Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner & Roo/Tdds erfolglos bekämpft? (https://www.trojaner-board.de/103577-trojaner-roo-tdds-erfolglos-bekaempft.html)

stanomaly 21.09.2011 19:05
Trojaner & Roo/Tdds erfolglos bekämpft?
 
Hallo allerseits,

ich habe auf meinem Laptop Windows Vista SP2 laufen, eigentlich immer mit den neuesten Updates. Gestern entdeckte mein Avira Antivir bösartige Software mit dem Namen Roo/Tdds... Hinter dem Tdds stand noch eine Zahl oder ein Buchstabe, den Zettel, auf dem ich das notiert habe, liegt leider im Büro, sorry.

Nach der Entdeckung poppten allerlei Fehlermeldungen auf, u.a. solche Fake-Meldungen, die behaupteten meine Festplatte sei kaputt oder der Arbeitsspeicher wäre nicht mehr da. Gleichzeitig wurden alle Desktopsymbole versteckt, ebenso alle Programme unten in der Startleiste sowie in der Liste, die man mit dem Windowsbutton unten links aufrufen kann. Sollte wohl einen Datenverlust simulieren und den User erschrecken. Hat es auch zuerst.

So, nun habe ich mich an die Bekämpfung gemacht und bin dabei recht schnell auf dieses Forum gestoßen. Habe allerdings nur quergelesen und verschiedene Programme runtergeladen und durchlaufen lassen. Als erstes habe ich TDDSkiller.exe installiert. Das hat zwar allerlei Dinge gefunden, das Problem aber nicht behoben. Nun folgten eine Reihe von anderen Programmen in wilder Reihenfolge, was wohl ein Fehler war: Combofix, HitmanPro, natürlich Antivir & Antivir Rescue Disc und noch einige andere, die ich leider nicht mehr alle zusammenbekomme. Combofix ist abgeschmiert, ich hatte allerdings Antivir und Ad-Aware im Hintergrund laufen. Als letzes hat mir ein Kollege noch ein Programm auf einen bootfähigen USB-Stick geladen. Der Scan hat einige Stunden gedauert und auch nicht sonderlich viel bewirkt.

Inzwischen scheint das System zwar wieder stabil zu laufen, aber sauber ist es bestimmt noch nicht. Außerdem sehe ich immer noch nichts in der Programmleiste, der Hintergrund ist weiterhin schwarz und die Symbole in der Schnellstartleiste sind entfernt worden, neue kann ich hinzufügen. Ich traue mich nicht mich ins Online-Banking einzuloggen oder andere sensible Geschichten zu machen. Ist mein System sauber? Was kann ich tun, um Vista wieder normal zum Laufen zu bringen?

Ach ja, eine Systemwiederherstellung mit einem Wiederherstellungspunkt von vor ein paar Tagen schlug fehl.

Hier mal zwei TDSSKiller Logfiles. Einmal vom ersten Scan nach der Infektion und dann nochmal von eben gerade:

Code:
TDSS rootkit removing tool 2.5.23.0 Sep 20 2011 08:53:10
2011/09/20 16:20:15.0457 0980        ================================================================================
2011/09/20 16:20:15.0457 0980        SystemInfo:
2011/09/20 16:20:15.0457 0980       
2011/09/20 16:20:15.0458 0980        OS Version: 6.0.6002 ServicePack: 2.0
2011/09/20 16:20:15.0458 0980        Product type: Workstation
2011/09/20 16:20:15.0458 0980        ComputerName:
2011/09/20 16:20:15.0458 0980        UserName:
2011/09/20 16:20:15.0458 0980        Windows directory: C:\Windows
2011/09/20 16:20:15.0458 0980        System windows directory: C:\Windows
2011/09/20 16:20:15.0458 0980        Processor architecture: Intel x86
2011/09/20 16:20:15.0458 0980        Number of processors: 2
2011/09/20 16:20:15.0458 0980        Page size: 0x1000
2011/09/20 16:20:15.0458 0980        Boot type: Normal boot
....
Scan finished
2011/09/20 16:22:24.0391 5088        ================================================================================
2011/09/20 16:22:24.0406 3704        Detected object count: 3
2011/09/20 16:22:24.0406 3704        Actual detected object count: 3
2011/09/20 16:23:04.0264 3704        C:\Windows\system32\drivers\H8SRTrapdiweitt.sys - will be deleted after reboot
2011/09/20 16:23:04.0264 3704        C:\Windows\system32\H8SRTxnxmmvtope.dll - will be deleted after reboot
2011/09/20 16:23:04.0264 3704        C:\Windows\system32\H8SRTbpdpexrtfb.dat - will be deleted after reboot
2011/09/20 16:23:04.0264 3704        C:\Windows\system32\H8SRTtxconxdiqh.dll - will be deleted after reboot
2011/09/20 16:23:04.0405 3704        HKLM\SYSTEM\ControlSet001\services\H8SRTd.sys - will be deleted after reboot
2011/09/20 16:23:04.0623 3704        HKLM\SYSTEM\ControlSet002\services\H8SRTd.sys - will be deleted after reboot
2011/09/20 16:23:05.0232 3704        HKLM\SYSTEM\ControlSet003\services\H8SRTd.sys - will be deleted after reboot
2011/09/20 16:23:05.0637 3704        C:\Windows\system32\drivers\H8SRTrapdiweitt.sys - will be deleted after reboot
2011/09/20 16:23:05.0637 3704        Rootkit.Win32.TDSS.tdl2(H8SRTd.sys) - User select action: Delete
2011/09/20 16:23:05.0653 3704        LockedFile.Multi.Generic(sptd) - User select action: Skip
2011/09/20 16:23:05.0871 3704        \Device\Harddisk0\DR0 (Rootkit.Boot.SST.a) - will be cured after reboot
2011/09/20 16:23:05.0871 3704        \Device\Harddisk0\DR0 - ok
2011/09/20 16:23:05.0887 3704        Rootkit.Boot.SST.a(\Device\Harddisk0\DR0) - User select action: Cure
2011/09/20 16:23:15.0247 3304        Deinitialize success
Code:
Scan finished
2011/09/21 20:01:22.0989 5276        ================================================================================
2011/09/21 20:01:23.0002 5920        Detected object count: 1
2011/09/21 20:01:23.0002 5920        Actual detected object count: 1
2011/09/21 20:01:36.0326 5920        sptd            (71e276f6d189413266ea22171806597b) C:\Windows\system32\Drivers\sptd.sys
2011/09/21 20:01:36.0327 5920        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
2011/09/21 20:01:36.0335 5920        C:\Windows\system32\Drivers\sptd.sys - copied to quarantine
2011/09/21 20:01:36.0336 5920        LockedFile.Multi.Generic(sptd) - User select action: Quarantine
Vielen Dank für eure Hilfe!

Gruß, Stanomaly

stanomaly 21.09.2011 19:16
Nachtrag: Da hier öfters nach Malwarebytes-Logs gefragt wird, habe ich das grad runtergeladen, aktualisiert und gestartet, es läuft gerade noch. Hätte ich Antivir ausschalten sollen? Das hat jedenfalls grad gemeldet:

"Datum/Uhrzeit: 21.09.2011, 20:10:46 Typ: Fund

In der Datei 'C:\&Recycle.Bin\...\List.bat' wurde eine Virus oder ein unerwünschtes Programm 'HEUR/HTML.Malware' gefunden.

Der Zugriff auf diese Datei wurde verweigert."

Ist das ein Virus oder hat Antivir nur Malwarebytes gefunden?

stanomaly 21.09.2011 21:06
So, der Malwarebytes-Scan ist nun fertig. Hat eine Weile gedauert und es ist einiges zusammen gekommen:

Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7764

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8080.16413

21.09.2011 22:00:27
mbam-log-2011-09-21 (22-00-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 360791
Laufzeit: 1 Stunde(n), 50 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> No action taken.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\richtx64.exe (Trojan.Agent) -> Value: richtx64.exe -> No action taken.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Infizierte Verzeichnisse:
c:\Washer2.rar (Trojan.SpyEyes) -> No action taken.

Infizierte Dateien:
c:\programdata\sysreserve.ini (Malware.Trace) -> No action taken.
c:\Washer2.rar\config.bin (Trojan.SpyEyes) -> No action taken.
Soll ich das Programm die infizierten Objekte entfernen lassen?

Edit: Habe nun die Objekte entfernt. Hoffe das war OK... und neugestartet.

Log:
Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7764

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8080.16413

21.09.2011 22:13:13
mbam-log-2011-09-21 (22-13-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 360791
Laufzeit: 1 Stunde(n), 50 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\richtx64.exe (Trojan.Agent) -> Value: richtx64.exe -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\Washer2.rar (Trojan.SpyEyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\programdata\sysreserve.ini (Malware.Trace) -> Quarantined and deleted successfully.
c:\Washer2.rar\config.bin (Trojan.SpyEyes) -> Quarantined and deleted successfully.
Jetzt mach ich noch nen Quick-Scan.


Edit2: Quickscan hat nix mehr gefunden:

Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7765

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8080.16413

21.09.2011 22:24:16
mbam-log-2011-09-21 (22-24-16).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 164773
Laufzeit: 4 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Habe nun auch eure Checkliste gefunden. Soll ich nun mit Schritt 1 beginnen, also defogger installieren? Sorry, dass ich das erst jetzt gesehen habe!

cosinus 22.09.2011 00:02
Zitat:
c:\Washer2.rar\config.bin (Trojan.SpyEyes) -> No action taken.
Eins vorweg: Es sollte hinlänglich bekannt sein, dass eine Bereinigung keine 100% Sicherheit (in Bezug auf Entfernung der Infektion) liefert und man den Rechner plätten und neu installieren sollte, wenn man kritische Dinge wie zB Onlinebanking in Zukunft weiterhin sicher erledigen will. Gerade beim BKA-Fake seh ich häufig noch SpyEyes-Infektionen - SpyEyes ist ein gefährlicher Keylogger, der sämtliche Tastaturanschläge aufzeichnet und so prinzipiell jedes eingetippte Passwort klauen kann!
Falls du lieber eine Neuinstallation vornehmen und vorher noch alle relevanten Daten sichern willst, folgst du zuerst dem 2. Link in meiner Signatur zur Datensicherung über Ubuntu oder einer anderen beliebigen Live-CD, anschließend dem Artikel zur Neuinstallation von Windows. Natürlich änderst du dann auch sämtliche Passwörter, wenn das System frisch installiert wurde!

Wichtig: Sichere über die Live-CD nur reine Datendateien, KEINE ausführbaren Dateien wie Programme/Spiele oder Setupdateien!

stanomaly 22.09.2011 00:22
Danke für die schnelle Antwort! :daumenhoc

Würde eine Neuinstallation von Windows die Infektion denn tatsächlich vollständig beheben? Und dürfte ich wirklich gar keine ausführbaren Dateien retten, auch nicht von Programmen, die ich gut und lange kenne?

cosinus 22.09.2011 00:57
Zitat:
Und dürfte ich wirklich gar keine ausführbaren Dateien retten, auch nicht von Programmen, die ich gut und lange kenne?
Musst du wissen ob du die behalten willst und damit das Risiko eingehen möchtest.
Eine komplette Neuinstallation von Windows ist aber die sicherste Methode, Infektionen zu beseitigen.

stanomaly 22.09.2011 01:12
Dann wird es wohl auf eine Neuinstallation hinauslaufen. Leider komme ich erst in etwa zwei Wochen wieder nach Berlin, wo meine ext. Platte und meine Windows-DVD liegt. Leider kann ich auf den Rechner bis dahin nicht verzichten, da ich ihn gerade unterwegs auch für die Arbeit brauche. Zeichnet der Trojaner denn alles auf, was ich tue?

Was kann ich in der Zeit, bis ich Formatieren kann, tun, um mich zu schützen?

cosinus 22.09.2011 10:12
Zitat:
Was kann ich in der Zeit, bis ich Formatieren kann, tun, um mich zu schützen?
Wir können ihn erstmal bereinigen bis du die Zeit hast ihn zu plätten.

Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


stanomaly 22.09.2011 16:47
Sorry, da hab ich wohl gleich wieder Mist gemacht.

Bin den Anweisungen gefolgt und hab alle Antivirenprogramme ausgeschaltet und den ESET-Scan gestartet. Da der sich nach 26 durchsuchten Dateien und 3% Fortschritt nicht mehr weiter bewegt hat (ca. 15 min.), dachte ich es liegt am Windows Defender, den ich nicht ausgeschaltet hatte, dachte der ist ohnehin wirkungslos. Die Windows-Firewall hab ich gleich mit ausgeschaltet. Danach den ESET wieder gestartet und nun schafft er es nicht mehr die Database upzudaten. Er fängt bei 50% an und sucht dann ein paar Sek. Dann sagt er "Can not get update. Is proxy configured?"

