02aedc6d289ccf037) C:\windows\system32\drivers\sfdrv01a.sys
2011/06/30 02:36:42.0687 3608        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\drivers\sffdisk.sys
2011/06/30 02:36:42.0734 3608        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\drivers\sffp_mmc.sys
2011/06/30 02:36:42.0781 3608        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\windows\system32\drivers\sffp_sd.sys
2011/06/30 02:36:42.0937 3608        sfhlp02        (daad4c099ebf5094d32c373ac1ac0f3c) C:\windows\system32\drivers\sfhlp02.sys
2011/06/30 02:36:43.0015 3608        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys
2011/06/30 02:36:43.0190 3608        sfsync04        (755c933969a81d119106097aa466715d) C:\windows\system32\drivers\sfsync04.sys
2011/06/30 02:36:43.0290 3608        sfvfs02        (197cef62eb4bc043e1578529fa2b9a48) C:\windows\system32\drivers\sfvfs02.sys
2011/06/30 02:36:43.0400 3608        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\drivers\sisagp.sys
2011/06/30 02:36:43.0470 3608        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys
2011/06/30 02:36:43.0510 3608        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys
2011/06/30 02:36:43.0610 3608        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys
2011/06/30 02:36:43.0800 3608        SNP2UVC        (5211173ebc74b388d096e197c2243675) C:\windows\system32\DRIVERS\snp2uvc.sys
2011/06/30 02:36:43.0940 3608        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys
2011/06/30 02:36:44.0220 3608        sptd            (cdddec541bc3c96f91ecb48759673505) C:\windows\System32\Drivers\sptd.sys
2011/06/30 02:36:44.0380 3608        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\windows\system32\DRIVERS\srv.sys
2011/06/30 02:36:44.0430 3608        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\windows\system32\DRIVERS\srv2.sys
2011/06/30 02:36:44.0480 3608        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\windows\system32\DRIVERS\srvnet.sys
2011/06/30 02:36:44.0620 3608        sscdbus        (d6870895fe46a464a19141440eb6cc1e) C:\windows\system32\DRIVERS\sscdbus.sys
2011/06/30 02:36:44.0650 3608        sscdmdfl        (0fe167362e4689b716cdc8d93adedda8) C:\windows\system32\DRIVERS\sscdmdfl.sys
2011/06/30 02:36:44.0680 3608        sscdmdm        (55a15707e32b6709242ad127e62ca55a) C:\windows\system32\DRIVERS\sscdmdm.sys
2011/06/30 02:36:44.0800 3608        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys
2011/06/30 02:36:44.0880 3608        swenum          (e58c78a848add9610a4db6d214af5224) C:\windows\system32\drivers\swenum.sys
2011/06/30 02:36:45.0020 3608        SynTP          (e09c6ae9f84b5985979046e0a5896584) C:\windows\system32\DRIVERS\SynTP.sys
2011/06/30 02:36:45.0200 3608        Tcpip          (24326784df8f3d5f5bbb9f878ce33c14) C:\windows\system32\drivers\tcpip.sys
2011/06/30 02:36:45.0400 3608        TCPIP6          (24326784df8f3d5f5bbb9f878ce33c14) C:\windows\system32\DRIVERS\tcpip.sys
2011/06/30 02:36:45.0540 3608        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\windows\system32\drivers\tcpipreg.sys
2011/06/30 02:36:45.0620 3608        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\windows\system32\drivers\tdpipe.sys
2011/06/30 02:36:45.0670 3608        TDTCP          (2c10395baa4847f83042813c515cc289) C:\windows\system32\drivers\tdtcp.sys
2011/06/30 02:36:45.0800 3608        tdx            (b459575348c20e8121d6039da063c704) C:\windows\system32\DRIVERS\tdx.sys
2011/06/30 02:36:45.0990 3608        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\windows\system32\drivers\termdd.sys
2011/06/30 02:36:46.0210 3608        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\windows\system32\DRIVERS\tssecsrv.sys
2011/06/30 02:36:46.0320 3608        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\windows\system32\drivers\tsusbflt.sys
2011/06/30 02:36:46.0500 3608        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\windows\system32\DRIVERS\tunnel.sys
2011/06/30 02:36:46.0570 3608        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys
2011/06/30 02:36:46.0660 3608        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\windows\system32\DRIVERS\udfs.sys
2011/06/30 02:36:46.0870 3608        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\drivers\uliagpkx.sys
2011/06/30 02:36:47.0050 3608        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\windows\system32\drivers\umbus.sys
2011/06/30 02:36:47.0120 3608        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys
2011/06/30 02:36:47.0340 3608        usbaudio        (1d9f2bd026e8e2d45033a4df3f16b78c) C:\windows\system32\drivers\usbaudio.sys
2011/06/30 02:36:47.0400 3608        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\windows\system32\drivers\usbccgp.sys
2011/06/30 02:36:47.0520 3608        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\drivers\usbcir.sys
2011/06/30 02:36:47.0870 3608        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\windows\system32\DRIVERS\usbehci.sys
2011/06/30 02:36:48.0130 3608        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\windows\system32\DRIVERS\usbhub.sys
2011/06/30 02:36:48.0470 3608        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\windows\system32\drivers\usbohci.sys
2011/06/30 02:36:48.0670 3608        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys
2011/06/30 02:36:49.0100 3608        usbscan        (576096ccbc07e7c4ea4f5e6686d6888f) C:\windows\system32\DRIVERS\usbscan.sys
2011/06/30 02:36:49.0411 3608        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\windows\system32\drivers\USBSTOR.SYS
2011/06/30 02:36:49.0723 3608        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\windows\system32\DRIVERS\usbuhci.sys
2011/06/30 02:36:50.0051 3608        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\windows\System32\Drivers\usbvideo.sys
2011/06/30 02:36:50.0347 3608        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\drivers\vdrvroot.sys
2011/06/30 02:36:50.0628 3608        vga            (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys
2011/06/30 02:36:50.0800 3608        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys
2011/06/30 02:36:51.0081 3608        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\windows\system32\drivers\vhdmp.sys
2011/06/30 02:36:51.0330 3608        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\drivers\viaagp.sys
2011/06/30 02:36:51.0377 3608        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys
2011/06/30 02:36:51.0549 3608        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\drivers\viaide.sys
2011/06/30 02:36:51.0907 3608        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\windows\system32\drivers\volmgr.sys
2011/06/30 02:36:52.0117 3608        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys
2011/06/30 02:36:52.0337 3608        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\windows\system32\drivers\volsnap.sys
2011/06/30 02:36:52.0797 3608        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys
2011/06/30 02:36:53.0057 3608        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys
2011/06/30 02:36:53.0487 3608        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys
2011/06/30 02:36:53.0597 3608        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys
2011/06/30 02:36:53.0817 3608        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
2011/06/30 02:36:53.0827 3608        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
2011/06/30 02:36:54.0107 3608        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys
2011/06/30 02:36:54.0387 3608        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys
2011/06/30 02:36:54.0663 3608        wdmirror        (ea4e9dd00e69b35f9bd3d39acb113e3f) C:\windows\system32\DRIVERS\WDMirror.sys
2011/06/30 02:36:54.0898 3608        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys
2011/06/30 02:36:55.0108 3608        WimFltr        (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\windows\system32\DRIVERS\wimfltr.sys
2011/06/30 02:36:55.0258 3608        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys
2011/06/30 02:36:55.0548 3608        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\windows\system32\DRIVERS\WinUSB.sys
2011/06/30 02:36:55.0778 3608        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\drivers\wmiacpi.sys
2011/06/30 02:36:55.0958 3608        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys
2011/06/30 02:36:56.0158 3608        wsvd            (baedc491374defd5e76336901d6d397d) C:\windows\system32\DRIVERS\wsvd.sys
2011/06/30 02:36:56.0248 3608        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\windows\system32\drivers\WudfPf.sys
2011/06/30 02:36:56.0378 3608        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\windows\system32\DRIVERS\WUDFRd.sys
2011/06/30 02:36:56.0488 3608        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/06/30 02:36:56.0518 3608        Boot (0x1200)  (e22e87bce789745c13bfad48ec1e6452) \Device\Harddisk0\DR0\Partition0
2011/06/30 02:36:56.0628 3608        Boot (0x1200)  (1406d996a9ca1e53acc05d59ecf97b91) \Device\Harddisk0\DR0\Partition1
2011/06/30 02:36:56.0668 3608        Boot (0x1200)  (30f5ced457eb846d2c4b523372a9a90f) \Device\Harddisk0\DR0\Partition2
2011/06/30 02:36:56.0698 3608        ================================================================================
2011/06/30 02:36:56.0698 3608        Scan finished
2011/06/30 02:36:56.0698 3608        ================================================================================
2011/06/30 02:36:56.0718 5692        Detected object count: 0
2011/06/30 02:36:56.0718 5692        Actual detected object count: 0

