Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Google spinnt (https://www.trojaner-board.de/100683-google-spinnt.html)

Sombra 23.06.2011 08:10
Google spinnt
 
... und zwar besteht das Problem bereits seit Monaten. Zum einen lahm Google extrem wenn ich einen Suchbegriff eingebe. Und zum anderen werden ständig Werbeseiten geöffnet anstatt die Seite, die ich eigentlich öffnen will.

Malwarebytes konnte bisher nichts finden... kann mir auch nicht vorstellen, dass meinem Computer was fehlt weil nur Google betroffen ist.

Jemand eine Idee was zu tun ist?

cosinus 23.06.2011 10:03
http://www.trojaner-board.de/images/icons/icon4.gif Bitte beachten http://www.trojaner-board.de/images/icons/icon4.gif => http://www.trojaner-board.de/95173-b...es-posten.html und http://www.trojaner-board.de/69886-a...-beachten.html

Sombra 26.06.2011 08:53
Hat keiner eine Idee?

Benutze Windows-7 falls das hilft.

cosinus 26.06.2011 12:16
Zitat:
Hat keiner eine Idee?
Was soll diese Frage? Ich hab die o.g. Links nich aus Spaß gepostet!

Sombra 26.06.2011 18:29
Sorry, ich dachte dein Beitrag sei eine Werbung v. Google :stirn:

Also ich hab jetzt defogger_disable_log ... der ist allerdings ziemlich kurz. Ich kann mir nicht vorstellen, dass man damit was anfagen kann.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:52 on 26/06/2011 (corleone)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:AlcoholAutomount -> Removed

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-

cosinus 27.06.2011 09:50
Ja und die anderen Logs?

Sombra 27.06.2011 11:31
Nachdem ich den Code in Benutzerdefinierte Scans / Fixes kopiere, bekomme lediglich die OTL.txt, jedoch keinen Extra.txt.

Hier jedenfalls OTL.txt:OTL Logfile:
Code:
OTL logfile created on: 6/27/2011 12:13:22 PM - Run 4
OTL by OldTimer - Version 3.2.24.1    Folder = C:\Users\corleone\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.99 Gb Total Physical Memory | 2.25 Gb Available Physical Memory | 75.15% Memory free
5.98 Gb Paging File | 5.16 Gb Available in Paging File | 86.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 225.33 Gb Total Space | 173.69 Gb Free Space | 77.08% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 105.06 Gb Free Space | 46.62% Space Free | Partition Type: NTFS
 
Computer Name: PC-3000 | User Name: corleone | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011/06/26 19:12:30 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\corleone\Desktop\OTL.exe
PRC - [2011/05/29 09:11:28 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/03/21 20:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/07/04 21:51:26 | 000,017,408 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe
PRC - [2010/05/20 23:59:30 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2010/05/20 23:59:28 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2010/04/20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
PRC - [2010/01/19 04:34:48 | 002,201,192 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/12/14 09:17:48 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/11/04 06:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/13 12:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/10/02 17:48:26 | 002,364,704 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
PRC - [2009/10/02 17:48:26 | 000,795,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2009/10/02 17:48:26 | 000,595,232 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
PRC - [2009/07/20 12:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/10 12:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
PRC - [2009/07/06 19:07:00 | 001,848,648 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/06/03 13:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009/04/15 16:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () -- C:\Windows\System32\Rezip.exe
PRC - [2007/05/28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007/04/13 18:49:00 | 000,101,528 | ---- | M] () -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
 
 
========== Modules (SafeList) ==========
 
MOD - [2011/06/26 19:12:30 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\corleone\Desktop\OTL.exe
MOD - [2011/06/15 23:29:15 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
MOD - [2010/11/20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010/07/04 23:32:36 | 000,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll
MOD - [2009/10/02 17:48:44 | 000,226,592 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btmmhook.dll
MOD - [2009/07/20 12:29:06 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/07/20 12:25:22 | 000,064,016 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\GameHook.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/05/29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2009/10/02 17:48:26 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/09/29 17:25:38 | 000,099,768 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/20 12:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Running] -- C:\Windows\System32\Rezip.exe -- (Rezip)
SRV - [2007/05/28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007/04/13 18:49:00 | 000,101,528 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE -- (IJPLMSVC)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/11/23 17:10:44 | 001,249,792 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/09/12 16:59:38 | 000,436,792 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010/09/12 16:35:15 | 000,094,208 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ezplay.sys -- (ezplay)
DRV - [2010/02/10 18:17:24 | 009,936,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/11/25 23:32:16 | 000,125,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2009/09/29 17:25:42 | 000,013,752 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TurboB.sys -- (TurboB)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/01 22:46:20 | 000,043,944 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2009/06/27 16:55:12 | 000,066,080 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009/06/17 18:56:32 | 000,028,560 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2009/06/17 18:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 18:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/03/25 17:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdm.sys -- (s1018mdm)
DRV - [2009/03/25 17:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018unic.sys -- (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM)
DRV - [2009/03/25 17:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mgmt.sys -- (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM)
DRV - [2009/03/25 17:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018obex.sys -- (s1018obex)
DRV - [2009/03/25 17:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018bus.sys -- (s1018bus) Sony Ericsson Device 1018 driver (WDM)
DRV - [2009/03/25 17:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018nd5.sys -- (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS)
DRV - [2009/03/25 17:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdfl.sys -- (s1018mdfl)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=OIE9HP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: {8B8A525A-CFCA-44cf-81C3-3969E6CB96E0}:3.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/24 11:33:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2010/08/07 20:40:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\corleone\AppData\Roaming\mozilla\Extensions
[2011/05/24 18:52:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\corleone\AppData\Roaming\mozilla\Firefox\Profiles\u7g8ud63.default\extensions
[2011/05/01 21:26:13 | 000,000,000 | ---D | M] (Web Search Pro) -- C:\Users\corleone\AppData\Roaming\mozilla\Firefox\Profiles\u7g8ud63.default\extensions\{8B8A525A-CFCA-44cf-81C3-3969E6CB96E0}
[2011/05/14 19:31:52 | 000,002,396 | ---- | M] () -- C:\Users\corleone\AppData\Roaming\Mozilla\Firefox\Profiles\u7g8ud63.default\searchplugins\askcom.xml
[2011/05/25 09:11:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
File not found (No name found) --
[2011/06/24 11:33:08 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/01/01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010/01/01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010/01/01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/01/01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/01/01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011/05/14 19:34:33 | 000,000,000 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - Startup: C:\Users\corleone\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e32e8039-c233-11df-96e0-b482fe37d72b}\Shell - "" = AutoRun
O33 - MountPoints2\{e32e8039-c233-11df-96e0-b482fe37d72b}\Shell\AutoRun\command - "" = G:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{d7840829-413c-4476-ba85-e20dfa11cba0} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Anti Trojan Elite - hkey= - key= -  File not found
MsConfig - StartUpReg: Skype - hkey= - key= -  File not found
MsConfig - State: "startup" - 2

 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/06/26 19:12:29 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\corleone\Desktop\OTL.exe
[2011/06/17 08:34:56 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/06/08 13:42:12 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview
[2011/06/08 13:40:56 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders
[2011/06/07 07:35:18 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\System32\fms.dll
[2011/06/05 10:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\mp3DirectCut
[2010/10/04 14:40:36 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\corleone\AppData\Roaming\pcouffin.sys
[2010/09/12 16:35:15 | 000,094,208 | ---- | C] (VSO Software) -- C:\Users\corleone\AppData\Roaming\ezplay.sys
[3 C:\Users\corleone\AppData\Local\*.tmp files -> C:\Users\corleone\AppData\Local\*.tmp -> ]
[2 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/06/27 12:11:52 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/27 12:11:36 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/06/27 12:11:31 | 2406,912,000 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/27 12:05:03 | 000,001,098 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/27 11:24:30 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/27 11:24:30 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/26 19:12:30 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\corleone\Desktop\OTL.exe
[2011/06/26 19:12:12 | 000,050,477 | ---- | M] () -- C:\Users\corleone\Desktop\Defogger.exe
[2011/06/17 08:35:05 | 000,001,984 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/06/15 23:32:52 | 000,654,166 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2011/06/15 23:32:52 | 000,616,008 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2011/06/15 23:32:52 | 000,130,006 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2011/06/15 23:32:52 | 000,106,388 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2011/06/08 14:24:50 | 000,447,792 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2011/06/07 15:14:26 | 000,000,000 | ---- | M] () -- C:\Users\corleone\AppData\Local\{69F2A64F-2E7F-45BC-A777-C6A54E2FACC9}
[2011/06/05 10:39:05 | 000,001,013 | ---- | M] () -- C:\Users\corleone\Desktop\mp3DirectCut.lnk
[2011/06/03 21:23:28 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[3 C:\Users\corleone\AppData\Local\*.tmp files -> C:\Users\corleone\AppData\Local\*.tmp -> ]
[2 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/06/26 19:12:11 | 000,050,477 | ---- | C] () -- C:\Users\corleone\Desktop\Defogger.exe
[2011/06/17 08:35:05 | 000,001,984 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/06/07 15:14:10 | 000,000,000 | ---- | C] () -- C:\Users\corleone\AppData\Local\{69F2A64F-2E7F-45BC-A777-C6A54E2FACC9}
[2011/06/07 07:36:09 | 000,146,852 | ---- | C] () -- C:\windows\System32\systemsf.ebd
[2011/06/07 07:35:03 | 000,010,429 | ---- | C] () -- C:\windows\System32\ScavengeSpace.xml
[2011/06/07 07:34:55 | 000,105,559 | ---- | C] () -- C:\windows\System32\RacRules.xml
[2011/06/05 10:39:05 | 000,001,013 | ---- | C] () -- C:\Users\corleone\Desktop\mp3DirectCut.lnk
[2011/05/21 20:22:18 | 000,000,000 | ---- | C] () -- C:\Users\corleone\AppData\Local\{E71D0CDF-1AB8-4940-8211-97D86DDCD98F}
[2011/05/02 18:47:41 | 000,000,000 | ---- | C] () -- C:\Users\corleone\AppData\Local\{C194D7DF-14B3-42B5-A3AE-2B25DF4D939F}
[2011/02/28 21:57:14 | 000,000,000 | ---- | C] () -- C:\windows\prestopm.INI
[2011/02/28 21:49:25 | 000,000,117 | -H-- | C] () -- C:\windows\NsNetScan.ini
[2011/02/28 21:44:34 | 000,040,960 | ---- | C] () -- C:\windows\System32\IPPCPUID.DLL
[2011/02/28 21:44:34 | 000,000,105 | ---- | C] () -- C:\windows\UMXADDIN.INI
[2011/02/28 21:44:23 | 000,011,776 | ---- | C] () -- C:\windows\System32\pmsbfn32.dll
[2011/02/28 21:43:03 | 000,000,074 | ---- | C] () -- C:\windows\PMINI.ini
[2011/02/09 21:59:21 | 000,028,672 | ---- | C] () -- C:\windows\System32\UIAuuomationCore.dll
[2010/10/04 14:41:57 | 000,000,014 | ---- | C] () -- C:\windows\System32\systeminfo3.dll
[2010/10/04 14:40:36 | 000,081,920 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\ezpinst.exe
[2010/10/04 14:40:36 | 000,007,887 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\pcouffin.cat
[2010/10/04 14:40:36 | 000,001,144 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\pcouffin.inf
[2010/09/12 16:35:15 | 000,087,608 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\inst.exe
[2010/09/12 16:35:15 | 000,007,861 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\ezplay.cat
[2010/09/12 16:35:15 | 000,001,104 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\ezplay.inf
[2010/09/12 16:35:15 | 000,000,125 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\ezplay.ini
[2010/09/12 14:13:26 | 000,000,126 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010/08/20 17:01:50 | 000,003,584 | ---- | C] () -- C:\Users\corleone\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/17 15:03:57 | 000,000,000 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\wklnhst.dat
[2010/08/13 15:28:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/08/07 20:40:02 | 000,000,760 | ---- | C] () -- C:\Users\corleone\AppData\Roaming\setup_ldm.iss
[2010/08/07 18:54:40 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2010/02/10 06:58:14 | 000,040,588 | ---- | C] () -- C:\windows\System32\nvcoproc.bin
[2010/02/08 02:07:31 | 000,654,166 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2010/02/08 02:07:31 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2010/02/08 02:07:31 | 000,130,006 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2010/02/08 02:07:31 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2010/02/07 09:04:15 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2010/02/07 08:25:49 | 000,311,296 | ---- | C] () -- C:\windows\System32\Rezip.exe
[2010/02/07 08:20:53 | 000,000,858 | ---- | C] () -- C:\windows\HotFixList.ini
[2009/09/29 17:25:42 | 000,013,752 | ---- | C] () -- C:\windows\System32\drivers\TurboB.sys
[2009/07/14 06:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/14 06:33:53 | 000,447,792 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/07/14 04:05:48 | 000,616,008 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2009/07/14 04:05:48 | 000,106,388 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT
[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat
[2009/07/14 01:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll
[2009/07/14 00:09:19 | 000,982,196 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2009/07/14 00:09:19 | 000,417,344 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
[2009/07/14 00:09:19 | 000,139,824 | ---- | C] () -- C:\windows\System32\igfcg500.bin
[2009/07/14 00:09:19 | 000,097,448 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[2006/10/08 12:33:54 | 000,000,000 | ---- | C] () -- C:\windows\R-series.ini
 
