Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   50€-Trojaner: auch mich hat es erwischt. (https://www.trojaner-board.de/107981-50-trojaner-mich-hat-erwischt.html)

borodin 12.01.2012 12:02
50€-Trojaner: auch mich hat es erwischt.
 
Liebes Trojaner-Board-Team,
zunächst vielen Dank für Eure Mühe hier. Mich hat es auch erwischt: "Windows wurde gesperrt...50€...blabla."
Nach Lektüre im Forum habe ich folgende Maßnahmen ergriffen:

1. Defogger
2. OTL (log: OTL_pre.txt)
3. GMER (log: GMER_pre.txt)
4. Malwarebytes (log: mbam-log-2012-01-11 (14-30-55).txt)
5. OTL (log: OTL_post.txt)
6. GMER (log: GMER_post.txt)

Ich danke Euch im Voraus für Eure Hilfe!
borodin

cosinus 12.01.2012 20:37
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

borodin 12.01.2012 20:44
Zitat:
Zitat von cosinus (Beitrag 753643)
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
Hallo Arne,
nein ich habe mir Malwarebytes erst gestern heruntergelaaden.
Jens

cosinus 12.01.2012 20:48
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


borodin 13.01.2012 06:47
Gute Morgen,
ESET hat einiges gefunden...

cosinus 13.01.2012 14:39
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

borodin 13.01.2012 20:01
Hier nun das OTL-log:


OTL Logfile:
Code:
OTL logfile created on: 13.01.2012 19:42:24 - Run 3
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,98 Gb Total Physical Memory | 2,27 Gb Available Physical Memory | 76,03% Memory free
4,82 Gb Paging File | 4,21 Gb Available in Paging File | 87,21% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 223,68 Gb Free Space | 75,04% Space Free | Partition Type: NTFS
Drive F: | 1,87 Gb Total Space | 1,76 Gb Free Space | 94,27% Space Free | Partition Type: FAT
 