Startmenüeinträge bleiben auch nach mehrmaligem Ausführen von Unhide.exe leer.
Zudem kommt hinzu, dass ich das Gefühl habe, dass mein Internet seit dem Tag langsamer läuft. Mag mich täuschen, aber teilweise braucht es echt lange zum laden.

cosinus 30.06.2011 10:20
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

blauer_alex 07.07.2011 19:30
Code:
ComboFix 11-07-07.03 - *** 07.07.2011  19:32:07.1.2 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3003.1964 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Recycle.Bin
c:\recycle.bin\config.bin
c:\recycle.bin\Recycle.Bin.exe
c:\windows\s.bat
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-06-07 bis 2011-07-07  ))))))))))))))))))))))))))))))
.
.
2011-07-07 17:51 . 2011-07-07 17:51        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-07-07 16:51 . 2011-07-07 16:51        28752        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\MpKsl230bdac5.sys
2011-07-07 16:51 . 2011-06-07 15:55        7074640        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\mpengine.dll
2011-07-03 21:53 . 2009-07-14 01:15        70144        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\CNBPP3.DLL
2011-06-29 21:30 . 2011-06-29 21:31        --------        d-----w-        c:\windows\system32\SPReview
2011-06-29 21:28 . 2011-06-29 21:28        --------        d-----w-        c:\windows\system32\EventProviders
2011-06-29 18:15 . 2011-06-29 18:15        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-29 18:15 . 2011-06-29 18:15        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-29 13:25 . 2011-05-24 10:44        293376        ----a-w-        c:\windows\system32\umpnpmgr.dll
2011-06-29 13:25 . 2010-11-20 12:18        145920        ----a-w-        c:\windows\system32\cfgmgr32.dll
2011-06-29 13:25 . 2011-05-04 04:34        1549312        ----a-w-        c:\windows\system32\tquery.dll
2011-06-29 13:25 . 2011-05-04 04:32        1401344        ----a-w-        c:\windows\system32\mssrch.dll
2011-06-29 13:25 . 2011-05-04 04:28        427520        ----a-w-        c:\windows\system32\SearchIndexer.exe
2011-06-29 13:25 . 2011-05-04 04:32        666624        ----a-w-        c:\windows\system32\mssvp.dll
2011-06-29 13:25 . 2011-05-04 04:32        337408        ----a-w-        c:\windows\system32\mssph.dll
2011-06-29 13:25 . 2011-05-04 04:32        197120        ----a-w-        c:\windows\system32\mssphtb.dll
2011-06-29 13:25 . 2011-05-04 04:28        164352        ----a-w-        c:\windows\system32\SearchProtocolHost.exe
2011-06-29 13:25 . 2011-05-04 04:28        86528        ----a-w-        c:\windows\system32\SearchFilterHost.exe
2011-06-29 13:25 . 2011-05-04 04:32        59392        ----a-w-        c:\windows\system32\msscntrs.dll
2011-06-27 14:56 . 2011-06-27 14:56        --------        d--h--w-        c:\programdata\CanonIJScan
2011-06-27 14:55 . 2011-06-27 14:57        --------        d-----w-        c:\users\***\AppData\Roaming\Canon
2011-06-27 14:48 . 2011-06-27 14:48        --------        d-----w-        c:\windows\system32\STRING
2011-06-27 14:48 . 2009-04-03 16:51        137216        ----a-w-        c:\windows\system32\CNMNPUI.DLL
2011-06-27 14:48 . 2009-04-03 16:51        353792        ----a-w-        c:\windows\system32\CNMNPPM.DLL
2011-06-27 14:48 . 2011-06-27 14:48        --------        d-----w-        c:\windows\system32\CHM
2011-06-27 14:46 . 2011-06-27 14:55        --------        d-----w-        c:\program files\Canon
2011-06-24 22:26 . 2011-06-24 22:26        --------        d-----w-        c:\users\***\AppData\Roaming\Mozilla-Cache
2011-06-24 22:23 . 2011-06-24 22:23        --------        d-----w-        C:\Programs
2011-06-24 03:39 . 2011-06-24 03:39        --------        d-----w-        C:\_OTL
2011-06-23 20:07 . 2010-11-05 01:58        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2011-06-23 20:05 . 2010-11-20 12:21        1619456        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2011-06-23 20:04 . 2010-11-20 12:30        53120        ----a-w-        c:\windows\system32\drivers\volmgr.sys
2011-06-23 20:03 . 2010-11-20 12:21        196608        ----a-w-        c:\windows\system32\wwanconn.dll
2011-06-23 20:02 . 2010-11-20 12:07        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-06-23 20:01 . 2010-11-20 12:21        697344        ----a-w-        c:\windows\system32\SmiEngine.dll
2011-06-23 20:01 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\wdscore.dll
2011-06-23 20:01 . 2010-11-20 12:17        209920        ----a-w-        c:\windows\system32\PkgMgr.exe
2011-06-23 20:00 . 2010-11-20 12:18        323072        ----a-w-        c:\windows\system32\drvstore.dll
2011-06-23 20:00 . 2010-11-20 12:18        257024        ----a-w-        c:\windows\system32\dpx.dll
2011-06-20 20:50 . 2011-06-20 20:50        218688        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2011-06-20 20:50 . 2011-06-20 20:50        --------        d-----w-        c:\program files\DAEMON Tools Lite
2011-06-15 05:07 . 2011-06-15 05:08        --------        d-----w-        c:\users\test
2011-06-15 02:08 . 2011-06-15 02:08        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes
2011-06-15 02:08 . 2011-06-15 02:08        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-15 00:33 . 2011-04-22 19:10        981504        ----a-w-        c:\windows\system32\wininet.dll
2011-06-15 00:33 . 2011-04-29 04:57        189952        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll
2011-06-15 00:33 . 2011-04-22 19:09        163328        ----a-w-        c:\program files\Internet Explorer\ieproxy.dll
2011-06-15 00:33 . 2011-05-28 02:53        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
2011-06-15 00:33 . 2011-04-27 02:17        223744        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 00:33 . 2011-04-27 02:17        96768        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 00:33 . 2011-04-27 02:17        123904        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-29 21:44 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
2011-06-07 15:55 . 2010-09-29 15:37        7074640        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-24 21:51 . 2011-05-24 21:51        445016        ----a-w-        c:\windows\system32\wrap_oal.dll
2011-05-24 21:51 . 2011-05-24 21:51        109144        ----a-w-        c:\windows\system32\OpenAL32.dll
2011-05-10 19:04 . 2011-02-01 05:10        24576        ----a-r-        c:\users\***\AppData\Roaming\Microsoft\Installer\{EDA2E9CA-8B7E-4BC0-9B0F-34B299555BF3}\IconEDA2E9CA.exe
2011-04-22 19:14 . 2011-05-25 04:02        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-04-09 16:55 . 2011-04-09 16:55        15453336        ----a-w-        c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55        13642904        ----a-w-        c:\windows\system32\xlivefnt.dll
2011-04-09 06:02 . 2011-05-11 17:05        3967872        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 17:05        3912576        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-24 11:39        123904        ----a-w-        c:\windows\system32\poqexec.exe
2011-06-29 18:15 . 2011-05-12 18:11        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2009-09-11 20:47        5066504        ----a-w-        c:\program files\Lenovo\LenovoSecuritySolution FP\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2009-09-11 20:47        5066504        ----a-w-        c:\program files\Lenovo\LenovoSecuritySolution FP\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-02 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-02 151064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-11 7739936]
"IndicatorListener"="c:\program files\Motorola\Bluetooth\mkil.dll" [2009-08-12 107784]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2009-07-22 17753352]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-09-03 1557800]
"PSQLLauncher"="c:\program files\Lenovo\LenovoSecuritySolution FP\launcher.exe" [2009-09-11 55048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"UpdateP2GShortCut"="c:\program files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-07-12 74752]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files\Windows Live\Installer\wlstart.exe" [2009-07-26 786760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2009-09-11 20:20        100616        ----a-w-        c:\program files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli c:\program files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
2010-12-13 19:51        102400        ----a-w-        c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-01 06:39        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 16:16        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
R1 MpKsl12f0c6c2;MpKsl12f0c6c2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B8AF5B40-1E54-4380-88CC-3E7E2475912E}\MpKsl12f0c6c2.sys [x]
R1 MpKsl4cced1c7;MpKsl4cced1c7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6FACF7C9-06C0-48D1-8F8E-95FE64D0A5F2}\MpKsl4cced1c7.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 136176]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [x]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-28 63240]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys [2009-07-09 40448]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-12-07 201168]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 136176]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-10-12 101120]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-07-28 414984]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-07-28 472328]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-26 691696]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys [2009-02-03 63096]
S1 funfrm;funfrm; [x]
S1 MpKsl230bdac5;MpKsl230bdac5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\MpKsl230bdac5.sys [2011-07-07 28752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2009-07-22 474888]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-07-15 233472]
S2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
S2 UpekSrvc;Upek Service;c:\program files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe [2009-09-11 44808]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-05-19 21520]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2009-07-22 3473672]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2009-07-22 709384]
S3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2009-07-13 516608]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-20 218688]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-07-15 36608]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-10-02 122368]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-27 51712]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSL230BDAC5
*NewlyCreated* - MPKSLB9A8086C
*Deregistered* - MpKslb9a8086c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
IgrsSvcs        REG_MULTI_SZ          ReadyComm.DirectRouter PS_MDP
.
Inhalt des "geplante Tasks" Ordners
.
2011-07-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 03:42]
.
2011-07-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 03:42]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.bild.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{6BF9D236-A1D2-426D-9AB6-7E95DCBAC6B4}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{7010AAE3-7CBB-46A4-8500-130D143CA629}: NameServer = 193.189.244.225 193.189.244.206
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ohh0ccb1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=de&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-4E3E0230AEBB4E96 - c:\recycle.bin\Recycle.Bin.exe
HKLM-Run-snp2uvc - c:\windows\vsnp2uvc.exe
HKLM-Run-VeriFaceManager - c:\program files\Lenovo\VeriFace\PManage.exe
HKLM-Run-NPSStartup - (no file)
HKLM-Run-Malwarebytes' Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-Free Videos To DVD_is1 - g:\dateien\Videos To DVD\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3336212685-1508650090-3164056612-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*s*e*a*n*_*k*i*n*g*s*t*o*n*_*-*_*r*e*a*d*y*_*o*r*_*n*o*t*_*(*d*e*-**+Z5\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(536)
c:\program files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\homefus2.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\infql2.dll
.
- - - - - - - > 'Explorer.exe'(4820)
c:\program files\Lenovo\LenovoSecuritySolution FP\farchns.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\infql2.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\qlbase.dll
.
Zeit der Fertigstellung: 2011-07-07  20:12:21
ComboFix-quarantined-files.txt  2011-07-07 18:12
.
Vor Suchlauf: 12 Verzeichnis(se), 52.751.499.264 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 53.017.075.712 Bytes frei
.
- - End Of File - - D029AE10A9A8F078F525B195E081677B

cosinus 07.07.2011 21:38
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Reglockdel::
[HKEY_USERS\S-1-5-21-3336212685-1508650090-3164056612-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*s*e*a*n*_*k*i*n*g*s*t*o*n*_*-*_*r*e*a*d*y*_*o*r*_*n*o*t*_*(*d*e*-**+Z5\OpenWithList]

