Trojaner-Board
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner:Backdoor.Win32.SdBot.nci von Kaspersky gefunden. (https://www.trojaner-board.de/100883-trojaner-backdoor-win32-sdbot-nci-kaspersky-gefunden.html)

Maurice 03.07.2011 18:00
Zitat:
30.06.2011 16:51:34 Kaspersky Internet Security Schutz-Center Gefunden: Backdoor.Win32.SdBot.nci K:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013scsaver.exe

Das ist der einzigste der noch drauf ist. Sonst findet Kaspersky nichts mehr.
Was sollte denn noch relevant sein? Das ist der einzigste Fund.

cosinus 03.07.2011 18:30
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Elf 1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2856415&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
[2010.05.25 16:30:31 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Maurice\AppData\Roaming\mozilla\Firefox\Profiles\3ctj3o27.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.10 22:22:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.03.20 13:22:34 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
O4 - HKCU..\Run: [msnmsgr]  File not found
O4 - HKCU..\Run: [Pando Media Booster]  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
:Files
K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Maurice 03.07.2011 18:41
Zitat:
========== OTL ==========
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Elf 1 Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2856415&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: true removed from browser.search.useDBForOrder
C:\Users\Maurice\AppData\Roaming\mozilla\Firefox\Profiles\3ctj3o27.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\Maurice\AppData\Roaming\mozilla\Firefox\Profiles\3ctj3o27.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\skin folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\locale\en folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\locale\de folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\locale folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\content folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\skin folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\locale\en folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\locale\de folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\locale folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\content folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru folder moved successfully.
C:\Programme\Mozilla Firefox\extensions folder moved successfully.
Folder C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
========== FILES ==========
File\Folder K:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.24.2 log created on 07032011_193835
OKay, was kommt als nächstes?