========== LOP Check ==========
 
[2010/12/31 11:41:44 | 000,000,000 | -HSD | M] -- C:\Users\corleone\AppData\Roaming\.#
[2010/11/24 17:17:18 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\avidemux
[2010/08/17 14:08:12 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\BitDefender
[2010/12/04 14:21:53 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\Canneverbe Limited
[2011/04/13 21:53:47 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\Canon
[2010/12/27 10:32:12 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\FreeFLVConverter
[2010/08/23 10:33:54 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\GameConsole
[2010/09/19 14:24:01 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\GetRightToGo
[2010/08/15 16:39:33 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\IrfanView
[2011/02/28 21:49:23 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\NewSoft
[2010/10/17 22:12:02 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\OpenOffice.org
[2011/05/14 19:34:33 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\PPMate
[2010/09/17 12:12:04 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\Sony
[2010/09/17 12:05:08 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\Sony Setup
[2010/08/17 15:04:21 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\Template
[2011/06/26 21:10:58 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\uTorrent
[2010/10/04 23:22:44 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\Vso
[2010/12/27 11:03:44 | 000,000,000 | ---D | M] -- C:\Users\corleone\AppData\Roaming\XMedia Recode
[2011/06/25 08:22:42 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/08/09 09:50:51 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011/02/28 21:39:34 | 000,000,000 | -H-D | M] -- C:\CanoScan
[2011/06/17 09:35:22 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010/11/21 19:41:30 | 000,000,000 | ---D | M] -- C:\Downloads
[2010/02/07 08:21:44 | 000,000,000 | ---D | M] -- C:\Intel
[2011/04/01 14:42:12 | 000,000,000 | ---D | M] -- C:\My Music
[2009/07/14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011/06/26 14:05:46 | 000,000,000 | R--D | M] -- C:\Program Files
[2011/05/25 22:15:35 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010/08/07 18:46:12 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011/06/26 19:26:39 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010/08/07 18:47:33 | 000,000,000 | R--D | M] -- C:\Users
[2011/06/08 14:26:18 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2009/10/06 08:06:36 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_523cdab8f40fe558\explorer.exe
[2011/02/26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
[2009/10/06 07:53:03 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_51c00e6ddae85c4b\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009/07/14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009/07/14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-24 05:59:49

< End of report >
--- --- ---

cosinus 27.06.2011 12:16
Zitat:
6/27/2011 12:13:22 PM - Run 4
Ja wie oft hast du denn schon OTL-Logs erstellt?? Lt. dem Kopf der Logs schon das vierte Mal! Die Extras werden nur beim 1. Mal erstellt!

Sombra 27.06.2011 12:24
Zählt es auch wie oft man das Programm öffnet? Gescannt habe ich nur zwei mal, weil ich beim ersten Mal den Code nicht reinkopiert hatte.

Kann ich jetzt noch irgendwie and die Extras kommen oder geht das garnicht mehr?

cosinus 27.06.2011 12:30
Naja so wichtig sind die Extras nicht. Das OTL-Log ist auch unauffällig.

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Sombra 27.06.2011 20:10
Also der log vom Kaspersky Prog:

2011/06/27 21:02:55.0756 3876 TDSS rootkit removing tool 2.5.6.0 Jun 27 2011 15:22:52
2011/06/27 21:02:56.0354 3876 ================================================================================
2011/06/27 21:02:56.0354 3876 SystemInfo:
2011/06/27 21:02:56.0354 3876
2011/06/27 21:02:56.0354 3876 OS Version: 6.1.7601 ServicePack: 1.0
2011/06/27 21:02:56.0354 3876 Product type: Workstation
2011/06/27 21:02:56.0354 3876 ComputerName: PC-3000
2011/06/27 21:02:56.0354 3876 UserName: corleone
2011/06/27 21:02:56.0354 3876 Windows directory: C:\windows
2011/06/27 21:02:56.0354 3876 System windows directory: C:\windows
2011/06/27 21:02:56.0354 3876 Processor architecture: Intel x86
2011/06/27 21:02:56.0354 3876 Number of processors: 4
2011/06/27 21:02:56.0354 3876 Page size: 0x1000
2011/06/27 21:02:56.0354 3876 Boot type: Normal boot
2011/06/27 21:02:56.0354 3876 ================================================================================
2011/06/27 21:02:56.0888 3876 Initialize success
2011/06/27 21:03:00.0208 5420 ================================================================================
2011/06/27 21:03:00.0208 5420 Scan started
2011/06/27 21:03:00.0208 5420 Mode: Manual;
2011/06/27 21:03:00.0208 5420 ================================================================================
2011/06/27 21:03:01.0278 5420 1394ohci (1b133875b8aa8ac48969bd3458afe9f5) C:\windows\system32\drivers\1394ohci.sys
2011/06/27 21:03:01.0353 5420 ACPI (cea80c80bed809aa0da6febc04733349) C:\windows\system32\drivers\ACPI.sys
2011/06/27 21:03:01.0444 5420 AcpiPmi (1efbc664abff416d1d07db115dcb264f) C:\windows\system32\drivers\acpipmi.sys
2011/06/27 21:03:01.0508 5420 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys
2011/06/27 21:03:01.0531 5420 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys
2011/06/27 21:03:01.0569 5420 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys
2011/06/27 21:03:01.0736 5420 AFD (9ebbba55060f786f0fcaa3893bfa2806) C:\windows\system32\drivers\afd.sys
2011/06/27 21:03:01.0802 5420 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\drivers\agp440.sys
2011/06/27 21:03:01.0864 5420 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys
2011/06/27 21:03:01.0917 5420 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\drivers\aliide.sys
2011/06/27 21:03:01.0937 5420 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\drivers\amdagp.sys
2011/06/27 21:03:01.0968 5420 amdide (cd5914170297126b6266860198d1d4f0) C:\windows\system32\drivers\amdide.sys
2011/06/27 21:03:02.0012 5420 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys
2011/06/27 21:03:02.0048 5420 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys
2011/06/27 21:03:02.0127 5420 amdsata (d320bf87125326f996d4904fe24300fc) C:\windows\system32\drivers\amdsata.sys
2011/06/27 21:03:02.0153 5420 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys
2011/06/27 21:03:02.0186 5420 amdxata (46387fb17b086d16dea267d5be23a2f2) C:\windows\system32\drivers\amdxata.sys
2011/06/27 21:03:02.0251 5420 AppID (aea177f783e20150ace5383ee368da19) C:\windows\system32\drivers\appid.sys
2011/06/27 21:03:02.0310 5420 arc (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys
2011/06/27 21:03:02.0327 5420 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys
2011/06/27 21:03:02.0406 5420 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys
2011/06/27 21:03:02.0473 5420 atapi (338c86357871c167a96ab976519bf59e) C:\windows\system32\drivers\atapi.sys
2011/06/27 21:03:02.0681 5420 athr (ee32c0a39b6d3d0834c4d46d8c45e1d0) C:\windows\system32\DRIVERS\athr.sys
2011/06/27 21:03:02.0828 5420 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys
2011/06/27 21:03:02.0882 5420 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\windows\system32\DRIVERS\b57nd60x.sys
2011/06/27 21:03:02.0928 5420 Beep (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys
2011/06/27 21:03:02.0990 5420 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys
2011/06/27 21:03:03.0035 5420 bowser (8f2da3028d5fcbd1a060a3de64cd6506) C:\windows\system32\DRIVERS\bowser.sys
2011/06/27 21:03:03.0076 5420 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys
2011/06/27 21:03:03.0103 5420 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys
2011/06/27 21:03:03.0133 5420 Brserid (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys
2011/06/27 21:03:03.0155 5420 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys
2011/06/27 21:03:03.0195 5420 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys
2011/06/27 21:03:03.0217 5420 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys
2011/06/27 21:03:03.0275 5420 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\drivers\BthEnum.sys
2011/06/27 21:03:03.0294 5420 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys
2011/06/27 21:03:03.0336 5420 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys
2011/06/27 21:03:03.0379 5420 BTHPORT (195c41cc67e9e1cedd960ccb74925920) C:\windows\System32\Drivers\BTHport.sys
2011/06/27 21:03:03.0421 5420 BTHUSB (43b3206dd654e783aa7e4ead340a43b8) C:\windows\System32\Drivers\BTHUSB.sys
2011/06/27 21:03:03.0470 5420 btusbflt (92c5b845803f3662637eb691ac0b250f) C:\windows\system32\drivers\btusbflt.sys
2011/06/27 21:03:03.0519 5420 btwaudio (7e826be3b3558208d5c9b00034e51be5) C:\windows\system32\drivers\btwaudio.sys
2011/06/27 21:03:03.0554 5420 btwavdt (af9148c3e844131ac954cb53ff43d971) C:\windows\system32\drivers\btwavdt.sys
2011/06/27 21:03:03.0626 5420 btwl2cap (aafd7cb76ba61fbb08e302da208c974a) C:\windows\system32\DRIVERS\btwl2cap.sys
2011/06/27 21:03:03.0670 5420 btwrchid (480b3d195854b2e55299cddddc50bcf9) C:\windows\system32\DRIVERS\btwrchid.sys
2011/06/27 21:03:03.0714 5420 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys
2011/06/27 21:03:03.0783 5420 cdrom (be167ed0fdb9c1fa1133953c18d5a6c9) C:\windows\system32\drivers\cdrom.sys
2011/06/27 21:03:03.0822 5420 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys
2011/06/27 21:03:03.0863 5420 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys
2011/06/27 21:03:03.0950 5420 CmBatt (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys
2011/06/27 21:03:04.0000 5420 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\drivers\cmdide.sys
2011/06/27 21:03:04.0034 5420 CNG (1b675691ed940766149c93e8f4488d68) C:\windows\system32\Drivers\cng.sys
2011/06/27 21:03:04.0091 5420 Compbatt (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys
2011/06/27 21:03:04.0175 5420 CompositeBus (cbe8c58a8579cfe5fccf809e6f114e89) C:\windows\system32\drivers\CompositeBus.sys
2011/06/27 21:03:04.0270 5420 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys
2011/06/27 21:03:04.0349 5420 DfsC (f024449c97ec1e464aaffda18593db88) C:\windows\system32\Drivers\dfsc.sys
2011/06/27 21:03:04.0394 5420 discache (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys
2011/06/27 21:03:04.0449 5420 Disk (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys
2011/06/27 21:03:04.0515 5420 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys
2011/06/27 21:03:04.0655 5420 DXGKrnl (23f5d28378a160352ba8f817bd8c71cb) C:\windows\System32\drivers\dxgkrnl.sys
2011/06/27 21:03:04.0902 5420 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys
2011/06/27 21:03:05.0096 5420 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys
2011/06/27 21:03:05.0174 5420 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\drivers\errdev.sys
2011/06/27 21:03:05.0236 5420 exfat (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys
2011/06/27 21:03:05.0304 5420 ezplay (73e701e0fa4d2fc7d22efceff276c50a) C:\windows\system32\Drivers\ezplay.sys
2011/06/27 21:03:05.0331 5420 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys
2011/06/27 21:03:05.0368 5420 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys
2011/06/27 21:03:05.0407 5420 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys
2011/06/27 21:03:05.0428 5420 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys
2011/06/27 21:03:05.0466 5420 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys
2011/06/27 21:03:05.0517 5420 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys
2011/06/27 21:03:05.0556 5420 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys
2011/06/27 21:03:05.0588 5420 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\windows\system32\drivers\Fs_Rec.sys
2011/06/27 21:03:05.0638 5420 fvevol (8a73e79089b282100b9393b644cb853b) C:\windows\system32\DRIVERS\fvevol.sys
2011/06/27 21:03:05.0680 5420 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys
2011/06/27 21:03:05.0798 5420 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys
2011/06/27 21:03:05.0868 5420 HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\windows\system32\drivers\HdAudio.sys
2011/06/27 21:03:05.0921 5420 HDAudBus (9036377b8a6c15dc2eec53e489d159b5) C:\windows\system32\drivers\HDAudBus.sys
2011/06/27 21:03:05.0947 5420 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys
2011/06/27 21:03:05.0972 5420 HidBth (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys
2011/06/27 21:03:06.0011 5420 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys
2011/06/27 21:03:06.0055 5420 HidUsb (10c19f8290891af023eaec0832e1eb4d) C:\windows\system32\drivers\hidusb.sys
2011/06/27 21:03:06.0114 5420 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\drivers\HpSAMD.sys
2011/06/27 21:03:06.0180 5420 HTTP (871917b07a141bff43d76d8844d48106) C:\windows\system32\drivers\HTTP.sys
2011/06/27 21:03:06.0233 5420 hwpolicy (0c4e035c7f105f1299258c90886c64c5) C:\windows\system32\drivers\hwpolicy.sys
2011/06/27 21:03:06.0290 5420 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\drivers\i8042prt.sys
2011/06/27 21:03:06.0379 5420 iaStor (eb3a2c773e202ced30595bbfad24febf) C:\windows\system32\DRIVERS\iaStor.sys
2011/06/27 21:03:06.0453 5420 iaStorV (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\windows\system32\drivers\iaStorV.sys
2011/06/27 21:03:06.0598 5420 igfx (ad626f6964f4d364d226c39e06872dd3) C:\windows\system32\DRIVERS\igdkmd32.sys
2011/06/27 21:03:06.0813 5420 iirsp (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys
2011/06/27 21:03:06.0920 5420 Impcd (4a31216a5e97d46ee06069d9e06428fa) C:\windows\system32\DRIVERS\Impcd.sys
2011/06/27 21:03:07.0018 5420 IntcAzAudAddService (96282fbce4534c9bf147cffe9e1fa8db) C:\windows\system32\drivers\RTKVHDA.sys
2011/06/27 21:03:07.0148 5420 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\drivers\intelide.sys
2011/06/27 21:03:07.0198 5420 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys
2011/06/27 21:03:07.0239 5420 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys
2011/06/27 21:03:07.0296 5420 IPMIDRV (4bd7134618c1d2a27466a099062547bf) C:\windows\system32\drivers\IPMIDrv.sys
2011/06/27 21:03:07.0313 5420 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys
2011/06/27 21:03:07.0344 5420 IRENUM (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys
2011/06/27 21:03:07.0375 5420 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\drivers\isapnp.sys
2011/06/27 21:03:07.0407 5420 iScsiPrt (cb7a9abb12b8415bce5d74994c7ba3ae) C:\windows\system32\drivers\msiscsi.sys
2011/06/27 21:03:07.0467 5420 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\drivers\kbdclass.sys
2011/06/27 21:03:07.0516 5420 kbdhid (9e3ced91863e6ee98c24794d05e27a71) C:\windows\system32\drivers\kbdhid.sys
2011/06/27 21:03:07.0556 5420 KSecDD (412cea1aa78cc02a447f5c9e62b32ff1) C:\windows\system32\Drivers\ksecdd.sys
2011/06/27 21:03:07.0593 5420 KSecPkg (26c046977e85b95036453d7b88ba1820) C:\windows\system32\Drivers\ksecpkg.sys
2011/06/27 21:03:07.0720 5420 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\windows\system32\DRIVERS\LHidFilt.Sys
2011/06/27 21:03:07.0769 5420 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys
2011/06/27 21:03:07.0810 5420 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\windows\system32\DRIVERS\LMouFilt.Sys
2011/06/27 21:03:07.0859 5420 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys
2011/06/27 21:03:07.0875 5420 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys
2011/06/27 21:03:07.0901 5420 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys
2011/06/27 21:03:07.0921 5420 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys
2011/06/27 21:03:07.0965 5420 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys
2011/06/27 21:03:08.0023 5420 LUsbFilt (77030525cd86a93f1af34fa9b96d33ce) C:\windows\system32\Drivers\LUsbFilt.Sys
2011/06/27 21:03:08.0109 5420 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\windows\system32\drivers\mbam.sys
2011/06/27 21:03:08.0194 5420 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys
2011/06/27 21:03:08.0239 5420 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys
2011/06/27 21:03:08.0277 5420 Modem (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys
2011/06/27 21:03:08.0316 5420 monitor (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys
2011/06/27 21:03:08.0368 5420 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\drivers\mouclass.sys
2011/06/27 21:03:08.0417 5420 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys
2011/06/27 21:03:08.0447 5420 mountmgr (fc8771f45ecccfd89684e38842539b9b) C:\windows\system32\drivers\mountmgr.sys
2011/06/27 21:03:08.0478 5420 mpio (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\windows\system32\drivers\mpio.sys
2011/06/27 21:03:08.0515 5420 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys
2011/06/27 21:03:08.0562 5420 MRxDAV (ceb46ab7c01c9f825f8cc6babc18166a) C:\windows\system32\drivers\mrxdav.sys
2011/06/27 21:03:08.0618 5420 mrxsmb (5d16c921e3671636c0eba3bbaac5fd25) C:\windows\system32\DRIVERS\mrxsmb.sys
2011/06/27 21:03:08.0643 5420 mrxsmb10 (a70c828a93cce4c11617f6249f4d87fc) C:\windows\system32\DRIVERS\mrxsmb10.sys
2011/06/27 21:03:08.0668 5420 mrxsmb20 (b81f204d146000be76651a50670a5e9e) C:\windows\system32\DRIVERS\mrxsmb20.sys
2011/06/27 21:03:08.0705 5420 msahci (012c5f4e9349e711e11e0f19a8589f0a) C:\windows\system32\drivers\msahci.sys
2011/06/27 21:03:08.0748 5420 msdsm (55055f8ad8be27a64c831322a780a228) C:\windows\system32\drivers\msdsm.sys
2011/06/27 21:03:08.0795 5420 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys
2011/06/27 21:03:08.0824 5420 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys
2011/06/27 21:03:08.0846 5420 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\drivers\msisadrv.sys
2011/06/27 21:03:08.0895 5420 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys
2011/06/27 21:03:08.0924 5420 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys
2011/06/27 21:03:08.0937 5420 MSPQM (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys
2011/06/27 21:03:08.0969 5420 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys
2011/06/27 21:03:08.0998 5420 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\drivers\mssmbios.sys
2011/06/27 21:03:09.0023 5420 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys
2011/06/27 21:03:09.0066 5420 MTConfig (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys
2011/06/27 21:03:09.0090 5420 Mup (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys
2011/06/27 21:03:09.0145 5420 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys
2011/06/27 21:03:09.0213 5420 NDIS (e7c54812a2aaf43316eb6930c1ffa108) C:\windows\system32\drivers\ndis.sys
2011/06/27 21:03:09.0236 5420 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys
2011/06/27 21:03:09.0284 5420 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys
2011/06/27 21:03:09.0333 5420 Ndisuio (d8a65dafb3eb41cbb622745676fcd072) C:\windows\system32\DRIVERS\ndisuio.sys
2011/06/27 21:03:09.0376 5420 NdisWan (38fbe267e7e6983311179230facb1017) C:\windows\system32\DRIVERS\ndiswan.sys
2011/06/27 21:03:09.0407 5420 NDProxy (a4bdc541e69674fbff1a8ff00be913f2) C:\windows\system32\drivers\NDProxy.sys
2011/06/27 21:03:09.0435 5420 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys
2011/06/27 21:03:09.0475 5420 NetBT (280122ddcf04b378edd1ad54d71c1e54) C:\windows\system32\DRIVERS\netbt.sys
2011/06/27 21:03:09.0548 5420 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys
2011/06/27 21:03:09.0604 5420 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys
2011/06/27 21:03:09.0624 5420 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys
2011/06/27 21:03:09.0709 5420 Ntfs (81189c3d7763838e55c397759d49007a) C:\windows\system32\drivers\Ntfs.sys
2011/06/27 21:03:09.0760 5420 Null (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys
2011/06/27 21:03:09.0821 5420 NVHDA (d2f4c4b22969236382ca853b8daa2d4e) C:\windows\system32\drivers\nvhda32v.sys
2011/06/27 21:03:10.0043 5420 nvlddmkm (f0280a7b9c6483ba7aaa42c0866f1c4a) C:\windows\system32\DRIVERS\nvlddmkm.sys
2011/06/27 21:03:10.0368 5420 nvraid (b3e25ee28883877076e0e1ff877d02e0) C:\windows\system32\drivers\nvraid.sys
2011/06/27 21:03:10.0402 5420 nvstor (4380e59a170d88c4f1022eff6719a8a4) C:\windows\system32\drivers\nvstor.sys
2011/06/27 21:03:10.0458 5420 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\drivers\nv_agp.sys
2011/06/27 21:03:10.0532 5420 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\drivers\ohci1394.sys
2011/06/27 21:03:10.0580 5420 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys
2011/06/27 21:03:10.0623 5420 partmgr (bf8f6af06da75b336f07e23aef97d93b) C:\windows\system32\drivers\partmgr.sys
2011/06/27 21:03:10.0657 5420 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys
2011/06/27 21:03:10.0699 5420 pci (673e55c3498eb970088e812ea820aa8f) C:\windows\system32\drivers\pci.sys
2011/06/27 21:03:10.0746 5420 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\drivers\pciide.sys
2011/06/27 21:03:10.0767 5420 pcmcia (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys
2011/06/27 21:03:10.0831 5420 pcouffin (02aaafb7ba137ce5ddabcdf8090954d9) C:\windows\system32\Drivers\pcouffin.sys
2011/06/27 21:03:10.0854 5420 pcw (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys
2011/06/27 21:03:10.0888 5420 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys
2011/06/27 21:03:11.0001 5420 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys
2011/06/27 21:03:11.0026 5420 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys
2011/06/27 21:03:11.0087 5420 Psched (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys
2011/06/27 21:03:11.0135 5420 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys
2011/06/27 21:03:11.0173 5420 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys
2011/06/27 21:03:11.0208 5420 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys
2011/06/27 21:03:11.0230 5420 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys
2011/06/27 21:03:11.0266 5420 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys
2011/06/27 21:03:11.0298 5420 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys
2011/06/27 21:03:11.0340 5420 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys
2011/06/27 21:03:11.0372 5420 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys
2011/06/27 21:03:11.0407 5420 rdbss (d528bc58a489409ba40334ebf96a311b) C:\windows\system32\DRIVERS\rdbss.sys
2011/06/27 21:03:11.0439 5420 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys
2011/06/27 21:03:11.0473 5420 RDPCDD (23dae03f29d253ae74c44f99e515f9a1) C:\windows\system32\DRIVERS\RDPCDD.sys
2011/06/27 21:03:11.0530 5420 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys
2011/06/27 21:03:11.0553 5420 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys
2011/06/27 21:03:11.0594 5420 RDPWD (288b06960d78428ff89e811632684e20) C:\windows\system32\drivers\RDPWD.sys
2011/06/27 21:03:11.0648 5420 rdyboost (518395321dc96fe2c9f0e96ac743b656) C:\windows\system32\drivers\rdyboost.sys
2011/06/27 21:03:11.0726 5420 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys
2011/06/27 21:03:11.0833 5420 rspndr (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys
2011/06/27 21:03:11.0856 5420 RTL8167 (7dfd48e24479b68b258d8770121155a0) C:\windows\system32\DRIVERS\Rt86win7.sys
2011/06/27 21:03:11.0937 5420 s1018bus (1c5c2cb892553d2cf3f45a4bb323fcd6) C:\windows\system32\DRIVERS\s1018bus.sys
2011/06/27 21:03:11.0956 5420 s1018mdfl (38f5ea219593f19b6b3a1b9c169e3b61) C:\windows\system32\DRIVERS\s1018mdfl.sys
2011/06/27 21:03:11.0994 5420 s1018mdm (666af6b64fc7df92d3ca4819ea91631d) C:\windows\system32\DRIVERS\s1018mdm.sys
2011/06/27 21:03:12.0015 5420 s1018mgmt (f4ceda6e2ddff2af8bd745615a7ca9c0) C:\windows\system32\DRIVERS\s1018mgmt.sys
2011/06/27 21:03:12.0073 5420 s1018nd5 (3622d9ff2253dcbe885b10736609a4ca) C:\windows\system32\DRIVERS\s1018nd5.sys
2011/06/27 21:03:12.0098 5420 s1018obex (49431efda842b474531c29ffae9f5d09) C:\windows\system32\DRIVERS\s1018obex.sys
2011/06/27 21:03:12.0116 5420 s1018unic (ac6b514cb4474f4c867d7cdc9cd54f05) C:\windows\system32\DRIVERS\s1018unic.sys
2011/06/27 21:03:12.0223 5420 SABI (6e5fbb7cbaec47038b945d5e9b144a64) C:\windows\system32\Drivers\SABI.sys
2011/06/27 21:03:12.0274 5420 sbp2port (05d860da1040f111503ac416ccef2bca) C:\windows\system32\drivers\sbp2port.sys
2011/06/27 21:03:12.0324 5420 scfilter (0693b5ec673e34dc147e195779a4dcf6) C:\windows\system32\DRIVERS\scfilter.sys
2011/06/27 21:03:12.0406 5420 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys
2011/06/27 21:03:12.0464 5420 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys
2011/06/27 21:03:12.0506 5420 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys
2011/06/27 21:03:12.0555 5420 sermouse (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys
2011/06/27 21:03:12.0605 5420 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\drivers\sffdisk.sys
2011/06/27 21:03:12.0628 5420 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\drivers\sffp_mmc.sys
2011/06/27 21:03:12.0645 5420 sffp_sd (6d4ccaedc018f1cf52866bbbaa235982) C:\windows\system32\drivers\sffp_sd.sys
2011/06/27 21:03:12.0688 5420 sfloppy (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys
2011/06/27 21:03:12.0717 5420 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\drivers\sisagp.sys
2011/06/27 21:03:12.0755 5420 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys
2011/06/27 21:03:12.0780 5420 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys
2011/06/27 21:03:12.0821 5420 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys
2011/06/27 21:03:12.0868 5420 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys
2011/06/27 21:03:12.0945 5420 srv (e4c2764065d66ea1d2d3ebc28fe99c46) C:\windows\system32\DRIVERS\srv.sys
2011/06/27 21:03:12.0978 5420 srv2 (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\windows\system32\DRIVERS\srv2.sys
2011/06/27 21:03:13.0009 5420 srvnet (be6bd660caa6f291ae06a718a4fa8abc) C:\windows\system32\DRIVERS\srvnet.sys
2011/06/27 21:03:13.0094 5420 stexstor (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys
2011/06/27 21:03:13.0137 5420 swenum (e58c78a848add9610a4db6d214af5224) C:\windows\system32\drivers\swenum.sys
2011/06/27 21:03:13.0200 5420 SynTP (069e5728e565bd401347cb94732c4733) C:\windows\system32\DRIVERS\SynTP.sys
2011/06/27 21:03:13.0294 5420 Tcpip (24326784df8f3d5f5bbb9f878ce33c14) C:\windows\system32\drivers\tcpip.sys
2011/06/27 21:03:13.0357 5420 TCPIP6 (24326784df8f3d5f5bbb9f878ce33c14) C:\windows\system32\DRIVERS\tcpip.sys
2011/06/27 21:03:13.0404 5420 tcpipreg (cca24162e055c3714ce5a88b100c64ed) C:\windows\system32\drivers\tcpipreg.sys
2011/06/27 21:03:13.0452 5420 TDPIPE (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\windows\system32\drivers\tdpipe.sys
2011/06/27 21:03:13.0483 5420 TDTCP (2c10395baa4847f83042813c515cc289) C:\windows\system32\drivers\tdtcp.sys
2011/06/27 21:03:13.0518 5420 tdx (b459575348c20e8121d6039da063c704) C:\windows\system32\DRIVERS\tdx.sys
2011/06/27 21:03:13.0563 5420 TermDD (04dbf4b01ea4bf25a9a3e84affac9b20) C:\windows\system32\drivers\termdd.sys
2011/06/27 21:03:13.0617 5420 tssecsrv (254bb140eee3c59d6114c1a86b636877) C:\windows\system32\DRIVERS\tssecsrv.sys
2011/06/27 21:03:13.0682 5420 TsUsbFlt (fd1d6c73e6333be727cbcc6054247654) C:\windows\system32\drivers\tsusbflt.sys
2011/06/27 21:03:13.0760 5420 tunnel (b2fa25d9b17a68bb93d58b0556e8c90d) C:\windows\system32\DRIVERS\tunnel.sys
2011/06/27 21:03:13.0811 5420 TurboB (c0847edcccef8d4f5354e82ec9e90159) C:\windows\system32\DRIVERS\TurboB.sys
2011/06/27 21:03:13.0933 5420 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys
2011/06/27 21:03:13.0977 5420 udfs (ee43346c7e4b5e63e54f927babbb32ff) C:\windows\system32\DRIVERS\udfs.sys
2011/06/27 21:03:14.0047 5420 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\drivers\uliagpkx.sys
2011/06/27 21:03:14.0101 5420 umbus (d295bed4b898f0fd999fcfa9b32b071b) C:\windows\system32\drivers\umbus.sys
2011/06/27 21:03:14.0126 5420 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys
2011/06/27 21:03:14.0229 5420 UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Program Files\Unlocker\UnlockerDriver5.sys
2011/06/27 21:03:14.0264 5420 usbccgp (bd9c55d7023c5de374507acc7a14e2ac) C:\windows\system32\DRIVERS\usbccgp.sys
2011/06/27 21:03:14.0304 5420 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\drivers\usbcir.sys
2011/06/27 21:03:14.0334 5420 usbehci (f92de757e4b7ce9c07c5e65423f3ae3b) C:\windows\system32\drivers\usbehci.sys
2011/06/27 21:03:14.0376 5420 usbhub (8dc94aec6a7e644a06135ae7506dc2e9) C:\windows\system32\DRIVERS\usbhub.sys
2011/06/27 21:03:14.0407 5420 usbohci (e185d44fac515a18d9deddc23c2cdf44) C:\windows\system32\drivers\usbohci.sys
2011/06/27 21:03:14.0484 5420 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys
2011/06/27 21:03:14.0564 5420 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\windows\system32\DRIVERS\usbscan.sys
2011/06/27 21:03:14.0610 5420 USBSTOR (f991ab9cc6b908db552166768176896a) C:\windows\system32\drivers\USBSTOR.SYS
2011/06/27 21:03:14.0645 5420 usbuhci (68df884cf41cdada664beb01daf67e3d) C:\windows\system32\drivers\usbuhci.sys
2011/06/27 21:03:14.0685 5420 usbvideo (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\windows\System32\Drivers\usbvideo.sys
2011/06/27 21:03:14.0756 5420 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\drivers\vdrvroot.sys
2011/06/27 21:03:14.0801 5420 vga (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys
2011/06/27 21:03:14.0830 5420 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys
2011/06/27 21:03:14.0863 5420 vhdmp (5461686cca2fda57b024547733ab42e3) C:\windows\system32\drivers\vhdmp.sys
2011/06/27 21:03:14.0916 5420 viaagp (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\drivers\viaagp.sys
2011/06/27 21:03:14.0942 5420 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys
2011/06/27 21:03:14.0963 5420 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\drivers\viaide.sys
2011/06/27 21:03:15.0009 5420 volmgr (4c63e00f2f4b5f86ab48a58cd990f212) C:\windows\system32\drivers\volmgr.sys
2011/06/27 21:03:15.0038 5420 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys
2011/06/27 21:03:15.0086 5420 volsnap (f497f67932c6fa693d7de2780631cfe7) C:\windows\system32\drivers\volsnap.sys
2011/06/27 21:03:15.0143 5420 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys
2011/06/27 21:03:15.0172 5420 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys
2011/06/27 21:03:15.0208 5420 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys
2011/06/27 21:03:15.0240 5420 WacomPen (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys
2011/06/27 21:03:15.0298 5420 WANARP (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
2011/06/27 21:03:15.0310 5420 Wanarpv6 (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
2011/06/27 21:03:15.0352 5420 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys
2011/06/27 21:03:15.0380 5420 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys
2011/06/27 21:03:15.0449 5420 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys
2011/06/27 21:03:15.0471 5420 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys
2011/06/27 21:03:15.0571 5420 WinUsb (a67e5f9a400f3bd1be3d80613b45f708) C:\windows\system32\DRIVERS\WinUsb.sys
2011/06/27 21:03:15.0600 5420 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\drivers\wmiacpi.sys
2011/06/27 21:03:15.0663 5420 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys
2011/06/27 21:03:15.0725 5420 WudfPf (e714a1c0354636837e20ccbf00888ee7) C:\windows\system32\drivers\WudfPf.sys
2011/06/27 21:03:15.0759 5420 WUDFRd (1023ee888c9b47178c5293ed5336ab69) C:\windows\system32\DRIVERS\WUDFRd.sys
2011/06/27 21:03:15.0823 5420 xusb21 (c26c68bcbac1f33f890c226769759209) C:\windows\system32\DRIVERS\xusb21.sys
2011/06/27 21:03:15.0874 5420 yukonw7 (30b73eb97218a16cbc6de535782a1b35) C:\windows\system32\DRIVERS\yk62x86.sys
2011/06/27 21:03:15.0943 5420 MBR (0x1B8) (2e5debb2116b3417023e0d6562d7ed07) \Device\Harddisk0\DR0
2011/06/27 21:03:16.0185 5420 Boot (0x1200) (4a7fd30f22d966266d3ffe86e5380bfe) \Device\Harddisk0\DR0\Partition0
2011/06/27 21:03:16.0208 5420 Boot (0x1200) (cad514c66730aa082471708766ac06a5) \Device\Harddisk0\DR0\Partition1
2011/06/27 21:03:16.0249 5420 Boot (0x1200) (7402f66b6ffe6ded88c053a1fcfd6976) \Device\Harddisk0\DR0\Partition2
2011/06/27 21:03:16.0253 5420 ================================================================================
2011/06/27 21:03:16.0253 5420 Scan finished
2011/06/27 21:03:16.0253 5420 ================================================================================
2011/06/27 21:03:16.0264 4656 Detected object count: 0
2011/06/27 21:03:16.0264 4656 Actual detected object count: 0