Driver::
funfrm
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

blauer_alex 08.07.2011 03:04
Code:
ComboFix 11-07-07.05 - *** 08.07.2011  3:31.2.2 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3003.2070 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\***\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_funfrm
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-06-08 bis 2011-07-08  ))))))))))))))))))))))))))))))
.
.
2011-07-08 01:44 . 2011-07-08 01:44        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-07-08 01:44 . 2011-07-08 01:44        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2011-07-08 01:07 . 2011-07-08 01:07        28752        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\MpKslfd4883df.sys
2011-07-07 16:51 . 2011-06-07 15:55        7074640        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\mpengine.dll
2011-07-03 21:53 . 2009-07-14 01:15        70144        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\CNBPP3.DLL
2011-06-29 21:30 . 2011-06-29 21:31        --------        d-----w-        c:\windows\system32\SPReview
2011-06-29 21:28 . 2011-06-29 21:28        --------        d-----w-        c:\windows\system32\EventProviders
2011-06-29 18:15 . 2011-06-29 18:15        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-29 18:15 . 2011-06-29 18:15        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-29 13:25 . 2011-05-24 10:44        293376        ----a-w-        c:\windows\system32\umpnpmgr.dll
2011-06-29 13:25 . 2010-11-20 12:18        145920        ----a-w-        c:\windows\system32\cfgmgr32.dll
2011-06-29 13:25 . 2011-05-04 04:34        1549312        ----a-w-        c:\windows\system32\tquery.dll
2011-06-29 13:25 . 2011-05-04 04:32        1401344        ----a-w-        c:\windows\system32\mssrch.dll
2011-06-29 13:25 . 2011-05-04 04:28        427520        ----a-w-        c:\windows\system32\SearchIndexer.exe
2011-06-29 13:25 . 2011-05-04 04:32        666624        ----a-w-        c:\windows\system32\mssvp.dll
2011-06-29 13:25 . 2011-05-04 04:32        337408        ----a-w-        c:\windows\system32\mssph.dll
2011-06-29 13:25 . 2011-05-04 04:32        197120        ----a-w-        c:\windows\system32\mssphtb.dll
2011-06-29 13:25 . 2011-05-04 04:28        164352        ----a-w-        c:\windows\system32\SearchProtocolHost.exe
2011-06-29 13:25 . 2011-05-04 04:28        86528        ----a-w-        c:\windows\system32\SearchFilterHost.exe
2011-06-29 13:25 . 2011-05-04 04:32        59392        ----a-w-        c:\windows\system32\msscntrs.dll
2011-06-27 14:56 . 2011-06-27 14:56        --------        d--h--w-        c:\programdata\CanonIJScan
2011-06-27 14:55 . 2011-06-27 14:57        --------        d-----w-        c:\users\***\AppData\Roaming\Canon
2011-06-27 14:48 . 2011-06-27 14:48        --------        d-----w-        c:\windows\system32\STRING
2011-06-27 14:48 . 2009-04-03 16:51        137216        ----a-w-        c:\windows\system32\CNMNPUI.DLL
2011-06-27 14:48 . 2009-04-03 16:51        353792        ----a-w-        c:\windows\system32\CNMNPPM.DLL
2011-06-27 14:48 . 2011-06-27 14:48        --------        d-----w-        c:\windows\system32\CHM
2011-06-27 14:46 . 2011-06-27 14:55        --------        d-----w-        c:\program files\Canon
2011-06-24 22:26 . 2011-06-24 22:26        --------        d-----w-        c:\users\***\AppData\Roaming\Mozilla-Cache
2011-06-24 22:23 . 2011-06-24 22:23        --------        d-----w-        C:\Programs
2011-06-24 03:39 . 2011-06-24 03:39        --------        d-----w-        C:\_OTL
2011-06-23 20:07 . 2010-11-05 01:58        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2011-06-23 20:05 . 2010-11-20 12:21        1619456        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2011-06-23 20:04 . 2010-11-20 12:30        53120        ----a-w-        c:\windows\system32\drivers\volmgr.sys
2011-06-23 20:03 . 2010-11-20 12:21        196608        ----a-w-        c:\windows\system32\wwanconn.dll
2011-06-23 20:02 . 2010-11-20 12:07        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-06-23 20:01 . 2010-11-20 12:21        697344        ----a-w-        c:\windows\system32\SmiEngine.dll
2011-06-23 20:01 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\wdscore.dll
2011-06-23 20:01 . 2010-11-20 12:17        209920        ----a-w-        c:\windows\system32\PkgMgr.exe
2011-06-23 20:00 . 2010-11-20 12:18        323072        ----a-w-        c:\windows\system32\drvstore.dll
2011-06-23 20:00 . 2010-11-20 12:18        257024        ----a-w-        c:\windows\system32\dpx.dll
2011-06-20 20:50 . 2011-06-20 20:50        218688        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2011-06-20 20:50 . 2011-06-20 20:50        --------        d-----w-        c:\program files\DAEMON Tools Lite
2011-06-15 05:07 . 2011-06-15 05:08        --------        d-----w-        c:\users\test
2011-06-15 02:08 . 2011-06-15 02:08        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes
2011-06-15 02:08 . 2011-06-15 02:08        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-15 00:33 . 2011-04-22 19:10        981504        ----a-w-        c:\windows\system32\wininet.dll
2011-06-15 00:33 . 2011-04-29 04:57        189952        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll
2011-06-15 00:33 . 2011-04-22 19:09        163328        ----a-w-        c:\program files\Internet Explorer\ieproxy.dll
2011-06-15 00:33 . 2011-05-28 02:53        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
2011-06-15 00:33 . 2011-04-27 02:17        223744        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 00:33 . 2011-04-27 02:17        96768        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 00:33 . 2011-04-27 02:17        123904        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-29 21:44 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
2011-06-07 15:55 . 2010-09-29 15:37        7074640        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-24 21:51 . 2011-05-24 21:51        445016        ----a-w-        c:\windows\system32\wrap_oal.dll
2011-05-24 21:51 . 2011-05-24 21:51        109144        ----a-w-        c:\windows\system32\OpenAL32.dll
2011-05-10 19:04 . 2011-02-01 05:10        24576        ----a-r-        c:\users\***\AppData\Roaming\Microsoft\Installer\{EDA2E9CA-8B7E-4BC0-9B0F-34B299555BF3}\IconEDA2E9CA.exe
2011-04-22 19:14 . 2011-05-25 04:02        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-04-09 16:55 . 2011-04-09 16:55        15453336        ----a-w-        c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55        13642904        ----a-w-        c:\windows\system32\xlivefnt.dll
2011-04-09 06:02 . 2011-05-11 17:05        3967872        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 17:05        3912576        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-24 11:39        123904        ----a-w-        c:\windows\system32\poqexec.exe
2011-06-29 18:15 . 2011-05-12 18:11        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2011-07-07_17.53.19  )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:55 . 2011-07-08 01:48        47112              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-09-26 00:59 . 2011-07-08 01:48        14310              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3336212685-1508650090-3164056612-1003_UserData.bin
- 2009-07-14 04:50 . 2011-07-07 16:40        86016              c:\windows\System32\DriverStore\infpub.dat
+ 2009-07-14 04:50 . 2011-07-08 01:47        86016              c:\windows\System32\DriverStore\infpub.dat