cosinus 03.07.2011 18:47
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Maurice 03.07.2011 18:59
Zitat:
2011/07/03 19:57:08.0753 1808 TDSS rootkit removing tool 2.5.8.0 Jun 28 2011 19:12:16
2011/07/03 19:57:09.0065 1808 ================================================================================
2011/07/03 19:57:09.0065 1808 SystemInfo:
2011/07/03 19:57:09.0065 1808
2011/07/03 19:57:09.0065 1808 OS Version: 6.1.7601 ServicePack: 1.0
2011/07/03 19:57:09.0065 1808 Product type: Workstation
2011/07/03 19:57:09.0065 1808 ComputerName: MAURICE-PC
2011/07/03 19:57:09.0065 1808 UserName: Maurice
2011/07/03 19:57:09.0065 1808 Windows directory: C:\Windows
2011/07/03 19:57:09.0065 1808 System windows directory: C:\Windows
2011/07/03 19:57:09.0065 1808 Processor architecture: Intel x86
2011/07/03 19:57:09.0065 1808 Number of processors: 4
2011/07/03 19:57:09.0065 1808 Page size: 0x1000
2011/07/03 19:57:09.0065 1808 Boot type: Normal boot
2011/07/03 19:57:09.0065 1808 ================================================================================
2011/07/03 19:57:12.0466 1808 Initialize success
2011/07/03 19:57:17.0614 3576 ================================================================================
2011/07/03 19:57:17.0614 3576 Scan started
2011/07/03 19:57:17.0614 3576 Mode: Manual;
2011/07/03 19:57:17.0614 3576 ================================================================================
2011/07/03 19:57:20.0468 3576 1394ohci (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
2011/07/03 19:57:20.0531 3576 ACPI (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
2011/07/03 19:57:20.0562 3576 AcpiPmi (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
2011/07/03 19:57:20.0671 3576 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/07/03 19:57:20.0874 3576 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/07/03 19:57:20.0968 3576 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/07/03 19:57:21.0077 3576 AFD (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
2011/07/03 19:57:21.0139 3576 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
2011/07/03 19:57:21.0280 3576 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/07/03 19:57:21.0404 3576 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
2011/07/03 19:57:21.0482 3576 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
2011/07/03 19:57:21.0545 3576 amdide (211fce336502911ec03fc15a91344c98) C:\Windows\system32\DRIVERS\amdide.sys
2011/07/03 19:57:21.0607 3576 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/07/03 19:57:21.0794 3576 amdkmdag (c22bdfcbed2596692096f85a9bf54358) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/07/03 19:57:22.0060 3576 amdkmdap (cc6a16ce23dbc94a59f8e821558d5754) C:\Windows\system32\DRIVERS\atikmpag.sys
2011/07/03 19:57:22.0122 3576 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/07/03 19:57:22.0153 3576 amdsata (6f64c768a9a48fab7c6d6cee1b30f97f) C:\Windows\system32\DRIVERS\amdsata.sys
2011/07/03 19:57:22.0184 3576 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/07/03 19:57:22.0262 3576 amdxata (e27866684780606bcce640a57937d88a) C:\Windows\system32\DRIVERS\amdxata.sys
2011/07/03 19:57:22.0340 3576 AppID (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
2011/07/03 19:57:22.0418 3576 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/07/03 19:57:22.0496 3576 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/07/03 19:57:22.0559 3576 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/07/03 19:57:22.0637 3576 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
2011/07/03 19:57:22.0699 3576 AtiHdmiService (c822c615b2f693ef4e5b355432976a81) C:\Windows\system32\drivers\AtiHdmi.sys
2011/07/03 19:57:22.0777 3576 AtiPcie (b73c832088dd54b55e04ff6f9646ad8c) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/07/03 19:57:22.0855 3576 atksgt (6e996cf8459a2594e0e9609d0e34d41f) C:\Windows\system32\DRIVERS\atksgt.sys
2011/07/03 19:57:22.0964 3576 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/07/03 19:57:23.0089 3576 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/07/03 19:57:23.0152 3576 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/07/03 19:57:23.0214 3576 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/07/03 19:57:23.0354 3576 bowser (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
2011/07/03 19:57:23.0448 3576 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/07/03 19:57:23.0526 3576 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/07/03 19:57:23.0651 3576 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/07/03 19:57:23.0760 3576 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/07/03 19:57:23.0854 3576 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/07/03 19:57:23.0916 3576 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/07/03 19:57:23.0978 3576 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/07/03 19:57:24.0056 3576 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/07/03 19:57:24.0197 3576 cdrom (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
2011/07/03 19:57:24.0290 3576 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/07/03 19:57:24.0337 3576 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/07/03 19:57:24.0415 3576 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/07/03 19:57:24.0493 3576 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
2011/07/03 19:57:24.0571 3576 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/07/03 19:57:24.0649 3576 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/07/03 19:57:24.0712 3576 CompositeBus (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
2011/07/03 19:57:24.0805 3576 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/07/03 19:57:24.0930 3576 DfsC (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
2011/07/03 19:57:25.0024 3576 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/07/03 19:57:25.0102 3576 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/07/03 19:57:25.0180 3576 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/07/03 19:57:25.0304 3576 DXGKrnl (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
2011/07/03 19:57:25.0648 3576 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/07/03 19:57:25.0897 3576 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/07/03 19:57:26.0038 3576 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
2011/07/03 19:57:26.0162 3576 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/07/03 19:57:26.0256 3576 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/07/03 19:57:26.0334 3576 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/07/03 19:57:26.0412 3576 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/07/03 19:57:26.0474 3576 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/07/03 19:57:26.0537 3576 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/07/03 19:57:26.0615 3576 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/07/03 19:57:26.0677 3576 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/07/03 19:57:26.0740 3576 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/07/03 19:57:26.0802 3576 fvevol (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
2011/07/03 19:57:26.0864 3576 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/07/03 19:57:27.0005 3576 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/07/03 19:57:27.0083 3576 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/07/03 19:57:27.0192 3576 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2011/07/03 19:57:27.0332 3576 HDAudBus (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
2011/07/03 19:57:27.0348 3576 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/07/03 19:57:27.0410 3576 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/07/03 19:57:27.0504 3576 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/07/03 19:57:27.0582 3576 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\drivers\hidusb.sys
2011/07/03 19:57:27.0644 3576 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
2011/07/03 19:57:27.0738 3576 HTCAND32 (950cc1e6ae3a6cd23e0945cde089b02c) C:\Windows\system32\Drivers\ANDROIDUSB.sys
2011/07/03 19:57:27.0832 3576 htcnprot (339adefad60353f960e3ca67ce468c24) C:\Windows\system32\DRIVERS\htcnprot.sys
2011/07/03 19:57:27.0894 3576 HTTP (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
2011/07/03 19:57:27.0956 3576 hwpolicy (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
2011/07/03 19:57:28.0019 3576 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
2011/07/03 19:57:28.0112 3576 iaStorV (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
2011/07/03 19:57:28.0222 3576 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/07/03 19:57:28.0378 3576 IntcAzAudAddService (97fa95e4f486f37d60ad3744d86f3d7e) C:\Windows\system32\drivers\RTKVHDA.sys
2011/07/03 19:57:28.0627 3576 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
2011/07/03 19:57:28.0690 3576 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/07/03 19:57:28.0752 3576 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/07/03 19:57:28.0814 3576 IPMIDRV (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
2011/07/03 19:57:28.0970 3576 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/07/03 19:57:29.0017 3576 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/07/03 19:57:29.0080 3576 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
2011/07/03 19:57:29.0142 3576 iScsiPrt (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
2011/07/03 19:57:29.0360 3576 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
2011/07/03 19:57:29.0470 3576 kbdhid (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
2011/07/03 19:57:29.0579 3576 kl1 (47f4320cff5bd3de472bb300a32a879e) C:\Windows\system32\DRIVERS\kl1.sys
2011/07/03 19:57:29.0657 3576 kl2 (0e29fe31bd4c72412ad99253e71b25c1) C:\Windows\system32\DRIVERS\kl2.sys
2011/07/03 19:57:29.0860 3576 KLIF (0fa77171e66d1f6887b02e9f9afe3523) C:\Windows\system32\DRIVERS\klif.sys
2011/07/03 19:57:29.0938 3576 KLIM6 (cf88b4985d957eee45c9939092e87c92) C:\Windows\system32\DRIVERS\klim6.sys
2011/07/03 19:57:30.0016 3576 klmouflt (3de1771c135328420315e21dde229bba) C:\Windows\system32\DRIVERS\klmouflt.sys
2011/07/03 19:57:30.0094 3576 KSecDD (412cea1aa78cc02a447f5c9e62b32ff1) C:\Windows\system32\Drivers\ksecdd.sys
2011/07/03 19:57:30.0156 3576 KSecPkg (26c046977e85b95036453d7b88ba1820) C:\Windows\system32\Drivers\ksecpkg.sys
2011/07/03 19:57:30.0296 3576 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
2011/07/03 19:57:30.0374 3576 Lbd (336abe8721cbc3110f1c6426da633417) C:\Windows\system32\DRIVERS\Lbd.sys
2011/07/03 19:57:30.0515 3576 lirsgt (975b6cf65f44e95883f3855bae8cecaf) C:\Windows\system32\DRIVERS\lirsgt.sys
2011/07/03 19:57:30.0842 3576 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/07/03 19:57:30.0983 3576 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/07/03 19:57:31.0061 3576 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/07/03 19:57:31.0139 3576 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/07/03 19:57:31.0201 3576 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/07/03 19:57:31.0295 3576 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/07/03 19:57:31.0404 3576 lvpopflt (cbf0bf6af73a704211bbb52efacaa8a0) C:\Windows\system32\DRIVERS\lvpopflt.sys
2011/07/03 19:57:31.0513 3576 LVPr2Mon (8be71d7edb8c7494913722059f760dd0) C:\Windows\system32\Drivers\LVPr2Mon.sys
2011/07/03 19:57:31.0638 3576 LVRS (b6e1ccd6572984adcae68439afd07011) C:\Windows\system32\DRIVERS\lvrs.sys
2011/07/03 19:57:31.0825 3576 LVUVC (6c42815dd57e397f0cd988304b5eb4b3) C:\Windows\system32\DRIVERS\lvuvc.sys
2011/07/03 19:57:32.0106 3576 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\Windows\system32\drivers\mbam.sys
2011/07/03 19:57:32.0200 3576 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/07/03 19:57:32.0262 3576 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/07/03 19:57:32.0324 3576 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/07/03 19:57:32.0402 3576 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/07/03 19:57:32.0434 3576 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
2011/07/03 19:57:32.0527 3576 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/07/03 19:57:32.0574 3576 mountmgr (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
2011/07/03 19:57:32.0636 3576 mpio (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
2011/07/03 19:57:32.0746 3576 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/07/03 19:57:32.0808 3576 MRxDAV (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