Computer Name: ***1 | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Programme\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Programme\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
PRC - C:\Programme\Iomega\QuikProtect\QpMonitor.exe ()
PRC - C:\Programme\TOSHIBA\TNROTATE\TNROTATE.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TPHM\TPCHWMsg.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\TrueSuite\TrueSuite.TouchControl.exe (AuthenTec Inc.)
PRC - C:\Programme\TrueSuite\TrueSuite.SysTray.exe (AuthenTec, Inc)
PRC - C:\Programme\TrueSuite\TrueSuite.Service.exe (AuthenTec, Inc)
PRC - C:\Programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe (AuthenTec, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\WINDOWS\system32\TFNF5.exe (TOSHIBA Corp.)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclToBTSrv.exe (Nokia)
PRC - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\TOSHIBA\TME3\TMERzCtl.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\TPSODDCtl.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TPSMain.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TME3\TMESRV31.exe (TOSHIBA)
PRC - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\Fingerprint Sensor\ATService.exe (AuthenTec, Inc.)
PRC - C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\Toshiba Online Product Information\TOPI.exe (TOSHIBA)
PRC - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\ReModem.exe ()
PRC - C:\Programme\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\firefox.exe ()
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe (Marvell Semiconductor, Inc.)
PRC - C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\TouchED\TouchED.exe (TOSHIBA Corporation)
PRC - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\TOSHIBA\TME3\TMEEJME.exe (TOSHIBA)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\62e34cfb5a8b233667c7c5a47a32ad93\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\d86a3346c3d90ff12d0df9d7726f3ece\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\1adc4ae51a5ac63e896a1402749ca495\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\Programme\IZArc\IZArcCM.dll ()
MOD - C:\Programme\Iomega\QuikProtect\QpMonitor.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll ()
MOD - C:\WINDOWS\system32\nvshell.dll ()
MOD - C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ()
MOD - C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\ReModem.exe ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\Programme\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - c:\Programme\McAfee\SiteAdvisor\mcfrmwk.dll ()
MOD - c:\Programme\McAfee\SiteAdvisor\cntscan.dll ()
MOD - c:\Programme\McAfee\SiteAdvisor\apengine.dll ()
MOD - C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\firefox.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (odserv) --  File not found
SRV - (MSK80Service) --  File not found
SRV - (MpfService) --  File not found
SRV - (McSysmon) --  File not found
SRV - (McShield) --  File not found
SRV - (McProxy) --  File not found
SRV - (McNASvc) --  File not found
SRV - (mcmscsvc) --  File not found
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (McAfee SiteAdvisor Service) -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (QSCopyEngine) -- C:\Programme\Iomega\QuikProtect\QpMonitor.exe ()
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (TPCHSrv) -- C:\Programme\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV - (FPLService) -- C:\Programme\TrueSuite\TrueSuite.Service.exe (AuthenTec, Inc)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (Tmesrv) -- C:\Programme\TOSHIBA\TME3\Tmesrv31.exe (TOSHIBA)
SRV - (ATService) -- C:\Programme\Fingerprint Sensor\ATService.exe (AuthenTec, Inc.)
SRV - (TNaviSrv) -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (TOSHIBA HDD SSD Alert Service) -- C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV - (TOSHIBA Bluetooth Service) -- C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (UNS) Intel(R) -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (Thpsrv) -- C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) -- C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (CFSvcs) -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (IDriverT) -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (xpsec) --  File not found
DRV - (xcpip) --  File not found
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (Impcd) -- C:\WINDOWS\system32\drivers\Impcd.sys (Intel Corporation)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (risdpcie) -- C:\WINDOWS\system32\drivers\risdpe86.sys (REDC)
DRV - (ATSwpWDF) -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys (AuthenTec, Inc.)
DRV - (tos_sps32) -- C:\WINDOWS\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (NVHDA) -- C:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (e1kexpress) Intel(R) -- C:\WINDOWS\system32\drivers\e1k5132.sys (Intel Corporation)
DRV - (HECI) Intel(R) -- C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (NETw5x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (Tosrfcom) -- C:\WINDOWS\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (tosrfec) -- C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (rixdpcie) -- C:\WINDOWS\system32\drivers\rixdpe86.sys (REDC)
DRV - (rimspci) -- C:\WINDOWS\system32\drivers\rimspe86.sys (REDC)
DRV - (Thpdrv) -- C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (PGEffect) -- C:\WINDOWS\system32\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV - (Thpevm) -- C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (QsFsFltr) -- C:\WINDOWS\system32\drivers\QsFsFltr.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (guardian2) -- C:\WINDOWS\system32\drivers\oz776.sys (O2Micro)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (TVALZFL) -- C:\WINDOWS\system32\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (tdudf) -- C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (trudf) -- C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (TVALZ) -- C:\WINDOWS\system32\DRIVERS\TVALZ.SYS (TOSHIBA Corporation)
DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (TMEI3E) -- C:\WINDOWS\system32\drivers\TMEI3E.sys (Toshiba Corporation)
DRV - (Netdevio) -- C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "foxsearch"
FF - prefs.js..browser.search.order.1: "foxsearch"
FF - prefs.js..browser.search.selectedEngine: "foxsearch"
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.7
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.11
FF - prefs.js..extensions.enabledItems: {4ED1F68A-5463-4931-9384-8FFF5ED91D92}:3.4.0
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8312
FF - prefs.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - user.js..browser.search.selectedEngine: "foxsearch"
FF - user.js..browser.search.order.1: "foxsearch"
FF - user.js..browser.search.defaultenginename: "foxsearch"
FF - user.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Programme\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\programme\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.06.03 14:49:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Programme\McAfee\SiteAdvisor [2011.11.09 23:12:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.10.26 11:28:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.06 23:02:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.31 15:15:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.06.03 14:49:49 | 000,000,000 | ---D | M]
 