- 2010-09-26 06:09 . 2011-07-07 16:40        32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-26 06:09 . 2011-07-08 01:47        32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-26 06:09 . 2011-07-08 01:47        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-09-26 06:09 . 2011-07-07 16:40        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:41 . 2011-07-07 16:40        16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2011-07-08 01:47        16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-11 20:49 . 2011-07-07 16:40        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-11 20:49 . 2011-07-08 01:49        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-11 20:49 . 2011-07-07 16:40        32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-11 20:49 . 2011-07-08 01:49        32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-11 20:49 . 2011-07-08 01:49        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-11 20:49 . 2011-07-07 16:40        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-09-25 22:49 . 2011-07-08 01:49        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-25 22:49 . 2011-07-07 17:02        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-25 22:49 . 2011-07-07 17:02        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-09-25 22:49 . 2011-07-08 01:49        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-09-29 23:39 . 2011-07-07 21:58        3016              c:\windows\System32\wdi\ERCQueuedResolutions.dat
- 2010-09-29 23:39 . 2011-06-14 20:26        3016              c:\windows\System32\wdi\ERCQueuedResolutions.dat
+ 2011-07-08 01:07 . 2011-07-08 01:46        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-07-07 16:39 . 2011-07-07 16:39        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-07-07 16:39 . 2011-07-07 16:39        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-08 01:07 . 2011-07-08 01:46        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 04:50 . 2011-07-08 01:47        143360              c:\windows\System32\DriverStore\infstrng.dat
- 2009-07-14 04:50 . 2011-07-07 16:40        143360              c:\windows\System32\DriverStore\infstrng.dat
+ 2009-07-14 04:50 . 2011-07-08 01:47        143360              c:\windows\System32\DriverStore\infstor.dat
- 2009-07-14 04:50 . 2011-07-07 16:40        143360              c:\windows\System32\DriverStore\infstor.dat
- 2010-06-29 20:26 . 2011-07-07 16:40        262144              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-06-29 20:26 . 2011-07-08 01:47        262144              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 04:47 . 2011-07-07 07:28        457084              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:47 . 2011-07-07 21:58        457084              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-05-12 21:29 . 2011-07-07 21:58        1817692              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3336212685-1508650090-3164056612-1003-8192.dat
- 2011-05-12 21:29 . 2011-07-07 07:28        1817692              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3336212685-1508650090-3164056612-1003-8192.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2009-09-11 20:47        5066504        ----a-w-        c:\program files\Lenovo\LenovoSecuritySolution FP\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2009-09-11 20:47        5066504        ----a-w-        c:\program files\Lenovo\LenovoSecuritySolution FP\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"4E3E0230AEBB4E96"="c:\recycle.bin\Recycle.Bin.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-02 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-02 151064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-11 7739936]
"IndicatorListener"="c:\program files\Motorola\Bluetooth\mkil.dll" [2009-08-12 107784]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2009-07-22 17753352]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-09-03 1557800]
"PSQLLauncher"="c:\program files\Lenovo\LenovoSecuritySolution FP\launcher.exe" [2009-09-11 55048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"UpdateP2GShortCut"="c:\program files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-07-12 74752]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files\Windows Live\Installer\wlstart.exe" [2009-07-26 786760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2009-09-11 20:20        100616        ----a-w-        c:\program files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli c:\program files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
2010-12-13 19:51        102400        ----a-w-        c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-01 06:39        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 16:16        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
R1 MpKsl12f0c6c2;MpKsl12f0c6c2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B8AF5B40-1E54-4380-88CC-3E7E2475912E}\MpKsl12f0c6c2.sys [x]
R1 MpKsl4cced1c7;MpKsl4cced1c7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6FACF7C9-06C0-48D1-8F8E-95FE64D0A5F2}\MpKsl4cced1c7.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 136176]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2009-07-22 709384]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-28 63240]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys [2009-07-09 40448]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-12-07 201168]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 136176]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-10-12 101120]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-07-28 414984]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-07-28 472328]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-26 691696]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys [2009-02-03 63096]
S1 MpKslfd4883df;MpKslfd4883df;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\MpKslfd4883df.sys [2011-07-08 28752]
S1 MpKslff09b73e;MpKslff09b73e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A05DB15E-A8BB-412B-93A0-256997125374}\MpKslff09b73e.sys [2011-07-08 28752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2009-07-22 474888]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-07-15 233472]
S2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
S2 UpekSrvc;Upek Service;c:\program files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe [2009-09-11 44808]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-05-19 21520]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2009-07-22 3473672]
S3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2009-07-13 516608]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-20 218688]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-07-15 36608]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-10-02 122368]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-27 51712]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSLFF09B73E
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
IgrsSvcs        REG_MULTI_SZ          ReadyComm.DirectRouter PS_MDP
.
Inhalt des "geplante Tasks" Ordners
.
2011-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 03:42]
.
2011-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 03:42]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.bild.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{6BF9D236-A1D2-426D-9AB6-7E95DCBAC6B4}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{7010AAE3-7CBB-46A4-8500-130D143CA629}: NameServer = 193.189.244.225 193.189.244.206
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ohh0ccb1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=de&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3336212685-1508650090-3164056612-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*s*e*a*n*_*k*i*n*g*s*t*o*n*_*-*_*r*e*a*d*y*_*o*r*_*n*o*t*_*(*d*e*-**+Z5\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(520)
c:\program files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\homefus2.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\infql2.dll
.
- - - - - - - > 'Explorer.exe'(3020)
c:\program files\Lenovo\LenovoSecuritySolution FP\farchns.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\infql2.dll
c:\program files\Lenovo\LenovoSecuritySolution FP\qlbase.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Lenovo\LenovoSecuritySolution FP\upeksvr.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-07-08  04:00:54 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-07-08 02:00
ComboFix2.txt  2011-07-07 18:12
.
Vor Suchlauf: 13 Verzeichnis(se), 52.744.552.448 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 52.526.571.520 Bytes frei
.
- - End Of File - - 443B75CF7913DB234121EB03A4BCA6CB