cosinus 28.06.2011 09:43
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Sombra 28.06.2011 12:56
combofix log:

Combofix Logfile:
Code:
ComboFix 11-06-27.04 - corleone 28.06.2011  13:40:00.1.4 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3061.2179 [GMT 2:00]
ausgeführt von:: c:\users\corleone\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\corleone\AppData\Roaming\.#
c:\users\corleone\AppData\Roaming\inst.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-28 bis 2011-06-28  ))))))))))))))))))))))))))))))
.
.
2011-06-28 11:45 . 2011-06-28 11:46        --------        d-----w-        c:\users\corleone\AppData\Local\temp
2011-06-28 11:45 . 2011-06-28 11:45        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-28 06:55 . 2011-06-07 15:55        7074640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0D426EF5-AECA-4CBD-A049-D344F81D8883}\mpengine.dll
2011-06-24 09:33 . 2011-06-24 09:33        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-24 09:33 . 2011-06-24 09:33        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-15 21:34 . 2011-04-22 23:25        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-06-15 21:34 . 2011-04-25 15:29        141104        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll
2011-06-15 21:34 . 2011-04-22 23:35        1797632        ----a-w-        c:\windows\system32\jscript9.dll
2011-06-15 21:20 . 2011-04-29 02:46        311808        ----a-w-        c:\windows\system32\drivers\srv.sys
2011-06-15 21:20 . 2011-04-29 02:46        310272        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-06-15 21:20 . 2011-04-29 02:46        114688        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-06-15 21:20 . 2011-04-25 04:31        1290624        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2011-06-15 21:20 . 2011-04-25 02:18        338944        ----a-w-        c:\windows\system32\drivers\afd.sys
2011-06-15 21:20 . 2011-02-25 05:34        571904        ----a-w-        c:\windows\system32\oleaut32.dll
2011-06-15 21:20 . 2011-01-17 05:47        161792        ----a-w-        c:\windows\system32\d3d10_1.dll
2011-06-15 21:20 . 2011-05-03 04:30        741376        ----a-w-        c:\windows\system32\inetcomm.dll
2011-06-15 21:20 . 2011-04-27 02:17        223744        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 21:20 . 2011-04-27 02:17        96768        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 21:20 . 2011-04-27 02:17        123904        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2011-06-10 18:41 . 2011-06-25 06:23        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-08 11:42 . 2011-06-08 11:42        --------        d-----w-        c:\windows\system32\SPReview
2011-06-08 11:40 . 2011-06-08 11:40        --------        d-----w-        c:\windows\system32\EventProviders
2011-06-07 13:14 . 2011-06-07 13:14        0        ---ha-w-        c:\users\corleone\AppData\Local\BIT7B0D.tmp
2011-06-07 10:35 . 2011-06-07 10:35        103864        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-07 05:35 . 2010-11-20 12:21        1619456        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2011-06-07 05:34 . 2010-11-20 12:21        11264        ----a-w-        c:\windows\system32\wshirda.dll
2011-06-05 08:39 . 2011-06-05 08:39        --------        d-----w-        c:\program files\mp3DirectCut
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-08 11:49 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
2011-05-29 07:11 . 2010-08-22 16:58        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2010-08-22 16:58        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-05-24 17:14 . 2010-08-10 10:54        222080        ------w-        c:\windows\system32\MpSigStub.exe
2011-05-21 18:22 . 2011-05-21 18:22        0        ---ha-w-        c:\users\corleone\AppData\Local\BIT5D9D.tmp
2011-05-02 16:48 . 2011-05-02 16:48        0        ---ha-w-        c:\users\corleone\AppData\Local\BIT9A31.tmp
2011-04-22 19:14 . 2011-05-25 06:41        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-04-09 06:02 . 2011-05-11 06:33        3967872        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 06:33        3912576        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-14 19:35        123904        ----a-w-        c:\windows\system32\poqexec.exe
2011-06-24 09:33 . 2011-05-25 07:11        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 20:44        1400712        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-18 205976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" [2009-11-20 13312]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-10 13834856]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-25 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-06 1848648]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-15 8120864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
c:\users\corleone\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-10-2 795936]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-8-7 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 10:28        72208        ----a-w-        c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 ATE_PROCMON;ATE_PROCMON;c:\program files\Anti Trojan Elite\ATEPMon.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-07 135664]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-07 135664]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2009-03-25 86824]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 15016]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 114728]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 106208]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 26024]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2009-03-25 104744]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2009-03-25 109864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-09-29 99768]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312]
S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-09-29 13752]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 43944]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-11-25 125824]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-07 17:44]
.
2011-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-07 17:44]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\corleone\AppData\Roaming\Mozilla\Firefox\Profiles\u7g8ud63.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-68881345.sys
MSConfigStartUp-Anti Trojan Elite - c:\program files\Anti Trojan Elite\TJEnder.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-06-28  13:48:18
ComboFix-quarantined-files.txt  2011-06-28 11:48
.
Vor Suchlauf: 8 Verzeichnis(se), 186.033.434.624 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 186.718.224.384 Bytes frei
.
- - End Of File - - 27E2EF08FB429CB736A10A009BACFC07
--- --- ---

cosinus 28.06.2011 15:32
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Sombra 29.06.2011 13:48
So, hier nun der gmer log:

GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-29 14:35:06
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AC1
Running: 5ndlc2y3.exe; Driver: C:\Users\corleone\AppData\Local\Temp\fxldapow.sys

PAGE            ...                                                                                             

---- User code sections - GMER 1.0.15 ----

.text          C:\windows\Explorer.EXE[2240] SHELL32.dll!SHFileOperationW                                      75CA96F6 5 Bytes  JMP 10001102 C:\Program Files\Unlocker\UnlockerHook.dll

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                                                    83694339 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                          836CDD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
PAGE            spsys.sys!?SPRevision@@3PADA + 4F90                                                              AC649000 290 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 50B3                                                              AC649123 629 Bytes  [45, 64, AC, FE, 05, 34, 45, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 5329                                                              AC649399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 538F                                                              AC6493FF 51 Bytes  [18, 5D, C2, 14, 00, 8B, FF, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 53C3                                                              AC649433 96 Bytes  [63, AC, 85, C9, 7C, 18, 8D, ...]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000081                                                                  bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\ACPI_HAL \Device\0000004b                                                                halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\0000007f                                                                  bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f652                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6864                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6982                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b482fe37d72b                     
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f652 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6864 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6982 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b482fe37d72b (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---

Sombra 29.06.2011 13:49
Und:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 14:46:54 on 29.06.2011

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit
Default Browser: Mozilla Corporation Firefox 5.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\windows\system32\FlashPlayerCPLApp.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ATE_PROCMON" (ATE_PROCMON) - ? - C:\Program Files\Anti Trojan Elite\ATEPMon.sys  (File not found)
"catchme" (catchme) - ? - C:\Users\corleone\AppData\Local\Temp\catchme.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\windows\system32\drivers\mbam.sys
"Turbo Boost UI Monitor driver" (TurboB) - "Intel Corp." - C:\windows\System32\DRIVERS\TurboB.sys
"VSO Software pcouffin" (pcouffin) - "VSO Software" - C:\windows\System32\Drivers\pcouffin.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\windows\system32\nvcpl.dll
{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll
{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll
{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\kbcplext.dll
{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\mcplext.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btncopy.dll
{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C} "NvAppShExt Class" - "NVIDIA Corporation" - C:\windows\system32\Nv3DAppShExt.dll
{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\windows\system32\nvshext.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\windows\system32\nvcpl.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - C:\Program Files\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{00000000-6E41-4FD3-8538-502F5495E5FC} "UrlSearchHook Class" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "Sopcast Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{D4027C7F-154A-4066-A1AD-4243D8127440} "Sopcast Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\corleone\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 3.2.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Logitech SetPoint.lnk" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\SetPoint.exe  (Shortcut exists | File exists)
"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AlcoholAutomount" - "Alcohol Soft Development Team" - "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"APLangApp" - "DoctorSoft" - "C:\Program Files\AnyPC Client\APLangApp.exe"
"CanonMyPrinter" - "CANON INC." - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
"CanonSolutionMenu" - "CANON INC." - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"CLMLServer" - "CyberLink" - "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
"PDVD8LanguageShortcut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"RemoteControl8" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
"UnlockerAssistant" - ? - "C:\Program Files\Unlocker\UnlockerAssistant.exe"  (File found, but it contains no detailed information)
"UpdateLBPShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
"UpdateP2GoShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
"UpdatePDRShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
"UpdatePPShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
"UpdatePSTShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\windows\system32\nvvsvc.exe
"Oberon Media Game Console service" (OberonGameConsoleService) - ? - C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
"PIXMA Extended Survey Program" (IJPLMSVC) - ? - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
"Rezip" (Rezip) - ? - C:\windows\SYSTEM32\Rezip.exe
"StarWind AE Service" (StarWindServiceAE) - "Rocket Division Software" - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
"TurboBoost" (TurboBoost) - "Intel(R) Corporation" - C:\Program Files\Intel\TurboBoost\TurboBoost.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"LBTWlgn" - "Logitech, Inc." - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 29.06.2011 14:36
Was ist mit mbrcheck?

Sombra 29.06.2011 15:07
Übersehen...

