Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   BOO TDSS M , Rechner und Internet browser langsamer (https://www.trojaner-board.de/103525-boo-tdss-m-rechner-internet-browser-langsamer.html)

siggy 19.09.2011 15:10
BOO TDSS M , Rechner und Internet browser langsamer
 
Hallo liebe TrojanerBoard Mitgleider ,
seit einigen Tagen kann ich mit Internetbrowsern fast gar nicht mehr surfen, da die Geschwindigkeit langsamer als von Handys ist.

Es liegt definitiv nicht am Internet selber, denn ich habe T-Home DSL 16.000+ IPTV und mein Receiver für Fernsehen geht ( und der brauch schon mindenstens 1500).

Firefox ist am lahmsten und Opera ist etwas schneller.

Allerdings tut das nichts zur Sache das ich den BOO TDSS M Virus habe (und auch schon länger).
Da es mich bisher nicht wirklich gestört hatte.
Das einzige was mir bekannt war, dass die Startfolge der Festplatte trotz korrekter Einstellung nicht richtig ist , und ich deshalb immer am Anfang ne andere Festplatte booten lassen muss um auf mein Betriebssystem zu kommen.

Ich würde mich sehr freuen, wenn mir jemand mit dem Problem helfen kann,
ich werde dann natürlich so schnell wie möglich antworten und die Anweisungen befolgen und die Risiken in Kauf nehmen.

mfg siggy

cosinus 19.09.2011 15:31
Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!


Führe danach auch bitte ESET aus, danach sehen wir weiter.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

n.

siggy 20.09.2011 12:30
ist es normal das der ESET Scan so lange dauert ?
gestern hatte er bei 3 stunden Laufzeit rund 29 %
, allerdings hab ich das abgebrochen, weil der Rechner mir zu laut ist und ich schlafen gehen wollte.

Heute hab ich ihn morgens angemacht und jetzt 6 Stunden laufen lassen und er hat grade mal 57.000 files durchsucht und nur 12 %.

cosinus 20.09.2011 12:59
Ja das kann dauern. Lass ihn bitte durchlaufen.

siggy 21.09.2011 13:45
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7748

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

19.09.2011 18:22:01
mbam-log-2011-09-19 (18-22-01).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 417991
Laufzeit: 1 Stunde(n), 19 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 16

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\OO1310T0QS (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update (Trojan.Agent.Gen) -> Value: Java Update -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\KeApplet (Trojan.Agent) -> Value: KeApplet -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\newdnswatch\8bf491c5ab2.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\7CHGP2BW\load[1].htm (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\0.43085303321689083.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\Nc2.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\Nc3.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\Nc4.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\Nc8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\Nc9.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\Nda.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\jar_cache6182722404583965036.tmp (Trojan.Agent.SZ) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\0.6465531458146891.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Roaming\Help\ceptr.tll (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Roaming\Help\comm.tll (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe (Trojan.Agent) -> Delete on reboot.
c:\Recycle.Bin\0582b608128ef7e (Trojan.Spyeyes) -> Quarantined and deleted successfully.





ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=21d47a98cba7894bab58bc03439ce65e
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-19 07:28:54
# local_time=2011-09-19 09:28:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 94 79846 52990441 1923457 0
# compatibility_mode=5893 16776574 100 94 56167167 68888763 0 0
# compatibility_mode=8192 67108863 100 0 117 117 0 0
# compatibility_mode=9217 16777214 75 66 14081736 18410722 0 0
# scanned=198711
# found=4
# cleaned=0
# scan_time=10516
C:\Users\Admin\AppData\Local\Temp\jar_cache4056103344549975675.tmp a variant of Win32/Kryptik.SKG trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\5e875b5a-3bd7cc49 Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\552fd2c8-1e945da3 a variant of Java/Agent.DM trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Admin\Desktop\BurgerKing\WhiteSmokeInstaller_9165.exe a variant of Win32/InstallCore.A application (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=21d47a98cba7894bab58bc03439ce65e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-21 05:14:59
# local_time=2011-09-21 07:14:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 94 38900 53035998 31645 0
# compatibility_mode=5893 16776574 100 94 56212724 68934320 0 0
# compatibility_mode=8192 67108863 100 0 45674 45674 0 0
# compatibility_mode=9217 16777214 75 66 14127293 18456279 0 0
# scanned=860324
# found=14
# cleaned=0
# scan_time=125
C:\Users\Admin\AppData\Local\Temp\jar_cache4056103344549975675.tmp a variant of Win32/Kryptik.SKG trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\5e875b5a-3bd7cc49 Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\552fd2c8-1e945da3 a variant of Java/Agent.DM trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Admin\Desktop\BurgerKing\WhiteSmokeInstaller_9165.exe a variant of Win32/InstallCore.A application (unable to clean) 00000000000000000000000000000000 I
D:\Down\Directlinks\CRC-Killer.exe Win32/Packed.Autoit.D.Gen application (unable to clean) 00000000000000000000000000000000 I
D:\Windows\CameraFixer.exe probably a variant of Win32/KillProc.A application (unable to clean) 00000000000000000000000000000000 I
D:\Windows\FixCamera.exe a variant of Win32/KillProc.A application (unable to clean) 00000000000000000000000000000000 I
E:\Dokumente und Einstellungen\Arbeit\Desktop\VisualBoyAdvance\MY Stuff\UltraMixer-2.3.2-win.exe multiple threats (unable to clean) 00000000000000000000000000000000 I
E:\Dokumente und Einstellungen\Neu\Anwendungsdaten\Nyux\daop.exe Win32/Spy.Zbot.YW trojan (unable to clean) 00000000000000000000000000000000 I
E:\Dokumente und Einstellungen\Neu\Lokale Einstellungen\Temp\plugtmp\plugin-2fdp.php JS/Exploit.Pdfka.OTW.Gen trojan (unable to clean) 00000000000000000000000000000000 I
E:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll Win32/Adware.Agent.NJT application (unable to clean) 00000000000000000000000000000000 I
E:\Programme\Free WMA to MP3 Converter\readmedia.dll probably a variant of Win32/PSW.Agent.BUPXGWL trojan (unable to clean) 00000000000000000000000000000000 I
E:\Programme\WarRock\System\WarRock.exe a variant of Win32/Packed.Themida application (unable to clean) 00000000000000000000000000000000 I
E:\WINDOWS\CameraFixer.exe probably a variant of Win32/KillProc.A application (unable to clean) 00000000000000000000000000000000 I

cosinus 21.09.2011 14:26
Zitat:
D:\Down\Directlinks\CRC-Killer.exe
Was ist das und aus welcher Quelle stammt das?

siggy 21.09.2011 14:37
Das ist schon ewigkeiten her, die Platte nutz ich auch gar nicht mehr, da sind halt nur noch alte Daten drauf.

Aber soweit ich weiß, hab ich das von hier :
perfectsoft(dot)tk

ich hab das ganze mal nicht als link kenntlich gemacht, da ich mir nicht sicher bin wie hier die Regeln im Forum diesbezüglich sind.

Das Programm ist dazu da CRC Fehler die beim entpacken von Rar dateien geschehen, praktisch auszulöschen, als wären diese nie da gewesen.
Hat aber glaub ich trotzdem nicht funktioniert.

cosinus 21.09.2011 15:01
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

siggy 21.09.2011 15:42
OTL Logfile:
Code:
OTL logfile created on: 21.09.2011 16:08:28 - Run 1
OTL by OldTimer - Version 3.2.29.1    Folder = C:\Users\Admin\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,55 Mb Total Physical Memory | 447,42 Mb Available Physical Memory | 46,68% Memory free
1,94 Gb Paging File | 1,12 Gb Available in Paging File | 57,80% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,51 Gb Total Space | 621,04 Gb Free Space | 66,67% Space Free | Partition Type: NTFS
Drive D: | 94,38 Gb Total Space | 17,73 Gb Free Space | 18,79% Space Free | Partition Type: NTFS
Drive E: | 54,67 Gb Total Space | 1,99 Gb Free Space | 3,64% Space Free | Partition Type: NTFS
 
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.09.21 16:04:11 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
PRC - [2011.07.29 21:34:06 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.27 13:26:29 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.04 14:36:11 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.05.14 11:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.14 03:14:12 | 000,100,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe

 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.03.27 22:11:04 | 000,094,208 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2011.03.02 12:40:51 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2008.04.11 14:23:22 | 000,081,920 | ---- | M] () -- C:\Programme\UltraISO\lang\lang_de.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.04 14:34:46 | 001,361,288 | ---- | M] (LogMeIn Inc.) [Auto | Stopped] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.07.29 21:34:06 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.18 07:16:19 | 001,343,400 | ---- | M] () [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011.04.27 13:26:29 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.02.18 17:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Stopped] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009.10.20 20:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.07.29 21:34:10 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.29 21:34:10 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.04.30 16:45:47 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.11.09 15:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.15 16:30:50 | 000,461,400 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2010.01.29 11:40:04 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Programme\UltraISO\drivers\ISODrive.sys -- (ISODrive)
DRV - [2009.10.20 20:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2007.02.16 02:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2000.07.24 01:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\BrPar.sys -- (BrPar)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 93 22 9A 04 6C CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.13 22:08:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.13 22:08:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.09 20:31:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.09 20:31:27 | 000,000,000 | ---D | M]
 