Was nun?? So ein Mist!!

cosinus 22.09.2011 20:17
Überlesen oder beim 2. Mal vergessen? => Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen

stanomaly 23.09.2011 18:41
So, hatte beim zweiten Durchlauf wohl wirklich vergessen als Admin zu starten. Hier nun das log vom abgeschlossenen Scan. Da hat sich wohl was in meinem Java eingenistet. Was nun?


Code:
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=b185b063c3acee42ba0cd8ffc4efa41c
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-23 05:32:47
# local_time=2011-09-23 07:32:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 94 200810 53320657 226610 0
# compatibility_mode=5892 16776574 100 100 170537 154321522 0 0
# compatibility_mode=8192 67108863 100 0 84412 84412 0 0
# scanned=201452
# found=6
# cleaned=0
# scan_time=10372
C:\Program Files\Unlocker\eBay_shortcuts_1016.exe        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
C:\Users\XB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\556445eb-3d587b6f.virus        probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\XB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1eff1eb1-2c0c2267.virus        probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\XB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\31bba1f4-1a4f61a4.virus        probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\XB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\edb02f6-1afc6644        a variant of Java/Agent.BR trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\XB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\fa8f07a-186a66d9.virus        probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 23.09.2011 19:09
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

stanomaly 24.09.2011 08:47
OTL.txt:

Code:
OTL logfile created on: 24.09.2011 09:08:47 - Run 1
OTL by OldTimer - Version 3.2.29.1    Folder = C:\Users\XB\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8080.16413)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 70,65% Memory free
7,21 Gb Paging File | 6,10 Gb Available in Paging File | 84,63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 287,95 Gb Total Space | 137,93 Gb Free Space | 47,90% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 5,47 Gb Free Space | 54,69% Space Free | Partition Type: NTFS
 