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 32-bit
Base Board Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer: Phoenix Technologies Ltd.
System Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
System Product Name: R580
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 198):
0x8361C000 \SystemRoot\system32\ntkrnlpa.exe
0x83A2E000 \SystemRoot\system32\halmacpi.dll
0x80BAE000 \SystemRoot\system32\kdcom.dll
0x8B81C000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8B8A1000 \SystemRoot\system32\PSHED.dll
0x8B8B2000 \SystemRoot\system32\BOOTVID.dll
0x8B8BA000 \SystemRoot\system32\CLFS.SYS
0x8B8FC000 \SystemRoot\system32\CI.dll
0x8BA31000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8BAA2000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8BAB0000 \SystemRoot\system32\drivers\ACPI.sys
0x8BAF8000 \SystemRoot\system32\drivers\WMILIB.SYS
0x8BB01000 \SystemRoot\system32\drivers\msisadrv.sys
0x8BB09000 \SystemRoot\system32\drivers\vdrvroot.sys
0x8BB14000 \SystemRoot\system32\drivers\pci.sys
0x8BB3E000 \SystemRoot\System32\drivers\partmgr.sys
0x8BB4F000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8BB57000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8BB62000 \SystemRoot\system32\drivers\volmgr.sys
0x8BB72000 \SystemRoot\System32\drivers\volmgrx.sys
0x8BBBD000 \SystemRoot\System32\drivers\mountmgr.sys
0x8BC24000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8BDD9000 \SystemRoot\system32\drivers\atapi.sys
0x8BC00000 \SystemRoot\system32\drivers\ataport.SYS
0x8BDE2000 \SystemRoot\system32\drivers\msahci.sys
0x8BDEC000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8BBD3000 \SystemRoot\system32\drivers\amdxata.sys
0x8B9A7000 \SystemRoot\system32\drivers\fltmgr.sys
0x8BBDC000 \SystemRoot\system32\drivers\fileinfo.sys
0x8BE33000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BF62000 \SystemRoot\System32\Drivers\msrpc.sys
0x8BF8D000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8BFA0000 \SystemRoot\System32\Drivers\cng.sys
0x8BE00000 \SystemRoot\System32\drivers\pcw.sys
0x8BE0E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8C006000 \SystemRoot\system32\drivers\ndis.sys
0x8C0BD000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C0FB000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C23F000 \SystemRoot\System32\drivers\tcpip.sys
0x8C389000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C3BA000 \SystemRoot\system32\drivers\volsnap.sys
0x8C200000 \SystemRoot\System32\Drivers\spldr.sys
0x8C208000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C120000 \SystemRoot\System32\Drivers\mup.sys
0x8C235000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C130000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8C162000 \SystemRoot\system32\DRIVERS\disk.sys
0x8C173000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x90DDA000 \SystemRoot\system32\drivers\cdrom.sys
0x90DF9000 \SystemRoot\System32\Drivers\Null.SYS
0x90C00000 \SystemRoot\System32\Drivers\Beep.SYS
0x90C07000 \SystemRoot\System32\drivers\vga.sys
0x8C1A5000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C1C6000 \SystemRoot\System32\drivers\watchdog.sys
0x8C1D3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C1DB000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C1E3000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C1EB000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BE17000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8BA00000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8BE25000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x91C08000 \SystemRoot\System32\DRIVERS\netbt.sys
0x91C3A000 \SystemRoot\system32\drivers\afd.sys
0x91C94000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x91C9B000 \SystemRoot\system32\DRIVERS\pacer.sys
0x91CBA000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x91CCB000 \SystemRoot\system32\DRIVERS\netbios.sys
0x91CD9000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x91CEC000 \SystemRoot\system32\drivers\termdd.sys
0x91CFD000 \??\C:\windows\system32\Drivers\SABI.sys
0x91D05000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x91D46000 \SystemRoot\system32\drivers\nsiproxy.sys
0x91D50000 \SystemRoot\system32\drivers\mssmbios.sys
0x91D5A000 \SystemRoot\System32\drivers\discache.sys
0x91D66000 \SystemRoot\System32\Drivers\dfsc.sys
0x91D7E000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x91D8C000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x9301F000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x93998000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x92413000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x924CA000 \SystemRoot\System32\drivers\dxgmms1.sys
0x92503000 \SystemRoot\system32\drivers\HDAudBus.sys
0x92522000 \SystemRoot\system32\drivers\usbehci.sys
0x92531000 \SystemRoot\system32\drivers\USBPORT.SYS
0x9280C000 \SystemRoot\system32\DRIVERS\athr.sys
0x92940000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x9294A000 \SystemRoot\system32\DRIVERS\yk62x86.sys
0x9299B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x9299F000 \SystemRoot\system32\drivers\i8042prt.sys
0x929B7000 \SystemRoot\system32\drivers\kbdclass.sys
0x929C4000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x929FE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x9257C000 \SystemRoot\system32\drivers\mouclass.sys
0x92589000 \SystemRoot\system32\DRIVERS\Impcd.sys
0x925A8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x925BA000 \SystemRoot\system32\drivers\CompositeBus.sys
0x925D5000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x925E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x92800000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x9399A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x939BC000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x939D4000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x93000000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x92400000 \SystemRoot\system32\drivers\swenum.sys
0x91DAD000 \SystemRoot\system32\drivers\ks.sys
0x92402000 \SystemRoot\system32\drivers\umbus.sys
0x9421E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x94262000 \SystemRoot\system32\drivers\nvhda32v.sys
0x94275000 \SystemRoot\system32\drivers\portcls.sys
0x942A4000 \SystemRoot\system32\drivers\drmk.sys
0x94C3D000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x94F13000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x96850000 \SystemRoot\System32\win32k.sys
0x94F24000 \SystemRoot\System32\drivers\Dxapi.sys
0x94F2E000 \SystemRoot\System32\Drivers\crashdmp.sys
0x90C13000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x94F3B000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x94F4C000 \SystemRoot\system32\DRIVERS\monitor.sys
0x94F57000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x94F6E000 \SystemRoot\System32\Drivers\usbvideo.sys
0x96AB0000 \SystemRoot\System32\TSDDD.dll
0x96AE0000 \SystemRoot\System32\cdd.dll
0x94F92000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0x94F98000 \SystemRoot\system32\drivers\hidusb.sys
0x94FA3000 \SystemRoot\system32\drivers\HIDCLASS.SYS
0x94FB6000 \SystemRoot\system32\drivers\HIDPARSE.SYS
0x94FBD000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x94FC5000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x94FD0000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x94FD8000 \SystemRoot\system32\drivers\btusbflt.sys
0x94FE2000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x942BD000 \SystemRoot\System32\Drivers\bthport.sys
0x94C00000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x94C24000 \SystemRoot\system32\drivers\BthEnum.sys
0x94321000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x9433C000 \SystemRoot\system32\drivers\btwavdt.sys
0x82215000 \SystemRoot\system32\drivers\btwaudio.sys
0x82296000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
0x822A1000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x822A4000 \SystemRoot\system32\drivers\luafv.sys
0x822BF000 \SystemRoot\system32\drivers\WudfPf.sys
0x822D9000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x822E9000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8232F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8233F000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x82352000 \SystemRoot\system32\DRIVERS\TurboB.sys
0x82359000 \SystemRoot\system32\drivers\HTTP.sys
0x823DE000 \SystemRoot\system32\DRIVERS\bowser.sys
0x82200000 \SystemRoot\System32\drivers\mpsdrv.sys
0x943AF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x97629000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x97664000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x97697000 \SystemRoot\system32\drivers\peauth.sys
0x9772E000 \SystemRoot\System32\Drivers\secdrv.SYS
0x97738000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x97759000 \SystemRoot\System32\drivers\tcpipreg.sys
0x97766000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9EC10000 \SystemRoot\System32\DRIVERS\srv.sys
0x9EC62000 \??\C:\windows\system32\drivers\mbam.sys
0x77190000 \Windows\System32\ntdll.dll
0x484A0000 \Windows\System32\smss.exe
0x773D0000 \Windows\System32\apisetschema.dll
0x00170000 \Windows\System32\autochk.exe
0x77370000 \Windows\System32\gdi32.dll
0x76FD0000 \Windows\System32\iertutil.dll
0x77320000 \Windows\System32\Wldap32.dll
0x76F40000 \Windows\System32\oleaut32.dll
0x76EA0000 \Windows\System32\advapi32.dll
0x772F0000 \Windows\System32\imagehlp.dll
0x76DD0000 \Windows\System32\user32.dll
0x76D30000 \Windows\System32\usp10.dll
0x772D0000 \Windows\System32\imm32.dll
0x76D20000 \Windows\System32\nsi.dll
0x76CE0000 \Windows\System32\ws2_32.dll
0x76C30000 \Windows\System32\rpcrt4.dll
0x76B80000 \Windows\System32\msvcrt.dll
0x76A20000 \Windows\System32\ole32.dll
0x769C0000 \Windows\System32\shlwapi.dll
0x76940000 \Windows\System32\comdlg32.dll
0x76820000 \Windows\System32\wininet.dll
0x76710000 \Windows\System32\urlmon.dll
0x76700000 \Windows\System32\psapi.dll
0x766E0000 \Windows\System32\sechost.dll
0x76600000 \Windows\System32\kernel32.dll
0x765F0000 \Windows\System32\normaliz.dll
0x76450000 \Windows\System32\setupapi.dll
0x75800000 \Windows\System32\shell32.dll
0x757F0000 \Windows\System32\lpk.dll
0x75720000 \Windows\System32\msctf.dll
0x756C0000 \Windows\System32\difxapi.dll
0x75630000 \Windows\System32\clbcatq.dll
0x75600000 \Windows\System32\cfgmgr32.dll
0x754E0000 \Windows\System32\crypt32.dll
0x754C0000 \Windows\System32\devobj.dll
0x75470000 \Windows\System32\KernelBase.dll
0x75440000 \Windows\System32\wintrust.dll
0x753B0000 \Windows\System32\comctl32.dll
0x753A0000 \Windows\System32\msasn1.dll

Processes (total 67):
0 System Idle Process
4 System
316 C:\Windows\System32\smss.exe
460 csrss.exe
520 C:\Windows\System32\wininit.exe
528 csrss.exe
580 C:\Windows\System32\services.exe
592 C:\Windows\System32\lsass.exe
604 C:\Windows\System32\lsm.exe
700 C:\Windows\System32\winlogon.exe
752 C:\Windows\System32\svchost.exe
812 C:\Windows\System32\nvvsvc.exe
852 C:\Windows\System32\svchost.exe
956 C:\Windows\System32\svchost.exe
988 C:\Windows\System32\svchost.exe
1020 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\audiodg.exe
1144 C:\Windows\System32\svchost.exe
1308 C:\Windows\System32\nvvsvc.exe
1348 C:\Windows\System32\spoolsv.exe
1384 C:\Windows\System32\svchost.exe
1520 C:\Windows\System32\svchost.exe
1552 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
1584 C:\Windows\System32\svchost.exe
1648 C:\Program Files\Canon\IJPLM\ijplmsvc.exe
1756 C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
1896 C:\Windows\System32\Rezip.exe
1928 C:\Program Files\CyberLink\Shared files\RichVideo.exe
1972 C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
1992 C:\Windows\System32\svchost.exe
2136 C:\Windows\System32\taskhost.exe
2204 C:\Windows\System32\dwm.exe
2244 C:\Windows\explorer.exe
2416 C:\Windows\System32\taskeng.exe
2428 C:\Windows\servicing\TrustedInstaller.exe
2452 C:\Windows\System32\svchost.exe
2652 C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
2736 C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
2780 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
2808 C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
2816 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
3088 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3132 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
3160 C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
3224 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
3424 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
3536 C:\Program Files\Unlocker\UnlockerAssistant.exe
3544 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
3640 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
3660 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3684 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
3756 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
3804 C:\Windows\System32\SearchIndexer.exe
3812 C:\Program Files\Logitech\SetPoint\SetPoint.exe
3876 C:\Program Files\OpenOffice.org 3\program\soffice.exe
3920 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
3928 C:\Program Files\OpenOffice.org 3\program\soffice.bin
3952 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
1636 C:\Program Files\Windows Media Player\wmpnetwk.exe
820 C:\Windows\System32\svchost.exe
4728 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
4808 C:\Windows\System32\svchost.exe
4628 C:\Windows\System32\svchost.exe
6012 C:\Windows\System32\taskeng.exe
5864 C:\Program Files\Mozilla Firefox\firefox.exe
5720 C:\Users\corleone\Desktop\MBRCheck.exe
5992 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`c6500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000003c`1b700000 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHM500JI, Rev: 2AC101C4

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: F5C09ACABD4A5370BDD907E8EDFE0C1DA0F9D3F5


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

cosinus 29.06.2011 15:11
Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Win7 (32-Bit) installiert?
Wenn nicht: Schau mal hier => RescueDisc-Win7-32-Bit

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Win7-Installations-DVD (32-Bit) hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der dieser DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

Sombra 29.06.2011 22:00
Ansich eine sehr gute Idee, weil ich das bisher noch nicht getan habe und sowieso tun will.