[2011.04.09 16:31:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2011.09.16 23:37:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions
[2011.09.08 14:45:43 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.09.10 11:40:02 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\foxyproxy@eric.h.jung
[2011.08.28 16:41:42 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\toolbar@ask.com
[2011.04.19 06:07:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.06.24 17:12:19 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.04.10 13:21:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LLXO0YP0.DEFAULT\EXTENSIONS\SURVEY-REMOVER@GMX.COM.XPI
[2011.09.07 16:26:37 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [EPSON Stylus DX5000 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Lan.FS] C:\Program Files\Lan.FS\Lan-fs.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\RunOnce: [KeApplet] C:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe ()
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E727E16-E825-49DE-ABA3-2FB70C364156}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.12.25 15:32:25 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.05.11 17:34:10 | 000,045,056 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005.05.11 16:49:08 | 000,000,042 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: vsmon - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.x264 - C:\Programme\x264vfw\x264vfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.21 16:04:10 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2011.09.19 18:31:43 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011.09.19 18:31:22 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
[2011.09.19 16:42:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2011.09.19 16:41:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.09.19 16:41:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.09.19 16:41:46 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.09.19 16:41:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.09.19 16:40:43 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Admin\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.18 00:25:46 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Help
[2011.09.11 11:45:13 | 000,098,304 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll
[2011.09.11 11:14:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PocketSoft
[2011.09.10 19:18:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Neuer Ordner (3)
[2011.09.10 13:53:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\biatz
[2011.09.09 20:33:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Apple Computer
[2011.09.09 20:33:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple Computer
[2011.09.09 20:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.09.09 20:32:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.09.09 20:31:56 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.09.09 20:31:55 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.09.09 20:31:55 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.09.09 20:31:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.09.09 20:30:19 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011.09.09 20:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.09.09 20:29:45 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple
[2011.09.09 20:29:36 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2011.09.09 20:28:22 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.09.09 20:28:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2011.09.09 20:28:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2011.09.04 13:22:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\creaxcover
[2011.08.28 17:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Ableton
[2011.08.28 17:37:04 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Ableton
[2011.08.28 17:37:04 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Ableton
[2011.08.28 16:49:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ableton
[2011.08.28 16:46:19 | 000,000,000 | ---D | C] -- C:\Program Files\Ableton
[2011.08.28 16:43:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\ableton_live_trial_822
[2011.08.28 16:41:01 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2011.08.28 16:40:06 | 003,383,272 | ---- | C] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 15:50:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\AYKAYEPCOVER
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lan.FS
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Lan.Fs
[2011.08.28 10:35:33 | 000,000,000 | ---D | C] -- C:\Program Files\Lan.FS
[2011.05.04 21:53:22 | 000,695,296 | ---- | C] (AnjoCaido) -- C:\Users\Admin\AppData\Roaming\MinecraftSP.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.21 16:04:11 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2011.09.21 14:36:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.21 14:36:51 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.21 14:36:51 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.21 07:15:36 | 000,000,260 | ---- | M] () -- C:\Windows\Brownie.ini
[2011.09.20 20:53:28 | 001,327,662 | ---- | M] () -- C:\Users\Admin\Desktop\Vocals unbearbeitet.mp3
[2011.09.19 18:31:24 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
[2011.09.19 18:22:12 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.19 16:41:52 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.09.19 16:40:57 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Admin\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei4
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei2
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei3
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei1
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei7
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei5
[2011.09.18 20:40:22 | 000,000,468 | ---- | M] () -- C:\Windows\System32\Datei0
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei9
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei8
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei10
[2011.09.18 20:40:22 | 000,000,465 | ---- | M] () -- C:\Windows\System32\Datei6
[2011.09.18 20:25:42 | 000,007,607 | ---- | M] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Ygwsnc.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\XZRDABX.job
[2011.09.18 20:23:15 | 000,415,560 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.09.18 20:22:54 | 753,836,032 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.11 15:42:55 | 000,646,244 | ---- | M] () -- C:\Users\Admin\Documents\xDSASBH.jpg
[2011.09.11 15:39:13 | 000,258,581 | ---- | M] () -- C:\Users\Admin\Documents\xAD.jpg
[2011.09.11 11:45:13 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll
[2011.09.10 19:35:29 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.09.10 19:35:29 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.09.10 19:35:29 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.09.10 19:35:29 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.09.07 07:10:08 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.08.28 16:40:13 | 003,383,272 | ---- | M] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 16:38:55 | 650,382,612 | ---- | M] () -- C:\Users\Admin\Desktop\ableton_live_trial_822.zip
[2011.08.28 10:25:15 | 000,000,000 | -H-- | M] () -- C:\Users\Admin\Documents\Default.rdp
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.20 20:53:26 | 001,327,662 | ---- | C] () -- C:\Users\Admin\Desktop\Vocals unbearbeitet.mp3
[2011.09.19 18:22:12 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.19 16:41:52 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.09.11 15:42:52 | 000,646,244 | ---- | C] () -- C:\Users\Admin\Documents\xDSASBH.jpg
[2011.09.11 15:39:11 | 000,258,581 | ---- | C] () -- C:\Users\Admin\Documents\xAD.jpg
[2011.09.11 11:14:32 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.09.10 19:25:37 | 000,007,607 | ---- | C] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.09 20:29:38 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011.08.28 16:31:26 | 650,382,612 | ---- | C] () -- C:\Users\Admin\Desktop\ableton_live_trial_822.zip
[2011.08.28 10:25:15 | 000,000,000 | -H-- | C] () -- C:\Users\Admin\Documents\Default.rdp
[2011.08.01 18:32:02 | 000,000,943 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\coreavc.ini
[2011.07.25 14:46:28 | 000,007,168 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.25 14:43:43 | 000,084,480 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.07.11 13:13:31 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll
[2011.07.10 14:08:00 | 000,103,400 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011.07.09 19:30:27 | 000,055,808 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2011.05.04 21:53:22 | 000,591,252 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Minecraft_Server.exe
[2011.05.04 21:53:22 | 000,290,797 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\minecraft_name.jar
[2011.05.04 21:53:22 | 000,232,501 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Minecraft.exe
[2011.05.04 21:53:22 | 000,051,765 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Minecraft.jar
[2011.05.04 21:53:22 | 000,000,230 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\server.properties
[2011.05.04 21:53:22 | 000,000,133 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\zan.settings
[2011.05.04 21:53:22 | 000,000,008 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\lastlogin
[2011.04.19 06:08:17 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.04.17 13:49:55 | 000,000,132 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.04.12 22:39:58 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.04.12 22:39:58 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2011.04.12 22:39:57 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2011.04.12 22:39:54 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini
[2011.04.12 22:39:53 | 000,009,030 | ---- | C] () -- C:\Windows\HL-2030.INI
[2011.04.12 22:38:54 | 000,000,054 | ---- | C] () -- C:\Windows\System32\bd2030.dat
[2011.04.12 22:37:45 | 000,000,260 | ---- | C] () -- C:\Windows\Brownie.ini
[2010.06.17 17:00:00 | 002,761,119 | ---- | C] () -- C:\Windows\System32\Melodyne editor.dll
[2009.10.20 20:19:30 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 10:47:43 | 000,643,628 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,126,188 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,415,560 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,606,992 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,103,370 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
 
========== LOP Check ==========
 
[2011.08.28 17:37:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ableton
[2011.04.13 20:27:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ashampoo
[2011.04.26 15:37:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\avidemux
[2011.06.05 16:29:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon
[2011.05.04 21:53:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\bin
[2011.07.10 14:07:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\de.txptr.googleplus
[2011.04.12 18:17:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EPSON
[2011.05.14 20:51:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2011.07.28 07:25:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeFLVConverter
[2011.09.18 11:46:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ICQ
[2011.05.04 21:53:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\minecraft_name_src
[2011.05.12 18:08:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Need for Speed World
[2011.04.14 21:43:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2011.05.04 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2011.05.04 21:53:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\resources
[2011.01.20 17:56:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\saves
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server 2
[2011.01.03 17:32:53 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\texturepacks
[2011.04.14 14:40:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TS3Client
[2011.05.04 21:53:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\world
[2011.05.17 20:51:33 | 000,012,724 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\XZRDABX.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\Tasks\Ygwsnc.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.08.28 17:37:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ableton
[2011.09.09 20:34:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Apple Computer
[2011.04.13 20:27:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ashampoo
[2011.04.26 15:37:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\avidemux
[2011.05.06 19:06:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Avira
[2011.06.05 16:29:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon
[2011.05.04 21:53:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\bin
[2011.04.14 21:02:13 | 000,000,000 | R--D | M] -- C:\Users\Admin\AppData\Roaming\Brother
[2011.07.10 14:07:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\de.txptr.googleplus
[2011.04.26 16:04:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DivX
[2011.08.22 21:58:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\dvdcss
[2011.04.12 18:17:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EPSON
[2011.05.14 20:51:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2011.07.28 07:25:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeFLVConverter
[2011.09.19 18:22:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Help
[2011.09.18 11:46:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ICQ
[2011.04.09 16:29:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Identities
[2011.04.17 12:03:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Macromedia
[2011.09.19 16:42:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2011.08.01 18:32:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Media Player Classic
[2011.09.20 15:35:54 | 000,000,000 | --SD | M] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2011.05.04 21:53:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\minecraft_name_src
[2011.04.09 16:31:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mozilla
[2011.06.28 19:40:27 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\NCH Software
[2011.05.12 18:08:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Need for Speed World
[2011.04.30 17:00:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Nero
[2011.04.14 21:43:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2011.05.04 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2011.05.04 21:53:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\resources
[2011.01.20 17:56:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\saves
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server 2
[2011.09.19 20:12:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Skype
[2011.06.19 19:59:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\skypePM
[2011.01.03 17:32:53 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\texturepacks
[2011.04.14 14:40:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TS3Client
[2011.08.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\vlc
[2011.04.09 18:33:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WinRAR
[2011.05.04 21:53:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\world
 