cosinus 08.07.2011 15:52
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

blauer_alex 13.07.2011 05:41
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-07-13 06:39:18
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 HITACHI_HTS545032B9A300 rev.PB3ZC61H
Running: dyv1ic3w.exe; Driver: C:\Users\***\AppData\Local\Temp\kxldrpog.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                                                                                          82E77339 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                82EB0D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.xreloc        C:\windows\System32\drivers\sfsync04.sys                                                                                              unknown last section [0x8AF42000, 0xC5E, 0x40000040]
?              C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5481BC9F-8218-4512-9CCD-58CF49BB11BF}\MpKsl4ded2da8.sys            Das System kann die angegebene Datei nicht finden. !
.vmp2          C:\windows\system32\drivers\acedrv11.sys                                                                                              entry point in ".vmp2" section [0xAD36869D]
PAGE            peauth.sys                                                                                                                            AE019B9B 72 Bytes  CALL 9D91421D

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\System32\rundll32.exe[3432] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                                  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3432] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                                  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3432] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                                [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3432] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                                [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3932] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                                  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3932] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                                  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3932] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                                [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\System32\rundll32.exe[3932] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                                [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe[3940] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe[3940] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]    [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe[3940] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe[3940] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe[3940] @ C:\windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe[3940] @ C:\windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]  [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000055                                                                                                      halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                                            8613EDD0
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                                    8613EDD0
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                                    8613EDD0
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                                    8613EDD0
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                                    8613EDD0
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                                                                                            8613EDD0

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001c7b2c8764                                                           
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                                                           
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                    C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                    0
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                0xA2 0x06 0xBC 0xA2 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                             
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                          0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                        0xB0 0x94 0x8D 0x25 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                       
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                  0xCE 0x39 0x47 0x96 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                                       
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                                  0x07 0xC7 0x8A 0x8D ...
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001c7b2c8764 (not active ControlSet)                                       
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)                                       
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                 
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                        C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                        0
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                    0xA2 0x06 0xBC 0xA2 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                         
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                              0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                            0xB0 0x94 0x8D 0x25 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                   
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                      0xCE 0x39 0x47 0x96 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)                   
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                                      0x07 0xC7 0x8A 0x8D ...