Aber ist das nicht etwas zu aufwendig für ein Google Problemchen? Sonst scheint das System überhaupt nicht infiziert zu sein.

cosinus 29.06.2011 22:06
Zitat:
Aber ist das nicht etwas zu aufwendig für ein Google Problemchen? Sonst scheint das System überhaupt nicht infiziert zu sein.
Dann lass es so und leb damit :stirn:

Sombra 29.06.2011 22:20
Bleib mal locker.
Bisher hatte ich noch nie mit einer einzigen Website ein Problem. Wenn überhaupt, war es die Website die infiziert war. Ist bei Google offensichtlich nicht der Fall.

cosinus 30.06.2011 09:06
Zitat:
Wenn überhaupt, war es die Website die infiziert war. Ist bei Google offensichtlich nicht der Fall.
Und wenn der infizierte MBR zu diesem Problem führt? Wie willst du das denn überprüfen wenn du den mBR nicht fixen willst? :dummguck:

Sombra 30.06.2011 09:41
Ich hab ihn gefixt und das Problem besteht nach wie vor.

Hier die neuen Logs:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 32-bit
Base Board Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer: Phoenix Technologies Ltd.
System Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
System Product Name: R580
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 193):
0x83653000 \SystemRoot\system32\ntkrnlpa.exe
0x8361C000 \SystemRoot\system32\halmacpi.dll
0x80B9D000 \SystemRoot\system32\kdcom.dll
0x8B80F000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8B894000 \SystemRoot\system32\PSHED.dll
0x8B8A5000 \SystemRoot\system32\BOOTVID.dll
0x8B8AD000 \SystemRoot\system32\CLFS.SYS
0x8B8EF000 \SystemRoot\system32\CI.dll
0x8BA39000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8BAAA000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8BAB8000 \SystemRoot\system32\drivers\ACPI.sys
0x8BB00000 \SystemRoot\system32\drivers\WMILIB.SYS
0x8BB09000 \SystemRoot\system32\drivers\msisadrv.sys
0x8BB11000 \SystemRoot\system32\drivers\vdrvroot.sys
0x8BB1C000 \SystemRoot\system32\drivers\pci.sys
0x8BB46000 \SystemRoot\System32\drivers\partmgr.sys
0x8BB57000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8BB5F000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8BB6A000 \SystemRoot\system32\drivers\volmgr.sys
0x8BB7A000 \SystemRoot\System32\drivers\volmgrx.sys
0x8BBC5000 \SystemRoot\System32\drivers\mountmgr.sys
0x8BC09000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8BDBE000 \SystemRoot\system32\drivers\atapi.sys
0x8BDC7000 \SystemRoot\system32\drivers\ataport.SYS
0x8BDEA000 \SystemRoot\system32\drivers\msahci.sys
0x8BBDB000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8BDF4000 \SystemRoot\system32\drivers\amdxata.sys
0x8BA00000 \SystemRoot\system32\drivers\fltmgr.sys
0x8BBE9000 \SystemRoot\system32\drivers\fileinfo.sys
0x8BE29000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BF58000 \SystemRoot\System32\Drivers\msrpc.sys
0x8BF83000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8BF96000 \SystemRoot\System32\Drivers\cng.sys
0x8BE00000 \SystemRoot\System32\drivers\pcw.sys
0x8BE0E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8C010000 \SystemRoot\system32\drivers\ndis.sys
0x8C0C7000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C105000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C229000 \SystemRoot\System32\drivers\tcpip.sys
0x8C373000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C3A4000 \SystemRoot\system32\drivers\volsnap.sys
0x8C3E3000 \SystemRoot\System32\Drivers\spldr.sys
0x8C12A000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C3EB000 \SystemRoot\System32\Drivers\mup.sys
0x8C200000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C157000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8C208000 \SystemRoot\system32\DRIVERS\disk.sys
0x8C189000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8FFDB000 \SystemRoot\system32\drivers\cdrom.sys
0x8FE00000 \SystemRoot\System32\Drivers\Null.SYS
0x8FE07000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C1AE000 \SystemRoot\System32\drivers\vga.sys
0x8C1BA000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C1DB000 \SystemRoot\System32\drivers\watchdog.sys
0x8C1E8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C1F0000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C1F8000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C000000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BE17000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8B99A000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8BFF3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8B9B1000 \SystemRoot\System32\DRIVERS\netbt.sys
0x9162A000 \SystemRoot\system32\drivers\afd.sys
0x91684000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x9168B000 \SystemRoot\system32\DRIVERS\pacer.sys
0x916AA000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x916BB000 \SystemRoot\system32\DRIVERS\netbios.sys
0x916C9000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x916DC000 \SystemRoot\system32\drivers\termdd.sys
0x916ED000 \??\C:\windows\system32\Drivers\SABI.sys
0x916F5000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x91736000 \SystemRoot\system32\drivers\nsiproxy.sys
0x91740000 \SystemRoot\system32\drivers\mssmbios.sys
0x9174A000 \SystemRoot\System32\drivers\discache.sys
0x91756000 \SystemRoot\System32\Drivers\dfsc.sys
0x9176E000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x9177C000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x92219000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x92B92000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x91E1A000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x91ED1000 \SystemRoot\System32\drivers\dxgmms1.sys
0x91F0A000 \SystemRoot\system32\drivers\HDAudBus.sys
0x91F29000 \SystemRoot\system32\drivers\usbehci.sys
0x91F38000 \SystemRoot\system32\drivers\USBPORT.SYS
0x92C10000 \SystemRoot\system32\DRIVERS\athr.sys
0x92D44000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x92D4E000 \SystemRoot\system32\DRIVERS\yk62x86.sys
0x92D9F000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x92DA3000 \SystemRoot\system32\drivers\i8042prt.sys
0x92DBB000 \SystemRoot\system32\drivers\kbdclass.sys
0x91F83000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x92DC8000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x92DCA000 \SystemRoot\system32\drivers\mouclass.sys
0x92DD7000 \SystemRoot\system32\DRIVERS\Impcd.sys
0x91FBD000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x92C00000 \SystemRoot\system32\drivers\CompositeBus.sys
0x91FDD000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x91E00000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x91FEF000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x92B94000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x92BB6000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x92BCE000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x92BE5000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x92C0D000 \SystemRoot\system32\drivers\swenum.sys
0x9179D000 \SystemRoot\system32\drivers\ks.sys
0x92200000 \SystemRoot\system32\drivers\umbus.sys
0x9860E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x98652000 \SystemRoot\system32\drivers\nvhda32v.sys
0x98665000 \SystemRoot\system32\drivers\portcls.sys
0x98694000 \SystemRoot\system32\drivers\drmk.sys
0x99224000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x994FA000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x9950B000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8FE0E000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x99518000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x9AF00000 \SystemRoot\System32\win32k.sys
0x99529000 \SystemRoot\System32\drivers\Dxapi.sys
0x99533000 \SystemRoot\system32\DRIVERS\monitor.sys
0x9953E000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x99555000 \SystemRoot\System32\Drivers\usbvideo.sys
0x9B160000 \SystemRoot\System32\TSDDD.dll
0x9B190000 \SystemRoot\System32\cdd.dll
0x99579000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0x9957F000 \SystemRoot\system32\drivers\hidusb.sys
0x9958A000 \SystemRoot\system32\drivers\HIDCLASS.SYS
0x9959D000 \SystemRoot\system32\drivers\HIDPARSE.SYS
0x995A4000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x995AC000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x995B7000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x995BF000 \SystemRoot\system32\drivers\btusbflt.sys
0x995C9000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x986AD000 \SystemRoot\System32\Drivers\bthport.sys
0x995DB000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x99200000 \SystemRoot\system32\drivers\BthEnum.sys
0x98711000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x9872C000 \SystemRoot\system32\drivers\btwavdt.sys
0x8281D000 \SystemRoot\system32\drivers\btwaudio.sys
0x8289E000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
0x828A9000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x828AC000 \SystemRoot\system32\drivers\luafv.sys
0x828C7000 \SystemRoot\system32\drivers\WudfPf.sys
0x828E1000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x828F1000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x82937000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x82947000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x8295A000 \SystemRoot\system32\DRIVERS\TurboB.sys
0x82961000 \SystemRoot\system32\drivers\HTTP.sys
0x829E6000 \SystemRoot\system32\DRIVERS\bowser.sys
0x82800000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9879F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x987C2000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x917D1000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA1C29000 \SystemRoot\system32\drivers\peauth.sys
0xA1CC0000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA1CCA000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA1CEB000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA1CF8000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA1D48000 \SystemRoot\System32\DRIVERS\srv.sys
0xA1D9A000 \??\C:\windows\system32\drivers\mbam.sys
0xAC215000 \SystemRoot\system32\drivers\spsys.sys
0x772F0000 \Windows\System32\ntdll.dll
0x47B70000 \Windows\System32\smss.exe
0x77530000 \Windows\System32\apisetschema.dll
0x00DF0000 \Windows\System32\autochk.exe
0x771E0000 \Windows\System32\urlmon.dll
0x77490000 \Windows\System32\oleaut32.dll
0x77480000 \Windows\System32\psapi.dll
0x77470000 \Windows\System32\normaliz.dll
0x77140000 \Windows\System32\advapi32.dll
0x77070000 \Windows\System32\msctf.dll
0x76F10000 \Windows\System32\ole32.dll
0x76E30000 \Windows\System32\kernel32.dll
0x76C90000 \Windows\System32\setupapi.dll
0x77450000 \Windows\System32\sechost.dll
0x77440000 \Windows\System32\lpk.dll
0x76C30000 \Windows\System32\shlwapi.dll
0x76B90000 \Windows\System32\usp10.dll
0x75F40000 \Windows\System32\shell32.dll
0x75EC0000 \Windows\System32\comdlg32.dll
0x75E90000 \Windows\System32\imagehlp.dll
0x75D70000 \Windows\System32\wininet.dll
0x75D20000 \Windows\System32\Wldap32.dll
0x75B60000 \Windows\System32\iertutil.dll
0x75B10000 \Windows\System32\gdi32.dll
0x75A40000 \Windows\System32\user32.dll
0x759E0000 \Windows\System32\difxapi.dll
0x75930000 \Windows\System32\msvcrt.dll
0x75910000 \Windows\System32\imm32.dll
0x75880000 \Windows\System32\clbcatq.dll
0x757D0000 \Windows\System32\rpcrt4.dll
0x75790000 \Windows\System32\ws2_32.dll
0x77430000 \Windows\System32\nsi.dll
0x75700000 \Windows\System32\comctl32.dll