< %APPDATA%\*.exe /s >
[2010.12.22 17:49:28 | 000,232,501 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Minecraft.exe
[2010.10.21 03:00:00 | 000,695,296 | ---- | M] (AnjoCaido) -- C:\Users\Admin\AppData\Roaming\MinecraftSP.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Minecraft_Server.exe
[2011.07.10 14:03:19 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.07.11 13:20:54 | 000,008,192 | R--- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{1B77BC7B-4538-4652-AF33-C201F21BF8F2}\Icon1B77BC7B.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\minecraft_name_src\Minecraft_Server.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Server 2\Minecraft_Server.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Server\Minecraft_Server.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2011.05.18 07:16:39 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=7BD7F45FF37FA0669CD32CA0EF46E22C -- C:\Windows\System32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\System32\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011.04.30 16:45:47 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
[2010.05.15 16:30:50 | 000,461,400 | ---- | M] (Check Point Software Technologies LTD) Unable to obtain MD5 -- C:\Windows\system32\drivers\vsdatant.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
--- --- ---

cosinus 21.09.2011 15:46
Zitat:
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
ZoneAlarm ist kontraproduktiver Müll, bitte umgehend deinstallieren und die Windows-Firewall einschalten!
Mach danach ein neues OTL-Log.

siggy 21.09.2011 16:06
Das Programm lässt sich nicht deinstallieren es fehlt eine dll datei und deshalb macht er das nicht.

edit//
hab die dll runtergeladen und eingefügt, er wollte darraufhin eine weitere dll datei haben und jetzt bemängelt er wiederrum die vsutil dll

die Windows Firewall war komischerweiße schon angeschaltet, obwohl ich die immer deaktiviert habe

zoneAlarm hab ich erstmal manuell gelöschtOTL Logfile:
Code:
OTL logfile created on: 21.09.2011 17:27:12 - Run 2
OTL by OldTimer - Version 3.2.29.1    Folder = C:\Users\Admin\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,55 Mb Total Physical Memory | 242,38 Mb Available Physical Memory | 25,29% Memory free
1,94 Gb Paging File | 1,01 Gb Available in Paging File | 52,01% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,51 Gb Total Space | 620,61 Gb Free Space | 66,62% Space Free | Partition Type: NTFS
Drive D: | 94,38 Gb Total Space | 17,73 Gb Free Space | 18,79% Space Free | Partition Type: NTFS
Drive E: | 54,67 Gb Total Space | 1,99 Gb Free Space | 3,64% Space Free | Partition Type: NTFS
Drive K: | 594,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.09.21 16:04:11 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
PRC - [2011.07.29 21:34:06 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.27 13:26:29 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.04 14:36:11 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.05.14 11:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.03.27 22:11:04 | 000,094,208 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2011.03.02 12:40:51 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2008.04.11 14:23:22 | 000,081,920 | ---- | M] () -- C:\Programme\UltraISO\lang\lang_de.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.04 14:34:46 | 001,361,288 | ---- | M] (LogMeIn Inc.) [Auto | Stopped] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.07.29 21:34:06 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.18 07:16:19 | 001,343,400 | ---- | M] () [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011.04.27 13:26:29 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009.10.20 20:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | Unknown | Running] --  -- (Vsdatant)
DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.07.29 21:34:10 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.29 21:34:10 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.04.30 16:45:47 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.11.09 15:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.01.29 11:40:04 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Programme\UltraISO\drivers\ISODrive.sys -- (ISODrive)
DRV - [2009.10.20 20:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2007.02.16 02:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2000.07.24 01:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\BrPar.sys -- (BrPar)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 93 22 9A 04 6C CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.13 22:08:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.13 22:08:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.09 20:31:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.09 20:31:27 | 000,000,000 | ---D | M]
 
[2011.04.09 16:31:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2011.09.16 23:37:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions
[2011.09.08 14:45:43 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.09.10 11:40:02 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\foxyproxy@eric.h.jung
[2011.08.28 16:41:42 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\toolbar@ask.com
[2011.04.19 06:07:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.06.24 17:12:19 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.04.10 13:21:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LLXO0YP0.DEFAULT\EXTENSIONS\SURVEY-REMOVER@GMX.COM.XPI
[2011.09.07 16:26:37 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [EPSON Stylus DX5000 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Lan.FS] C:\Program Files\Lan.FS\Lan-fs.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\RunOnce: [KeApplet] C:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe ()
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E727E16-E825-49DE-ABA3-2FB70C364156}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.12.25 15:32:25 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.05.11 17:34:10 | 000,045,056 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005.05.11 16:49:08 | 000,000,042 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: vsmon - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.x264 - C:\Programme\x264vfw\x264vfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.21 17:10:15 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\vsinit
[2011.09.21 17:08:58 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\vsutil
[2011.09.21 16:50:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Application Data
[2011.09.21 16:04:10 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2011.09.19 18:31:43 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011.09.19 18:31:22 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
[2011.09.19 16:42:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2011.09.19 16:41:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.09.19 16:41:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.09.19 16:41:46 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.09.19 16:41:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.09.19 16:40:43 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Admin\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.18 00:25:46 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Help
[2011.09.11 11:45:13 | 000,098,304 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll
[2011.09.11 11:14:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PocketSoft
[2011.09.10 19:18:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Neuer Ordner (3)
[2011.09.10 13:53:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\biatz
[2011.09.09 20:33:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Apple Computer
[2011.09.09 20:33:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple Computer
[2011.09.09 20:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.09.09 20:32:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.09.09 20:31:56 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.09.09 20:31:55 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.09.09 20:31:55 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.09.09 20:31:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.09.09 20:30:19 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011.09.09 20:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.09.09 20:29:45 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple
[2011.09.09 20:29:36 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2011.09.09 20:28:22 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.09.09 20:28:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2011.09.09 20:28:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2011.09.04 13:22:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\creaxcover
[2011.08.28 17:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Ableton
[2011.08.28 17:37:04 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Ableton
[2011.08.28 17:37:04 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Ableton
[2011.08.28 16:49:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ableton
[2011.08.28 16:46:19 | 000,000,000 | ---D | C] -- C:\Program Files\Ableton
[2011.08.28 16:43:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\ableton_live_trial_822
[2011.08.28 16:41:01 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2011.08.28 16:40:06 | 003,383,272 | ---- | C] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 15:50:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\AYKAYEPCOVER
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lan.FS
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Lan.Fs
[2011.08.28 10:35:33 | 000,000,000 | ---D | C] -- C:\Program Files\Lan.FS
[2011.08.27 18:42:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Xara
[2011.05.04 21:53:22 | 000,695,296 | ---- | C] (AnjoCaido) -- C:\Users\Admin\AppData\Roaming\MinecraftSP.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.21 17:10:07 | 000,033,135 | ---- | M] () -- C:\Users\Admin\Desktop\vsinit.zip
[2011.09.21 17:08:41 | 000,065,489 | ---- | M] () -- C:\Users\Admin\Desktop\vsutil.zip
[2011.09.21 16:36:51 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.21 16:36:51 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.21 16:04:11 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2011.09.21 14:36:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.21 07:15:36 | 000,000,260 | ---- | M] () -- C:\Windows\Brownie.ini
[2011.09.20 20:53:28 | 001,327,662 | ---- | M] () -- C:\Users\Admin\Desktop\Vocals unbearbeitet.mp3
[2011.09.19 18:31:24 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
[2011.09.19 18:22:12 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.19 16:41:52 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.09.19 16:40:57 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Admin\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei4
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei2
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei3
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei1
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei7
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei5
[2011.09.18 20:40:22 | 000,000,468 | ---- | M] () -- C:\Windows\System32\Datei0
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei9
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei8
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei10
[2011.09.18 20:40:22 | 000,000,465 | ---- | M] () -- C:\Windows\System32\Datei6
[2011.09.18 20:25:42 | 000,007,607 | ---- | M] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Ygwsnc.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\XZRDABX.job
[2011.09.18 20:23:15 | 000,415,560 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.09.18 20:22:54 | 753,836,032 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.11 15:42:55 | 000,646,244 | ---- | M] () -- C:\Users\Admin\Documents\xDSASBH.jpg
[2011.09.11 15:39:13 | 000,258,581 | ---- | M] () -- C:\Users\Admin\Documents\xAD.jpg
[2011.09.11 11:45:13 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll
[2011.09.10 19:35:29 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.09.10 19:35:29 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.09.10 19:35:29 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.09.10 19:35:29 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.09.07 07:10:08 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.08.28 16:40:13 | 003,383,272 | ---- | M] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 16:38:55 | 650,382,612 | ---- | M] () -- C:\Users\Admin\Desktop\ableton_live_trial_822.zip
[2011.08.28 10:25:15 | 000,000,000 | -H-- | M] () -- C:\Users\Admin\Documents\Default.rdp
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.21 17:10:07 | 000,033,135 | ---- | C] () -- C:\Users\Admin\Desktop\vsinit.zip
[2011.09.21 17:08:41 | 000,065,489 | ---- | C] () -- C:\Users\Admin\Desktop\vsutil.zip
[2011.09.20 20:53:26 | 001,327,662 | ---- | C] () -- C:\Users\Admin\Desktop\Vocals unbearbeitet.mp3
[2011.09.19 18:22:12 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.19 16:41:52 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.09.11 15:42:52 | 000,646,244 | ---- | C] () -- C:\Users\Admin\Documents\xDSASBH.jpg
[2011.09.11 15:39:11 | 000,258,581 | ---- | C] () -- C:\Users\Admin\Documents\xAD.jpg
[2011.09.11 11:14:32 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.09.10 19:25:37 | 000,007,607 | ---- | C] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.09 20:29:38 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011.08.28 16:31:26 | 650,382,612 | ---- | C] () -- C:\Users\Admin\Desktop\ableton_live_trial_822.zip
[2011.08.28 10:25:15 | 000,000,000 | -H-- | C] () -- C:\Users\Admin\Documents\Default.rdp
[2011.07.25 14:46:28 | 000,007,168 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.25 14:43:43 | 000,084,480 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.07.11 13:13:31 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll
[2011.07.10 14:08:00 | 000,103,400 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011.07.09 19:30:27 | 000,055,808 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2011.05.04 21:53:22 | 000,591,252 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Minecraft_Server.exe
[2011.05.04 21:53:22 | 000,290,797 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\minecraft_name.jar
[2011.05.04 21:53:22 | 000,232,501 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Minecraft.exe
[2011.05.04 21:53:22 | 000,051,765 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Minecraft.jar
[2011.05.04 21:53:22 | 000,000,230 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\server.properties
[2011.05.04 21:53:22 | 000,000,133 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\zan.settings
[2011.05.04 21:53:22 | 000,000,008 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\lastlogin
[2011.04.19 06:08:17 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.04.12 22:39:58 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.04.12 22:39:58 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2011.04.12 22:39:57 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2011.04.12 22:39:54 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini
[2011.04.12 22:39:53 | 000,009,030 | ---- | C] () -- C:\Windows\HL-2030.INI
[2011.04.12 22:38:54 | 000,000,054 | ---- | C] () -- C:\Windows\System32\bd2030.dat
[2011.04.12 22:37:45 | 000,000,260 | ---- | C] () -- C:\Windows\Brownie.ini
[2010.06.17 17:00:00 | 002,761,119 | ---- | C] () -- C:\Windows\System32\Melodyne editor.dll
[2009.10.20 20:19:30 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 10:47:43 | 000,643,628 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,126,188 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,415,560 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,606,992 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,103,370 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
 