---- EOF - GMER 1.0.15 ----

blauer_alex 13.07.2011 05:47
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 06:45:35 on 13.07.2011

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit
Default Browser: Mozilla Corporation Firefox 5.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\windows\system32\DivXControlPanelApplet.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 9\Nero BurnRights\NeroBurnRights_cpl.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\windows\system32\drivers\acedrv11.sys
"Bridge0" (Bridge0) - "Lenovo" - C:\windows\System32\drivers\WDBridge.sys
"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\windows\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"kxldrpog" (kxldrpog) - ? - C:\Users\***\AppData\Local\Temp\kxldrpog.sys  (Hidden registry entry, rootkit activity | File not found)
"MpKsl12f0c6c2" (MpKsl12f0c6c2) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B8AF5B40-1E54-4380-88CC-3E7E2475912E}\MpKsl12f0c6c2.sys  (File not found)
"MpKsl14e1b36c" (MpKsl14e1b36c) - "Microsoft Corporation" - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5AB883B6-5617-48F0-B1EE-C0CDE93BDCB5}\MpKsl14e1b36c.sys
"MpKsl4cced1c7" (MpKsl4cced1c7) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6FACF7C9-06C0-48D1-8F8E-95FE64D0A5F2}\MpKsl4cced1c7.sys  (File not found)
"MpKsl4ded2da8" (MpKsl4ded2da8) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5481BC9F-8218-4512-9CCD-58CF49BB11BF}\MpKsl4ded2da8.sys  (File not found)
"Realtek IR Driver" (RtsUIR) - ? - C:\windows\System32\DRIVERS\Rts516xIR.sys  (File not found)
"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\windows\System32\DRIVERS\RtsUCcid.sys  (File not found)
"RtsUStor.Sys Realtek USB Card Reader" (RSUSBSTOR) - ? - C:\windows\System32\Drivers\RtsUStor.sys  (File not found)
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology (StarForce)" - C:\windows\System32\drivers\sfdrv01.sys
"StarForce Protection Environment Driver (version 1.x.a)" (sfdrv01a) - "Protection Technology (StarForce)" - C:\windows\System32\drivers\sfdrv01a.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology (StarForce)" - C:\windows\System32\drivers\sfhlp02.sys
"StarForce Protection Synchronization Driver (version 4.x)" (sfsync04) - "Protection Technology (StarForce)" - C:\windows\System32\drivers\sfsync04.sys
"StarForce Protection VFS Driver (version 2.x)" (sfvfs02) - "Protection Technology (StarForce)" - C:\windows\System32\drivers\sfvfs02.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\windows\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{055EF591-5C38-49a0-9BDA-51B1D69D0BF4} "@C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll,-4263" - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{0A7D34C2-E9DA-48A1-9E34-0CDFC2DE3B44} "CSendToContextMenu Object" - "Motorola, Inc." - C:\Program Files\Motorola\Bluetooth\btmshell.dll
{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MI8079~1\shellext.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{862D80CE-A2A4-45D4-8008-7F40766F5FEA} "My Bluetooth" - "Motorola, Inc." - C:\Program Files\Motorola\Bluetooth\btmshell.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{9AFDE8D6-200C-4b41-A5FC-B7251DFD1A8E} "Safearchive ContextMenu Class" - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll
{E6D7D89A-2232-446d-8A0F-D0F9B06DB1CA} "Safearchive ExtractIcon Class" - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll
{66C99756-1C92-4d3e-BA69-9400A6F731F5} "Safearchive PropertySheetHandler Class" - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll
{771C7324-DA80-49D3-8017-753B0AF60951} "VeriFace Enc" - ? -  (File not found | COM-object registry key not found)
{DF4F5AE4-E795-4C12-BC26-7726C27F71AE} "VeriFace file icon extension" - ? -  (File not found | COM-object registry key not found)
{2d3dd4c0-3bd7-11d2-821e-444553540000} "WdmidleDeviceShellExtension" - ? - c:\program files\lenovo\energy management\powcpl.dll  (File found, but it contains no detailed information)
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{21347690-EC41-4F9A-8887-1F4AEE672439} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
<binary data> "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{3785D0AD-BFFF-47F6-BF5B-A587C162FED9} "Canon Easy-WebPrint EX BHO" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Notification packages" - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll
"Security Packages" - "Microsoft Corporation" - C:\windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"4E3E0230AEBB4E96" - ? - C:\Recycle.Bin\Recycle.Bin.exe  (File not found)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"BTMTrayAgent" - "Motorola, Inc." - rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
"CanonMyPrinter" - "CANON INC." - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
"CanonSolutionMenu" - "CANON INC." - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"Energy Management" - "Lenovo (Beijing) Limited" - C:\Program Files\Lenovo\Energy Management\Energy Management.exe
"EnergyUtility" - "Lenovo(beijing) Limited" - C:\Program Files\Lenovo\Energy Management\utility.exe
"IndicatorListener" - "Motorola, Inc." - rundll32.exe "C:\Program Files\Motorola\Bluetooth\mkil.dll",StartNotification
"MSC" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"PSQLLauncher" - "UPEK Inc." - "C:\Program Files\Lenovo\LenovoSecuritySolution FP\launcher.exe" /startup
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"UpdateP2GShortCut" - "CyberLink Corp." - "C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
"WinampAgent" - "Nullsoft, Inc." - "C:\Program Files\Winamp\winampa.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Canon BJNP Port" - "CANON INC." - C:\windows\system32\CNMNPPM.DLL

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Bluetooth Device Manager" (Bluetooth Device Manager) - "Motorola, Inc." - C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
"Bluetooth Media Service" (Bluetooth Media Service) - "Motorola, Inc." - C:\Program Files\Motorola\Bluetooth\audiosrv.exe
"Bluetooth OBEX Service" (Bluetooth OBEX Service) - "Motorola, Inc." - C:\Program Files\Motorola\Bluetooth\obexsrv.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\windows\system32\FsUsbExService.Exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"IGRS" (IGRS) - "Lenovo Group Limited" - C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Lenovo ReadyComm AppSvc" (Lenovo ReadyComm AppSvc) - "Lenovo Group Limited" - C:\Program Files\Lenovo\ReadyComm\AppSvc.exe
"Lenovo ReadyComm ConnSvc" (Lenovo ReadyComm ConnSvc) - "Lenovo Group Limited" - C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe
"McAfee SiteAdvisor Service" (McAfee SiteAdvisor Service) - ? - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe  (File not found)
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Nero BackItUp Scheduler 4.0" (Nero BackItUp Scheduler 4.0) - "Nero AG" - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"SeaPort" (SeaPort) - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server Browser" (SQLBrowser) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
"Upek Service" (UpekSrvc) - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"psfus" - "UPEK Inc." - C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

blauer_alex 13.07.2011 05:49
Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows 7 Home Premium Edition
Windows Information:                Service Pack 1 (build 7601), 32-bit
Base Board Manufacturer:        LENOVO
BIOS Manufacturer:                LENOVO
System Manufacturer:                LENOVO
System Product Name:                20034,3749
Logical Drives Mask:                0x0000002c