2011/07/03 19:57:32.0870 3576 mrxsmb (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/07/03 19:57:32.0933 3576 mrxsmb10 (a70c828a93cce4c11617f6249f4d87fc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/07/03 19:57:33.0011 3576 mrxsmb20 (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/07/03 19:57:33.0073 3576 msahci (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
2011/07/03 19:57:33.0136 3576 msdsm (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
2011/07/03 19:57:33.0229 3576 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/07/03 19:57:33.0307 3576 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/07/03 19:57:33.0354 3576 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
2011/07/03 19:57:33.0432 3576 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/07/03 19:57:33.0510 3576 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/07/03 19:57:33.0557 3576 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/07/03 19:57:33.0635 3576 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/07/03 19:57:33.0744 3576 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
2011/07/03 19:57:33.0760 3576 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/07/03 19:57:33.0838 3576 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/07/03 19:57:33.0916 3576 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/07/03 19:57:33.0978 3576 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2011/07/03 19:57:34.0072 3576 NDIS (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
2011/07/03 19:57:34.0103 3576 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/07/03 19:57:34.0150 3576 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/07/03 19:57:34.0212 3576 Ndisuio (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/07/03 19:57:34.0306 3576 NdisWan (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/07/03 19:57:34.0352 3576 NDProxy (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
2011/07/03 19:57:34.0399 3576 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2011/07/03 19:57:34.0477 3576 NetBT (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
2011/07/03 19:57:34.0555 3576 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/07/03 19:57:34.0649 3576 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/07/03 19:57:34.0711 3576 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2011/07/03 19:57:34.0805 3576 Ntfs (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
2011/07/03 19:57:34.0992 3576 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/07/03 19:57:35.0070 3576 nvraid (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
2011/07/03 19:57:35.0179 3576 nvstor (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
2011/07/03 19:57:35.0351 3576 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
2011/07/03 19:57:35.0460 3576 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
2011/07/03 19:57:35.0554 3576 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/07/03 19:57:35.0632 3576 partmgr (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
2011/07/03 19:57:35.0694 3576 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/07/03 19:57:35.0788 3576 pci (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
2011/07/03 19:57:35.0819 3576 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
2011/07/03 19:57:35.0990 3576 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/07/03 19:57:36.0084 3576 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/07/03 19:57:36.0178 3576 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/07/03 19:57:36.0380 3576 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2011/07/03 19:57:36.0443 3576 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/07/03 19:57:36.0599 3576 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/07/03 19:57:36.0724 3576 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/07/03 19:57:36.0958 3576 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/07/03 19:57:37.0082 3576 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/07/03 19:57:37.0145 3576 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2011/07/03 19:57:37.0192 3576 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/07/03 19:57:37.0223 3576 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/07/03 19:57:37.0316 3576 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/07/03 19:57:37.0410 3576 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2011/07/03 19:57:37.0441 3576 rdbss (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
2011/07/03 19:57:37.0504 3576 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/07/03 19:57:37.0566 3576 RDPCDD (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/07/03 19:57:37.0628 3576 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2011/07/03 19:57:37.0675 3576 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2011/07/03 19:57:37.0753 3576 RDPWD (288b06960d78428ff89e811632684e20) C:\Windows\system32\drivers\RDPWD.sys
2011/07/03 19:57:37.0831 3576 rdyboost (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
2011/07/03 19:57:37.0909 3576 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2011/07/03 19:57:37.0987 3576 RTL8167 (e099d23ee1bbce0cf5745f811f3b1882) C:\Windows\system32\DRIVERS\Rt86win7.sys
2011/07/03 19:57:38.0065 3576 RTL8192su (9ce8deffaffccbf473015d76ae8ee514) C:\Windows\system32\DRIVERS\RTL8192su.sys
2011/07/03 19:57:38.0174 3576 sbp2port (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
2011/07/03 19:57:38.0284 3576 scfilter (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
2011/07/03 19:57:38.0377 3576 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/07/03 19:57:38.0455 3576 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/07/03 19:57:38.0518 3576 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/07/03 19:57:38.0596 3576 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/07/03 19:57:38.0689 3576 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
2011/07/03 19:57:38.0783 3576 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
2011/07/03 19:57:38.0908 3576 sffp_sd (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
2011/07/03 19:57:39.0001 3576 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/07/03 19:57:39.0110 3576 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
2011/07/03 19:57:39.0220 3576 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/07/03 19:57:39.0360 3576 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/07/03 19:57:39.0469 3576 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/07/03 19:57:39.0578 3576 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/07/03 19:57:39.0672 3576 srv (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
2011/07/03 19:57:39.0734 3576 srv2 (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
2011/07/03 19:57:39.0812 3576 srvnet (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
2011/07/03 19:57:39.0875 3576 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/07/03 19:57:39.0968 3576 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
2011/07/03 19:57:40.0171 3576 Tcpip (24326784df8f3d5f5bbb9f878ce33c14) C:\Windows\system32\drivers\tcpip.sys
2011/07/03 19:57:40.0312 3576 TCPIP6 (24326784df8f3d5f5bbb9f878ce33c14) C:\Windows\system32\DRIVERS\tcpip.sys
2011/07/03 19:57:40.0343 3576 tcpipreg (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/07/03 19:57:40.0421 3576 TDPIPE (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
2011/07/03 19:57:40.0483 3576 TDTCP (2c10395baa4847f83042813c515cc289) C:\Windows\system32\drivers\tdtcp.sys
2011/07/03 19:57:40.0546 3576 tdx (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
2011/07/03 19:57:40.0608 3576 TermDD (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
2011/07/03 19:57:40.0702 3576 tssecsrv (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/07/03 19:57:40.0811 3576 TsUsbFlt (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
2011/07/03 19:57:40.0873 3576 tunnel (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
2011/07/03 19:57:40.0936 3576 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/07/03 19:57:41.0123 3576 udfs (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
2011/07/03 19:57:41.0450 3576 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
2011/07/03 19:57:41.0528 3576 umbus (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
2011/07/03 19:57:41.0606 3576 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/07/03 19:57:41.0700 3576 USBAAPL (d4fb6ecc60a428564ba8768b0e23c0fc) C:\Windows\system32\Drivers\usbaapl.sys
2011/07/03 19:57:41.0794 3576 usbaudio (1d9f2bd026e8e2d45033a4df3f16b78c) C:\Windows\system32\drivers\usbaudio.sys
2011/07/03 19:57:41.0856 3576 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/07/03 19:57:41.0934 3576 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
2011/07/03 19:57:42.0028 3576 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
2011/07/03 19:57:42.0106 3576 usbfilter (e5b14557793164db879ee56f5b59c3e2) C:\Windows\system32\DRIVERS\usbfilter.sys
2011/07/03 19:57:42.0184 3576 usbhub (9d22aad9ac6a07c691a1113e5f860868) C:\Windows\system32\drivers\usbhub.sys
2011/07/03 19:57:42.0277 3576 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2011/07/03 19:57:42.0355 3576 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/07/03 19:57:42.0418 3576 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
2011/07/03 19:57:42.0480 3576 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/07/03 19:57:42.0496 3576 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/07/03 19:57:42.0574 3576 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
2011/07/03 19:57:42.0667 3576 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/07/03 19:57:42.0714 3576 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/07/03 19:57:42.0792 3576 vhdmp (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
2011/07/03 19:57:42.0870 3576 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
2011/07/03 19:57:42.0948 3576 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/07/03 19:57:43.0010 3576 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
2011/07/03 19:57:43.0073 3576 volmgr (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
2011/07/03 19:57:43.0166 3576 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/07/03 19:57:43.0291 3576 volsnap (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
2011/07/03 19:57:43.0432 3576 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/07/03 19:57:43.0556 3576 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
2011/07/03 19:57:43.0619 3576 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
2011/07/03 19:57:43.0697 3576 vwifimp (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys
2011/07/03 19:57:43.0728 3576 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/07/03 19:57:43.0790 3576 WANARP (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/03 19:57:43.0884 3576 Wanarpv6 (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/03 19:57:43.0915 3576 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/07/03 19:57:43.0978 3576 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/07/03 19:57:44.0071 3576 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/07/03 19:57:44.0134 3576 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/07/03 19:57:44.0227 3576 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
2011/07/03 19:57:44.0305 3576 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/07/03 19:57:44.0399 3576 WudfPf (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
2011/07/03 19:57:44.0461 3576 WUDFRd (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/07/03 19:57:44.0555 3576 MBR (0x1B8) (4624822e540ec83cd0819525c65846ba) \Device\Harddisk0\DR0
2011/07/03 19:57:44.0602 3576 Boot (0x1200) (0adcd0eb588d44bd4c70cae75e35b383) \Device\Harddisk0\DR0\Partition0
2011/07/03 19:57:44.0633 3576 Boot (0x1200) (878bbda660f8b2d3971c9bff9ee7c850) \Device\Harddisk0\DR0\Partition1
2011/07/03 19:57:44.0648 3576 Boot (0x1200) (e3d44a51b61605b1fb6375050a87cc54) \Device\Harddisk0\DR0\Partition2
2011/07/03 19:57:44.0648 3576 ================================================================================
2011/07/03 19:57:44.0648 3576 Scan finished
2011/07/03 19:57:44.0648 3576 ================================================================================
2011/07/03 19:57:44.0664 3476 Detected object count: 0
2011/07/03 19:57:44.0664 3476 Actual detected object count: 0
Das wäre gemacht. Und was kommt jetzt?