========== LOP Check ==========
 
[2011.08.28 17:37:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ableton
[2011.04.13 20:27:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ashampoo
[2011.04.26 15:37:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\avidemux
[2011.06.05 16:29:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon
[2011.05.04 21:53:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\bin
[2011.07.10 14:07:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\de.txptr.googleplus
[2011.04.12 18:17:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EPSON
[2011.05.14 20:51:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2011.07.28 07:25:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeFLVConverter
[2011.09.18 11:46:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ICQ
[2011.05.04 21:53:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\minecraft_name_src
[2011.05.12 18:08:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Need for Speed World
[2011.04.14 21:43:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2011.05.04 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2011.05.04 21:53:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\resources
[2011.01.20 17:56:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\saves
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server 2
[2011.01.03 17:32:53 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\texturepacks
[2011.04.14 14:40:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TS3Client
[2011.05.04 21:53:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\world
[2011.05.17 20:51:33 | 000,012,724 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\XZRDABX.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\Tasks\Ygwsnc.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2011.09.21 16:50:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\ZA_PreservedFiles
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.08.28 17:37:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ableton
[2011.09.09 20:34:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Apple Computer
[2011.04.13 20:27:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ashampoo
[2011.04.26 15:37:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\avidemux
[2011.05.06 19:06:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Avira
[2011.06.05 16:29:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon
[2011.05.04 21:53:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\bin
[2011.04.14 21:02:13 | 000,000,000 | R--D | M] -- C:\Users\Admin\AppData\Roaming\Brother
[2011.07.10 14:07:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\de.txptr.googleplus
[2011.04.26 16:04:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DivX
[2011.08.22 21:58:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\dvdcss
[2011.04.12 18:17:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EPSON
[2011.05.14 20:51:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2011.07.28 07:25:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeFLVConverter
[2011.09.19 18:22:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Help
[2011.09.18 11:46:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ICQ
[2011.04.09 16:29:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Identities
[2011.09.19 16:42:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2011.08.01 18:32:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Media Player Classic
[2011.09.20 15:35:54 | 000,000,000 | --SD | M] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2011.05.04 21:53:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\minecraft_name_src
[2011.04.09 16:31:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mozilla
[2011.06.28 19:40:27 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\NCH Software
[2011.05.12 18:08:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Need for Speed World
[2011.04.30 17:00:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Nero
[2011.04.14 21:43:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2011.05.04 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2011.05.04 21:53:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\resources
[2011.01.20 17:56:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\saves
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server
[2011.05.04 21:53:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Server 2
[2011.09.19 20:12:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Skype
[2011.06.19 19:59:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\skypePM
[2011.01.03 17:32:53 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\texturepacks
[2011.04.14 14:40:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TS3Client
[2011.08.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\vlc
[2011.04.09 18:33:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WinRAR
[2011.05.04 21:53:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\world
 
< %APPDATA%\*.exe /s >
[2010.12.22 17:49:28 | 000,232,501 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Minecraft.exe
[2010.10.21 03:00:00 | 000,695,296 | ---- | M] (AnjoCaido) -- C:\Users\Admin\AppData\Roaming\MinecraftSP.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Minecraft_Server.exe
[2011.07.10 14:03:19 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.07.11 13:20:54 | 000,008,192 | R--- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{1B77BC7B-4538-4652-AF33-C201F21BF8F2}\Icon1B77BC7B.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\minecraft_name_src\Minecraft_Server.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Server 2\Minecraft_Server.exe
[2011.03.19 15:54:46 | 000,591,252 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Server\Minecraft_Server.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2011.05.18 07:16:39 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=7BD7F45FF37FA0669CD32CA0EF46E22C -- C:\Windows\System32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\System32\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011.04.30 16:45:47 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
--- --- ---

cosinus 21.09.2011 19:46
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
DRV - File not found [Kernel | Unknown | Running] --  -- (Vsdatant)
[2011.08.28 16:41:42 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\toolbar@ask.com
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Lan.FS] C:\Program Files\Lan.FS\Lan-fs.exe ()
O4 - HKCU..\RunOnce: [KeApplet] C:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.12.25 15:32:25 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.05.11 17:34:10 | 000,045,056 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005.05.11 16:49:08 | 000,000,042 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
[2011.08.28 16:40:06 | 003,383,272 | ---- | C] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Lan.Fs
[2011.08.28 10:35:33 | 000,000,000 | ---D | C] -- C:\Program Files\Lan.FS
[2011.08.27 18:42:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Xara
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei4
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei2
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei3
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei1
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei7
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei5
[2011.09.18 20:40:22 | 000,000,468 | ---- | M] () -- C:\Windows\System32\Datei0
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei9
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei8
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei10
[2011.09.18 20:40:22 | 000,000,465 | ---- | M] () -- C:\Windows\System32\Datei6
[2011.09.18 20:25:42 | 000,007,607 | ---- | M] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Ygwsnc.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\XZRDABX.job
[2011.09.19 18:22:12 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.11 11:14:32 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.05.17 20:51:33 | 000,012,724 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\XZRDABX.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\Tasks\Ygwsnc.job
[2011.09.21 16:50:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\ZA_PreservedFiles
:Files
C:\Program Files\Ask.com
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

siggy 22.09.2011 14:38
der otl fix funktioniert nicht, es stürzt ab
AntiViren Programm etc waren alle ausgeschaltet.
ich habe mal ein screen gemacht

http://img13.imageshack.us/img13/1672/otlfehler.jpg

cosinus 22.09.2011 15:04
Probiers mit diesem Text:

Code:
:OTL
[2011.08.28 16:41:42 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\toolbar@ask.com
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Lan.FS] C:\Program Files\Lan.FS\Lan-fs.exe ()
O4 - HKCU..\RunOnce: [KeApplet] C:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.12.25 15:32:25 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.05.11 17:34:10 | 000,045,056 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005.05.11 16:49:08 | 000,000,042 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
[2011.08.28 16:40:06 | 003,383,272 | ---- | C] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Lan.Fs
[2011.08.28 10:35:33 | 000,000,000 | ---D | C] -- C:\Program Files\Lan.FS
[2011.08.27 18:42:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Xara
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei4
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei2
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei3
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei1
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei7
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei5
[2011.09.18 20:40:22 | 000,000,468 | ---- | M] () -- C:\Windows\System32\Datei0
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei9
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei8
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei10
[2011.09.18 20:40:22 | 000,000,465 | ---- | M] () -- C:\Windows\System32\Datei6
[2011.09.18 20:25:42 | 000,007,607 | ---- | M] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Ygwsnc.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\XZRDABX.job
[2011.09.19 18:22:12 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.11 11:14:32 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.05.17 20:51:33 | 000,012,724 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\XZRDABX.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\Tasks\Ygwsnc.job
[2011.09.21 16:50:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\ZA_PreservedFiles
:Files
C:\Program Files\Ask.com
:Commands
[emptytemp]
[resethosts]

siggy 22.09.2011 15:32
immer noch keine Rückmeldung nach 27 minuten.

diesmal liegt es daran :
http://img577.imageshack.us/img577/613/otlfehler2.jpg

edit//
gibt es vielleicht sonst noch irgendetwas zu beachten ?
bzw ist es sogar normal das es so lange dauert ?

cosinus 22.09.2011 15:37
Dann lassen wir auch diese Zeile weg, probier mit diesem Text:

Code:
:OTL
[2011.08.28 16:41:42 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\toolbar@ask.com
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Lan.FS] C:\Program Files\Lan.FS\Lan-fs.exe ()
O4 - HKCU..\RunOnce: [KeApplet] C:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.12.25 15:32:25 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.05.11 17:34:10 | 000,045,056 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005.05.11 16:49:08 | 000,000,042 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
[2011.08.28 16:40:06 | 003,383,272 | ---- | C] (Search-Results) -- C:\Users\Admin\Desktop\ApnToolbarInstaller.exe
[2011.08.28 10:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Lan.Fs
[2011.08.28 10:35:33 | 000,000,000 | ---D | C] -- C:\Program Files\Lan.FS
[2011.08.27 18:42:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Xara
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei4
[2011.09.18 20:40:22 | 000,000,471 | ---- | M] () -- C:\Windows\System32\Datei2
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei3
[2011.09.18 20:40:22 | 000,000,470 | ---- | M] () -- C:\Windows\System32\Datei1
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei7
[2011.09.18 20:40:22 | 000,000,469 | ---- | M] () -- C:\Windows\System32\Datei5
[2011.09.18 20:40:22 | 000,000,468 | ---- | M] () -- C:\Windows\System32\Datei0
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei9
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei8
[2011.09.18 20:40:22 | 000,000,467 | ---- | M] () -- C:\Windows\System32\Datei10
[2011.09.18 20:40:22 | 000,000,465 | ---- | M] () -- C:\Windows\System32\Datei6
[2011.09.18 20:25:42 | 000,007,607 | ---- | M] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\tasks\Ygwsnc.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\XZRDABX.job
[2011.09.19 18:22:12 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\mkwdob.sys
[2011.09.11 11:14:32 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.05.17 20:51:33 | 000,012,724 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.18 20:24:56 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\Xilv.job
[2011.09.18 20:24:50 | 000,000,302 | -HS- | M] () -- C:\Windows\Tasks\XZRDABX.job
[2011.09.18 20:24:50 | 000,000,304 | -HS- | M] () -- C:\Windows\Tasks\Ygwsnc.job
[2011.09.21 16:50:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Application Data\ZA_PreservedFiles
:Files
C:\Program Files\Ask.com
:Commands
[emptytemp]
[resethosts]

siggy 22.09.2011 16:03
All processes killed
========== OTL ==========
Folder C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\llxo0yp0.default\extensions\toolbar@ask.com\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Programme\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Lan.FS deleted successfully.
C:\Programme\Lan.FS\Lan-fs.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\KeApplet not found.
C:\Users\Admin\AppData\Local\Temp\ke64tnkff.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
D:\autoexec.bat moved successfully.
E:\AUTOEXEC.BAT moved successfully.
File move failed. K:\Autorun.exe scheduled to be moved on reboot.
File move failed. K:\Autorun.inf scheduled to be moved on reboot.
C:\Users\Admin\Desktop\ApnToolbarInstaller.exe moved successfully.
C:\ProgramData\Lan.Fs\Profile\Sound folder moved successfully.
C:\ProgramData\Lan.Fs\Profile\Settings folder moved successfully.
C:\ProgramData\Lan.Fs\Profile\Emoticons folder moved successfully.
C:\ProgramData\Lan.Fs\Profile folder moved successfully.
C:\ProgramData\Lan.Fs folder moved successfully.
C:\Program Files\Lan.FS folder moved successfully.
C:\Users\Admin\AppData\Local\Xara\MAGIX 3D Maker embeded\Updates\ENG folder moved successfully.
C:\Users\Admin\AppData\Local\Xara\MAGIX 3D Maker embeded\Updates\DEU folder moved successfully.
C:\Users\Admin\AppData\Local\Xara\MAGIX 3D Maker embeded\Updates folder moved successfully.
C:\Users\Admin\AppData\Local\Xara\MAGIX 3D Maker embeded folder moved successfully.
C:\Users\Admin\AppData\Local\Xara folder moved successfully.
C:\Windows\System32\Datei4 moved successfully.
C:\Windows\System32\Datei2 moved successfully.
C:\Windows\System32\Datei3 moved successfully.
C:\Windows\System32\Datei1 moved successfully.
C:\Windows\System32\Datei7 moved successfully.
C:\Windows\System32\Datei5 moved successfully.
C:\Windows\System32\Datei0 moved successfully.
C:\Windows\System32\Datei9 moved successfully.
C:\Windows\System32\Datei8 moved successfully.
C:\Windows\System32\Datei10 moved successfully.
C:\Windows\System32\Datei6 moved successfully.
C:\Users\Admin\AppData\Local\Resmon.ResmonCfg moved successfully.
C:\Windows\Tasks\Xilv.job moved successfully.
C:\Windows\Tasks\Ygwsnc.job moved successfully.
C:\Windows\Tasks\XZRDABX.job moved successfully.
C:\Windows\System32\drivers\mkwdob.sys moved successfully.
C:\Windows\patchw32.dll moved successfully.
File move failed. C:\Windows\Tasks\SCHEDLGU.TXT scheduled to be moved on reboot.
File C:\Windows\Tasks\Xilv.job not found.
File C:\Windows\Tasks\XZRDABX.job not found.
File C:\Windows\Tasks\Ygwsnc.job not found.
C:\ProgramData\Application Data\ZA_PreservedFiles folder moved successfully.
========== FILES ==========
C:\Program Files\Ask.com\Updater folder moved successfully.
C:\Program Files\Ask.com\assets\oobe folder moved successfully.
C:\Program Files\Ask.com\assets folder moved successfully.
C:\Program Files\Ask.com folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 2000942757 bytes
->Temporary Internet Files folder emptied: 365869675 bytes
->Java cache emptied: 1635853 bytes
->FireFox cache emptied: 119609388 bytes
->Opera cache emptied: 2311234 bytes
->Flash cache emptied: 166258 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 54236695 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2.427,00 mb

HOSTS file reset successfully

OTL by OldTimer - Version 3.2.29.1 log created on 09222011_164621

Files\Folders moved on Reboot...
File move failed. K:\Autorun.exe scheduled to be moved on reboot.
File move failed. K:\Autorun.inf scheduled to be moved on reboot.
File move failed. C:\Windows\Tasks\SCHEDLGU.TXT scheduled to be moved on reboot.
File move failed. C:\Windows\S421F1A66.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 22.09.2011 19:37
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