Computer Name: XB-PC | User Name: XB | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.09.24 09:07:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\XB\Desktop\OTL.exe
PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009.08.15 21:31:40 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.12.05 17:11:54 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2008.08.29 14:58:16 | 001,528,608 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2008.06.30 12:28:24 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\hidfind.exe
PRC - [2008.06.30 12:28:14 | 000,196,608 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\Apoint.exe
PRC - [2008.06.30 12:28:12 | 000,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApntEx.exe
PRC - [2008.06.30 12:28:12 | 000,046,376 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApMsgFwd.exe
PRC - [2008.06.26 13:10:06 | 000,442,467 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe
PRC - [2008.06.26 13:10:00 | 000,221,273 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\stacsv.exe
PRC - [2008.06.26 13:09:50 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\AEstSrv.exe
PRC - [2008.04.28 16:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) -- C:\Programme\Dell\DellDock\DockLogin.exe
PRC - [2008.01.14 10:13:02 | 000,132,392 | ---- | M] (CyberLink Corp.) -- C:\Programme\Dell\MediaDirect\PCMService.exe
PRC - [2007.10.03 15:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007.10.03 15:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.08.16 10:46:49 | 000,771,584 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\74b25c0069cb3a0441b0891ad204ea86\System.Runtime.Remoting.ni.dll
MOD - [2011.08.16 10:28:57 | 007,950,848 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b9ea0d414c4861120bfb7365d8ec0939\System.ni.dll
MOD - [2011.06.15 09:53:59 | 011,490,816 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f6deb187f24bb3185841092b89fbfdbb\mscorlib.ni.dll
MOD - [2009.03.30 06:42:12 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.09.17 05:16:00 | 000,159,744 | -H-- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2008.05.02 06:15:37 | 000,010,240 | ---- | M] () -- C:\Programme\Unlocker\UnlockerCOM.dll
MOD - [2008.03.12 07:37:52 | 000,055,808 | -H-- | M] () -- C:\Windows\System32\bcmwlrmt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (wltrysvc)
SRV - File not found [Auto | Stopped] --  -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2011.09.02 15:29:30 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2008.12.05 17:11:54 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2008.09.10 14:56:17 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008.08.29 14:58:16 | 001,528,608 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2008.06.26 13:10:00 | 000,221,273 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\stacsv.exe -- (STacSV)
SRV - [2008.06.26 13:09:50 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\AEstSrv.exe -- (AESTFilters)
SRV - [2008.04.28 16:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stop_Pending] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.10.03 15:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.07.21 12:11:12 | 000,138,192 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.21 12:11:11 | 000,066,616 | -H-- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.05.25 02:00:36 | 000,064,512 | -H-- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2011.05.25 02:00:36 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2010.01.21 18:40:57 | 000,271,360 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.01.21 18:40:57 | 000,018,048 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.10.08 17:55:33 | 000,028,520 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.29 02:55:38 | 000,005,120 | -H-- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2009.02.20 12:28:50 | 000,005,632 | -H-- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008.09.17 06:01:02 | 003,930,112 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2008.09.17 06:01:02 | 003,930,112 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.09.14 16:32:10 | 000,717,296 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008.08.29 14:57:18 | 000,306,299 | -H-- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2008.06.30 12:28:10 | 000,170,032 | -H-- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008.06.26 13:10:08 | 000,380,928 | -H-- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008.03.29 18:36:28 | 000,125,328 | -H-- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008.03.14 15:04:26 | 000,054,784 | -H-- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2008.03.12 07:37:46 | 000,018,424 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
DRV - [2008.03.11 08:53:02 | 000,149,208 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV - [2008.03.11 08:53:00 | 000,277,624 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid)
DRV - [2008.03.11 08:42:24 | 000,203,264 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2008.03.11 08:24:46 | 000,038,400 | -H-- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2008.03.11 08:24:44 | 000,046,592 | -H-- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008.03.11 08:24:42 | 000,043,008 | -H-- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2008.01.21 04:23:25 | 000,251,904 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2008.01.21 04:23:25 | 000,220,672 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2008.01.21 04:23:21 | 000,016,896 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007.05.02 11:11:18 | 000,109,704 | -H-- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2007.05.02 11:11:18 | 000,015,112 | -H-- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2007.05.02 11:11:16 | 000,083,592 | -H-- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2007.01.18 19:28:02 | 000,005,275 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2003.04.29 13:10:40 | 000,004,448 | -H-- | M] (StarForce Technologies, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003.04.28 12:12:21 | 000,094,464 | -H-- | M] (StarForce Technologies, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\prohlp02.sys -- (prohlp02)
DRV - [2003.04.28 11:16:07 | 000,050,816 | -H-- | M] (StarForce Technologies, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\prodrv06.sys -- (prodrv06)
DRV - [2003.04.04 09:41:46 | 000,006,848 | -H-- | M] (StarForce Technologies, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\prosync1.sys -- (prosync1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4080910
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4080910
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.14
FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6
FF - prefs.js..extensions.enabledItems: {DB2EA31C-58F5-48b7-8D60-CB0739257904}:0.21
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {45d8ff86-d909-11db-9705-005056c00008}:1.0.5
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.21 17:16:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.21 18:33:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2011.09.21 17:16:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.09.21 17:16:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2011.05.17 18:09:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XB\AppData\Roaming\mozilla\Extensions
[2010.09.14 13:17:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XB\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.05.17 18:09:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XB\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2011.09.17 20:23:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XB\AppData\Roaming\mozilla\Firefox\Profiles\aou9vsu3.default\extensions
[2011.09.21 17:17:44 | 000,000,000 | ---D | M] (Image Zoom) -- C:\Users\XB\AppData\Roaming\mozilla\Firefox\Profiles\aou9vsu3.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2011.09.21 17:17:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XB\AppData\Roaming\mozilla\Firefox\Profiles\aou9vsu3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.09.21 17:17:45 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\XB\AppData\Roaming\mozilla\Firefox\Profiles\aou9vsu3.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2011.09.21 17:17:45 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\XB\AppData\Roaming\mozilla\Firefox\Profiles\aou9vsu3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.05.17 18:09:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XB\AppData\Roaming\mozilla\Sunbird\Profiles\qlosceo3.default\extensions
[2011.09.21 17:38:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.09.21 17:16:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.09.21 17:38:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\XB\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AOU9VSU3.DEFAULT\EXTENSIONS\{45D8FF86-D909-11DB-9705-005056C00008}.XPI
() (No name found) -- C:\USERS\XB\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AOU9VSU3.DEFAULT\EXTENSIONS\{DB2EA31C-58F5-48B7-8D60-CB0739257904}.XPI
[2011.09.07 18:26:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.31 20:20:41 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.31 20:20:41 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.05.31 20:20:41 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.05.31 20:20:41 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.05.31 20:20:41 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.05.31 20:20:41 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter File not found
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter File not found
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10v_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\XB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\XB\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D4AA4CE-FA5C-4D1D-8845-B69DCC52D969}: DhcpNameServer = 81.173.194.76 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AAEF5F1E-EDBC-4AE0-9A9A-3EA018D664A2}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Programme\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\XB\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XB\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{14d5bf64-4c8d-11df-bfc8-0021707f0182}\Shell\AutoRun\command - "" = F:\PMB_P.exe
O33 - MountPoints2\{17a37849-826a-11dd-9f69-0021707f0182}\Shell - "" = AutoRun
O33 - MountPoints2\{17a37849-826a-11dd-9f69-0021707f0182}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{62fac7d5-ef23-11df-9caf-0021707f0182}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{7ac755be-ebe6-11dd-93be-0021707f0182}\Shell - "" = AutoRun
O33 - MountPoints2\{7ac755be-ebe6-11dd-93be-0021707f0182}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\Shell\AutoRun\command - "" = explorer .
O33 - MountPoints2\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\Shell\mobile\command - "" = F:\MobileLaunch.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: 97776012.sys - Driver
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: 97776012.sys - Driver
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: hitmanpro35 - Reg Error: Value error.
SafeBootNet: hitmanpro35.sys - Reg Error: Value error.
SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {05466845-FF44-4671-92C1-A5FD0F9EEE1C} - Microsoft Reader
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.24 09:07:33 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\XB\Desktop\OTL.exe
[2011.09.22 18:38:34 | 000,000,000 | ---D | C] -- C:\Users\XB\Desktop\To Do Reinstall
[2011.09.22 18:28:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2011.09.22 18:28:39 | 000,000,000 | ---D | C] -- C:\Program Files\MozBackup
[2011.09.22 17:13:02 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011.09.22 17:12:51 | 002,322,184 | ---- | C] (ESET) -- C:\Users\XB\Desktop\esetsmartinstaller_enu.exe
[2011.09.21 20:07:43 | 000,000,000 | ---D | C] -- C:\Users\XB\AppData\Roaming\Malwarebytes
[2011.09.21 20:07:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.09.21 20:07:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.09.21 20:07:25 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.09.21 20:07:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.09.21 20:06:40 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\XB\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.21 20:01:36 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.09.21 19:21:10 | 000,000,000 | RH-D | C] -- C:\Users\XB\AppData\Roaming\SecuROM
[2011.09.21 18:49:07 | 001,403,184 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\XB\Desktop\tdsskiller.exe
[2011.09.21 18:41:24 | 003,313,664 | ---- | C] (Avira GmbH) -- C:\Users\XB\Desktop\bootwizard.exe
[2011.09.21 09:27:43 | 000,200,976 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmcomm.sys
[2011.09.21 09:27:34 | 002,002,416 | ---- | C] (Trend Micro Inc.) -- C:\Users\XB\Desktop\HousecallLauncher.exe
[2011.09.21 09:07:20 | 000,000,000 | ---D | C] -- C:\Users\XB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2011.09.21 08:49:56 | 000,000,000 | -HSD | C] -- C:\found.000
[2011.09.20 23:52:53 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
[2011.09.20 23:52:52 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos
[2011.09.20 23:43:58 | 000,000,000 | ---D | C] -- C:\Users\XB\AppData\Roaming\Avira
[2011.09.20 23:38:56 | 000,028,520 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.09.20 23:38:53 | 000,138,192 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.09.20 23:38:53 | 000,066,616 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.09.20 23:38:52 | 000,000,000 | -H-D | C] -- C:\ProgramData\Avira
[2011.09.20 23:38:52 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.09.20 16:46:18 | 004,219,996 | ---- | C] (Swearware) -- C:\Users\XB\Desktop\ComboFix.exe
[2011.09.20 16:33:57 | 000,000,000 | -H-D | C] -- C:\ProgramData\Hitman Pro
[2011.09.20 16:33:53 | 006,394,688 | ---- | C] (SurfRight B.V.) -- C:\Users\XB\Desktop\HitmanPro359129.exe
[2011.09.17 12:58:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam
[2011.09.17 12:57:56 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2011.09.17 12:57:55 | 000,000,000 | ---D | C] -- C:\Program Files\Steam
[2002.03.11 11:06:30 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2002.03.11 10:45:04 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsia.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.24 09:07:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\XB\Desktop\OTL.exe
[2011.09.24 09:01:00 | 000,001,052 | -H-- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011.09.24 08:27:00 | 000,001,098 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.09.24 08:21:59 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.24 08:21:59 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.23 22:27:01 | 000,001,094 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.09.23 16:24:56 | 002,322,184 | ---- | M] (ESET) -- C:\Users\XB\Desktop\esetsmartinstaller_enu.exe
[2011.09.23 16:20:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.23 16:20:18 | 3755,974,656 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.23 15:29:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.09.22 18:28:39 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\MozBackup.lnk
[2011.09.22 18:28:15 | 001,035,926 | ---- | M] () -- C:\Users\XB\Desktop\MozBackup-1.5.1-EN.exe
[2011.09.21 20:06:49 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\XB\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.21 18:49:05 | 001,403,184 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\XB\Desktop\tdsskiller.exe
[2011.09.21 18:41:22 | 003,313,664 | ---- | M] (Avira GmbH) -- C:\Users\XB\Desktop\bootwizard.exe
[2011.09.21 16:17:09 | 203,431,075 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.09.21 16:12:50 | 000,412,248 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.09.21 09:34:57 | 000,102,400 | ---- | M] () -- C:\Windows\RegBootClean.exe
[2011.09.21 09:34:35 | 000,189,047 | ---- | M] () -- C:\Users\XB\AppData\Local\census.cache
[2011.09.21 09:34:30 | 000,157,845 | ---- | M] () -- C:\Users\XB\AppData\Local\ars.cache
[2011.09.21 09:27:39 | 000,000,036 | ---- | M] () -- C:\Users\XB\AppData\Local\housecall.guid.cache
[2011.09.21 09:27:32 | 002,002,416 | ---- | M] (Trend Micro Inc.) -- C:\Users\XB\Desktop\HousecallLauncher.exe
[2011.09.21 09:17:43 | 000,007,512 | ---- | M] () -- C:\Users\XB\AppData\Local\d3d9caps.dat
[2011.09.21 09:17:17 | 010,268,672 | ---- | M] () -- C:\Users\XB\Desktop\Ad-Aware95Install.msi
[2011.09.21 09:08:27 | 000,000,456 | ---- | M] () -- C:\ProgramData\6DSS92c31Apgjk
[2011.09.21 09:07:21 | 000,000,208 | ---- | M] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011.09.21 09:07:21 | 000,000,160 | ---- | M] () -- C:\ProgramData\~6DSS92c31Apgjkr
[2011.09.20 23:52:43 | 001,339,288 | ---- | M] () -- C:\Users\XB\Desktop\sar_15_sfx.exe
[2011.09.20 23:50:32 | 013,679,328 | ---- | M] () -- C:\Users\XB\Desktop\vipre-de-setup.exe
[2011.09.20 23:37:07 | 067,980,144 | ---- | M] () -- C:\Users\XB\Desktop\avira_antivir_personal_de.exe
[2011.09.20 16:46:35 | 004,219,996 | ---- | M] (Swearware) -- C:\Users\XB\Desktop\ComboFix.exe
[2011.09.20 16:34:26 | 000,023,624 | -H-- | M] () -- C:\Windows\System32\drivers\hitmanpro35.sys
[2011.09.20 16:32:30 | 006,394,688 | ---- | M] (SurfRight B.V.) -- C:\Users\XB\Desktop\HitmanPro359129.exe
[2011.09.18 16:56:42 | 000,000,064 | -H-- | M] () -- C:\Windows\System32\rp_stats.dat
[2011.09.18 16:56:42 | 000,000,044 | -H-- | M] () -- C:\Windows\System32\rp_rules.dat
[2011.09.18 16:37:54 | 000,000,000 | -H-- | M] () -- C:\ProgramData\LauncherAccess.dt
[2011.09.14 20:09:40 | 000,116,224 | ---- | M] () -- C:\Users\XB\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.08.29 11:49:41 | 000,618,442 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.08.29 11:49:41 | 000,587,178 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.29 11:49:41 | 000,122,842 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.08.29 11:49:41 | 000,101,250 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.22 18:28:39 | 000,000,826 | ---- | C] () -- C:\Users\Public\Desktop\MozBackup.lnk
[2011.09.22 18:28:28 | 001,035,926 | ---- | C] () -- C:\Users\XB\Desktop\MozBackup-1.5.1-EN.exe
[2011.09.21 16:12:32 | 3755,974,656 | -HS- | C] () -- C:\hiberfil.sys
[2011.09.21 09:34:54 | 000,102,400 | ---- | C] () -- C:\Windows\RegBootClean.exe
[2011.09.21 09:34:35 | 000,189,047 | ---- | C] () -- C:\Users\XB\AppData\Local\census.cache
[2011.09.21 09:34:30 | 000,157,845 | ---- | C] () -- C:\Users\XB\AppData\Local\ars.cache
[2011.09.21 09:27:39 | 000,000,036 | ---- | C] () -- C:\Users\XB\AppData\Local\housecall.guid.cache
[2011.09.21 09:17:10 | 010,268,672 | ---- | C] () -- C:\Users\XB\Desktop\Ad-Aware95Install.msi
[2011.09.21 09:07:21 | 000,000,208 | ---- | C] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011.09.21 09:07:21 | 000,000,160 | ---- | C] () -- C:\ProgramData\~6DSS92c31Apgjkr
[2011.09.21 09:07:20 | 000,000,456 | ---- | C] () -- C:\ProgramData\6DSS92c31Apgjk
[2011.09.20 23:52:44 | 001,339,288 | ---- | C] () -- C:\Users\XB\Desktop\sar_15_sfx.exe
[2011.09.20 23:35:35 | 067,980,144 | ---- | C] () -- C:\Users\XB\Desktop\avira_antivir_personal_de.exe
[2011.09.20 23:17:58 | 013,679,328 | ---- | C] () -- C:\Users\XB\Desktop\vipre-de-setup.exe
[2011.09.20 16:34:26 | 000,023,624 | -H-- | C] () -- C:\Windows\System32\drivers\hitmanpro35.sys
[2011.06.19 16:57:12 | 000,000,064 | -H-- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.06.19 16:57:12 | 000,000,044 | -H-- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.06.15 11:07:40 | 000,000,416 | -H-- | C] () -- C:\Windows\BRWMARK.INI
[2011.06.15 11:07:40 | 000,000,034 | -H-- | C] () -- C:\Windows\System32\BD7440N.DAT
[2010.09.14 13:17:37 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat
[2010.02.27 21:54:02 | 000,017,408 | ---- | C] () -- C:\Users\XB\AppData\Local\WebpageIcons.db
[2010.01.22 16:21:59 | 000,000,040 | -H-- | C] () -- C:\Windows\RUNAWAY.INI
[2010.01.22 16:09:02 | 000,176,214 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2010.01.22 16:09:02 | 000,090,112 | -H-- | C] () -- C:\Windows\System32\atibrtmon.exe
[2010.01.21 18:40:57 | 000,271,360 | -H-- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.01.21 18:40:57 | 000,018,048 | -H-- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.12.24 17:02:40 | 000,000,206 | -H-- | C] () -- C:\Windows\System32\srcr.dat
[2009.10.15 16:59:44 | 000,000,000 | -H-- | C] () -- C:\Windows\OPPRIN~1.INI
[2009.05.28 20:41:05 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.28 20:41:05 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.05.28 20:40:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.05.10 23:27:54 | 000,000,528 | -H-- | C] () -- C:\Windows\eReg.dat
[2009.04.24 17:02:14 | 000,451,928 | ---- | C] () -- C:\Program Files\setup.exe
[2009.04.24 17:01:52 | 140,387,071 | ---- | C] () -- C:\Program Files\openofficeorg1.cab
[2009.04.24 17:01:34 | 009,819,136 | ---- | C] () -- C:\Program Files\openofficeorg31.msi
[2009.04.23 18:29:54 | 000,000,336 | ---- | C] () -- C:\Program Files\setup.ini
[2009.01.26 13:38:12 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2008.12.25 00:34:32 | 000,004,767 | -H-- | C] () -- C:\Windows\Irremote.ini
[2008.10.19 22:54:43 | 000,000,000 | -H-- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008.10.19 22:49:47 | 000,000,059 | -H-- | C] () -- C:\Windows\wininit.ini
[2008.10.19 22:47:51 | 000,005,632 | -H-- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2008.09.30 17:48:38 | 009,776,640 | ---- | C] () -- C:\Program Files\openofficeorg30.msi
[2008.09.20 18:41:11 | 000,755,027 | -H-- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.09.20 18:41:11 | 000,164,352 | -H-- | C] () -- C:\Windows\System32\unrar.dll
[2008.09.17 17:21:11 | 000,007,512 | ---- | C] () -- C:\Users\XB\AppData\Local\d3d9caps.dat
[2008.09.13 17:00:15 | 000,116,224 | ---- | C] () -- C:\Users\XB\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.09.11 00:21:57 | 003,107,788 | -H-- | C] () -- C:\Windows\System32\atiumdva.dat
[2008.09.11 00:21:57 | 000,159,744 | -H-- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.09.10 16:28:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008.09.10 14:53:33 | 000,000,074 | -HS- | C] () -- C:\Windows\CT4CET.bin
[2008.09.10 14:48:44 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.09.10 14:45:35 | 000,055,808 | -H-- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2008.08.29 14:58:26 | 000,197,408 | -H-- | C] () -- C:\Windows\System32\vpnapi.dll
[2008.06.04 10:23:14 | 000,026,624 | -H-- | C] () -- C:\Windows\System32\ssp7ml3.dll
[2008.01.21 09:15:58 | 000,618,442 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,122,842 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2007.04.16 02:24:16 | 000,023,752 | -H-- | C] () -- C:\Windows\System32\providers.bin
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,412,248 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,587,178 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,101,250 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:26 | 000,557,568 | -H-- | C] () -- C:\Windows\System32\hpotscl1.dll
[2006.11.02 12:23:21 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | -H-- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | -H-- | C] () -- C:\Windows\System32\mlang.dat
[2005.01.17 07:10:16 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\BRTCPCON.DLL
[2004.08.09 07:00:42 | 000,000,114 | -H-- | C] () -- C:\Windows\System32\BRLMW03A.INI
[2001.11.14 12:56:00 | 001,802,240 | -H-- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2011.09.21 17:17:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Azureus
[2011.09.21 17:17:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\DAEMON Tools
[2010.08.24 22:49:24 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Doctor Who
[2011.09.23 16:22:53 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Dropbox
[2011.04.20 13:50:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\gnupg
[2009.01.26 15:20:11 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\OpenOffice.org
[2011.03.06 19:19:36 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\PCDr
[2011.08.06 13:40:00 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\RDecke
[2008.10.19 22:55:31 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Samsung
[2011.09.21 17:17:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Stellarium
[2011.09.21 17:17:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Thunderbird
[2010.02.11 16:18:58 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Uniblue
[2011.09.23 15:29:15 | 000,032,582 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.09.14 15:30:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Adobe
[2008.09.12 19:12:05 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\ATI
[2011.09.20 23:43:58 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Avira
[2011.09.21 17:17:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Azureus
[2009.02.01 18:47:42 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Creative
[2011.09.21 17:17:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\DAEMON Tools
[2008.09.12 19:10:29 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Dell
[2009.01.30 23:20:10 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\DivX
[2010.08.24 22:49:24 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Doctor Who
[2011.09.23 16:22:53 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Dropbox
[2011.09.21 17:17:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\dvdcss
[2011.04.20 13:50:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\gnupg
[2008.11.21 14:15:09 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Google
[2008.09.12 19:11:14 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Identities
[2010.12.07 21:34:59 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Macromedia
[2011.09.21 20:07:43 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Media Center Programs
[2009.03.06 23:33:30 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Media Player Classic
[2011.06.07 11:50:24 | 000,000,000 | --SD | M] -- C:\Users\XB\AppData\Roaming\Microsoft
[2011.05.17 18:09:21 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Mozilla
[2008.12.28 21:43:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Nero
[2009.01.26 15:20:11 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\OpenOffice.org
[2009.01.26 15:14:16 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\OpenOffice.org2
[2011.03.06 19:19:36 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\PCDr
[2011.08.06 13:40:00 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\RDecke
[2009.08.15 21:31:55 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Real
[2008.10.19 22:55:31 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Samsung
[2011.09.21 19:21:10 | 000,000,000 | RH-D | M] -- C:\Users\XB\AppData\Roaming\SecuROM
[2011.09.23 16:23:22 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Skype
[2011.07.16 03:30:38 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\skypePM
[2011.09.21 17:17:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Stellarium
[2011.09.21 17:17:47 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Thunderbird
[2010.02.11 16:18:58 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\Uniblue
[2008.09.13 18:12:37 | 000,000,000 | ---D | M] -- C:\Users\XB\AppData\Roaming\vlc
 