cosinus 03.07.2011 20:20
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Maurice 03.07.2011 21:18
Combofix Logfile:
Code:
ComboFix 11-07-02.03 - Maurice 03.07.2011  22:05:24.1.4 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3326.2009 [GMT 2:00]
ausgeführt von:: c:\users\Maurice\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
AV: Lavasoft Ad-Watch Live! Virenschutz *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Maurice\AppData\Local\Microsoft\Windows\Temporary Internet Files\PMH3729.tmp
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-06-03 bis 2011-07-03  ))))))))))))))))))))))))))))))
.
.
2011-07-03 20:12 . 2011-07-03 20:13        --------        d-----w-        c:\users\Maurice\AppData\Local\temp
2011-07-03 20:12 . 2011-07-03 20:12        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-07-03 17:38 . 2011-07-03 17:38        --------        d-----w-        C:\_OTL
2011-07-02 21:33 . 2011-07-02 21:33        --------        d-----w-        c:\users\Maurice\AppData\Roaming\ArchiCrypt
2011-07-02 21:31 . 2011-07-02 21:31        --------        d-----w-        c:\program files\ArchiCrypt
2011-07-02 14:38 . 2011-06-07 15:55        7074640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{17612D2A-9584-483A-B491-0F5AD850AD3D}\mpengine.dll
2011-07-02 00:38 . 2011-07-01 18:22        16432        ----a-w-        c:\windows\system32\lsdelete.exe
2011-07-01 19:16 . 2011-07-01 19:16        --------        d-----w-        c:\programdata\EA Logs
2011-07-01 18:22 . 2011-07-01 18:22        101720        ----a-w-        c:\windows\system32\drivers\SBREDrv.sys
2011-07-01 18:18 . 2011-04-29 10:12        64512        ----a-w-        c:\windows\system32\drivers\Lbd.sys
2011-07-01 18:18 . 2011-07-01 18:18        --------        d-----w-        c:\programdata\Lavasoft
2011-07-01 18:18 . 2011-07-01 18:18        --------        d-----w-        c:\program files\Lavasoft
2011-07-01 17:46 . 2011-07-02 09:49        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2011-07-01 17:46 . 2011-07-01 17:46        --------        d-----w-        c:\program files\Spybot - Search & Destroy
2011-07-01 17:30 . 2006-06-19 11:01        69632        ----a-w-        c:\windows\system32\ztvcabinet.dll
2011-06-30 14:41 . 2011-06-30 14:41        --------        d-----w-        c:\program files\Common Files\xing shared
2011-06-30 10:11 . 2011-06-30 10:11        --------        d-----w-        c:\users\Maurice\AppData\Roaming\Malwarebytes
2011-06-30 10:11 . 2011-06-30 10:11        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-30 10:11 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-30 10:11 . 2011-06-30 10:11        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-06-30 10:11 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-29 10:58 . 2011-05-24 10:44        293376        ----a-w-        c:\windows\system32\umpnpmgr.dll
2011-06-29 10:57 . 2011-05-04 04:32        1401344        ----a-w-        c:\windows\system32\mssrch.dll
2011-06-29 10:57 . 2011-05-04 04:34        1549312        ----a-w-        c:\windows\system32\tquery.dll
2011-06-29 10:57 . 2011-05-04 04:32        337408        ----a-w-        c:\windows\system32\mssph.dll
2011-06-29 10:57 . 2011-05-04 04:28        427520        ----a-w-        c:\windows\system32\SearchIndexer.exe
2011-06-29 10:57 . 2011-05-04 04:28        164352        ----a-w-        c:\windows\system32\SearchProtocolHost.exe
2011-06-29 10:57 . 2011-05-04 04:32        666624        ----a-w-        c:\windows\system32\mssvp.dll
2011-06-29 10:57 . 2011-05-04 04:32        197120        ----a-w-        c:\windows\system32\mssphtb.dll
2011-06-29 10:57 . 2011-05-04 04:32        59392        ----a-w-        c:\windows\system32\msscntrs.dll
2011-06-29 10:57 . 2011-05-04 04:28        86528        ----a-w-        c:\windows\system32\SearchFilterHost.exe
2011-06-21 22:36 . 2011-06-21 22:36        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-21 22:36 . 2011-06-21 22:36        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-16 05:41 . 2011-04-25 15:29        141104        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 05:41 . 2011-04-22 23:25        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-06-16 05:41 . 2011-04-22 23:35        1797632        ----a-w-        c:\windows\system32\jscript9.dll
2011-06-16 05:04 . 2011-04-29 02:46        311808        ----a-w-        c:\windows\system32\drivers\srv.sys
2011-06-16 05:04 . 2011-04-29 02:46        310272        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-06-16 05:04 . 2011-04-29 02:46        114688        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-06-16 05:04 . 2011-04-25 04:31        1290624        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2011-06-16 05:04 . 2011-04-25 02:18        338944        ----a-w-        c:\windows\system32\drivers\afd.sys
2011-06-16 05:04 . 2011-02-25 05:34        571904        ----a-w-        c:\windows\system32\oleaut32.dll
2011-06-16 05:04 . 2011-05-03 04:30        741376        ----a-w-        c:\windows\system32\inetcomm.dll
2011-06-16 05:04 . 2011-04-27 02:17        223744        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 05:04 . 2011-04-27 02:17        96768        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 05:04 . 2011-04-27 02:17        123904        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2011-06-12 21:39 . 2011-06-29 19:38        --------        d-----w-        c:\program files\ICQ7.5
2011-06-10 20:22 . 2011-06-27 13:59        --------        d-----w-        c:\programdata\Skype Extras
2011-06-10 20:21 . 2011-06-10 20:21        --------        d-----w-        c:\program files\Common Files\Skype
2011-06-09 11:38 . 2011-06-09 11:38        --------        d-----w-        c:\program files\iPod
2011-06-09 11:38 . 2011-06-09 11:40        --------        d-----w-        c:\program files\iTunes
2011-06-07 10:35 . 2011-06-07 10:35        103864        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-30 14:40 . 2010-01-18 06:30        348160        ----a-w-        c:\windows\system32\msvcr71.dll
2011-06-30 14:40 . 2010-01-18 06:30        499712        ----a-w-        c:\windows\system32\msvcp71.dll
2011-06-19 19:01 . 2011-05-14 10:18        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-24 17:14 . 2010-01-26 14:37        222080        ------w-        c:\windows\system32\MpSigStub.exe
2011-05-18 20:47 . 2010-04-09 01:45        952        --sha-w-        c:\programdata\KGyGaAvL.sys
2011-04-22 19:14 . 2011-05-25 10:13        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-04-17 22:01 . 2011-04-17 22:01        53248        ----a-r-        c:\users\Maurice\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-04-15 11:18 . 2011-04-15 11:18        159080        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10138.bin
2011-04-10 15:48 . 2011-04-10 15:48        86528        ----a-w-        c:\windows\system32\iesysprep.dll
2011-04-10 15:48 . 2011-04-10 15:48        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2011-04-10 15:48 . 2011-04-10 15:48        63488        ----a-w-        c:\windows\system32\tdc.ocx
2011-04-10 15:48 . 2011-04-10 15:48        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2011-04-10 15:48 . 2011-04-10 15:48        367104        ----a-w-        c:\windows\system32\html.iec
2011-04-10 15:48 . 2011-04-10 15:48        161792        ----a-w-        c:\windows\system32\msls31.dll
2011-04-10 15:48 . 2011-04-10 15:48        1126912        ----a-w-        c:\windows\system32\wininet.dll
2011-04-10 15:48 . 2011-04-10 15:48        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll
2011-04-10 15:48 . 2011-04-10 15:48        74752        ----a-w-        c:\windows\system32\iesetup.dll
2011-04-10 15:48 . 2011-04-10 15:48        420864        ----a-w-        c:\windows\system32\vbscript.dll
2011-04-10 15:48 . 2011-04-10 15:48        35840        ----a-w-        c:\windows\system32\imgutil.dll
2011-04-10 15:48 . 2011-04-10 15:48        23552        ----a-w-        c:\windows\system32\licmgr10.dll
2011-04-10 15:48 . 2011-04-10 15:48        152064        ----a-w-        c:\windows\system32\wextract.exe
2011-04-10 15:48 . 2011-04-10 15:48        150528        ----a-w-        c:\windows\system32\iexpress.exe
2011-04-10 15:48 . 2011-04-10 15:48        142848        ----a-w-        c:\windows\system32\ieUnatt.exe
2011-04-10 15:48 . 2011-04-10 15:48        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl
2011-04-10 15:48 . 2011-04-10 15:48        11776        ----a-w-        c:\windows\system32\mshta.exe
2011-04-10 15:48 . 2011-04-10 15:48        101888        ----a-w-        c:\windows\system32\admparse.dll
2011-04-09 06:02 . 2011-05-11 20:21        3967872        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 20:21        3912576        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-17 09:49        123904        ----a-w-        c:\windows\system32\poqexec.exe
2011-04-06 14:20 . 2011-04-06 14:20        91424        ----a-w-        c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20        107808        ----a-w-        c:\windows\system32\dns-sd.exe
2011-06-21 22:36 . 2011-05-06 11:03        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Logitech Vid"="c:\program files\Logitech\Vid HD\Vid.exe" [2011-01-13 6129496]
"ICQ"="c:\program files\ICQ7.5\ICQ.exe" [2011-06-29 124216]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-03 8120864]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-05-07 344736]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-01 190808]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-01-27 585728]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-06-30 273544]
.
c:\users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-5-21 110592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~2\kloehk.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-05-26 19:50        15147400        ----a-r-        c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-05-06 132184]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-06-28 2151640]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-10-26 25088]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2010-06-23 23040]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2011-04-29 15232]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-12-16 3453712]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-04-29 64512]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-07 172032]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-02-03 1155072]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [2010-09-16 80896]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-04-07 5430272]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-07 157184]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-03-21 362600]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 47069977
*Deregistered* - 47069977
.
Inhalt des "geplante Tasks" Ordners
.
2011-07-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-04-29 11:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to Mp3 Converter - c:\users\Maurice\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Maurice\AppData\Roaming\Mozilla\Firefox\Profiles\3ctj3o27.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.mtb-news.de/news/2011/05/27/sonntag-29-mai-action-heroes-20h-live-bei-mtb-news-de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-BsScanner
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3481837660-1793344714-466227997-1000\Software\SecuROM\License information*]
"datasecu"=hex:77,d8,cc,77,c8,e6,93,70,7e,41,91,29,70,47,aa,f2,02,f2,55,1f,89,
  be,41,26,56,65,03,53,44,67,2a,d5,d9,a6,e7,b9,d6,29,4d,82,6b,a5,3d,4c,3e,e2,\
"rkeysecu"=hex:84,c4,10,36,15,35,8e,89,f4,53,45,70,5e,f4,05,88
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-07-03  22:14:51
ComboFix-quarantined-files.txt  2011-07-03 20:14
.
Vor Suchlauf: 8 Verzeichnis(se), 1.391.912.804.352 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 1.394.795.802.624 Bytes frei
.
- - End Of File - - F1C143A3219D4950E2E9A0509AD6AF6A
--- --- ---