siggy 22.09.2011 20:25
2011/09/22 21:20:46.0751 2424 TDSS rootkit removing tool 2.5.23.0 Sep 20 2011 08:53:10
2011/09/22 21:20:46.0938 2424 ================================================================================
2011/09/22 21:20:46.0938 2424 SystemInfo:
2011/09/22 21:20:46.0938 2424
2011/09/22 21:20:46.0938 2424 OS Version: 6.1.7600 ServicePack: 0.0
2011/09/22 21:20:46.0938 2424 Product type: Workstation
2011/09/22 21:20:46.0938 2424 ComputerName: ADMIN-PC
2011/09/22 21:20:46.0938 2424 UserName: Admin
2011/09/22 21:20:46.0938 2424 Windows directory: C:\Windows
2011/09/22 21:20:46.0938 2424 System windows directory: C:\Windows
2011/09/22 21:20:46.0938 2424 Processor architecture: Intel x86
2011/09/22 21:20:46.0938 2424 Number of processors: 1
2011/09/22 21:20:46.0938 2424 Page size: 0x1000
2011/09/22 21:20:46.0938 2424 Boot type: Normal boot
2011/09/22 21:20:46.0938 2424 ================================================================================
2011/09/22 21:20:48.0498 2424 Initialize success
2011/09/22 21:20:53.0490 2920 ================================================================================
2011/09/22 21:20:53.0490 2920 Scan started
2011/09/22 21:20:53.0490 2920 Mode: Manual;
2011/09/22 21:20:53.0490 2920 ================================================================================
2011/09/22 21:20:54.0410 2920 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/09/22 21:20:54.0442 2920 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
2011/09/22 21:20:54.0473 2920 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/09/22 21:20:54.0535 2920 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/09/22 21:20:54.0582 2920 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/09/22 21:20:54.0629 2920 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/09/22 21:20:54.0707 2920 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys
2011/09/22 21:20:54.0754 2920 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
2011/09/22 21:20:54.0785 2920 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/09/22 21:20:54.0816 2920 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
2011/09/22 21:20:54.0847 2920 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
2011/09/22 21:20:54.0878 2920 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
2011/09/22 21:20:54.0941 2920 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/22 21:20:54.0956 2920 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/09/22 21:20:55.0066 2920 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys
2011/09/22 21:20:55.0097 2920 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/09/22 21:20:55.0144 2920 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys
2011/09/22 21:20:55.0253 2920 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
2011/09/22 21:20:55.0471 2920 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/09/22 21:20:55.0534 2920 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/09/22 21:20:55.0580 2920 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/22 21:20:55.0627 2920 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
2011/09/22 21:20:55.0721 2920 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/09/22 21:20:55.0814 2920 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/22 21:20:55.0955 2920 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/09/22 21:20:56.0095 2920 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/09/22 21:20:56.0173 2920 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/09/22 21:20:56.0267 2920 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/09/22 21:20:56.0376 2920 bowser (fcafaef6798d7b51ff029f99a9898961) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/22 21:20:56.0438 2920 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/09/22 21:20:56.0485 2920 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/09/22 21:20:56.0579 2920 BrPar (2fe6d5be0629f706197b30c0aa05de30) C:\Windows\System32\drivers\BrPar.sys
2011/09/22 21:20:56.0641 2920 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/09/22 21:20:56.0688 2920 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/09/22 21:20:56.0750 2920 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/09/22 21:20:56.0813 2920 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/09/22 21:20:56.0875 2920 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/09/22 21:20:56.0984 2920 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/22 21:20:57.0031 2920 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/22 21:20:57.0094 2920 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/09/22 21:20:57.0172 2920 CLEDX (b53f9635457b56dcffef750e18aec6cb) C:\Windows\system32\DRIVERS\cledx.sys
2011/09/22 21:20:57.0218 2920 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/09/22 21:20:57.0296 2920 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/09/22 21:20:57.0343 2920 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
2011/09/22 21:20:57.0390 2920 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/09/22 21:20:57.0452 2920 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/09/22 21:20:57.0499 2920 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/09/22 21:20:57.0593 2920 cpuz135 (c2eb4539a4f6ab6edd01bdc191619975) C:\Windows\system32\drivers\cpuz135_x32.sys
2011/09/22 21:20:57.0624 2920 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/09/22 21:20:57.0718 2920 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys
2011/09/22 21:20:57.0842 2920 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys
2011/09/22 21:20:57.0889 2920 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/09/22 21:20:57.0967 2920 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/09/22 21:20:58.0045 2920 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/09/22 21:20:58.0139 2920 DXGKrnl (c94b6c3cc628179cb9b9061c19888b99) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/22 21:20:58.0201 2920 E1G60 (22ef8965101685add128f03a2b03ce16) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/22 21:20:58.0373 2920 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/09/22 21:20:58.0544 2920 ElbyCDFL (ce37e3d51912e59c80c6d84337c0b4cd) C:\Windows\system32\Drivers\ElbyCDFL.sys
2011/09/22 21:20:58.0622 2920 ElbyCDIO (aaa8999a169e39fb8b48ae49cd6ac30a) C:\Windows\system32\Drivers\ElbyCDIO.sys
2011/09/22 21:20:58.0685 2920 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/09/22 21:20:58.0732 2920 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
2011/09/22 21:20:58.0825 2920 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/09/22 21:20:58.0888 2920 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/09/22 21:20:58.0966 2920 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/22 21:20:59.0028 2920 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/09/22 21:20:59.0075 2920 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/09/22 21:20:59.0137 2920 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/22 21:20:59.0200 2920 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/09/22 21:20:59.0278 2920 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/09/22 21:20:59.0324 2920 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/22 21:20:59.0356 2920 fvevol (5592f5dba26282d24d2b080eb438a4d7) C:\Windows\system32\DRIVERS\fvevol.sys
2011/09/22 21:20:59.0418 2920 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/09/22 21:20:59.0496 2920 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/09/22 21:20:59.0668 2920 hamachi (833051c6c6c42117191935f734cfbd97) C:\Windows\system32\DRIVERS\hamachi.sys
2011/09/22 21:20:59.0761 2920 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/09/22 21:20:59.0824 2920 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2011/09/22 21:20:59.0917 2920 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/22 21:20:59.0964 2920 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/09/22 21:21:00.0011 2920 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/09/22 21:21:00.0073 2920 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/09/22 21:21:00.0167 2920 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/22 21:21:00.0245 2920 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/09/22 21:21:00.0307 2920 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
2011/09/22 21:21:00.0354 2920 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
2011/09/22 21:21:00.0416 2920 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/22 21:21:00.0463 2920 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys
2011/09/22 21:21:00.0526 2920 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/09/22 21:21:00.0697 2920 IntcAzAudAddService (bfcd7edc663f513e7c4a0b9400e58c70) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/22 21:21:00.0838 2920 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
2011/09/22 21:21:00.0900 2920 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/22 21:21:00.0947 2920 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/22 21:21:01.0009 2920 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/09/22 21:21:01.0056 2920 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/09/22 21:21:01.0134 2920 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/09/22 21:21:01.0181 2920 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
2011/09/22 21:21:01.0228 2920 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/22 21:21:01.0337 2920 ISODrive (2f03ceb28307983f3b36216d35ffa5aa) C:\Program Files\UltraISO\drivers\ISODrive.sys
2011/09/22 21:21:01.0384 2920 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/22 21:21:01.0430 2920 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/22 21:21:01.0493 2920 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/22 21:21:01.0540 2920 KSecPkg (26c046977e85b95036453d7b88ba1820) C:\Windows\system32\Drivers\ksecpkg.sys
2011/09/22 21:21:01.0633 2920 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/22 21:21:01.0711 2920 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/09/22 21:21:01.0774 2920 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/09/22 21:21:01.0820 2920 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/09/22 21:21:01.0867 2920 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/09/22 21:21:01.0930 2920 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/09/22 21:21:01.0992 2920 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys
2011/09/22 21:21:02.0117 2920 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/09/22 21:21:02.0179 2920 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/09/22 21:21:02.0242 2920 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/09/22 21:21:02.0351 2920 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/22 21:21:02.0429 2920 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/22 21:21:02.0476 2920 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/22 21:21:02.0522 2920 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
2011/09/22 21:21:02.0585 2920 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
2011/09/22 21:21:02.0632 2920 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/22 21:21:02.0694 2920 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
2011/09/22 21:21:02.0741 2920 mrxsmb (f4a054be78af7f410129c4b64b07dc9b) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/22 21:21:03.0068 2920 mrxsmb10 (deffa295bd1895c6ed8e3078412ac60b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/22 21:21:03.0443 2920 mrxsmb20 (24d76abe5dcad22f19d105f76fdf0ce1) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/22 21:21:03.0552 2920 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
2011/09/22 21:21:03.0646 2920 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
2011/09/22 21:21:03.0708 2920 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/09/22 21:21:03.0770 2920 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/09/22 21:21:03.0817 2920 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/09/22 21:21:03.0895 2920 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/22 21:21:03.0973 2920 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/22 21:21:04.0020 2920 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/09/22 21:21:04.0082 2920 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/09/22 21:21:04.0145 2920 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/22 21:21:04.0192 2920 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/09/22 21:21:04.0238 2920 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/09/22 21:21:04.0285 2920 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/09/22 21:21:04.0394 2920 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/22 21:21:04.0488 2920 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys
2011/09/22 21:21:04.0550 2920 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/09/22 21:21:04.0613 2920 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/22 21:21:04.0660 2920 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/22 21:21:04.0706 2920 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/22 21:21:04.0847 2920 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
2011/09/22 21:21:04.0894 2920 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/22 21:21:04.0956 2920 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/22 21:21:05.0081 2920 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/09/22 21:21:05.0174 2920 NPF (b9730495e0cf674680121e34bd95a73b) C:\Windows\system32\drivers\npf.sys
2011/09/22 21:21:05.0221 2920 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/09/22 21:21:05.0284 2920 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/22 21:21:05.0424 2920 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys
2011/09/22 21:21:05.0767 2920 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/09/22 21:21:05.0892 2920 NVENETFD (b5e37e31c053bc9950455a257526514b) C:\Windows\system32\DRIVERS\nvm62x32.sys
2011/09/22 21:21:06.0422 2920 nvlddmkm (b0881dda5a8160422561ffab7f0008b1) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/22 21:21:06.0656 2920 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys
2011/09/22 21:21:06.0719 2920 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys
2011/09/22 21:21:06.0797 2920 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/09/22 21:21:06.0844 2920 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/22 21:21:06.0922 2920 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/09/22 21:21:06.0968 2920 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
2011/09/22 21:21:07.0015 2920 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/09/22 21:21:07.0093 2920 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
2011/09/22 21:21:07.0140 2920 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
2011/09/22 21:21:07.0187 2920 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/09/22 21:21:07.0234 2920 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/09/22 21:21:07.0296 2920 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/09/22 21:21:07.0483 2920 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/22 21:21:07.0546 2920 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/09/22 21:21:07.0670 2920 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/22 21:21:07.0748 2920 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/09/22 21:21:07.0826 2920 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/09/22 21:21:07.0904 2920 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/22 21:21:07.0951 2920 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/22 21:21:07.0998 2920 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/09/22 21:21:08.0060 2920 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/22 21:21:08.0123 2920 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/22 21:21:08.0185 2920 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2011/09/22 21:21:08.0248 2920 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/22 21:21:08.0294 2920 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/09/22 21:21:08.0372 2920 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/22 21:21:08.0419 2920 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys
2011/09/22 21:21:08.0466 2920 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/22 21:21:08.0528 2920 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2011/09/22 21:21:08.0575 2920 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
2011/09/22 21:21:08.0638 2920 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys
2011/09/22 21:21:08.0794 2920 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/22 21:21:08.0856 2920 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys
2011/09/22 21:21:08.0950 2920 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/09/22 21:21:09.0028 2920 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
2011/09/22 21:21:09.0106 2920 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/09/22 21:21:09.0184 2920 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/22 21:21:09.0246 2920 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/09/22 21:21:09.0293 2920 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/09/22 21:21:09.0402 2920 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/09/22 21:21:09.0433 2920 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/09/22 21:21:09.0480 2920 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/09/22 21:21:09.0511 2920 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/09/22 21:21:09.0589 2920 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
2011/09/22 21:21:09.0636 2920 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/09/22 21:21:09.0683 2920 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/09/22 21:21:09.0730 2920 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/09/22 21:21:09.0808 2920 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/09/22 21:21:09.0948 2920 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/09/22 21:21:09.0948 2920 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/09/22 21:21:09.0979 2920 sptd - detected LockedFile.Multi.Generic (1)
2011/09/22 21:21:10.0026 2920 srv (2ba4ebc7dfba845a1edbe1f75913be33) C:\Windows\system32\DRIVERS\srv.sys
2011/09/22 21:21:10.0073 2920 srv2 (dce7e10feaabd4cae95948b3de5340bb) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/22 21:21:10.0135 2920 srvnet (b5665baa2120b8a54e22e9cd07c05106) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/22 21:21:10.0213 2920 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/22 21:21:10.0291 2920 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/09/22 21:21:10.0369 2920 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys
2011/09/22 21:21:10.0416 2920 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys
2011/09/22 21:21:10.0478 2920 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/22 21:21:10.0603 2920 Tcpip (2cc3d75488abd3ec628bbb9a4fc84efc) C:\Windows\system32\drivers\tcpip.sys
2011/09/22 21:21:10.0681 2920 TCPIP6 (2cc3d75488abd3ec628bbb9a4fc84efc) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/22 21:21:10.0775 2920 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/22 21:21:10.0822 2920 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys
2011/09/22 21:21:10.0868 2920 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys
2011/09/22 21:21:10.0915 2920 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/22 21:21:10.0962 2920 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/22 21:21:11.0087 2920 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/22 21:21:11.0149 2920 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/22 21:21:11.0180 2920 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/09/22 21:21:11.0243 2920 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/22 21:21:11.0321 2920 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/09/22 21:21:11.0383 2920 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/22 21:21:11.0430 2920 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/09/22 21:21:11.0508 2920 usbaudio (2436a42aab4ad48a9b714e5b0f344627) C:\Windows\system32\drivers\usbaudio.sys
2011/09/22 21:21:11.0555 2920 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/22 21:21:11.0617 2920 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
2011/09/22 21:21:11.0664 2920 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/22 21:21:11.0726 2920 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/22 21:21:11.0773 2920 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/22 21:21:11.0820 2920 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/22 21:21:11.0898 2920 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
2011/09/22 21:21:11.0945 2920 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/22 21:21:12.0007 2920 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/22 21:21:12.0085 2920 usbvideo (f642a7e4bf78cfa359cca0a3557c28d7) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/22 21:21:12.0179 2920 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/09/22 21:21:12.0226 2920 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/22 21:21:12.0288 2920 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/09/22 21:21:12.0319 2920 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/09/22 21:21:12.0382 2920 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
2011/09/22 21:21:12.0428 2920 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/09/22 21:21:12.0475 2920 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
2011/09/22 21:21:12.0522 2920 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys
2011/09/22 21:21:12.0569 2920 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys
2011/09/22 21:21:12.0616 2920 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/09/22 21:21:12.0662 2920 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/09/22 21:21:12.0725 2920 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
2011/09/22 21:21:12.0787 2920 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/09/22 21:21:12.0850 2920 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
2011/09/22 21:21:12.0928 2920 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/09/22 21:21:12.0990 2920 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/22 21:21:13.0021 2920 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/22 21:21:13.0146 2920 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/09/22 21:21:13.0193 2920 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/22 21:21:13.0333 2920 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/09/22 21:21:13.0380 2920 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/09/22 21:21:13.0520 2920 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/09/22 21:21:13.0630 2920 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/22 21:21:13.0723 2920 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
2011/09/22 21:21:13.0786 2920 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/22 21:21:14.0082 2920 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/09/22 21:21:14.0129 2920 MBR (0x1B8) (0792f22bcc85cfd3b28324561fffcabb) \Device\Harddisk1\DR1
2011/09/22 21:21:14.0191 2920 Boot (0x1200) (ccd3177a71457eb762cf28634128ac37) \Device\Harddisk0\DR0\Partition0
2011/09/22 21:21:14.0222 2920 Boot (0x1200) (9c9e6a8eab04ad9f6070fef280da98f6) \Device\Harddisk0\DR0\Partition1
2011/09/22 21:21:14.0254 2920 Boot (0x1200) (0d6e6dbba5ad5efd6e391b122011cbf6) \Device\Harddisk1\DR1\Partition0
2011/09/22 21:21:14.0269 2920 ================================================================================
2011/09/22 21:21:14.0269 2920 Scan finished
2011/09/22 21:21:14.0269 2920 ================================================================================
2011/09/22 21:21:14.0300 2520 Detected object count: 1
2011/09/22 21:21:14.0300 2520 Actual detected object count: 1
2011/09/22 21:21:24.0440 2520 LockedFile.Multi.Generic(sptd) - User select action: Skip