Processes (total 68):
0 System Idle Process
4 System
312 C:\Windows\System32\smss.exe
456 csrss.exe
516 C:\Windows\System32\wininit.exe
528 csrss.exe
580 C:\Windows\System32\services.exe
592 C:\Windows\System32\lsass.exe
600 C:\Windows\System32\lsm.exe
664 C:\Windows\System32\winlogon.exe
764 C:\Windows\System32\svchost.exe
824 C:\Windows\System32\nvvsvc.exe
864 C:\Windows\System32\svchost.exe
960 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\svchost.exe
1024 C:\Windows\System32\svchost.exe
1104 C:\Windows\System32\audiodg.exe
1148 C:\Windows\System32\svchost.exe
1328 C:\Windows\System32\nvvsvc.exe
1360 C:\Windows\System32\spoolsv.exe
1388 C:\Windows\System32\svchost.exe
1424 C:\Windows\System32\taskeng.exe
1552 C:\Windows\System32\svchost.exe
1596 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
1624 C:\Windows\System32\svchost.exe
1716 C:\Program Files\Canon\IJPLM\ijplmsvc.exe
1776 C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
1964 C:\Windows\System32\taskeng.exe
1980 C:\Windows\System32\taskhost.exe
344 C:\Windows\System32\dwm.exe
464 C:\Windows\explorer.exe
596 C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
936 C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
1184 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
1168 C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
1220 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
2168 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2212 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
2268 C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
2400 C:\Windows\System32\Rezip.exe
2432 C:\Program Files\CyberLink\Shared files\RichVideo.exe
2476 C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
2496 C:\Windows\System32\svchost.exe
2968 C:\Windows\servicing\TrustedInstaller.exe
3000 C:\Windows\System32\svchost.exe
3068 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
3320 C:\Windows\System32\SearchIndexer.exe
3636 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
3668 C:\Program Files\Unlocker\UnlockerAssistant.exe
3684 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
3760 C:\Windows\System32\svchost.exe
2072 C:\Program Files\Windows Media Player\wmpnetwk.exe
1884 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
3168 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
3100 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3364 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
3352 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
3020 C:\Program Files\Logitech\SetPoint\SetPoint.exe
3656 C:\Program Files\OpenOffice.org 3\program\soffice.exe
3776 C:\Program Files\OpenOffice.org 3\program\soffice.bin
1868 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
3344 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
3988 WmiPrvSE.exe
5276 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
5336 C:\Windows\System32\sppsvc.exe
5372 C:\Windows\System32\svchost.exe
3732 C:\Users\corleone\Desktop\MBRCheck.exe
2064 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`c6500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000003c`1b700000 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHM500JI, Rev: 2AC101C4

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

Sombra 30.06.2011 09:43
GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-30 10:12:07
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AC1
Running: 5ndlc2y3.exe; Driver: C:\Users\corleone\AppData\Local\Temp\fxldapow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                                                    8365A339 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                          83693D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User code sections - GMER 1.0.15 ----

.text          C:\windows\Explorer.EXE[296] SHELL32.dll!SHFileOperationW                                        764196F6 5 Bytes  JMP 10001102 C:\Program Files\Unlocker\UnlockerHook.dll

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                          fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                          rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000081                                                                  bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\ACPI_HAL \Device\0000004b                                                                halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\0000007f                                                                  bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f652                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6864                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6982                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b482fe37d72b                     
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f652 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6864 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6982 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b482fe37d72b (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 30.06.2011 10:17
Aber auf jeden Fall haben wir den MBR glattgezogen. Das hätte ich auch gemacht, wenn das Problem nicht bestünde.

Hast du rein zufällig einen Router? Wenn ja wurde da das Adminpasswort geändert?
Wenn nicht, setz diesen Router auf Werkseinstellungen zurück und konfiguriere ihn neu. Wichtig ist, dass du das unsichere vordefinierte Adminkennwort zum Router änderst!

Sombra 30.06.2011 21:09
Hey, ich merke gerade dass Google wieder einwandfrei funktioniert. Ich weiß nicht ob das so bleibt, aber danke jedenfalls für deine Zeit & Mühe. :daumenhoc

Falls ich wieder ein Problem haben sollte: Würde es Sinn machen beim nächsten mal sofort MBR und Gmer-logs zu erstellen und den Rest (Defogger, OTL, Combofix) zu lassen?

cosinus 30.06.2011 21:14
Und was habich gesagt? :pfeiff:

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Sombra 05.07.2011 19:51
Tja, zu früh gefreut. Google lahmt wie eh und je.

Ich werde Malwarebytes und Superspyware mal bei Gelegenheit drüber laufen lassen. Aber ich brauche langsam mal eine Lösung und keine 1000 Schritte, die zu nichts und wieder nichts führen. Was soll so ein Quatsch?
Entweder man kennt die Lösung des Problems oder nicht.

cosinus 06.07.2011 11:06
Zitat:
Aber ich brauche langsam mal eine Lösung und keine 1000 Schritte, die zu nichts und wieder nichts führen. Was soll so ein Quatsch?
Mal langsam. Solche arroganten Forderungen sind bei einer Bereinigung völlig fehl am Platze. Solche aggressiven Forderungen kannst du stellen, wenn du einen Vor-Service bezahlt hast. Aber nicht hier :stirn:
Immerhin lief ja auch für eine Woche wieder alles wenn ich das hier vom Datum der Postings her sehe.

Zitat:
Entweder man kennt die Lösung des Problems oder nicht.
Was für ein hanebüchener Unsinn. Wenn du mir zeigst, wie man eine :glaskugel: bezieht und bedient dann könnte man sofort sagen ich kenn die Lösung :pfeiff: - offenbar ist dir die Komplexität eines Computeres und einenes modernen Betriebssystems völlig unbekannt.

Außerdem hast du nicht mal erwähnt ob du einen Router hast und in welcher Konfig der ist. Trägt auch nicht dazu bei, dass man dir schneller helfen kann.

Sombra 06.07.2011 12:41
Pahaha, bezahlen soll ich auch noch?

Es lieft nicht für eine Woche. Am nächsten Tag wars schon wieder langsam, ich wollte nur etwas abwarten um zu sehen ob es auch bleibt.

Hab keinen Router. Ein normales W-Lan von Siemens. Über diesen laufen im Hause zwei weitere Computer, bei denen Google einwandfrei funktioniert.

cosinus 06.07.2011 12:48
Zitat:
Pahaha, bezahlen soll ich auch noch?
Mit dem Lesen + Verstehen haperts auch bei dir? :stirn:

Zitat:
Hab keinen Router. Ein normales W-Lan von Siemens.
Jaja, welches Gerät willst du natürlich nicht verraten. Mit Sicherheit verbirgt sich ein Router dahinter, nur sehr speziell/exotische Hardware von Alice hab ich mal gesehen, wo es tatsächlich kein Router war.

Sombra 07.07.2011 10:43
Ok, ESET hat nun 8 Infektionen gefunden und gelöscht.

Google funktioniert derzeit wieder uneingeschränkt. Mal abwarten ob es so bleibt.

Vielleicht war Google davon betroffen, weil ich es als Startseite benutze.

cosinus 07.07.2011 11:05
Was hat ESET genau gefunden, wrum postest du das Log nicht?
Warum verrätst du nicht das Modell des Routers/WLAN-AP von Siemens?

Auf der einen Seite forderst du schnelle Hilfe ohne "1000 Schritte" (was so schonmal blödsinn ist, da man wie gesagt Computerprobleme dieser Art erstmal analysieren muss und nicht durch hellseherische Kräfte in 2-3 Klicks beheben kann) auf der anderen Seite aber lässt du die benötigten Infos weg. :balla:

Sombra 07.07.2011 12:36
Ich kenne das Modell doch gar nicht, müsste erstmal nachsehen. Aber das ist nicht nötig weil das Problem gelöst zu sein scheint. Ich meine 8 Infektion sind schon ein was. Auf meiner enormen Windows Erfahrung basierend, würde ich sagen dass dies das Problem war ;)

Allerdings hatte ich tatsächlich noch nie den Unterschied zwischen eines üblichen System Scans und eines Online-Scans. Ist ESET das einzige Programm, das sowas zustande bringt? Falls ja, sollte das geändert werden. Für Leute, die viel Google nutzen und als Startseite haben (so ich ich) ist das schon ein großes Problem.

Hier der Log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=489878550990df4592daeca3ddde42f8
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-06 05:02:56
# local_time=2011-07-06 07:02:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=768 16777215 100 0 27822102 27822102 0 0
# compatibility_mode=5893 16776573 100 94 111675 61597318 0 0
# compatibility_mode=8192 67108863 100 0 630 630 0 0
# scanned=175501
# found=13
# cleaned=13
# scan_time=5649
C:\Program Files\VideoConverter\VideoConverter.exe a variant of Win32/InstallCore.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\corleone\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\2a13cdc1-1a7dc4fb a variant of Java/TrojanDownloader.OpenStream.NBF trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\corleone\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\52a32a53-217d38f6 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\corleone\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\68ca72e3-11727b26 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\corleone\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\342a1d2a-6fa2718d multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\corleone\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\ec1fe70-1e387eb5 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\corleone\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\6f4d4735-309a5af8 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Windows\System32\UIAuuomationCore.dll a variant of Win32/Spy.Agent.NTN trojan (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
D:\PC-3000\Backup Set 2010-11-28 190003\Backup Files 2011-01-23 202142\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
D:\PC-3000\Backup Set 2010-11-28 190003\Backup Files 2011-01-30 190003\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
D:\PC-3000\Backup Set 2010-11-28 190003\Backup Files 2011-02-13 190003\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
D:\PC-3000\Backup Set 2011-02-20 191817\Backup Files 2011-02-27 201139\Backup files 2.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
D:\PC-3000\Backup Set 2011-05-22 202408\Backup Files 2011-05-22 202408\Backup files 7.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

cosinus 07.07.2011 22:00
Zitat:
C:\Windows\System32\UIAuuomationCore.dll
Hm, wenn dann wohl am ehesten diese Datei.
Kannst du sie mal aus der Quarantäne holen und sie bei uns hochladen? => http://www.trojaner-board.de/54791-a...ner-board.html

Sombra 09.07.2011 08:46
^ Sind mir anscheinend abhanden gekommen, weil der Quaräntene Ordner leer ist.
Nach dem Scan war das Programm auch nicht mehr auf dem Desktop zu sehen. Ich muss erst bei Suche "Eset" eingeben, um die Dateien im Datenträger (C: ) einzusehen. Wenn ich dann auf Quaräntene klicke, ist alles leer.

Übrigens gibt es auf im UploadChannel keine Anleitung für Windows 7.

cosinus 10.07.2011 18:39
Zitat:
Übrigens gibt es auf im UploadChannel keine Anleitung für Windows 7
Warum wohl :lach:
Der Uploadchannel wird über den Browser bedient, was hat das mit Windows7 zu tun?


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:57 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129