Kommt jetzt noch was oder war es der letzte Schritt? :D

cosinus 04.07.2011 08:30
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Maurice 04.07.2011 13:12
GMER

GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-07-04 13:24:15
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\000000b2 WDC_WD15 rev.80.0
Running: oiq886te.exe; Driver: C:\Users\Maurice\AppData\Local\Temp\pfliifob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwAdjustPrivilegesToken [0x8C980992]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwAlpcConnectPort [0x8C9823FA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwAlpcCreatePort [0x8C982674]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwAlpcSendWaitReceivePort [0x8C9828E6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwClose [0x8C9812AA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwConnectPort [0x8C981A52]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateEvent [0x8C981E4E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateFile [0x8C9814C8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateMutant [0x8C981D34]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateNamedPipeFile [0x8C980582]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreatePort [0x8C981C08]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateSection [0x8C98072A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateSemaphore [0x8C981F6E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateThread [0x8C980F32]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateThreadEx [0x8C981030]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwCreateWaitablePort [0x8C981C9E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwDebugActiveProcess [0x8C983596]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwDuplicateObject [0x8C984716]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwFsControlFile [0x8C981694]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwLoadDriver [0x8C983688]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwMapViewOfSection [0x8C983D62]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenEvent [0x8C981EE4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenFile [0x8C981336]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenMutant [0x8C981DC4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenProcess [0x8C980BDC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenSection [0x8C983AFC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenSemaphore [0x8C982004]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwOpenThread [0x8C980AD0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwQueryDirectoryObject [0x8C982B30]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwQuerySection [0x8C98409C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwQueueApcThread [0x8C98398E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwReplyPort [0x8C982368]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwReplyWaitReceivePort [0x8C98222E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwRequestWaitReplyPort [0x8C983330]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwResumeThread [0x8C9845B8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSecureConnectPort [0x8C98179C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSetContextThread [0x8C98114C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSetInformationToken [0x8C982BD2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSetSecurityObject [0x8C983790]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSetSystemInformation [0x8C9841EC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSuspendProcess [0x8C9842DE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSuspendThread [0x8C984418]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwSystemDebugControl [0x8C9834BA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwTerminateProcess [0x8C980D7C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwTerminateThread [0x8C980CD2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwUnmapViewOfSection [0x8C983F40]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wlh_x86]/Kaspersky Lab)                  ZwWriteVirtualMemory [0x8C980E68]