[2010.06.02 20:06:06 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2012.01.12 21:11:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\extensions
[2010.06.03 22:51:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.04 07:51:41 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011.09.12 12:27:35 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012.01.12 21:11:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.22 11:58:21 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.06.03 16:26:53 | 000,000,000 | ---D | M] (TrueSuite Website Log On) -- C:\Programme\Mozilla Firefox\extensions\websitelogon_toolbar@truesuite.com
[2011.10.26 11:28:00 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\ANWENDUNGSDATEN\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BüHREN\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\PCKHF0TX.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BüHREN\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\PCKHF0TX.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}
[2010.06.02 04:06:24 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.11.09 23:12:46 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAMME\MCAFEE\SITEADVISOR
[2010.06.03 14:49:49 | 000,000,000 | ---D | M] (Firefox Synchronisation Extension) -- C:\PROGRAMME\NOKIA\NOKIA OVI SUITE\CONNECTORS\BOOKMARKS CONNECTOR\FIREFOXEXTENSION
[2011.04.14 13:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Programme\mozilla firefox\components\Scriptff.dll
[2010.03.19 08:23:30 | 000,686,592 | ---- | M] (Synatix GmbH) -- C:\Programme\mozilla firefox\plugins\npmieze.dll
[2010.04.01 17:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 17:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.10.08 09:32:38 | 000,000,143 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\foxsearch.src
[2010.04.01 17:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.04.01 17:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.04.01 17:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\ScriptSn.20120103224235.dll (McAfee, Inc.)
O2 - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Programme\TrueSuite\TrueSuite.IEBHO.dll (AuthenTec Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CFSServ.exe] CFSServ.exe -NoClient File not found
O4 - HKLM..\Run: [ClientAppLogon] C:\Programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe (AuthenTec, Inc.)
O4 - HKLM..\Run: [DDWMon] C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
O4 - HKLM..\Run: [IMSS] C:\Programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe ()
O4 - HKLM..\Run: [ITSecMng] C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PrnStatusMX] C:\Programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe (Marvell Semiconductor, Inc.)
O4 - HKLM..\Run: [QuiKProtect] C:\Programme\Iomega\QuikProtect\startQuikProtect.exe (Iomega Corporation - An EMC Company)
O4 - HKLM..\Run: [SmoothView] C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SystemTray] C:\Programme\TrueSuite\TrueSuite.SysTray.exe (AuthenTec, Inc)
O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Programme\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Programme\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TNRotate] C:\Programme\TOSHIBA\TNROTATE\TNROTATE.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TosSENotify] C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosWaitSrv] C:\Programme\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TouchED] C:\Programme\TOSHIBA\TouchED\TouchED.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSODDCtl] C:\WINDOWS\System32\TPSODDCtl.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TUSBSleepChargeSrv] C:\Programme\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [TWebCamera] C:\Programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [ANT Agent] C:\Programme\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
O4 - HKCU..\Run: [Mozilla Firefox] C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\firefox.exe ()
O4 - HKCU..\Run: [NokiaOviSuite2] C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKCU..\Run: [TOSHIBA Online Product Information] C:\Programme\TOSHIBA\Toshiba Online Product Information\TOPI.exe (TOSHIBA)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Bluetooth Manager.lnk = C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (TrueSuite.GINA.dll) -C:\WINDOWS\System32\TrueSuite.GINA.dll (AuthenTec)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene Bilder\Hullefax\CSFecht.BMP
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene Bilder\Hullefax\CSFecht.BMP
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002.10.14 04:38:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\Shell - "" = AutoRun
O33 - MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\Shell - "" = AutoRun
O33 - MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\Shell\AutoRun\command - "" = Iomega Encryption Utility.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: mcmscsvc -  File not found
SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: mcmscsvc -  File not found
SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootNet: MpfService -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4F478B30-EA1F-95DC-CB0D-5DB2298AF31B} - Internet Explorer
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.12 21:06:32 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.01.12 21:06:07 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe
[2012.01.11 14:30:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.01.11 14:30:01 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.11 14:30:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.01.11 14:15:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
[2012.01.11 14:15:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.01.11 09:25:33 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.01.05 19:39:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\McAfee
[2012.01.04 03:05:20 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.13 19:39:56 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.01.13 19:38:11 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
[2012.01.13 19:36:40 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2012.01.13 19:36:18 | 000,246,668 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2012.01.13 19:35:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.13 19:35:03 | 3204,890,624 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.12 21:06:08 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe
[2012.01.12 20:54:48 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