< %APPDATA%\*.exe /s >
[2011.05.25 22:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\XB\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2011.05.25 22:07:42 | 000,174,784 | ---- | M] (Dropbox, Inc.) -- C:\Users\XB\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2011.06.06 17:58:44 | 003,120,288 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\XB\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2011.05.25 10:33:47 | 051,021,472 | ---- | M] (Dell Inc) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Binaries\full_dsc_5830_10_32_01.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\0a58ebe8-5880-4eba-999a-97d144d9f9d1\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\0aacd27e-241a-49b8-ad83-76a6af250838\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\0bdb0ac7-5fd7-4328-a8de-adcc25c013aa\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\107f3d74-2918-4a31-a289-64116284eb99\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\1d44e7ee-874a-4b2c-9234-c31465b3451a\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\4323305a-d284-4c43-8d43-26387cdfcab8\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\438f97e0-24cb-44ea-b69a-48dabe4bc268\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\447c3751-bdba-44cd-9902-75b696878626\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\50be6b4d-9022-43a1-9a80-a21a80399e95\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\6a8231fc-3373-4b23-9a38-3880095b5f3f\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\6d0fd0f5-0cc6-4146-8c55-9e7fcdd71884\DellSignedAppUpdaterRules\AddCertificate.exe
[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\XB\AppData\Roaming\PCDr\Update\Rules\91d93da8-4e8f-4016-b59b-add099e35d75\DellSignedAppUpdaterRules\AddCertificate.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | -H-- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.09.11 00:18:04 | 000,021,560 | -H-- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys
[2008.09.11 00:18:04 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.09.11 00:18:04 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.09.11 00:18:04 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2007.09.29 23:03:32 | 000,384,024 | ---- | M] (Intel Corporation) MD5=16A4671255CFB842225F0FDB6DBDB414 -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
[2008.03.11 08:44:12 | 000,305,176 | -H-- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Drivers\storage\R180982\iastor.sys
[2008.03.11 08:44:12 | 000,305,176 | -H-- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys
[2008.03.11 08:44:12 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_cfa1dde4\iaStor.sys
[2008.03.11 08:44:12 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | -H-- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | -H-- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008.09.14 16:32:10 | 000,717,296 | -H-- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | -H-- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | -H-- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | -H-- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | -H-- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.03.12 07:37:52 | 000,055,808 | -H-- | M] () Unable to obtain MD5 -- C:\Windows\system32\bcmwlrmt.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<          >

< End of report >

cosinus 24.09.2011 11:50
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{14d5bf64-4c8d-11df-bfc8-0021707f0182}\Shell\AutoRun\command - "" = F:\PMB_P.exe
O33 - MountPoints2\{17a37849-826a-11dd-9f69-0021707f0182}\Shell - "" = AutoRun
O33 - MountPoints2\{17a37849-826a-11dd-9f69-0021707f0182}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{62fac7d5-ef23-11df-9caf-0021707f0182}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{7ac755be-ebe6-11dd-93be-0021707f0182}\Shell - "" = AutoRun
O33 - MountPoints2\{7ac755be-ebe6-11dd-93be-0021707f0182}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\Shell\AutoRun\command - "" = explorer .
O33 - MountPoints2\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\Shell\mobile\command - "" = F:\MobileLaunch.exe
[2011.09.21 09:07:20 | 000,000,000 | ---D | C] -- C:\Users\XB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2011.09.21 08:49:56 | 000,000,000 | -HSD | C] -- C:\found.000
[2011.09.21 09:08:27 | 000,000,456 | ---- | M] () -- C:\ProgramData\6DSS92c31Apgjk
[2011.09.21 09:07:21 | 000,000,208 | ---- | M] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011.09.21 09:07:21 | 000,000,160 | ---- | M] () -- C:\ProgramData\~6DSS92c31Apgjkr
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

stanomaly 24.09.2011 13:50
Done.

Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14d5bf64-4c8d-11df-bfc8-0021707f0182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14d5bf64-4c8d-11df-bfc8-0021707f0182}\ not found.
File F:\PMB_P.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17a37849-826a-11dd-9f69-0021707f0182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17a37849-826a-11dd-9f69-0021707f0182}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17a37849-826a-11dd-9f69-0021707f0182}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17a37849-826a-11dd-9f69-0021707f0182}\ not found.
File G:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62fac7d5-ef23-11df-9caf-0021707f0182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62fac7d5-ef23-11df-9caf-0021707f0182}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ac755be-ebe6-11dd-93be-0021707f0182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ac755be-ebe6-11dd-93be-0021707f0182}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ac755be-ebe6-11dd-93be-0021707f0182}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ac755be-ebe6-11dd-93be-0021707f0182}\ not found.
File H:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\ not found.
File explorer . not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7f6ab8f-1a40-11df-ad57-0021707f0182}\ not found.
File F:\MobileLaunch.exe not found.
C:\Users\XB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery folder moved successfully.
C:\found.000\dir0000.chk folder moved successfully.
C:\found.000 folder moved successfully.
C:\ProgramData\6DSS92c31Apgjk moved successfully.
C:\ProgramData\~6DSS92c31Apgjk moved successfully.
C:\ProgramData\~6DSS92c31Apgjkr moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: XB
->Temp folder emptied: 688168181 bytes
->Temporary Internet Files folder emptied: 16130052 bytes
->Java cache emptied: 92758426 bytes
->FireFox cache emptied: 263608221 bytes
->Flash cache emptied: 3167535 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1449114 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 114602369 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.125,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.29.1 log created on 09242011_141330

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Direkt nach dem Neustart wollte Adobe Flash Player ein Update. Das Update konnte aber nicht installiert werden, weil wohl eine Datei im system32 Ordner nicht da war oder nicht darauf zugegriffen werden konnte.

cosinus 24.09.2011 13:53
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

stanomaly 24.09.2011 14:03
Das Tool sieht irgendwie anders aus als beim letzten Mal und auf dem Screenshot. Hier der Report:

Code:
14:59:18.0586 3316        TDSS rootkit removing tool 2.6.0.0 Sep 23 2011 07:42:37
14:59:18.0975 3316        ============================================================
14:59:18.0975 3316        Current date / time: 2011/09/24 14:59:18.0975
14:59:18.0975 3316        SystemInfo:
14:59:18.0975 3316       
14:59:18.0975 3316        OS Version: 6.0.6002 ServicePack: 2.0
14:59:18.0975 3316        Product type: Workstation
14:59:18.0975 3316        ComputerName: XB-PC
14:59:18.0976 3316        UserName: XB
14:59:18.0976 3316        Windows directory: C:\Windows
14:59:18.0976 3316        System windows directory: C:\Windows
14:59:18.0976 3316        Processor architecture: Intel x86
14:59:18.0976 3316        Number of processors: 2
14:59:18.0976 3316        Page size: 0x1000
14:59:18.0976 3316        Boot type: Normal boot
14:59:18.0976 3316        ============================================================
14:59:19.0511 3316        Initialize success
14:59:39.0540 3444        ============================================================
14:59:39.0540 3444        Scan started
14:59:39.0541 3444        Mode: Manual;
14:59:39.0541 3444        ============================================================
14:59:39.0908 3444        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
14:59:39.0911 3444        ACPI - ok
14:59:39.0997 3444        adp94xx        (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
14:59:40.0003 3444        adp94xx - ok
14:59:40.0044 3444        adpahci        (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
14:59:40.0049 3444        adpahci - ok
14:59:40.0086 3444        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
14:59:40.0087 3444        adpu160m - ok
14:59:40.0124 3444        adpu320        (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
14:59:40.0127 3444        adpu320 - ok
14:59:40.0243 3444        AFD            (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
14:59:40.0247 3444        AFD - ok
14:59:40.0284 3444        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
14:59:40.0286 3444        agp440 - ok
14:59:40.0322 3444        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
14:59:40.0324 3444        aic78xx - ok
14:59:40.0369 3444        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
14:59:40.0370 3444        aliide - ok
14:59:40.0401 3444        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
14:59:40.0402 3444        amdagp - ok
14:59:40.0429 3444        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
14:59:40.0430 3444        amdide - ok
14:59:40.0474 3444        AmdK7          (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
14:59:40.0475 3444        AmdK7 - ok
14:59:40.0508 3444        AmdK8          (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
14:59:40.0509 3444        AmdK8 - ok
14:59:40.0569 3444        ApfiltrService  (1de27858a431a5749e0f3df54ba935b9) C:\Windows\system32\DRIVERS\Apfiltr.sys
14:59:40.0572 3444        ApfiltrService - ok
14:59:40.0612 3444        arc            (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
14:59:40.0614 3444        arc - ok
14:59:40.0668 3444        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
14:59:40.0670 3444        arcsas - ok
14:59:40.0728 3444        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
14:59:40.0730 3444        AsyncMac - ok
14:59:40.0758 3444        atapi          (0d83c87a801a3dfcd1bf73893fe7518c) C:\Windows\system32\drivers\atapi.sys
14:59:40.0759 3444        atapi - ok
14:59:40.0940 3444        atikmdag        (ac9e487e3513561e4f7953c438727ff7) C:\Windows\system32\DRIVERS\atikmdag.sys
14:59:40.0993 3444        atikmdag - ok
14:59:41.0040 3444        atksgt          (6e996cf8459a2594e0e9609d0e34d41f) C:\Windows\system32\DRIVERS\atksgt.sys
14:59:41.0044 3444        atksgt - ok
14:59:41.0123 3444        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
14:59:41.0124 3444        avgntflt - ok
14:59:41.0156 3444        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
14:59:41.0159 3444        avipbb - ok
14:59:41.0239 3444        BCM42RLY        (bcb27987aaf7962c72b0f337a201cc28) C:\Windows\system32\drivers\BCM42RLY.sys
14:59:41.0240 3444        BCM42RLY - ok
14:59:41.0318 3444        BCM43XX        (b2134f695efd5eb392e906ac2413452e) C:\Windows\system32\DRIVERS\bcmwl6.sys
14:59:41.0334 3444        BCM43XX - ok
14:59:41.0383 3444        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
14:59:41.0384 3444        Beep - ok
14:59:41.0422 3444        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
14:59:41.0423 3444        blbdrive - ok
14:59:41.0494 3444        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
14:59:41.0496 3444        bowser - ok
14:59:41.0537 3444        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
14:59:41.0538 3444        BrFiltLo - ok
14:59:41.0591 3444        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
14:59:41.0592 3444        BrFiltUp - ok
14:59:41.0650 3444        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
14:59:41.0652 3444        Brserid - ok
14:59:41.0746 3444        BrSerIf        (1a5fc78e41840edf79d65ec16eff2787) C:\Windows\system32\Drivers\BrSerIf.sys
14:59:41.0748 3444        BrSerIf - ok
14:59:41.0778 3444        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
14:59:41.0780 3444        BrSerWdm - ok
14:59:41.0812 3444        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
14:59:41.0813 3444        BrUsbMdm - ok
14:59:41.0839 3444        BrUsbSer        (a24c7b39602218f8dbdb2b6704325fc7) C:\Windows\system32\Drivers\BrUsbSer.sys
14:59:41.0840 3444        BrUsbSer - ok
14:59:41.0876 3444        BthEnum        (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys
14:59:41.0877 3444        BthEnum - ok
14:59:41.0929 3444        BTHMODEM        (5ffa6988ff9597986ff2ada736cc90c0) C:\Windows\system32\DRIVERS\bthmodem.sys
14:59:41.0930 3444        BTHMODEM - ok
14:59:41.0982 3444        BthPan          (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys
14:59:41.0984 3444        BthPan - ok
14:59:42.0052 3444        BthPort        (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys
14:59:42.0059 3444        BthPort - ok
14:59:42.0118 3444        BTHUSB          (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys
14:59:42.0120 3444        BTHUSB - ok
14:59:42.0171 3444        btwaudio        (58c4b59d0ebfb637e2e296cf4a686ba0) C:\Windows\system32\drivers\btwaudio.sys
14:59:42.0172 3444        btwaudio - ok
14:59:42.0209 3444        btwavdt        (e8cc9436cc464d6975adbc4aece0ba7b) C:\Windows\system32\drivers\btwavdt.sys
14:59:42.0211 3444        btwavdt - ok
14:59:42.0241 3444        btwl2cap        (ecb98391c756a7b9cfbae89d9d1235e1) C:\Windows\system32\DRIVERS\btwl2cap.sys
14:59:42.0243 3444        btwl2cap - ok
14:59:42.0272 3444        btwrchid        (62ed55843f8216eb25a909a820613033) C:\Windows\system32\DRIVERS\btwrchid.sys
14:59:42.0273 3444        btwrchid - ok
14:59:42.0342 3444        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
14:59:42.0344 3444        cdfs - ok
14:59:42.0388 3444        cdrom          (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
14:59:42.0390 3444        cdrom - ok
14:59:42.0420 3444        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
14:59:42.0421 3444        circlass - ok
14:59:42.0475 3444        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
14:59:42.0480 3444        CLFS - ok
14:59:42.0524 3444        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
14:59:42.0525 3444        CmBatt - ok
14:59:42.0554 3444        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
14:59:42.0556 3444        cmdide - ok
14:59:42.0591 3444        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
14:59:42.0592 3444        Compbatt - ok
14:59:42.0614 3444        crcdisk        (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
14:59:42.0616 3444        crcdisk - ok
14:59:42.0673 3444        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
14:59:42.0674 3444        Crusoe - ok
14:59:42.0765 3444        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
14:59:42.0766 3444        CVirtA - ok
14:59:42.0860 3444        CVPNDRVA        (720482888c3778f26eeb83d286a6cdc3) C:\Windows\system32\Drivers\CVPNDRVA.sys
14:59:42.0864 3444        CVPNDRVA - ok
14:59:42.0965 3444        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
14:59:42.0967 3444        DfsC - ok
14:59:42.0995 3444        DgiVecp - ok
14:59:43.0091 3444        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
14:59:43.0092 3444        disk - ok
14:59:43.0153 3444        DNE            (86d52c32a308f84bbc626bff7c1fb710) C:\Windows\system32\DRIVERS\dne2000.sys
14:59:43.0155 3444        DNE - ok
14:59:43.0229 3444        Dot4            (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
14:59:43.0232 3444        Dot4 - ok
14:59:43.0297 3444        Dot4Print      (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
14:59:43.0298 3444        Dot4Print - ok
14:59:43.0361 3444        dot4usb        (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
14:59:43.0363 3444        dot4usb - ok
14:59:43.0416 3444        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
14:59:43.0417 3444        drmkaud - ok
14:59:43.0497 3444        DXGKrnl        (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
14:59:43.0505 3444        DXGKrnl - ok
14:59:43.0552 3444        e1express      (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys
14:59:43.0555 3444        e1express - ok
14:59:43.0600 3444        E1G60          (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
14:59:43.0602 3444        E1G60 - ok
14:59:43.0709 3444        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
14:59:43.0711 3444        Ecache - ok
14:59:43.0777 3444        elxstor        (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
14:59:43.0782 3444        elxstor - ok
14:59:43.0843 3444        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
14:59:43.0844 3444        ErrDev - ok
14:59:43.0900 3444        exfat          (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
14:59:43.0903 3444        exfat - ok
14:59:43.0950 3444        fastfat        (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
14:59:43.0952 3444        fastfat - ok
14:59:43.0982 3444        fdc            (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
14:59:43.0983 3444        fdc - ok
14:59:44.0027 3444        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
14:59:44.0029 3444        FileInfo - ok
14:59:44.0054 3444        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
14:59:44.0056 3444        Filetrace - ok
14:59:44.0080 3444        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
14:59:44.0081 3444        flpydisk - ok
14:59:44.0120 3444        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
14:59:44.0123 3444        FltMgr - ok
14:59:44.0154 3444        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
14:59:44.0155 3444        Fs_Rec - ok
14:59:44.0188 3444        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
14:59:44.0189 3444        gagp30kx - ok
14:59:44.0280 3444        HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
14:59:44.0283 3444        HdAudAddService - ok
14:59:44.0320 3444        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
14:59:44.0328 3444        HDAudBus - ok
14:59:44.0360 3444        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
14:59:44.0361 3444        HidBth - ok
14:59:44.0395 3444        HidIr          (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
14:59:44.0396 3444        HidIr - ok
14:59:44.0420 3444        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
14:59:44.0421 3444        HidUsb - ok
14:59:44.0462 3444        HpCISSs        (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
14:59:44.0463 3444        HpCISSs - ok
14:59:44.0533 3444        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
14:59:44.0539 3444        HTTP - ok
14:59:44.0604 3444        i2omp          (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
14:59:44.0605 3444        i2omp - ok
14:59:44.0654 3444        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
14:59:44.0656 3444        i8042prt - ok
14:59:44.0742 3444        iaStor          (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
14:59:44.0746 3444        iaStor - ok
14:59:44.0788 3444        iaStorV        (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
14:59:44.0792 3444        iaStorV - ok
14:59:44.0832 3444        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
14:59:44.0833 3444        iirsp - ok
14:59:44.0877 3444        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
14:59:44.0878 3444        intelide - ok
14:59:44.0926 3444        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
14:59:44.0928 3444        intelppm - ok
14:59:44.0961 3444        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:59:44.0963 3444        IpFilterDriver - ok
14:59:44.0983 3444        IpInIp - ok
14:59:45.0020 3444        IPMIDRV        (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
14:59:45.0022 3444        IPMIDRV - ok
14:59:45.0058 3444        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
14:59:45.0060 3444        IPNAT - ok
14:59:45.0100 3444        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
14:59:45.0102 3444        IRENUM - ok
14:59:45.0143 3444        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
14:59:45.0145 3444        isapnp - ok
14:59:45.0201 3444        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
14:59:45.0204 3444        iScsiPrt - ok
14:59:45.0246 3444        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
14:59:45.0248 3444        iteatapi - ok
14:59:45.0285 3444        itecir          (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys
14:59:45.0287 3444        itecir - ok
14:59:45.0324 3444        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
14:59:45.0326 3444        iteraid - ok
14:59:45.0390 3444        k57nd60x        (a67e8cfcad7d4f8b35643d6c79ba64c3) C:\Windows\system32\DRIVERS\k57nd60x.sys
14:59:45.0394 3444        k57nd60x - ok
14:59:45.0420 3444        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
14:59:45.0422 3444        kbdclass - ok
14:59:45.0455 3444        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
14:59:45.0456 3444        kbdhid - ok
14:59:45.0529 3444        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
14:59:45.0536 3444        KSecDD - ok
14:59:45.0695 3444        Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
14:59:45.0696 3444        Lavasoft Kernexplorer - ok
14:59:45.0809 3444        Lbd            (336abe8721cbc3110f1c6426da633417) C:\Windows\system32\DRIVERS\Lbd.sys
14:59:45.0811 3444        Lbd - ok
14:59:45.0876 3444        lirsgt          (975b6cf65f44e95883f3855bae8cecaf) C:\Windows\system32\DRIVERS\lirsgt.sys
14:59:45.0877 3444        lirsgt - ok
14:59:45.0932 3444        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
14:59:45.0935 3444        lltdio - ok
14:59:45.0998 3444        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
14:59:46.0000 3444        LSI_FC - ok
14:59:46.0038 3444        LSI_SAS        (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
14:59:46.0040 3444        LSI_SAS - ok
14:59:46.0077 3444        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
14:59:46.0079 3444        LSI_SCSI - ok
14:59:46.0119 3444        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
14:59:46.0121 3444        luafv - ok
14:59:46.0188 3444        MBAMProtector  (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys
14:59:46.0189 3444        MBAMProtector - ok
14:59:46.0235 3444        megasas        (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
14:59:46.0236 3444        megasas - ok
14:59:46.0286 3444        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
14:59:46.0291 3444        MegaSR - ok
14:59:46.0332 3444        MEMSWEEP2 - ok
14:59:46.0358 3444        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
14:59:46.0360 3444        Modem - ok
14:59:46.0403 3444        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
14:59:46.0404 3444        monitor - ok
14:59:46.0430 3444        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
14:59:46.0432 3444        mouclass - ok
14:59:46.0455 3444        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
14:59:46.0456 3444        mouhid - ok
14:59:46.0480 3444        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
14:59:46.0482 3444        MountMgr - ok
14:59:46.0521 3444        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
14:59:46.0523 3444        mpio - ok
14:59:46.0560 3444        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
14:59:46.0562 3444        mpsdrv - ok
14:59:46.0623 3444        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
14:59:46.0625 3444        Mraid35x - ok
14:59:46.0714 3444        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
14:59:46.0716 3444        MRxDAV - ok
14:59:46.0781 3444        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
14:59:46.0783 3444        mrxsmb - ok
14:59:46.0838 3444        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:59:46.0842 3444        mrxsmb10 - ok
14:59:46.0881 3444        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:59:46.0883 3444        mrxsmb20 - ok
14:59:46.0938 3444        msahci          (f70590424eefbf5c27a40c67afdb8383) C:\Windows\system32\drivers\msahci.sys
14:59:46.0940 3444        msahci - ok
14:59:46.0973 3444        msdsm          (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
14:59:46.0975 3444        msdsm - ok
14:59:47.0023 3444        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
14:59:47.0024 3444        Msfs - ok
14:59:47.0048 3444        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
14:59:47.0050 3444        msisadrv - ok
14:59:47.0096 3444        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
14:59:47.0097 3444        MSKSSRV - ok
14:59:47.0122 3444        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
14:59:47.0123 3444        MSPCLOCK - ok
14:59:47.0152 3444        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
14:59:47.0153 3444        MSPQM - ok