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                                                        83249339 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                83282D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 10D7                                                                  83289DCC 4 Bytes  [92, 09, 98, 8C]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 10FF                                                                  83289DF4 8 Bytes  [FA, 23, 98, 8C, 74, 26, 98, ...]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1143                                                                  83289E38 4 Bytes  [E6, 28, 98, 8C]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 116F                                                                  83289E64 4 Bytes  [AA, 12, 98, 8C]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1193                                                                  83289E88 4 Bytes  [52, 1A, 98, 8C]
.text          ...                                                                                                 
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                                              section is writeable [0x9262A000, 0x2F786C, 0xE8000020]
.text          C:\Windows\system32\DRIVERS\lirsgt.sys                                                                section is writeable [0xA28BB300, 0x1B7E, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text          C:\Program Files\Real\RealPlayer\Update\realsched.exe[3092] kernel32.dll!SetUnhandledExceptionFilter  77483D01 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                              kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\000000a7                                                                    halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\tdx \Device\Udp                                                                              kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                            kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind                                      ???j?l??tunnel?ox????i???????????????????5??????s????7??????{152c3281-3409-11df-abf3-806e6f6e6963}????????:??????D?gB9??Microsoft????i????N??i???7??????????? ???i???????????????????????????????????????????V??00????N??i?????????D?????i???????????i????D??i??? ???????i???????????????????????2?????????????????????i?????7???n????N??i???7???????????????????,??????????S???????????????????????USB\DevClass_00&SubClass_00&Prot_00?USB\DevClass_00&SubClass_00?USB\DevClass_00?USB\COMPOSITE????????i??? ???????i???????????i???????????????????????????????????i??????????s.??????????????????????\??\USB#VID_09DA&PID_8090#5&27e4fbe1&0&3#{a5dcbf10-6530-11d2-901f-00c04fb951ed}?????? ???????i??????????????????????????????????? ???????i?????i???????1??L????????? ??????idg?????i???i???i??(?????????????????ad???????????7?g?????????????????t??????????? ???????i?????i?????i????????&??????????????>?????i????????????usbstor.inf:Generic.NTx86:USBSTOR_BULK:6.1.7601.17577:usb\class_08&subclass_06&prot_50??????usb\class_08&subclass_06&prot_5
Reg            HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route                                    ???j????????????????????????????????????????????t???????????????????????????????or??????????20??????????????????????@%systemroot%\system32\drivers\RdpRefMp.sys,-100????????????????????????????????????????SCSI Miniport????k?l?????????l???m??????????????????? ????????????????????????????$?????????p???? ???e????????????????????????V????????g????LegacyDriver?????????????????6??.1??????????????t????????????????????p???????????????????n??????????????t???????????????????????????????????t????????????????????????k?k?1??system32\DRIVERS\pacer.sys????????????????????????????????????????????????????????????????P??????????????????????????????e???-???????C??{533c5b84-ec70-11d2-9505-00c04f79deaf}\0010?????????????????Microsoft????????????????????????????e???????????k?k?1???j????????????????V?????????????STORAGE\VolumeSnapshot??=C????r?????????????{00000000-0000-0000-0000-000000000000}?B-H????X??????????????????y???k??????#{???i?i?k?????? ????????????????????????j???k???k??{71a27cdd-812a-11d0-bec7-08002be2092f}\0006?ff?????
Reg            HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export                                    ????????????????????????????????????????????????11?}?1????$??????.???????7??????????????????????11???????????????????? ??????????????????????????????????????????????????????????????????????????????????????f???????????????f??????????.NTx86??????Microsoft???? ???????f???????????????????????????????f??????????? ???1??|???\?l??????H?????????????????????????????? ??????? ??????? ????????????.??x???X?h??????D???????????????????????????????????? ??????? ?????Root\*6TO4MP\0044???? ?????????????????????1????????????????????00000407?????????????????????????????????????????????????????????????????????????????????????-??????D3??Root\*6TO4MP\0048???????????????????????acpi\authenticamd_-_x86??????????????n??????????????????Net???????D?????????????????????????????????????????????? ???????????????????f?1????????????????????? ?????????????????????1????????????&????????????????????/??? ?????????????????????1????????????????????? ???????????????????f?1????????????????????? ?????????????????????1????????????????????? ?????????
Reg            HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind                                ???j?k??\SystemRoot\system32\drivers\kbdhid.sys?????system32\DRIVERS\kl2.sys?????~???????????????j???????????????????????????????????????????????j?????????????????????????????????? ??????g?????????????e??un??un???????e??????t???@%systemroot%\system32\wkssvc.dll,-1005?????@%systemroot%\system32\wkssvc.dll,-1007?????????????????e????????????????????????5???~????????????R??j??????????system32\DRIVERS\lirsgt.sys?????????????????????????????????????s????????j???e?f?~???????l?l?i???????U??????????\SystemRoot\system32\drivers\mouclass.sys?????Z??j?????????n??????:??????S?g_1???????????n??11???????????????????????B??????????????????????????????????????????????Pointer Class?????????????????B??j??????????storprop.dll,AtaPropPageProvider?????j?j?????????????????????????e??????el???????????????e???????j???.???????i?k????FSFilter Virtualization?????@%SystemRoot%\system32\drivers\ndis.sys,-201?????????????????j???????????n?k?n?n?j????$??j???4???????-???????????z??????????p????????????e???????????z?z?o??????????????????11?
Reg            HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route                                ???jSv???j???j??????????????? ???????i???????????i?1????????????????????? h????????????????????j????? ???????i?????j???????1????????????????????? ?i???i???i???i???i???i???i???j???j???j???j????? ???????j???????????i?1????????????????????? ???????5???????k?????j????? ???????i?????j???????1????????????????????? ???????j???????????i?1?????????????????????????h???????????5?????????????????????????j????? ???????i?????j???????1????????????????????? ???????j???????????i?1?????????????????????????i???6??????7&21d63dca&0?7?????????????j??????8??j????????h?????mshdc.inf_x86_neutral_f64b9c35a3a5be81???????j?j?j?j?j?j?j????<??j????????h??????????&???????j???????h????b??j?????????n?????????????????????????????????????????f???????????????????????????t???j???e??????????????????????????????e???????????????????????????nettun.inf?00}??@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100???????????????????????????e?g?n???j???????????????????????????????????????6?.17??????????????????????????????t?????X??????1???t?????????????????????
Reg            HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export                              ????????Net?1}????????????????????m???????t?????????????????????*6to4mp? "???????????????t????,??????????????????????????????k???????k???????k??? ?????????????????????????????????e??????`??????k???c??? ???????|???????????d?:??????????%?&????????????????????B??MSAFD NetBIOS [\Device\NetBT_Tcpip6_{1EA6CF0A-FBE0-4912-993F-2E0D29FF0724}] SEQPACKET 3??r??MSAFD NetBIOS [\Device\NetBT_Tcpip6_{12F85669-41C3-43A6-9BD1-2D408BCE84F9}] DATAGRAM 70??A???????????-????????m??????????????????????????????????B??????????????Microsoft???????????????????????????????????????l???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{0460A44E-BF9B-4390-B541-6C61E6B57A13}] DATAGRAM 91?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????AC???????????????????0???????e?? ?@
Reg            HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind                                          ???f?????????????:???????????????f??*6to4mp??D??????or???j?j?????g?gMi??RasPppoe??????N?????????????????{8ECC055D-047F-11D1-A537-0000F8753ED1}?_10???f???s?s?s???????j????N??????????????????????i??????????????????04??PCI\VEN_197B&DEV_2380&REV_00?PCI\VEN_197B&DEV_2380?PCI\VEN_197B&CC_0C0010?PCI\VEN_197B&CC_0C00?PCI\VEN_197B?PCI\CC_0C0010?PCI\CC_0C00????????g?gMi???????????R?????sPC???f?f?f?f?f?f?f???????????e?e?e?e?e?e?e?e?e?f?f??Microsoft???????????.NT??????????f???????6???f???e??tunnel?CCA????|??i???????3???f?fr ??TDI??????????????4???4??????el???????k??????????????????HD???????f???v??se???????k????N??h????????D?????.NT??????????????????????????j?j?????g?ys????????????s?????sol???????????t?????s%\?????????????????s????????????? ??????? ???????4???f???????e??????????????????????????????????LegacyDriver?????????????f???j?j?f???????f??KSecDD?060???????????%??????????LegacyDriver?????f???????g???????????????????????????????????????????????f?f?i?i?f?i?:???/?l6???PCI\VEN_1022&DEV_1204&SUBSYS_00000000&REV_00?PCI\VE
Reg            HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route                                        ???j?j????????????R??j????????h???????0??p???n?????eta??PnP Filter?????????????????g??????????????????????b??j?????????n????????????????????????@%SystemRoot%\system32\drivers\fltmgr.sys,-10000????????????????p???System32\drivers\hwpolicy.sys????j???j???j?????k?l??1.2.0.125????????q????T??j????????h????????j?j????????????????????????f????????????e????System32\Drivers\ksecdd.sys???????:??j????????h??????????j???0??e2???????????n??????????p???Fs_Rec?00????????j???????????j????????????????????????????????????????????????8??j????????h??????????????????d???????????????????????????5???F??????d6???? ??5??????p?????????????????????????b??j?????????n????.NT?ms??oem3.inf?????j??????????????????????????g???system32\DRIVERS\nwifi.sys???????????????????????v??????????????????????? ???f???\?????\To??????????%SystemRoot%\System32\srvsvc.dll??????L??p??????k???????????????t???text????System32\Drivers\ksecpkg.sys?????????????5??s????????????????????????j??????p????????????d?????????V2A???????j????????????????????????????m??k?
Reg            HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export                                        ???j?j????????????????????????f????????????e????System32\Drivers\ksecdd.sys???????:??j????????h??????????j???0??e2???????????n??????????p???Fs_Rec?00????????j???????????j????????????????????????????????????????????????8??j????????h??????????????????d???????????????????????????5???F??????d6???? ??5??????p?????????????????????????b??j?????????n????.NT?ms??oem3.inf?????j??????????????????????????g???system32\DRIVERS\nwifi.sys???????????????????????v??????????????????????? ???f???\?????\To??????????%SystemRoot%\System32\srvsvc.dll??????L??p??????k???????????????t???text????System32\Drivers\ksecpkg.sys?????????????5??s????????????????????????j??????p????????????d?????????V2A???????j????????????????????????????m??k??????????????????????????HIDClass????????????????????????????????????p???Cryptography?????????j???????e????<??j????????h??????j??????????tunnel???????j???j???????????????????j?????j?n??????????????????????Maurice??????????h??@%SystemRoot%\system32\drivers\fileinfo.sys,-100?????????j???-??e5????X????????
Reg            HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind                                    ???j?n??????????????????????Maurice??????????h??@%SystemRoot%\system32\drivers\fileinfo.sys,-100?????????j???-??e5????X??????????e???s?z?s???????j???0???2?????? ??????g????????z.????P??j????????h?????@%SystemRoot%\system32\drivers\nsiproxy.sys,-2???????????????????????n??%m??%m??????????????RPCSS?????????8????????????e?????????j????<??j????????h??????????????????p???l???k??????????PNP_TDI??????????g???????????????????????k??????????Extended Base???????C0??????r???????????????Controls the underlying video driver stacks to provide fully-featured display capabilities.?????Keyboard Class???????????k???????????????????????????j??????????????????system32\drivers\nsiproxy.sys??????????????????????????????????????g?????????????????e???????j???9????????????????????????????Z??j?????????e????input.inf????f?h?j?g?t??\SystemRoot\system32\drivers\HDAudBus.sys??????j????system32\DRIVERS\kl1.sys?????????????????????????????????????s??rpcss???????????????????t???7616269602?8?<?????j?????u?u?u?????|?9?|????????t???????p????l?
Reg            HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route                                    ???j????system32\DRIVERS\kl1.sys?????????????????????????????????????s??rpcss???????????????????t???7616269602?8?<?????j?????u?u?u?????|?9?|????????t???????p????l?x?}?}?}???????????m???p??????????????????????????????????????????t??????????????g?????????????s??*PNP09FF????sh???????k???????????????????h??????????????????????????????????????@%SystemRoot%\system32\drivers\mountmgr.sys,-101?????j?j?j?j?j?j?j??system32\drivers\ndis.sys????????????l??????????system32\drivers\MSPCLOCK.sys???s???Typ??????????????????n???????????????m?m?????????????????????s??????????????????t????j????????????????4??j?????????????????????????l?m???m?m?????????????+???+??NDIS Wrapper????\SystemRoot\system32\drivers\luafv.sys??????????????????????????????????????????????Microsoft????k?k????????????base????????????????t???t???????????????t????????????????????????f?f?j?j?j?j?j??????????????{0??????????????????????????????????????@%SystemRoot%\system32\drivers\fvevol.sys,-100????????2??j????????h??????????????????????????????.?????????????
Reg            HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export                                  ???j?????u?u?u?????|?9?|????????t???????p????l?x?}?}?}???????????m???p??????????????????????????????????????????t??????????????g?????????????s??*PNP09FF????sh???????k???????????????????h??????????????????????????????????????@%SystemRoot%\system32\drivers\mountmgr.sys,-101?????j?j?j?j?j?j?j??system32\drivers\ndis.sys????????????l??????????system32\drivers\MSPCLOCK.sys???s???Typ??????????????????n???????????????m?m?????????????????????s??????????????????t????j????????????????4??j?????????????????????????l?m???m?m?????????????+???+??NDIS Wrapper????\SystemRoot\system32\drivers\luafv.sys??????????????????????????????????????????????Microsoft????k?k????????????base????????????????t???t???????????????t????????????????????????f?f?j?j?j?j?j??????????????{0??????????????????????????????????????@%SystemRoot%\system32\drivers\fvevol.sys,-100????????2??j????????h??????????????????????????????.?????????????j?k??\SystemRoot\system32\drivers\kbdhid.sys?????system32\DRIVERS\kl2.sys?????~???????????????j?????????????????????