Kernel Drivers (total 193):
  0x82E39000 \SystemRoot\system32\ntkrnlpa.exe
  0x82E02000 \SystemRoot\system32\halmacpi.dll
  0x80BA7000 \SystemRoot\system32\kdcom.dll
  0x8AC17000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8AC9C000 \SystemRoot\system32\PSHED.dll
  0x8ACAD000 \SystemRoot\system32\BOOTVID.dll
  0x8ACB5000 \SystemRoot\system32\CLFS.SYS
  0x8ACF7000 \SystemRoot\system32\CI.dll
  0x8AE12000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8AE83000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8AE91000 \SystemRoot\system32\drivers\ACPI.sys
  0x8AED9000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x8AEE2000 \SystemRoot\system32\drivers\msisadrv.sys
  0x8AEEA000 \SystemRoot\system32\drivers\vdrvroot.sys
  0x8AEF5000 \SystemRoot\system32\drivers\pci.sys
  0x8AF1F000 \SystemRoot\System32\drivers\partmgr.sys
  0x8AF30000 \SystemRoot\System32\drivers\sfsync04.sys
  0x8AF43000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8AF4B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x8AF56000 \SystemRoot\system32\drivers\volmgr.sys
  0x8AF66000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8AFB1000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8AFC7000 \SystemRoot\system32\drivers\atapi.sys
  0x8AFD0000 \SystemRoot\system32\drivers\ataport.SYS
  0x8AFF3000 \SystemRoot\system32\drivers\msahci.sys
  0x8AE00000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x8ADA2000 \SystemRoot\system32\drivers\amdxata.sys
  0x8ADAB000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8ADDF000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8B011000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8B140000 \SystemRoot\System32\Drivers\msrpc.sys
  0x8B16B000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8B17E000 \SystemRoot\System32\Drivers\cng.sys
  0x8B1DB000 \SystemRoot\System32\drivers\pcw.sys
  0x8B1E9000 \SystemRoot\System32\Drivers\Fs_Rec.sys
  0x8B22D000 \SystemRoot\system32\drivers\ndis.sys
  0x8B2E4000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8B322000 \SystemRoot\System32\Drivers\ksecpkg.sys
  0x8B43F000 \SystemRoot\System32\drivers\tcpip.sys
  0x8B589000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8B5BA000 \SystemRoot\system32\drivers\volsnap.sys
  0x8B400000 \SystemRoot\System32\Drivers\spldr.sys
  0x8B408000 \SystemRoot\System32\drivers\sfvfs02.sys
  0x8B420000 \SystemRoot\System32\drivers\sfhlp02.sys
  0x8B428000 \SystemRoot\System32\drivers\sfdrv01a.sys
  0x8B347000 \SystemRoot\System32\drivers\sfdrv01.sys
  0x8B35A000 \SystemRoot\System32\drivers\rdyboost.sys
  0x8B387000 \SystemRoot\System32\Drivers\mup.sys
  0x8B397000 \SystemRoot\System32\drivers\hwpolicy.sys
  0x8B39F000 \SystemRoot\System32\DRIVERS\fvevol.sys
  0x8B3D1000 \SystemRoot\system32\DRIVERS\disk.sys
  0x8B200000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
  0x90223000 \SystemRoot\system32\drivers\cdrom.sys
  0x90242000 \SystemRoot\system32\DRIVERS\MpFilter.sys
  0x90269000 \SystemRoot\System32\Drivers\Null.SYS
  0x90270000 \SystemRoot\System32\Drivers\Beep.SYS
  0x90277000 \SystemRoot\System32\drivers\vga.sys
  0x90283000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x902A4000 \SystemRoot\System32\drivers\watchdog.sys
  0x902B1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x902B9000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x902C1000 \SystemRoot\system32\drivers\rdprefmp.sys
  0x902C9000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x902D4000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x902E2000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x902F9000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x90305000 \SystemRoot\system32\drivers\afd.sys
  0x9035F000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x90391000 \SystemRoot\system32\DRIVERS\wfplwf.sys
  0x90398000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x903B7000 \SystemRoot\system32\DRIVERS\vwififlt.sys
  0x903C8000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x903D6000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x903E9000 \SystemRoot\system32\drivers\termdd.sys
  0x90E0B000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x90E4C000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x90E56000 \SystemRoot\system32\drivers\mssmbios.sys
  0x90E60000 \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5481BC9F-8218-4512-9CCD-58CF49BB11BF}\MpKsl4ded2da8.sys
  0x90E66000 \SystemRoot\System32\drivers\discache.sys
  0x90E72000 \SystemRoot\System32\Drivers\dfsc.sys
  0x90E8A000 \SystemRoot\system32\DRIVERS\blbdrive.sys
  0x90E98000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x90EB9000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x90ECB000 \SystemRoot\system32\drivers\wmiacpi.sys
  0x92206000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
  0x92828000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x928DF000 \SystemRoot\System32\drivers\dxgmms1.sys
  0x92918000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x92923000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x9296E000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x9297D000 \SystemRoot\system32\drivers\HDAudBus.sys
  0x9299C000 \SystemRoot\system32\DRIVERS\L1C62x86.sys
  0x91C34000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
  0x91E9B000 \SystemRoot\system32\DRIVERS\vwifibus.sys
  0x91EA5000 \SystemRoot\system32\drivers\i8042prt.sys
  0x91EBD000 \SystemRoot\system32\drivers\kbdclass.sys
  0x91ECA000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x91F01000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x91F03000 \SystemRoot\system32\drivers\mouclass.sys
  0x91F10000 \SystemRoot\system32\DRIVERS\AcpiVpc.sys
  0x91F1F000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x91F23000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x91F29000 \SystemRoot\system32\drivers\CompositeBus.sys
  0x91F36000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
  0x91F48000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x91F60000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x91F6B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x91F8D000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x91FA5000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x91FBC000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x91FD3000 \SystemRoot\system32\DRIVERS\WDMirror.sys
  0x91FDA000 \SystemRoot\system32\drivers\swenum.sys
  0x91C00000 \SystemRoot\system32\drivers\ks.sys
  0x929AC000 \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
  0x91FDC000 \SystemRoot\system32\drivers\umbus.sys
  0x90ED4000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x91FEA000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x9B430000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x9B6D3000 \SystemRoot\system32\drivers\portcls.sys
  0x9B702000 \SystemRoot\system32\drivers\drmk.sys
  0x9B71B000 \SystemRoot\system32\drivers\IntcHdmi.sys
  0x9C7B0000 \SystemRoot\System32\win32k.sys
  0x9B73E000 \SystemRoot\System32\drivers\Dxapi.sys
  0x9B748000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x9B755000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x9B760000 \SystemRoot\System32\Drivers\dump_msahci.sys
  0x9B76A000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
  0x9B77B000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x9C610000 \SystemRoot\System32\TSDDD.dll
  0x9C640000 \SystemRoot\System32\cdd.dll
  0x90F18000 \SystemRoot\System32\Drivers\btmusb.sys
  0x9B7B0000 \SystemRoot\system32\drivers\luafv.sys
  0x9B7CB000 \SystemRoot\system32\drivers\WudfPf.sys
  0x9B786000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x90F97000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x9B796000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x929E7000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0xAD200000 \SystemRoot\system32\drivers\HTTP.sys
  0xAD285000 \SystemRoot\system32\DRIVERS\bowser.sys
  0xAD29E000 \SystemRoot\System32\drivers\mpsdrv.sys
  0xAD2B0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xAD2D3000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0xAD30E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0xAD341000 \??\C:\windows\system32\drivers\acedrv11.sys
  0xAE00E000 \SystemRoot\system32\drivers\peauth.sys
  0xAE0A5000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xAE0AF000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0xAE0D0000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xAE0DD000 \SystemRoot\System32\DRIVERS\srv2.sys
  0xAE12D000 \SystemRoot\System32\DRIVERS\srv.sys
  0xAE185000 \??\C:\windows\system32\FsUsbExDisk.SYS
  0xAE19A000 \SystemRoot\system32\DRIVERS\MpNWMon.sys
  0xAE1A4000 \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5AB883B6-5617-48F0-B1EE-C0CDE93BDCB5}\MpKsl14e1b36c.sys
  0xAE1AA000 \??\C:\Users\***\AppData\Local\Temp\kxldrpog.sys
  0x77200000 \Windows\System32\ntdll.dll
  0x47C00000 \Windows\System32\smss.exe
  0x77440000 \Windows\System32\apisetschema.dll
  0x00D80000 \Windows\System32\autochk.exe
  0x773B0000 \Windows\System32\comdlg32.dll
  0x77350000 \Windows\System32\shlwapi.dll
  0x77170000 \Windows\System32\oleaut32.dll
  0x77130000 \Windows\System32\ws2_32.dll
  0x77340000 \Windows\System32\lpk.dll
  0x770E0000 \Windows\System32\Wldap32.dll
  0x76F40000 \Windows\System32\setupapi.dll
  0x76E60000 \Windows\System32\kernel32.dll
  0x76E10000 \Windows\System32\gdi32.dll
  0x76C10000 \Windows\System32\iertutil.dll
  0x76AD0000 \Windows\System32\urlmon.dll
  0x76A40000 \Windows\System32\clbcatq.dll
  0x76A30000 \Windows\System32\normaliz.dll
  0x76980000 \Windows\System32\msvcrt.dll
  0x768B0000 \Windows\System32\msctf.dll
  0x76880000 \Windows\System32\imagehlp.dll
  0x76820000 \Windows\System32\difxapi.dll
  0x766C0000 \Windows\System32\ole32.dll
  0x766A0000 \Windows\System32\imm32.dll
  0x76680000 \Windows\System32\sechost.dll
  0x765B0000 \Windows\System32\user32.dll
  0x765A0000 \Windows\System32\psapi.dll
  0x75950000 \Windows\System32\shell32.dll
  0x75940000 \Windows\System32\nsi.dll
  0x75890000 \Windows\System32\rpcrt4.dll
  0x757F0000 \Windows\System32\advapi32.dll
  0x75750000 \Windows\System32\usp10.dll
  0x75650000 \Windows\System32\wininet.dll
  0x755C0000 \Windows\System32\comctl32.dll
  0x75590000 \Windows\System32\wintrust.dll
  0x75540000 \Windows\System32\KernelBase.dll
  0x75420000 \Windows\System32\crypt32.dll
  0x75400000 \Windows\System32\devobj.dll
  0x753D0000 \Windows\System32\cfgmgr32.dll
  0x753C0000 \Windows\System32\msasn1.dll