cosinus 22.09.2011 20:55
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

siggy 22.09.2011 21:54
Combofix Logfile:
Code:
ComboFix 11-09-22.03 - Admin 22.09.2011  22:28:24.1.1 - x86
Microsoft Windows 7 Ultimate  6.1.7600.0.1252.49.1031.18.959.523 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\newdnswatch
c:\newdnswatch\8BF491C5AB2.exe
c:\newdnswatch\8FB29FA0128EF7E
c:\users\Admin\AppData\Roaming\Help\coredb\storage
c:\users\Admin\AppData\Roaming\Minecraft.exe
c:\users\Admin\AppData\Roaming\Minecraft_Server.exe
c:\users\Admin\AppData\Roaming\server
c:\users\Admin\AppData\Roaming\server\banned-ips.txt
c:\users\Admin\AppData\Roaming\server\banned-players.txt
c:\users\Admin\AppData\Roaming\server\Minecraft_Server.exe
c:\users\Admin\AppData\Roaming\server\ops.txt
c:\users\Admin\AppData\Roaming\server\server.log
c:\users\Admin\AppData\Roaming\server\server.properties
c:\users\Admin\AppData\Roaming\server\white-list.txt
c:\users\Admin\AppData\Roaming\server\world\level.dat
c:\users\Admin\AppData\Roaming\server\world\level.dat_old
c:\users\Admin\AppData\Roaming\server\world\players\balktrex.dat
c:\users\Admin\AppData\Roaming\server\world\players\Gamesplitter.dat
c:\users\Admin\AppData\Roaming\server\world\players\Leo321.dat
c:\users\Admin\AppData\Roaming\server\world\players\Lordhelmchen.dat
c:\users\Admin\AppData\Roaming\server\world\players\Mandarak.dat
c:\users\Admin\AppData\Roaming\server\world\region\r.-1.-1.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.-1.-2.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.-1.0.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.-2.-1.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.-2.-2.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.-2.0.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.0.-1.mcr
c:\users\Admin\AppData\Roaming\server\world\region\r.0.0.mcr
c:\users\Admin\AppData\Roaming\server\world\session.lock
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-22 bis 2011-09-22  ))))))))))))))))))))))))))))))
.
.
2011-09-22 20:38 . 2011-09-22 20:38        --------        d-----w-        c:\windows\ServiceProfiles\NetworkService\AppData\Local\temp
2011-09-22 20:38 . 2011-09-22 20:38        --------        d-----w-        c:\windows\ServiceProfiles\LocalService\AppData\Local\temp
2011-09-22 20:38 . 2011-09-22 20:38        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-09-21 19:40 . 2011-09-21 19:40        --------        d-----w-        C:\_OTL
2011-09-19 16:31 . 2011-09-19 16:31        --------        d-----w-        c:\program files\ESET
2011-09-19 14:42 . 2011-09-19 14:42        --------        d-----w-        c:\users\Admin\AppData\Roaming\Malwarebytes
2011-09-19 14:41 . 2011-09-19 14:41        --------        d-----w-        c:\programdata\Malwarebytes
2011-09-19 14:41 . 2011-09-19 16:21        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-09-19 14:41 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-09-11 09:45 . 2011-09-11 09:45        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
2011-09-11 09:14 . 2011-09-11 09:14        --------        d-----w-        c:\program files\Common Files\PocketSoft
2011-09-09 18:33 . 2011-09-09 18:34        --------        d-----w-        c:\users\Admin\AppData\Roaming\Apple Computer
2011-09-09 18:33 . 2011-09-09 18:33        --------        d-----w-        c:\users\Admin\AppData\Local\Apple Computer
2011-09-09 18:32 . 2011-09-09 18:32        --------        dc----w-        c:\windows\system32\DRVSTORE
2011-09-09 18:32 . 2009-05-18 11:17        26600        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys
2011-09-09 18:32 . 2008-04-17 10:12        107368        ----a-w-        c:\windows\system32\GEARAspi.dll
2011-09-09 18:29 . 2011-09-09 18:29        --------        d-----w-        c:\users\Admin\AppData\Local\Apple
2011-09-09 18:29 . 2011-09-09 18:29        --------        d-----w-        c:\program files\Apple Software Update
2011-09-09 18:28 . 2011-09-09 18:28        --------        d-----w-        c:\program files\Bonjour
2011-09-09 18:28 . 2011-09-09 18:31        --------        d-----w-        c:\program files\Common Files\Apple
2011-09-09 18:28 . 2011-09-09 18:28        --------        d-----w-        c:\programdata\Apple
2011-09-05 19:48 . 2011-09-05 19:54        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-28 15:37 . 2011-08-28 15:37        --------        d-----w-        c:\programdata\Ableton
2011-08-28 15:37 . 2011-08-28 15:37        --------        d-----w-        c:\users\Admin\AppData\Roaming\Ableton
2011-08-28 14:46 . 2011-08-28 14:46        --------        d-----w-        c:\program files\Ableton
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-22 19:18 . 2011-07-09 17:46        0        --sh--w-        c:\windows\S421F1A66.tmp
2011-07-29 19:34 . 2011-04-19 09:36        66616        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2011-07-29 19:34 . 2011-04-19 09:36        138192        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2011-07-15 10:49 . 2011-07-28 05:24        313208        ----a-w-        c:\windows\system32\TubeFinder.exe
2011-07-12 09:20 . 2011-07-12 09:20        83816        ----a-w-        c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20        73064        ----a-w-        c:\windows\system32\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20        50536        ----a-w-        c:\windows\system32\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20        178536        ----a-w-        c:\windows\system32\dnssdX.dll
2011-07-11 11:20 . 2011-07-11 11:20        8192        ----a-r-        c:\users\Admin\AppData\Roaming\Microsoft\Installer\{1B77BC7B-4538-4652-AF33-C201F21BF8F2}\Icon1B77BC7B.exe
2011-07-05 16:37 . 2011-07-05 16:37        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2011-09-07 14:26 . 2011-04-09 14:31        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-05-18 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 33120]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-03-28 10029672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv
.
R0 ndiu;ndiu;c:\windows\System32\drivers\mkwdob.sys [x]
R3 GPU-Z;GPU-Z;c:\users\Admin\AppData\Local\Temp\GPU-Z.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-18 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-04-30 691696]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 1361288]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
.
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\llxo0yp0.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-5Z3U4G4IZCXEZEWW - c:\newdnswatch\8BF491C5AB2.exe
AddRemove-Local Area Network File Send 2_is1 - c:\program files\Lan.FS\unins000.exe
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\conhost.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\WUDFHost.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskmgr.exe
c:\program files\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-22  22:47:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-09-22 20:47
.
Vor Suchlauf: 8 Verzeichnis(se), 667.475.525.632 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 667.142.402.048 Bytes frei
.
- - End Of File - - 1B8071250D3D04ADE2242EC52C76D05D
--- --- ---

cosinus 23.09.2011 08:44
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
File::
c:\windows\System32\drivers\mkwdob.sys