---- EOF - GMER 1.0.15 ----
--- --- ---



OSAM

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 13:37:37 on 04.07.2011

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit
Default Browser: Mozilla Corporation Firefox 5.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Kaspersky Lab ZAO" - C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll
"AppInit_DLLs" - "Kaspersky Lab ZAO" - C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll

[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - ? - C:\Windows\system32\lsdelete.exe  (File found, but it contains no detailed information)

[Common]
-----( %SystemRoot%\Tasks )-----
"Ad-Aware Update (Weekly).job" - "Lavasoft Limited                                                      " - C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"catchme" (catchme) - ? - C:\Users\Maurice\AppData\Local\Temp\catchme.sys  (File not found)
"EagleNT" (EagleNT) - ? - C:\Windows\system32\drivers\EagleNT.sys  (File not found)
"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys  (File found, but it contains no detailed information)
"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"Profos" (Profos) - ? - C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MIF5BA~1\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\program files\real\realplayer\rpshell.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{52B87208-9CCF-42C9-B88E-069281105805} "Trojan Remover Shell Extension" - ? -  (File not found | COM-object registry key not found)
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{4248FE82-7FCB-46AC-B270-339F08212110} "&Virtuelle Tastatur" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)
"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{CCF151D8-D089-449F-A5A4-D9909053F20F} "Li&nks untersuchen" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{E33CF602-D945-461A-83F0-819F76A199F8} "FilterBHO Class" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} "IEVkbdBHO Class" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Adobe Gamma Loader.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ7.5\ICQ.exe" silent loginmode=4
"Logitech Vid" - "Logitech Inc." - "C:\Program Files\Logitech\Vid HD\Vid.exe" -bootmode
"SpybotSD TeaTimer" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"AVP" - "Kaspersky Lab ZAO" - "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
"CLMLServer" - "CyberLink" - "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
"HTC Sync Loader" - ? - "C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"LWS" - "Logitech Inc." - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Real\RealPlayer\update\realsched.exe"  -osboot

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
"Internet Pass-Through Service" (PassThru Service) - ? - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Kaspersky Anti-Virus Service" (AVP) - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft Limited" - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"nProtect GameGuard Service" (npggsvc) - "INCA Internet Co., Ltd." - C:\Windows\system32\GameMon.des
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe  (File found, but it contains no detailed information)
"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]


MBR

Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 32-bit
Base Board Manufacturer: MEDIONPC
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: MEDIONPC
System Product Name: MS-7646
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 161):
0x83245000 \SystemRoot\system32\ntkrnlpa.exe
0x8320E000 \SystemRoot\system32\halmacpi.dll
0x80BC5000 \SystemRoot\system32\kdcom.dll
0x8C20A000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x8C215000 \SystemRoot\system32\PSHED.dll
0x8C226000 \SystemRoot\system32\BOOTVID.dll
0x8C22E000 \SystemRoot\system32\CLFS.SYS
0x8C270000 \SystemRoot\system32\CI.dll
0x8C31B000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8C38C000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8C39A000 \SystemRoot\system32\drivers\ACPI.sys
0x8C3E2000 \SystemRoot\system32\drivers\WMILIB.SYS
0x8C3EB000 \SystemRoot\system32\drivers\msisadrv.sys
0x8C41F000 \SystemRoot\system32\drivers\pci.sys
0x8C449000 \SystemRoot\system32\drivers\vdrvroot.sys
0x8C454000 \SystemRoot\System32\drivers\partmgr.sys
0x8C465000 \SystemRoot\system32\drivers\volmgr.sys
0x8C475000 \SystemRoot\System32\drivers\volmgrx.sys
0x8C4C0000 \SystemRoot\system32\DRIVERS\amdide.sys
0x8C4C7000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8C4D5000 \SystemRoot\System32\drivers\mountmgr.sys
0x8C4EB000 \SystemRoot\system32\drivers\atapi.sys
0x8C4F4000 \SystemRoot\system32\drivers\ataport.SYS
0x8C517000 \SystemRoot\system32\DRIVERS\amdsata.sys
0x8C528000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C570000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8C579000 \SystemRoot\system32\drivers\fltmgr.sys
0x8C5AD000 \SystemRoot\system32\drivers\fileinfo.sys
0x8C5BE000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x8C60C000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8C73B000 \SystemRoot\System32\Drivers\msrpc.sys
0x8C766000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8C779000 \SystemRoot\System32\Drivers\cng.sys
0x8C7D6000 \SystemRoot\System32\drivers\pcw.sys
0x8C7E4000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8C830000 \SystemRoot\system32\drivers\ndis.sys
0x8C8E7000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C925000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8CA0F000 \SystemRoot\System32\drivers\tcpip.sys
0x8CB59000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8CB8A000 \SystemRoot\system32\drivers\volsnap.sys
0x8CBC9000 \SystemRoot\System32\Drivers\spldr.sys
0x8CBD1000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C94A000 \SystemRoot\System32\Drivers\mup.sys
0x8CC31000 \SystemRoot\system32\DRIVERS\kl1.sys
0x8D153000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8D15B000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8D18D000 \SystemRoot\system32\DRIVERS\disk.sys
0x8D19E000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8D1C3000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x8CC11000 \SystemRoot\system32\drivers\cdrom.sys
0x8C95A000 \SystemRoot\system32\DRIVERS\klif.sys
0x8D1F3000 \SystemRoot\System32\Drivers\Null.SYS
0x8CA00000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C9DA000 \SystemRoot\System32\drivers\vga.sys
0x8C800000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C821000 \SystemRoot\System32\drivers\watchdog.sys
0x8CA07000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C9E6000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C9EE000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C7ED000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C5CD000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C5DB000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C600000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x92A2C000 \SystemRoot\system32\drivers\afd.sys
0x92A86000 \SystemRoot\System32\DRIVERS\netbt.sys
0x92AB8000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x92ABF000 \SystemRoot\system32\DRIVERS\pacer.sys
0x92ADE000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x92AEF000 \SystemRoot\system32\DRIVERS\klim6.sys
0x92AF7000 \SystemRoot\system32\DRIVERS\netbios.sys
0x92B05000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x92B18000 \SystemRoot\system32\drivers\termdd.sys
0x92B29000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x92B6A000 \SystemRoot\system32\drivers\nsiproxy.sys
0x92B74000 \SystemRoot\system32\drivers\mssmbios.sys
0x92B7E000 \SystemRoot\System32\drivers\discache.sys
0x92B8A000 \SystemRoot\System32\Drivers\dfsc.sys
0x92BA2000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x92BB0000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x92BD1000 \SystemRoot\system32\DRIVERS\amdppm.sys
0x92A00000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x9300C000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x93601000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x936B8000 \SystemRoot\System32\drivers\dxgmms1.sys
0x936F1000 \SystemRoot\system32\drivers\HDAudBus.sys
0x93710000 \SystemRoot\system32\DRIVERS\Rt86win7.sys
0x9376A000 \SystemRoot\system32\drivers\1394ohci.sys
0x93797000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x9379D000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x937A7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x937F2000 \SystemRoot\system32\DRIVERS\usbfilter.sys
0x93588000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x93597000 \SystemRoot\system32\drivers\CompositeBus.sys
0x935A4000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x935B6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x935CE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x935D9000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x92BE2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C400000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x93A27000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x93A3E000 \SystemRoot\system32\drivers\kbdclass.sys
0x93A4B000 \SystemRoot\system32\drivers\mouclass.sys
0x93A58000 \SystemRoot\system32\drivers\swenum.sys
0x93A5A000 \SystemRoot\system32\drivers\ks.sys
0x93A8E000 \SystemRoot\system32\drivers\umbus.sys
0x93A9C000 \SystemRoot\system32\drivers\usbhub.sys
0x93AE0000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x93AF1000 \SystemRoot\system32\drivers\AtiHdmi.sys
0x93B0F000 \SystemRoot\system32\drivers\portcls.sys
0x93B3E000 \SystemRoot\system32\drivers\drmk.sys
0x94238000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x9450C000 \SystemRoot\system32\DRIVERS\RTL8192su.sys
0x945B5000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x945BF000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x945D6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x945D8000 \SystemRoot\System32\Drivers\crashdmp.sys
0x945E5000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x945EF000 \SystemRoot\System32\Drivers\dump_amdsata.sys
0x94200000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x99A80000 \SystemRoot\System32\win32k.sys
0x94211000 \SystemRoot\System32\drivers\Dxapi.sys
0x9421B000 \SystemRoot\system32\DRIVERS\monitor.sys
0x93B57000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x94226000 \SystemRoot\system32\drivers\hidusb.sys
0x93B6E000 \SystemRoot\system32\drivers\HIDCLASS.SYS
0x94231000 \SystemRoot\system32\drivers\HIDPARSE.SYS
0x9D61E000 \SystemRoot\system32\DRIVERS\lvuvc.sys
0x9DA3F000 \SystemRoot\system32\drivers\usbaudio.sys
0x9DA53000 \SystemRoot\system32\DRIVERS\lvrs.sys
0x9DA99000 \SystemRoot\system32\drivers\kbdhid.sys
0x9DAA5000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x9DAB0000 \SystemRoot\system32\DRIVERS\klmouflt.sys
0x99CE0000 \SystemRoot\System32\TSDDD.dll
0x99D10000 \SystemRoot\System32\cdd.dll
0x9DAB9000 \SystemRoot\system32\drivers\luafv.sys
0x9DAD4000 \SystemRoot\system32\drivers\WudfPf.sys
0x9DAEE000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9DAFE000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9DB44000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9DB54000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9DB67000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x9DB70000 \SystemRoot\system32\drivers\HTTP.sys
0x9D600000 \SystemRoot\system32\DRIVERS\bowser.sys
0x93B81000 \SystemRoot\System32\drivers\mpsdrv.sys
0x93B93000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x93BB6000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x93A00000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9D619000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0xA382B000 \SystemRoot\system32\drivers\peauth.sys
0xA38C2000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA38CC000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA38ED000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA38FA000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA394A000 \SystemRoot\System32\DRIVERS\srv.sys
0xA399C000 \SystemRoot\System32\drivers\ipnat.sys
0xA39C2000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xA39E3000 \??\C:\Windows\system32\drivers\mbam.sys
0x76EC0000 \Windows\System32\ntdll.dll
0x475B0000 \Windows\System32\smss.exe
0x77100000 \Windows\System32\apisetschema.dll