14:59:47.0198 3444        MsRPC          (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
14:59:47.0201 3444        MsRPC - ok
14:59:47.0233 3444        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
14:59:47.0235 3444        mssmbios - ok
14:59:47.0258 3444        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
14:59:47.0259 3444        MSTEE - ok
14:59:47.0302 3444        Mup            (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
14:59:47.0304 3444        Mup - ok
14:59:47.0358 3444        NativeWifiP    (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
14:59:47.0361 3444        NativeWifiP - ok
14:59:47.0398 3444        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
14:59:47.0406 3444        NDIS - ok
14:59:47.0428 3444        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
14:59:47.0430 3444        NdisTapi - ok
14:59:47.0471 3444        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
14:59:47.0472 3444        Ndisuio - ok
14:59:47.0505 3444        NdisWan        (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
14:59:47.0507 3444        NdisWan - ok
14:59:47.0557 3444        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
14:59:47.0559 3444        NDProxy - ok
14:59:47.0591 3444        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
14:59:47.0593 3444        NetBIOS - ok
14:59:47.0629 3444        netbt          (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
14:59:47.0632 3444        netbt - ok
14:59:47.0699 3444        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
14:59:47.0700 3444        nfrd960 - ok
14:59:47.0760 3444        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
14:59:47.0761 3444        Npfs - ok
14:59:47.0784 3444        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
14:59:47.0786 3444        nsiproxy - ok
14:59:47.0878 3444        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
14:59:47.0894 3444        Ntfs - ok
14:59:47.0919 3444        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
14:59:47.0920 3444        ntrigdigi - ok
14:59:47.0939 3444        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
14:59:47.0942 3444        Null - ok
14:59:47.0979 3444        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
14:59:47.0981 3444        nvraid - ok
14:59:48.0008 3444        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
14:59:48.0010 3444        nvstor - ok
14:59:48.0041 3444        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
14:59:48.0043 3444        nv_agp - ok
14:59:48.0059 3444        NwlnkFlt - ok
14:59:48.0080 3444        NwlnkFwd - ok
14:59:48.0134 3444        OA001Ufd        (9b7cd7151a7c4009c383396155f02b95) C:\Windows\system32\DRIVERS\OA001Ufd.sys
14:59:48.0136 3444        OA001Ufd - ok
14:59:48.0168 3444        OA001Vid        (cdcdad303a9208cf3513400ef2a05f80) C:\Windows\system32\DRIVERS\OA001Vid.sys
14:59:48.0172 3444        OA001Vid - ok
14:59:48.0241 3444        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
14:59:48.0243 3444        ohci1394 - ok
14:59:48.0299 3444        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
14:59:48.0301 3444        Parport - ok
14:59:48.0351 3444        partmgr        (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
14:59:48.0353 3444        partmgr - ok
14:59:48.0388 3444        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
14:59:48.0389 3444        Parvdm - ok
14:59:48.0425 3444        pci            (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
14:59:48.0428 3444        pci - ok
14:59:48.0467 3444        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
14:59:48.0468 3444        pciide - ok
14:59:48.0502 3444        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
14:59:48.0505 3444        pcmcia - ok
14:59:48.0575 3444        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
14:59:48.0588 3444        PEAUTH - ok
14:59:48.0687 3444        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
14:59:48.0689 3444        PptpMiniport - ok
14:59:48.0731 3444        Processor      (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
14:59:48.0732 3444        Processor - ok
14:59:48.0784 3444        prodrv06        (e87132348aaa995fcb3a8870f0da525d) C:\Windows\System32\drivers\prodrv06.sys
14:59:48.0786 3444        prodrv06 - ok
14:59:48.0838 3444        prohlp02        (efa0b90d3f2ddd18f064f94a3e9aa503) C:\Windows\system32\drivers\prohlp02.sys
14:59:48.0841 3444        prohlp02 - ok
14:59:48.0881 3444        prosync1        (cc3d1bb199cbb576b0fbaaba626b6714) C:\Windows\system32\drivers\prosync1.sys
14:59:48.0882 3444        prosync1 - ok
14:59:48.0946 3444        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
14:59:48.0948 3444        PSched - ok
14:59:49.0031 3444        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
14:59:49.0048 3444        ql2300 - ok
14:59:49.0095 3444        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
14:59:49.0097 3444        ql40xx - ok
14:59:49.0142 3444        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
14:59:49.0144 3444        QWAVEdrv - ok
14:59:49.0302 3444        R300            (ac9e487e3513561e4f7953c438727ff7) C:\Windows\system32\DRIVERS\atikmdag.sys
14:59:49.0354 3444        R300 - ok
14:59:49.0380 3444        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
14:59:49.0381 3444        RasAcd - ok
14:59:49.0437 3444        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
14:59:49.0439 3444        Rasl2tp - ok
14:59:49.0481 3444        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
14:59:49.0483 3444        RasPppoe - ok
14:59:49.0512 3444        RasSstp        (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
14:59:49.0515 3444        RasSstp - ok
14:59:49.0560 3444        rdbss          (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
14:59:49.0564 3444        rdbss - ok
14:59:49.0634 3444        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
14:59:49.0635 3444        RDPCDD - ok
14:59:49.0681 3444        rdpdr          (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
14:59:49.0685 3444        rdpdr - ok
14:59:49.0704 3444        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
14:59:49.0706 3444        RDPENCDD - ok
14:59:49.0767 3444        RDPWD          (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
14:59:49.0770 3444        RDPWD - ok
14:59:49.0857 3444        RFCOMM          (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys
14:59:49.0859 3444        RFCOMM - ok
14:59:49.0916 3444        rimmptsk        (c2ef513bbe069f0d4ee0938a76f975d3) C:\Windows\system32\DRIVERS\rimmptsk.sys
14:59:49.0918 3444        rimmptsk - ok
14:59:49.0937 3444        rimsptsk        (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys
14:59:49.0939 3444        rimsptsk - ok
14:59:49.0960 3444        rismxdp        (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys
14:59:49.0962 3444        rismxdp - ok
14:59:50.0015 3444        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
14:59:50.0017 3444        rspndr - ok
14:59:50.0059 3444        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
14:59:50.0061 3444        sbp2port - ok
14:59:50.0116 3444        sdbus          (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
14:59:50.0118 3444        sdbus - ok
14:59:50.0154 3444        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
14:59:50.0156 3444        secdrv - ok
14:59:50.0190 3444        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
14:59:50.0191 3444        Serenum - ok
14:59:50.0230 3444        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
14:59:50.0232 3444        Serial - ok
14:59:50.0269 3444        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
14:59:50.0270 3444        sermouse - ok
14:59:50.0322 3444        sffdisk        (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
14:59:50.0323 3444        sffdisk - ok
14:59:50.0358 3444        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
14:59:50.0360 3444        sffp_mmc - ok
14:59:50.0402 3444        sffp_sd        (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
14:59:50.0403 3444        sffp_sd - ok
14:59:50.0448 3444        sfhlp01        (95654a66531b8a198d0d5d153cc95f8e) C:\Windows\system32\drivers\sfhlp01.sys
14:59:50.0450 3444        sfhlp01 - ok
14:59:50.0482 3444        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
14:59:50.0483 3444        sfloppy - ok
14:59:50.0559 3444        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
14:59:50.0561 3444        sisagp - ok
14:59:50.0598 3444        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
14:59:50.0600 3444        SiSRaid2 - ok
14:59:50.0636 3444        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
14:59:50.0638 3444        SiSRaid4 - ok
14:59:50.0748 3444        Smb            (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
14:59:50.0750 3444        Smb - ok
14:59:50.0787 3444        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
14:59:50.0789 3444        spldr - ok
14:59:50.0871 3444        sptd            (71e276f6d189413266ea22171806597b) C:\Windows\system32\Drivers\sptd.sys
14:59:50.0871 3444        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
14:59:50.0874 3444        sptd ( LockedFile.Multi.Generic ) - warning
14:59:50.0874 3444        sptd - detected LockedFile.Multi.Generic (1)
14:59:50.0952 3444        srv            (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
14:59:50.0957 3444        srv - ok
14:59:51.0036 3444        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
14:59:51.0039 3444        srv2 - ok
14:59:51.0083 3444        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
14:59:51.0085 3444        srvnet - ok
14:59:51.0147 3444        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
14:59:51.0148 3444        ssmdrv - ok
14:59:51.0210 3444        SSPORT          (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys
14:59:51.0211 3444        SSPORT - ok
14:59:51.0271 3444        ss_bus          (5a1d0ca8a5f1e7b4ec50b9d76c001f0e) C:\Windows\system32\DRIVERS\ss_bus.sys
14:59:51.0273 3444        ss_bus - ok
14:59:51.0328 3444        ss_mdfl        (f0a85580e36a3a85059037d39a9cf079) C:\Windows\system32\DRIVERS\ss_mdfl.sys
14:59:51.0329 3444        ss_mdfl - ok
14:59:51.0378 3444        ss_mdm          (84c3dbfd1bfa4adc0a950b3d5506cb00) C:\Windows\system32\DRIVERS\ss_mdm.sys
14:59:51.0381 3444        ss_mdm - ok
14:59:51.0474 3444        StarOpen        (306521935042fc0a6988d528643619b3) C:\Windows\system32\drivers\StarOpen.sys
14:59:51.0475 3444        StarOpen - ok
14:59:51.0520 3444        STHDA          (805b1fc7e25613ce2dc93c0759d0aa30) C:\Windows\system32\DRIVERS\stwrt.sys
14:59:51.0526 3444        STHDA - ok
14:59:51.0581 3444        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
14:59:51.0582 3444        swenum - ok
14:59:51.0633 3444        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
14:59:51.0634 3444        Symc8xx - ok
14:59:51.0675 3444        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
14:59:51.0677 3444        Sym_hi - ok
14:59:51.0725 3444        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
14:59:51.0727 3444        Sym_u3 - ok
14:59:51.0865 3444        Tcpip          (2756186e287139310997090797e0182b) C:\Windows\system32\drivers\tcpip.sys
14:59:51.0877 3444        Tcpip - ok
14:59:51.0931 3444        Tcpip6          (2756186e287139310997090797e0182b) C:\Windows\system32\DRIVERS\tcpip.sys
14:59:51.0944 3444        Tcpip6 - ok
14:59:51.0989 3444        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
14:59:51.0991 3444        tcpipreg - ok
14:59:52.0033 3444        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
14:59:52.0034 3444        TDPIPE - ok
14:59:52.0068 3444        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
14:59:52.0070 3444        TDTCP - ok
14:59:52.0127 3444        tdx            (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
14:59:52.0129 3444        tdx - ok
14:59:52.0168 3444        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
14:59:52.0170 3444        TermDD - ok
14:59:52.0252 3444        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
14:59:52.0254 3444        tssecsrv - ok
14:59:52.0291 3444        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
14:59:52.0293 3444        tunmp - ok
14:59:52.0365 3444        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
14:59:52.0366 3444        tunnel - ok
14:59:52.0405 3444        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
14:59:52.0407 3444        uagp35 - ok
14:59:52.0471 3444        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
14:59:52.0475 3444        udfs - ok
14:59:52.0519 3444        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
14:59:52.0521 3444        uliagpkx - ok
14:59:52.0561 3444        uliahci        (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
14:59:52.0565 3444        uliahci - ok
14:59:52.0613 3444        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
14:59:52.0616 3444        UlSata - ok
14:59:52.0672 3444        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
14:59:52.0674 3444        ulsata2 - ok
14:59:52.0725 3444        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
14:59:52.0727 3444        umbus - ok
14:59:52.0831 3444        UnlockerDriver5 (4847639d852763ee39415c929470f672) C:\Program Files\Unlocker\UnlockerDriver5.sys
14:59:52.0832 3444        UnlockerDriver5 - ok
14:59:52.0907 3444        usbccgp        (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
14:59:52.0909 3444        usbccgp - ok
14:59:52.0940 3444        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
14:59:52.0942 3444        usbcir - ok
14:59:52.0980 3444        usbehci        (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
14:59:52.0982 3444        usbehci - ok
14:59:53.0016 3444        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
14:59:53.0019 3444        usbhub - ok
14:59:53.0058 3444        usbohci        (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
14:59:53.0059 3444        usbohci - ok
14:59:53.0102 3444        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
14:59:53.0103 3444        usbprint - ok
14:59:53.0160 3444        usbscan        (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
14:59:53.0162 3444        usbscan - ok
14:59:53.0215 3444        USBSTOR        (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:59:53.0217 3444        USBSTOR - ok
14:59:53.0278 3444        usbuhci        (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
14:59:53.0280 3444        usbuhci - ok
14:59:53.0318 3444        vga            (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
14:59:53.0320 3444        vga - ok
14:59:53.0348 3444        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
14:59:53.0350 3444        VgaSave - ok
14:59:53.0385 3444        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
14:59:53.0387 3444        viaagp - ok
14:59:53.0419 3444        ViaC7          (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
14:59:53.0420 3444        ViaC7 - ok
14:59:53.0459 3444        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
14:59:53.0461 3444        viaide - ok
14:59:53.0481 3444        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
14:59:53.0483 3444        volmgr - ok
14:59:53.0547 3444        volmgrx        (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
14:59:53.0552 3444        volmgrx - ok
14:59:53.0621 3444        volsnap        (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
14:59:53.0626 3444        volsnap - ok
14:59:53.0668 3444        vsmraid        (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
14:59:53.0671 3444        vsmraid - ok
14:59:53.0713 3444        VSTHWBS2        (c466021d31ff6c0a6069d12299d80c0b) C:\Windows\system32\DRIVERS\VSTBS23.SYS
14:59:53.0717 3444        VSTHWBS2 - ok
14:59:53.0790 3444        VST_DPV        (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
14:59:53.0804 3444        VST_DPV - ok
14:59:53.0860 3444        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
14:59:53.0861 3444        WacomPen - ok
14:59:53.0895 3444        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
14:59:53.0898 3444        Wanarp - ok
14:59:53.0907 3444        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
14:59:53.0910 3444        Wanarpv6 - ok
14:59:53.0957 3444        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
14:59:53.0959 3444        Wd - ok
14:59:54.0005 3444        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
14:59:54.0013 3444        Wdf01000 - ok
14:59:54.0107 3444        winachsf        (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
14:59:54.0116 3444        winachsf - ok
14:59:54.0197 3444        WmiAcpi        (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
14:59:54.0199 3444        WmiAcpi - ok
14:59:54.0258 3444        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
14:59:54.0260 3444        ws2ifsl - ok
14:59:54.0312 3444        WSDPrintDevice  (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
14:59:54.0313 3444        WSDPrintDevice - ok
14:59:54.0367 3444        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
14:59:54.0369 3444        WUDFRd - ok
14:59:54.0422 3444        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
14:59:54.0443 3444        \Device\Harddisk0\DR0 - ok
14:59:54.0459 3444        Boot (0x1200)  (2045b22ae7a0c980add1b4130b40a01d) \Device\Harddisk0\DR0\Partition0
14:59:54.0461 3444        \Device\Harddisk0\DR0\Partition0 - ok
14:59:54.0467 3444        Boot (0x1200)  (84e7f347abbc3880d37553383eca1bd2) \Device\Harddisk0\DR0\Partition1
14:59:54.0468 3444        \Device\Harddisk0\DR0\Partition1 - ok
14:59:54.0473 3444        ============================================================
14:59:54.0473 3444        Scan finished
14:59:54.0473 3444        ============================================================
14:59:54.0490 3440        Detected object count: 1
14:59:54.0491 3440        Actual detected object count: 1
15:00:03.0126 3440        sptd ( LockedFile.Multi.Generic ) - skipped by user
15:00:03.0126 3440        sptd ( LockedFile.Multi.Generic ) - User select action: Skip