Driver::
ndiu
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

siggy 23.09.2011 18:45
Combofix Logfile:
Code:
ComboFix 11-09-23.03 - Admin 23.09.2011  17:52:17.2.1 - x86
Microsoft Windows 7 Ultimate  6.1.7600.0.1252.49.1031.18.959.423 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Admin\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
FILE ::
"c:\windows\System32\drivers\mkwdob.sys"
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ndiu
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-23 bis 2011-09-23  ))))))))))))))))))))))))))))))
.
.
2011-09-23 16:04 . 2011-09-23 16:04        --------        d-----w-        c:\windows\ServiceProfiles\NetworkService\AppData\Local\temp
2011-09-21 19:40 . 2011-09-21 19:40        --------        d-----w-        C:\_OTL
2011-09-19 16:31 . 2011-09-19 16:31        --------        d-----w-        c:\program files\ESET
2011-09-19 14:42 . 2011-09-19 14:42        --------        d-----w-        c:\users\Admin\AppData\Roaming\Malwarebytes
2011-09-19 14:41 . 2011-09-19 14:41        --------        d-----w-        c:\programdata\Malwarebytes
2011-09-19 14:41 . 2011-09-19 16:21        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-09-19 14:41 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-09-11 09:45 . 2011-09-11 09:45        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
2011-09-11 09:14 . 2011-09-11 09:14        --------        d-----w-        c:\program files\Common Files\PocketSoft
2011-09-09 18:33 . 2011-09-09 18:34        --------        d-----w-        c:\users\Admin\AppData\Roaming\Apple Computer
2011-09-09 18:33 . 2011-09-09 18:33        --------        d-----w-        c:\users\Admin\AppData\Local\Apple Computer
2011-09-09 18:32 . 2011-09-09 18:32        --------        dc----w-        c:\windows\system32\DRVSTORE
2011-09-09 18:32 . 2009-05-18 11:17        26600        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys
2011-09-09 18:32 . 2008-04-17 10:12        107368        ----a-w-        c:\windows\system32\GEARAspi.dll
2011-09-09 18:29 . 2011-09-09 18:29        --------        d-----w-        c:\users\Admin\AppData\Local\Apple
2011-09-09 18:29 . 2011-09-09 18:29        --------        d-----w-        c:\program files\Apple Software Update
2011-09-09 18:28 . 2011-09-09 18:28        --------        d-----w-        c:\program files\Bonjour
2011-09-09 18:28 . 2011-09-09 18:31        --------        d-----w-        c:\program files\Common Files\Apple
2011-09-09 18:28 . 2011-09-09 18:28        --------        d-----w-        c:\programdata\Apple
2011-09-05 19:48 . 2011-09-05 19:54        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-28 15:37 . 2011-08-28 15:37        --------        d-----w-        c:\programdata\Ableton
2011-08-28 15:37 . 2011-08-28 15:37        --------        d-----w-        c:\users\Admin\AppData\Roaming\Ableton
2011-08-28 14:46 . 2011-08-28 14:46        --------        d-----w-        c:\program files\Ableton
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-22 19:18 . 2011-07-09 17:46        0        --sh--w-        c:\windows\S421F1A66.tmp
2011-07-29 19:34 . 2011-04-19 09:36        66616        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2011-07-29 19:34 . 2011-04-19 09:36        138192        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2011-07-15 10:49 . 2011-07-28 05:24        313208        ----a-w-        c:\windows\system32\TubeFinder.exe
2011-07-12 09:20 . 2011-07-12 09:20        83816        ----a-w-        c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20        73064        ----a-w-        c:\windows\system32\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20        50536        ----a-w-        c:\windows\system32\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20        178536        ----a-w-        c:\windows\system32\dnssdX.dll
2011-07-11 11:20 . 2011-07-11 11:20        8192        ----a-r-        c:\users\Admin\AppData\Roaming\Microsoft\Installer\{1B77BC7B-4538-4652-AF33-C201F21BF8F2}\Icon1B77BC7B.exe
2011-07-05 16:37 . 2011-07-05 16:37        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2011-09-07 14:26 . 2011-04-09 14:31        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-05-18 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((  SnapShot@2011-09-22_20.41.31  )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:55 . 2011-09-23 16:13        44388              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-04-09 14:30 . 2011-09-23 16:13        7180              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2627716630-3158059880-397312216-1001_UserData.bin
+ 2011-09-22 19:18 . 2011-09-23 16:11        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-22 19:18 . 2011-09-22 20:40        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-22 19:18 . 2011-09-23 16:11        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-09-22 19:18 . 2011-09-22 20:40        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-04-15 05:06 . 2011-09-23 13:42        279844              c:\windows\System32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 33120]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-03-28 10029672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv
.
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 1361288]
R3 GPU-Z;GPU-Z;c:\users\Admin\AppData\Local\Temp\GPU-Z.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-18 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-04-30 691696]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
.
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\llxo0yp0.default\
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\conhost.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-23  18:17:32 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-09-23 16:17
ComboFix2.txt  2011-09-22 20:47
.
Vor Suchlauf: 11 Verzeichnis(se), 666.735.017.984 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 666.447.929.344 Bytes frei
.
- - End Of File - - DBBE549F37B1F2C2428C4FE6FBCF16C9
--- --- ---

cosinus 23.09.2011 19:36
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

siggy 24.09.2011 18:40
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:36:08 on 24.09.2011

OS: Windows 7 Ultimate Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 6.0.2

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"AxSWindC.cpl" - "Alcohol Soft Development Team" - C:\Windows\system32\AxSWindC.cpl
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights 10" - "Nero AG" - C:\Program Files\Nero\Nero 10\Nero BurnRights\NeroBurnRights_10.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"aglorpod" (aglorpod) - ? - C:\Users\Admin\AppData\Local\Temp\aglorpod.sys  (Hidden registry entry, rootkit activity | File not found)
"auafff93" (auafff93) - "Microsoft Corporation" - C:\Windows\system32\drivers\auafff93.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"BrPar" (BrPar) - "Brother Industries Ltd." - C:\Windows\System32\drivers\BrPar.sys
"catchme" (catchme) - ? - C:\Users\Admin\AppData\Local\Temp\catchme.sys  (File not found)
"cpuz135" (cpuz135) - "CPUID" - C:\Windows\system32\drivers\cpuz135_x32.sys
"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\Windows\System32\Drivers\ElbyCDFL.sys
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"GPU-Z" (GPU-Z) - ? - C:\Users\Admin\AppData\Local\Temp\GPU-Z.sys  (File not found)
"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys
"ISO DVD/CD-ROM Device Driver" (ISODrive) - "EZB Systems, Inc." - C:\Program Files\UltraISO\drivers\ISODrive.sys
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"MBAMSwissArmy" (MBAMSwissArmy) - ? - C:\Windows\system32\drivers\mbamswissarmy.sys  (File not found)
"mbr" (mbr) - ? - C:\Users\Admin\AppData\Local\Temp\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"NetGroup Packet Filter Driver" (NPF) - "CACE Technologies, Inc." - C:\Windows\System32\drivers\npf.sys
"Nsynas32" (Nsynas32) - ? - C:\Windows\system32\drivers\Nsynas32.sys  (File not found)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll
{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{AD392E40-428C-459F-961E-9B147782D099} "UIContextMenu Class" - "EZB Systems, Inc." - C:\Program Files\UltraISO\isoshell.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"HiDownload" - ? - C:\Program Files\StreamingStar\HiDownload_Platinum\HiDownloadPlatinum.exe
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10w.ocx / hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{593DDEC6-7468-4cdd-90E1-42DADAA222E9} "DivX HiQ" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

[Known DLLs]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----
"user32" - "Microsoft Corporation" - C:\Windows\system32\user32.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 3.3.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AlcoholAutomount" - "Alcohol Soft Development Team" - "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"CloneCDTray" - "SlySoft, Inc." - "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"LifeCam" - "Microsoft Corporation" - "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
"LogMeIn Hamachi Ui" - "LogMeIn Inc." - "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%SystemRoot%\system32\Wat\WatUX.exe,-601" (WatAdminSvc) - "Microsoft Corporation" - C:\Windows\system32\Wat\WatAdminSvc.exe  (File is exclusively opened, access blocked)
"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LogMeIn Hamachi Tunneling Engine" (Hamachi2Svc) - "LogMeIn Inc." - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"MSCamSvc" (MSCamSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft LifeCam\MSCamS32.exe
"Remote Packet Capture Protocol v.0 (experimental)" (rpcapd) - "CACE Technologies, Inc." - C:\Program Files\WinPcap\rpcapd.exe
"StarWind AE Service" (StarWindServiceAE) - "StarWind Software" - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

siggy 15.10.2011 14:43
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-15 15:30:00
-----------------------------
15:30:00.558 OS Version: Windows 6.1.7600
15:30:00.558 Number of processors: 1 586 0x7F01
15:30:00.558 ComputerName: ADMIN-PC UserName: Admin
15:30:06.024 Initialize success
15:32:51.184 Disk 0 \Device\Harddisk0\DR0 -> \Device\0000006b
15:32:51.199 Disk 0 Vendor: SAMSUNG_ JF10 Size: 152627MB BusType: 3
15:32:51.199 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\0000006c
15:32:51.199 Disk 1 Vendor: WDC_WD10 05.0 Size: 953869MB BusType: 3
15:32:53.227 Disk 1 MBR read successfully
15:32:53.227 Disk 1 MBR scan
15:32:53.227 Disk 1 unknown MBR code
15:32:53.243 Disk 1 scanning sectors +1953523712
15:32:53.290 Disk 1 scanning C:\Windows\system32\drivers
15:32:57.081 Service scanning
15:32:58.843 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
15:32:59.499 Modules scanning
15:33:29.295 Disk 1 trace - called modules:
15:33:29.326 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x847161f8]<<
15:33:29.841 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x85645030]
15:33:29.841 3 CLASSPNP.SYS[8786659e] -> nt!IofCallDriver -> [0x85459df0]
15:33:29.872 5 ACPI.sys[8715f3b2] -> nt!IofCallDriver -> \Device\0000006c[0x854711f8]
15:33:29.872 \Driver\nvstor[0x85468948] -> IRP_MJ_CREATE -> 0x847161f8
15:33:29.887 Scan finished successfully
15:38:26.303 Disk 1 MBR has been saved successfully to "C:\Users\Admin\Documents\MBR.dat"
15:38:26.319 The log file has been saved successfully to "C:\Users\Admin\Documents\aswMBR.txt"

cosinus 16.10.2011 13:35
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Alle Zeitangaben in WEZ +1. Es ist jetzt 15:07 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131