Processes (total 67):
0 System Idle Process
4 System
352 C:\Windows\System32\smss.exe
496 csrss.exe
580 C:\Windows\System32\wininit.exe
592 csrss.exe
632 C:\Windows\System32\services.exe
652 C:\Windows\System32\lsass.exe
660 C:\Windows\System32\lsm.exe
744 C:\Windows\System32\winlogon.exe
816 C:\Windows\System32\svchost.exe
892 C:\Windows\System32\svchost.exe
956 C:\Windows\System32\atiesrxx.exe
1016 C:\Windows\System32\svchost.exe
1056 C:\Windows\System32\svchost.exe
1088 C:\Windows\System32\svchost.exe
1128 C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
1272 C:\Windows\System32\svchost.exe
1348 C:\Windows\System32\atieclxx.exe
1572 C:\Windows\System32\dwm.exe
1604 C:\Windows\explorer.exe
1788 C:\Windows\System32\spoolsv.exe
1800 C:\Windows\System32\taskhost.exe
1848 C:\Windows\System32\svchost.exe
1936 C:\Windows\System32\svchost.exe
1992 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
300 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
716 C:\Program Files\Bonjour\mDNSResponder.exe
908 C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
1320 C:\Windows\System32\svchost.exe
1600 C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
116 C:\Windows\System32\PnkBstrA.exe
2076 C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
2100 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2152 C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
2192 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
2208 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
2308 C:\Windows\System32\svchost.exe
2400 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
2444 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
2564 C:\Program Files\iTunes\iTunesHelper.exe
2584 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
2596 C:\Program Files\Real\RealPlayer\Update\realsched.exe
2808 C:\Program Files\Windows Sidebar\sidebar.exe
2860 C:\Program Files\ICQ7.5\ICQ.exe
2900 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
3236 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
4032 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3344 C:\Program Files\Mozilla Firefox\firefox.exe
2476 C:\Program Files\Mozilla Firefox\plugin-container.exe
4072 C:\Program Files\iPod\bin\iPodService.exe
2892 C:\Windows\System32\alg.exe
1764 C:\Windows\System32\SearchIndexer.exe
4140 C:\Windows\System32\taskhost.exe
4236 C:\Program Files\Windows Media Player\wmpnetwk.exe
4276 WUDFHost.exe
5652 C:\Windows\System32\svchost.exe
4216 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
3204 C:\Windows\System32\svchost.exe
2728 C:\Windows\System32\svchost.exe
4356 <unknown>
5840 <unknown>
3728 C:\Windows\explorer.exe
1400 C:\Windows\System32\audiodg.exe
3272 C:\Users\Maurice\Desktop\MBRCheck.exe
5212 C:\Windows\System32\conhost.exe
5464 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000158`10c00000 (NTFS)

PhysicalDrive0 Model Number: WDCWD15EARS-00Z5B1, Rev: 80.00A80

Size Device Name MBR Status
--------------------------------------------
1397 GB \\.\PhysicalDrive0

Warum lagt mein Rechner jetzt nach den durchläufen von den drei Programmen?
Das hat er vorher nicht..-.-
Und ich habe die drei Logs so gepostet, weil das in einem Quote Fenster zu unübersichtlich wäre. Nehme ich mal an.

cosinus 04.07.2011 14:00
Zitat:
Size Device Name MBR Status
--------------------------------------------
1397 GB \\.\PhysicalDrive0
Log von mbrcheck ist unvollständig!

Zitat:
Warum lagt mein Rechner jetzt nach den durchläufen von den drei Programmen?
Könnte an GMER liegen. Windows schon neu gestartet?

Maurice 04.07.2011 14:57
Ja, habe ihn schon neu gestartet.
Als der Pc automtisch neu gestartet hat nachdem der MBRCheck durchgelaufen ist, ist er nicht richtig hochgefahren also hat Windows nicht gestartet...bei deiner Anweisung steht ja auch das das nur ein paar Sekunden dauern soll. Was es aber nicht tat.
lg

cosinus 04.07.2011 15:38
Zitat:
Als der Pc automtisch neu gestartet hat nachdem der MBRCheck durchgelaufen ist, ist er nicht richtig hochgefahren also hat Windows nicht gestartet...
Äh, nach mbrcheck startet Windows jetzt nicht mehr? :confused:
Hast du nur das Log gemacht oder irgendwelche Fixaktionen?

Maurice 04.07.2011 17:48
Eigentlich nur das Log so wie beschrieben.

Eine Frage an der Seite, würde der Trojaner auf eine externe Festplatte übergehen wenn ich eine anschließe? Dann würde ich wenn wir zu keinem Ergebniss kommen sollten meinen Rechner formatieren, aber wie das geht wüsste ich jetzt auch nicht 100% -.-.

cosinus 04.07.2011 19:40
Du willst jetzt so kurz vorm Abschluss doch alles plätten und neumachen? :confused:

Maurice 04.07.2011 20:13
Nein, will ich nicht^^ das war nur eine Frage. Ich kann ja nicht wissen das das bald fertig ist ;) habe ja keine Ahnung ;)
Also kommen wir zum eigentlich Thema zurück. Wie geht es denn jetzt weiter? Ich bin froh wenn ich das Teil wieder los bin oO


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:05 Uhr.
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131