cosinus 24.09.2011 14:55
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

stanomaly 24.09.2011 15:57
So, Combofix ist auch durch:

Code:
ComboFix 11-09-24.01 - XB 24.09.2011  16:38:27.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3581.2688 [GMT 2:00]
ausgeführt von:: c:\users\XB\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Setup.exe
c:\windows\IsUn0407.exe
c:\windows\system32\srcr.dat
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-24 bis 2011-09-24  ))))))))))))))))))))))))))))))
.
.
2011-09-24 12:49 . 2011-09-24 12:49        1449114        ----a-w-        c:\windows\system32\PerfStringBackup.TMP
2011-09-24 12:13 . 2011-09-24 12:13        --------        d-----w-        C:\_OTL
2011-09-22 16:28 . 2011-09-22 16:28        --------        d-----w-        c:\program files\MozBackup
2011-09-22 15:13 . 2011-09-22 15:13        --------        d-----w-        c:\program files\ESET
2011-09-21 18:07 . 2011-09-21 18:07        --------        d-----w-        c:\users\XB\AppData\Roaming\Malwarebytes
2011-09-21 18:07 . 2011-09-21 18:07        --------        d-----w-        c:\programdata\Malwarebytes
2011-09-21 18:07 . 2011-09-21 18:07        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-09-21 18:07 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-09-21 18:01 . 2011-09-21 18:01        --------        d-----w-        C:\TDSSKiller_Quarantine
2011-09-21 17:21 . 2011-09-21 17:21        --------        d--h--r-        c:\users\XB\AppData\Roaming\SecuROM
2011-09-21 07:34 . 2011-09-21 07:34        102400        ----a-w-        c:\windows\RegBootClean.exe
2011-09-21 07:27 . 2011-06-21 04:09        200976        ----a-w-        c:\windows\system32\drivers\tmcomm.sys
2011-09-20 21:52 . 2011-09-20 21:52        --------        d-----w-        c:\program files\Sophos
2011-09-20 21:38 . 2011-09-20 21:38        --------        d-----w-        c:\program files\Avira
2011-09-20 14:34 . 2011-09-20 14:34        23624        ---ha-w-        c:\windows\system32\drivers\hitmanpro35.sys
2011-09-20 14:33 . 2011-09-20 14:34        --------        d--h--w-        c:\programdata\Hitman Pro
2011-09-17 10:58 . 2011-09-21 15:16        --------        d-----w-        c:\program files\Common Files\Steam
2011-09-17 10:57 . 2011-09-23 15:56        --------        d-----w-        c:\program files\Steam
2011-09-16 16:44 . 2011-08-12 02:44        7152464        ---ha-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6A79BDD4-5B48-4037-B143-09A7752CAB9A}\mpengine.dll
2011-09-05 17:04 . 2011-09-05 17:04        183696        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-09-05 17:04 . 2011-09-05 17:04        183696        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-20 13:04 . 2011-05-17 16:02        404640        ---ha-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-11 13:25 . 2011-08-25 08:00        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-07-06 15:31 . 2011-08-15 16:07        214016        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-06-30 06:35 . 2010-04-02 16:44        101720        ---ha-w-        c:\windows\system32\drivers\SBREDrv.sys
2009-04-24 15:01 . 2009-04-24 15:01        9819136        ----a-w-        c:\program files\openofficeorg31.msi
2008-09-30 15:48 . 2008-09-30 15:48        9776640        ----a-w-        c:\program files\openofficeorg30.msi
2002-03-11 09:06 . 2002-03-11 09:06        1822520        ----a-w-        c:\program files\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45        1708856        ----a-w-        c:\program files\instmsia.exe
2009-05-01 21:02 . 2009-05-01 21:02        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll
2011-09-07 16:26 . 2011-05-31 18:20        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-04-15 2515552]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2010-04-15 10:33        2515552        ----a-w-        c:\program files\Vuze_Remote\tbVuze.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-04-15 2515552]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-04-15 2515552]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\XB\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\XB\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\XB\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\XB\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-06-30 196608]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-03-12 3563520]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2008-01-14 132392]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-06-26 442467]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-08-15 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\XB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\XB\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-09-10 12:56        10536        ----a-w-        c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 gupdate1c9857b8b2f9105;Google Update Service (gupdate1c9857b8b2f9105);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 133104]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-09-02 2152152]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-03-11 29736]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 133104]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2011-05-25 15232]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\A479.tmp [x]
R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2008-01-21 987648]
R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2008-01-21 251904]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-05-25 64512]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-09-14 717296]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\aestsrv.exe [2008-06-26 73728]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-07-29 5120]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2008-03-14 54784]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-03-11 203264]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2008-03-11 149208]
S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2008-03-11 277624]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 23518345
*NewlyCreated* - 23525287
*Deregistered* - 23518345
*Deregistered* - 23525287
*Deregistered* - avipbb
*Deregistered* - ssmdrv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-21 13:40]
.
2011-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 21:16]
.
2011-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 21:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4080910
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\XB\AppData\Roaming\Mozilla\Firefox\Profiles\aou9vsu3.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
HKLM-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
SafeBoot-97776012.sys
AddRemove-ZoomBrowserEXDeInstall - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-24 16:48
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\A479.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3073598487-600519957-3315168187-1000\Software\SecuROM\License information*]
"datasecu"=hex:df,02,08,42,5e,02,73,d7,af,a0,0a,af,4b,ca,2b,8a,08,dd,c0,00,6b,
  1d,35,46,f0,d3,ce,90,b4,da,c9,1a,62,37,ec,5a,41,df,48,dd,67,de,e6,bd,32,f0,\
"rkeysecu"=hex:e7,3c,94,71,5b,91,c2,a5,ca,5e,4c,73,5a,01,a9,c9
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-09-24  16:52:23
ComboFix-quarantined-files.txt  2011-09-24 14:52
.
Vor Suchlauf: 7 Verzeichnis(se), 149.965.443.072 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 149.924.421.632 Bytes frei
.
- - End Of File - - 55C32AF2AA78F21DA54A33ACD1CC949D

cosinus 24.09.2011 16:30
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

stanomaly 24.09.2011 18:43
Hier ist das GMER-Log. Das Programm hat sich zwar nicht aufgehangen, aber irgendwann kam die Meldung "The scan was stopped." Ob d.h., dass fertig gescannt wurde weiß ich nicht.

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-09-24 19:39:26
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0
Running: gotcuqfr.exe; Driver: C:\Users\XB\AppData\Local\Temp\pxldipoc.sys


---- System - GMER 1.0.15 ----

INT 0x52        ?                                                                                                                    B16F72D0
INT 0x62        ?                                                                                                                    B16F7050
INT 0x71        ?                                                                                                                    B38A27D0
INT 0x72        ?                                                                                                                    B16F7550
INT 0x81        ?                                                                                                                    B38A2CD0
INT 0x82        ?                                                                                                                    B38A57D0
INT 0x91        ?                                                                                                                    B38A2A50
INT 0xA0        ?                                                                                                                    B38A22D0
INT 0xA2        ?                                                                                                                    B16F7A50
INT 0xB0        ?                                                                                                                    B38AA7D0
INT 0xB1        ?                                                                                                                    B16F7CD0

---- Kernel code sections - GMER 1.0.15 ----

?              System32\Drivers\spkt.sys                                                                                            Das System kann den angegebenen Pfad nicht finden. !
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                                                            section is writeable [0xBB60A000, 0x213FE7, 0xE8000020]
.text          USBPORT.SYS!DllUnload                                                                                                BBF7441B 5 Bytes  JMP B338D4E0
.text          ai04huq0.SYS                                                                                                        BC20F000 22 Bytes  [82, 73, DC, E2, 6C, 72, DC, ...]
.text          ai04huq0.SYS                                                                                                        BC20F017 137 Bytes  [00, 32, B7, 99, B7, 3D, B5, ...]
.text          ai04huq0.SYS                                                                                                        BC20F0A1 43 Bytes  [F0, AA, E2, 74, E6, A4, E2, ...]
.text          ai04huq0.SYS                                                                                                        BC20F0CE 10 Bytes  [00, 00, 00, 00, 00, 00, 66, ...]
.text          ai04huq0.SYS                                                                                                        BC20F0DA 12 Bytes  [00, 00, 02, 00, 00, 00, 25, ...]
.text          ...                                                                                                                 
?              system32\DRIVERS\avgntflt.sys                                                                                        Das System kann den angegebenen Pfad nicht finden. !
.text          C:\Windows\system32\DRIVERS\atksgt.sys                                                                              section is writeable [0xCDAED300, 0x3ACC8, 0xE8000020]
.text          C:\Windows\system32\DRIVERS\lirsgt.sys                                                                              section is writeable [0xCDBC0300, 0x1B7E, 0xE8000020]
?              C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                          Das System kann die angegebene Datei nicht finden. !
?              C:\Users\XB\AppData\Local\Temp\catchme.sys                                                                          Das System kann die angegebene Datei nicht finden. !

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                  [B78A2048] \SystemRoot\System32\Drivers\spkt.sys

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              B16AE1F8
Device          \FileSystem\fastfat \FatCdrom                                                                                        B3D2A4D0
Device          \Driver\volmgr \Device\VolMgrControl                                                                                B0D181F8
Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    B33C01F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    B33C01F8
Device          \Driver\usbehci \Device\USBPDO-2                                                                                    B33CA1F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                    B33C01F8
Device          \Driver\usbuhci \Device\USBPDO-4                                                                                    B33C01F8
Device          \Driver\usbuhci \Device\USBPDO-5                                                                                    B33C01F8
Device          \Driver\usbehci \Device\USBPDO-6                                                                                    B33CA1F8
Device          \Driver\volmgr \Device\HarddiskVolume1                                                                              B0D181F8
Device          \Driver\volmgr \Device\HarddiskVolume2                                                                              B0D181F8
Device          \Driver\cdrom \Device\CdRom0                                                                                        B33CE1F8
Device          \Driver\iaStor \Device\Ide\iaStor0                                                                                  [B7AB88E0] \SystemRoot\system32\drivers\iastor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\iaStor \Device\Ide\iaStor0                                                                                  prosync1.sys (StarForce Protection Synchronization Driver/StarForce Technologies, Inc.)
Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-0                                                                        [B7AB88E0] \SystemRoot\system32\drivers\iastor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-0                                                                        prosync1.sys (StarForce Protection Synchronization Driver/StarForce Technologies, Inc.)
Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-1                                                                        [B7AB88E0] \SystemRoot\system32\drivers\iastor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-1                                                                        prosync1.sys (StarForce Protection Synchronization Driver/StarForce Technologies, Inc.)
Device          \Driver\volmgr \Device\HarddiskVolume3                                                                              B0D181F8
Device          \Driver\cdrom \Device\CdRom1                                                                                        B33CE1F8
Device          \Driver\prohlp02 \Device\ProHlp02                                                                                    BA246A08
Device          \Driver\netbt \Device\NetBt_Wins_Export                                                                              B08CC500
Device          \Driver\netbt \Device\NetBT_Tcpip_{1D4AA4CE-FA5C-4D1D-8845-B69DCC52D969}                                            B08CC500
Device          \Driver\Smb \Device\NetbiosSmb                                                                                      B3CB41F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{AAEF5F1E-EDBC-4AE0-9A9A-3EA018D664A2}                                            B08CC500
Device          \Driver\iScsiPrt \Device\RaidPort0                                                                                  B383B1F8
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    B33C01F8
Device          \Driver\PCI_PNP6872 \Device\0000006d                                                                                spkt.sys
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    B33C01F8
Device          \Driver\usbehci \Device\USBFDO-2                                                                                    B33CA1F8
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    B33C01F8
Device          \Driver\usbuhci \Device\USBFDO-4                                                                                    B33C01F8
Device          \Driver\sptd \Device\1839898909                                                                                      spkt.sys
Device          \Driver\usbuhci \Device\USBFDO-5                                                                                    B33C01F8
Device          \Driver\usbehci \Device\USBFDO-6                                                                                    B33CA1F8
Device          \Driver\ai04huq0 \Device\Scsi\ai04huq01Port2Path0Target0Lun0                                                        B33C21F8
Device          \Driver\ai04huq0 \Device\Scsi\ai04huq01                                                                              B33C21F8
Device          \FileSystem\fastfat \Fat                                                                                            B3D2A4D0

AttachedDevice  \FileSystem\fastfat \Fat                                                                                            fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

Device          \FileSystem\cdfs \Cdfs                                                                                              B0E6B1F8

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\001fe1be032d                                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                              0x20 0x7D 0xF4 0xD8 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                           
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x24 0xEE 0x66 0x3F ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x07 0xF0 0xE1 0xE1 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\001fe1be032d (not active ControlSet)                     
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                  0x20 0x7D 0xF4 0xD8 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)       
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x24 0xEE 0x66 0x3F ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x07 0xF0 0xE1 0xE1 ...
Reg            HKLM\SYSTEM\ControlSet004\Services\BthPort\Parameters\Keys\001fe1be032d (not active ControlSet)                     
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                  0x20 0x7D 0xF4 0xD8 ...
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)       
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x24 0xEE 0x66 0x3F ...
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x07 0xF0 0xE1 0xE1 ...