Processes (total 72):
      0 System Idle Process
      4 SYSTEM
    268 C:\Windows\System32\smss.exe
    396 csrss.exe
    452 C:\Windows\System32\wininit.exe
    464 csrss.exe
    512 C:\Windows\System32\services.exe
    520 C:\Windows\System32\lsass.exe
    528 C:\Windows\System32\lsm.exe
    692 C:\Windows\System32\svchost.exe
    748 C:\Windows\System32\winlogon.exe
    800 C:\Windows\System32\svchost.exe
    860 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    956 C:\Windows\System32\svchost.exe
    1028 C:\Windows\System32\svchost.exe
    1056 C:\Windows\System32\svchost.exe
    1156 C:\Windows\System32\svchost.exe
    1344 C:\Windows\System32\svchost.exe
    1468 C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksvr.exe
    1544 C:\Windows\System32\svchost.exe
    1636 C:\Windows\System32\wlanext.exe
    1648 C:\Windows\System32\conhost.exe
    1724 C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe
    1804 C:\Windows\System32\spoolsv.exe
    2024 C:\Windows\System32\svchost.exe
    524 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    784 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    1108 C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
    1376 C:\Program Files\Bonjour\mDNSResponder.exe
    1588 C:\Windows\System32\FsUsbExService.Exe
    1656 C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe
    1904 C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
    1304 C:\Windows\System32\IgrsSvcs.exe
    2080 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    2172 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    2208 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2260 C:\Windows\System32\svchost.exe
    2332 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    2380 C:\Program Files\Motorola\Bluetooth\obexsrv.exe
    2656 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    2756 WmiPrvSE.exe
    2992 C:\Windows\System32\taskhost.exe
    3096 C:\Windows\System32\SearchIndexer.exe
    3364 C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    3372 C:\Windows\System32\dwm.exe
    3456 C:\Windows\explorer.exe
    3656 C:\Windows\System32\svchost.exe
    3816 C:\Windows\System32\hkcmd.exe
    3792 C:\Windows\System32\igfxpers.exe
    3880 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    3932 C:\Windows\System32\rundll32.exe
    3432 C:\Windows\System32\rundll32.exe
    3720 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2732 C:\Program Files\Lenovo\Energy Management\utility.exe
    3964 C:\Program Files\Lenovo\Energy Management\Energy Management.exe
    2700 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    3284 C:\Program Files\Winamp\winampa.exe
    3940 C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe
    1476 C:\Program Files\Microsoft Security Client\msseces.exe
    1216 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    3604 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    4236 unsecapp.exe
    4336 C:\Program Files\Motorola\Bluetooth\audiosrv.exe
    4736 C:\Windows\System32\svchost.exe
    4916 C:\Program Files\Windows Media Player\wmpnetwk.exe
    2600 C:\Windows\System32\svchost.exe
    4500 C:\Windows\System32\igfxsrvc.exe
    3448 C:\Windows\System32\SearchProtocolHost.exe
    4800 C:\Windows\System32\SearchFilterHost.exe
    3276 C:\Users\***\Desktop\MBRCheck.exe
    3280 C:\Windows\System32\conhost.exe
    6120 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c900000  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000003f`40a00000  (NTFS)

PhysicalDrive0 Model Number: HITACHIHTS545032B9A300, Rev: PB3ZC61H

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \\.\PhysicalDrive0  Windows 2008 MBR code detected
            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

cosinus 13.07.2011 09:04
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


blauer_alex 06.08.2011 20:24
Okay, jetzt hab ich mir diesen Ukash-Virus (BKA bla bla) eingefangen. Hatte irgendwie ja das Gefühl, dass mein System noch nicht wieder ganz virenfrei ist.

Wie könnte ich da jetzt vorgehen? Hab was gelesen von wegen "Von CD booten", aber das funktioniert bei mir irgendwie nicht.

Vielen Dank!

blauer_alex 07.08.2011 13:03
Hab durch eine Systemwiederherstellung von vor zwei Tagen erstmal das Problem mit dem BKA-Display nicht mehr, denke aber, dass da noch was drauf ist, was nicht so schön ist. Hab auch mal ein paar Programme drüberlaufen lassen und das gefundene Zeug entfernen lassen. Zuletzt lief noch der Onlinescan von ESET, hier das Logfile:


Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7d5b49dea5761d48af0e31f9c2ed910d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-07 05:54:49
# local_time=2011-08-07 07:54:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 2447362 64305983 0 0
# compatibility_mode=8192 67108863 100 0 150 150 0 0
# scanned=237528
# found=1
# cleaned=0
# scan_time=21697
C:\Users\***\Desktop\Dateien\DVD1\de-tr10a.iso        a variant of Win32/Keygen.AF application (unable to clean)        00000000000000000000000000000000        I

cosinus 08.08.2011 11:14
Zitat:
C:\Users\***\Desktop\Dateien\DVD1\de-tr10a.iso a variant of Win32/Keygen.AF
:pfui: :pfui:


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:06 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130