---- EOF - GMER 1.0.15 ----
Der OSAM-Scan folgt.

stanomaly 24.09.2011 18:54
Hier OSAM:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:52:48 on 24.09.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 6.0.2

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"BCMWLCPL.CPL" - "Dell Inc." - C:\Windows\system32\BCMWLCPL.CPL
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"bcmwlcpl.cpl" - "Dell Inc." - C:\Windows\System32\bcmwlcpl.cpl
"Nero BurnRights" - ? - C:\Program Files\Nero\Nero 9\Nero BurnRights\NeroBurnRights_cpl.cpl  (File not found)
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ai04huq0" (ai04huq0) - "Microsoft Corporation" - C:\Windows\system32\drivers\ai04huq0.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"avgntflt" (avgntflt) - ? - C:\Windows\System32\DRIVERS\avgntflt.sys  (File not found)
"BCM42RLY" (BCM42RLY) - "Broadcom Corporation" - C:\Windows\System32\drivers\BCM42RLY.sys
"catchme" (catchme) - ? - C:\Users\XB\AppData\Local\Temp\catchme.sys  (File not found)
"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\Windows\system32\Drivers\CVPNDRVA.sys
"DgiVecp" (DgiVecp) - ? - C:\Windows\system32\Drivers\DgiVecp.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys  (File found, but it contains no detailed information)
"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"mbr" (mbr) - ? - C:\ComboFix\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"MEMSWEEP2" (MEMSWEEP2) - ? - C:\Windows\system32\A479.tmp  (File not found)
"pxldipoc" (pxldipoc) - ? - C:\Users\XB\AppData\Local\Temp\pxldipoc.sys  (Hidden registry entry, rootkit activity | File not found)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"SSPORT" (SSPORT) - "Samsung Electronics" - C:\Windows\system32\Drivers\SSPORT.sys
"StarForce Protection Environment Driver v6" (prodrv06) - "StarForce Technologies, Inc." - C:\Windows\System32\drivers\prodrv06.sys
"StarForce Protection Helper Driver" (sfhlp01) - "StarForce Technologies, Inc." - C:\Windows\System32\drivers\sfhlp01.sys
"StarForce Protection Helper Driver v2" (prohlp02) - "StarForce Technologies, Inc." - C:\Windows\System32\drivers\prohlp02.sys
"StarForce Protection Synchronization Driver v1" (prosync1) - "StarForce Technologies, Inc." - C:\Windows\System32\drivers\prosync1.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{44BBA840-CC51-11CF-AAFA-00AA00B6015C} "Microsoft Windows Mail 7" - ? - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE  (File not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{5A7B2149-7840-4531-B7B4-58F0F1CB0A6E} "IMAPIShlXt Class" - "Dell Inc" - C:\Windows\IMAPIShellExt.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - ? - C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll  (File not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -  (File not found | COM-object registry key not found)
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - C:\Program Files\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Vuze Remote Toolbar" - "Conduit Ltd." - C:\Program Files\Vuze_Remote\tbVuze.dll
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{ba14329e-9550-4989-b3f2-9732e92d17cc} "Vuze Remote Toolbar" - "Conduit Ltd." - C:\Program Files\Vuze_Remote\tbVuze.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "DAEMON Tools Toolbar" - ? - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
{ba14329e-9550-4989-b3f2-9732e92d17cc} "Vuze Remote Toolbar" - "Conduit Ltd." - C:\Program Files\Vuze_Remote\tbVuze.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Dell Inc." - C:\Program Files\Dell\BAE\BAE.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{ba14329e-9550-4989-b3f2-9732e92d17cc} "Vuze Remote Toolbar" - "Conduit Ltd." - C:\Program Files\Vuze_Remote\tbVuze.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\XB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\XB\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Broadcom Wireless Manager UI" - "Dell Inc." - C:\Windows\system32\WLTRAY.exe
"IAAnotif" - "Intel Corporation" - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"PCMService" - "CyberLink Corp." - "C:\Program Files\Dell\MediaDirect\PCMService.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"Dell Wireless WLAN Card Logon Provider" - "Dell Inc." - C:\Windows\System32\BCMLogon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
"Dell Wireless WLAN Tray Service" (wltrysvc) - ? - C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\bcmwltry.exe  (File not found)
"Dock Login Service" (DockLoginService) - "Stardock Corporation" - C:\Program Files\Dell\DellDock\DockLogin.exe
"Google Update Service (gupdate1c9857b8b2f9105)" (gupdate1c9857b8b2f9105) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoToAssist" (GoToAssist) - "Citrix Online, a division of Citrix Systems, Inc." - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft Limited" - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Nero BackItUp Scheduler 4.0" (Nero BackItUp Scheduler 4.0) - "Nero AG" - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe
"SupportSoft Sprocket Service (dellsupportcenter)" (sprtsvc_dellsupportcenter) - ? - C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter  (File not found)

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"GoToAssist" - "Citrix Online, a division of Citrix Systems, Inc." - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 24.09.2011 20:11
aswMBR kommt auch gleich?

stanomaly 24.09.2011 20:24
Jupp, hab's grad nochmal neu gestartet, da es sich scheinbar bei einer Datei aufgehangen hat. Hat jedenfalls eine halbe Stunde lang nicht weiter gemacht.

stanomaly 24.09.2011 22:34
Diesmal hat's geklappt. Er hat sich trotzdem irgendwann an einer Datei verhakt. Ich poste mal das Logfile bis hierher, viel wäre ohnehin nicht mehr gekommen. Vielleicht hilft das schon weiter. Ansonsten versuche ich morgen nochmal einen vollständigen Durchlauf und lösche die Dateien, bei denen das Programm sich anscheinend gerne sehr lange aufhält.

Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-24 21:20:35
-----------------------------
21:20:35.266    OS Version: Windows 6.0.6002 Service Pack 2
21:20:35.267    Number of processors: 2 586 0x1706
21:20:35.270    ComputerName: XB-PC  UserName: XB
21:20:37.409    Initialize success
21:20:45.107    AVAST engine defs: 11092401
21:20:48.186    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:20:48.229    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
21:20:51.055    Disk 0 MBR read successfully
21:20:51.163    Disk 0 MBR scan
21:20:51.171    Disk 0 Windows VISTA default MBR code
21:20:51.348    Disk 0 scanning sectors +625139712
21:20:52.119    Disk 0 scanning C:\Windows\system32\drivers
21:24:23.102    Service scanning
21:24:24.570    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
21:24:25.201    Modules scanning
21:28:05.139    Disk 0 trace - called modules:
21:28:05.273    ntkrnlpa.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll iastor.sys spkt.sys >>UNKNOWN [0xb1666938]<<
21:28:05.281    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xb225f4f8]
21:28:05.292    3 CLASSPNP.SYS[b81c58b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xb177b030]
21:28:07.466    AVAST engine scan C:\Windows
21:32:01.850    AVAST engine scan C:\Windows\system32
21:57:03.523    AVAST engine scan C:\Windows\system32\drivers
22:03:12.091    AVAST engine scan C:\Users\XB
23:28:06.664    Disk 0 MBR has been saved successfully to "C:\Users\XB\Desktop\MBR.dat"
23:28:06.684    The log file has been saved successfully to "C:\Users\XB\Desktop\aswMBR.txt"

cosinus 26.09.2011 10:08
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


stanomaly 26.09.2011 16:10
OK, danke, mache mich dann an die weiteren Scans. Hier ist erstmal noch das vollständige aswMBR Log, das ich noch schuldig war. ;)

HTML-Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-24 21:20:35
-----------------------------
21:20:35.266    OS Version: Windows 6.0.6002 Service Pack 2
21:20:35.267    Number of processors: 2 586 0x1706
21:20:35.270    ComputerName: XB-PC  UserName: XB
21:20:37.409    Initialize success
21:20:45.107    AVAST engine defs: 11092401
21:20:48.186    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:20:48.229    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
21:20:51.055    Disk 0 MBR read successfully
21:20:51.163    Disk 0 MBR scan
21:20:51.171    Disk 0 Windows VISTA default MBR code
21:20:51.348    Disk 0 scanning sectors +625139712
21:20:52.119    Disk 0 scanning C:\Windows\system32\drivers
21:24:23.102    Service scanning
21:24:24.570    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
21:24:25.201    Modules scanning
21:28:05.139    Disk 0 trace - called modules:
21:28:05.273    ntkrnlpa.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll iastor.sys spkt.sys >>UNKNOWN [0xb1666938]<<
21:28:05.281    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xb225f4f8]
21:28:05.292    3 CLASSPNP.SYS[b81c58b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xb177b030]
21:28:07.466    AVAST engine scan C:\Windows
21:32:01.850    AVAST engine scan C:\Windows\system32
21:57:03.523    AVAST engine scan C:\Windows\system32\drivers
22:03:12.091    AVAST engine scan C:\Users\XB
23:28:06.664    Disk 0 MBR has been saved successfully to "C:\Users\XB\Desktop\MBR.dat"
23:28:06.684    The log file has been saved successfully to "C:\Users\XB\Desktop\aswMBR.txt"


aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-26 12:19:12
-----------------------------
12:19:12.556    OS Version: Windows 6.0.6002 Service Pack 2
12:19:12.556    Number of processors: 2 586 0x1706
12:19:12.559    ComputerName: XB-PC  UserName: XB
12:20:05.883    Initialize success
12:21:37.513    AVAST engine defs: 11092502
12:24:43.182    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
12:24:43.187    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
12:24:45.277    Disk 0 MBR read successfully
12:24:45.282    Disk 0 MBR scan
12:24:45.290    Disk 0 Windows VISTA default MBR code
12:24:45.298    Disk 0 scanning sectors +625139712
12:24:45.437    Disk 0 scanning C:\Windows\system32\drivers
12:25:08.533    Service scanning
12:25:10.138    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
12:25:10.772    Modules scanning
12:25:21.872    Disk 0 trace - called modules:
12:25:21.919    ntkrnlpa.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll iastor.sys spec.sys >>UNKNOWN [0xb1666938]<<
12:25:21.927    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xb225eac8]
12:25:22.282    3 CLASSPNP.SYS[b81be8b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xb1786030]
12:25:24.350    AVAST engine scan C:\Windows
12:25:30.600    AVAST engine scan C:\Windows\system32
12:29:10.401    AVAST engine scan C:\Windows\system32\drivers
12:29:39.604    AVAST engine scan C:\Users\XB
12:48:36.594    AVAST engine scan C:\ProgramData
12:53:23.790    Scan finished successfully
17:07:28.750    Disk 0 MBR has been saved successfully to "C:\Users\XB\Desktop\MBR.dat"
17:07:28.765    The log file has been saved successfully to "C:\Users\XB\Desktop\aswMBR.txt"

stanomaly 26.09.2011 17:36
Hier ist schonmal Malwarebytes, der Rest folgt später...

Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7801

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8080.16413

26.09.2011 18:32:16
mbam-log-2011-09-26 (18-32-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 340659
Laufzeit: 1 Stunde(n), 17 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55