[2012.01.12 12:40:33 | 000,471,320 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.01.12 12:40:33 | 000,453,288 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.01.12 12:40:33 | 000,088,744 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.01.12 12:40:33 | 000,075,366 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.01.11 14:30:02 | 000,000,763 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.11 09:30:06 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\***\defogger_reenable
[2012.01.11 09:26:17 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.10 17:22:26 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\s0ifz8bb.exe
[2012.01.10 17:20:10 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2012.01.10 17:09:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2011.12.31 16:38:21 | 000,159,232 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.21 15:26:33 | 000,028,938 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Comma Separated Values (Windows).ADR
[2011.12.16 19:49:36 | 000,000,284 | ---- | M] () -- C:\WINDOWS\matlab.ini
[2011.12.15 03:20:43 | 002,226,488 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.13 19:35:03 | 3204,890,624 | -HS- | C] () -- C:\hiberfil.sys
[2012.01.11 14:30:02 | 000,000,763 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.11 09:30:06 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\***\defogger_reenable
[2012.01.11 09:25:43 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\s0ifz8bb.exe
[2012.01.11 09:25:37 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2011.11.02 22:26:26 | 000,028,938 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Comma Separated Values (Windows).ADR
[2011.10.29 22:35:31 | 001,191,392 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2011.06.21 13:14:04 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2011.06.21 13:14:04 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2011.02.24 18:39:53 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.02.10 05:03:48 | 000,000,306 | ---- | C] () -- C:\WINDOWS\primopdf.ini
[2011.01.20 21:30:41 | 000,059,924 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2011.01.07 13:24:19 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2010.06.04 08:04:01 | 000,180,624 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll
[2010.06.03 23:11:00 | 000,000,284 | ---- | C] () -- C:\WINDOWS\matlab.ini
[2010.06.03 22:27:34 | 000,006,172 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\PrimoPDFSet.xml
[2010.06.03 22:27:34 | 000,000,310 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\APUSet.xml
[2010.06.03 17:16:48 | 000,159,232 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.02 20:15:06 | 000,000,748 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.06.02 20:06:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.06.01 19:56:22 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2010.06.01 19:50:19 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010.06.01 19:44:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2010.06.01 19:41:09 | 000,000,206 | ---- | C] () -- C:\WINDOWS\hbcikrnl.ini
[2010.06.01 19:37:02 | 000,007,084 | ---- | C] () -- C:\WINDOWS\System32\drivers\HDACfg.dat
[2010.06.01 19:37:02 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtkhdaud.dat
[2010.03.31 05:27:48 | 000,471,320 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2010.03.31 05:27:48 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2010.03.31 05:27:48 | 000,088,744 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2010.03.31 05:27:48 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2010.03.31 05:27:43 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010.03.31 05:27:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010.03.31 05:27:42 | 000,453,288 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2010.03.31 05:27:42 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010.03.31 05:27:42 | 000,075,366 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2010.03.31 05:27:42 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010.03.31 05:27:42 | 000,004,598 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010.03.31 05:27:42 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010.03.31 05:27:41 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010.03.31 05:27:41 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010.03.31 05:27:39 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010.03.31 05:27:39 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2009.12.08 19:09:10 | 001,731,176 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.12.08 19:09:10 | 001,657,448 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009.12.08 19:09:10 | 001,612,392 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.12.08 19:09:10 | 001,108,584 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.12.08 19:09:10 | 000,510,568 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2009.12.08 19:09:10 | 000,473,704 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009.12.08 19:09:10 | 000,449,128 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009.12.08 17:25:12 | 001,589,414 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2003.01.07 20:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.10.14 05:35:13 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002.10.14 05:34:46 | 002,226,488 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002.10.14 05:21:25 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\000StTHK.exe
[2002.10.14 04:51:04 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll
[2002.10.14 04:50:20 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2002.10.14 04:49:46 | 000,159,744 | ---- | C] () -- C:\WINDOWS\MakeMrk.exe
[2002.10.14 04:49:46 | 000,000,083 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2002.10.14 04:39:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2002.10.14 04:37:24 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
 
========== LOP Check ==========
 
[2011.04.17 15:59:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AAV
[2010.06.01 19:47:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations
[2011.04.10 15:20:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GARMIN
[2010.12.24 11:55:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010.06.03 14:47:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OviInstallerCache
[2010.06.13 13:38:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011.06.21 13:16:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SafeNet Sentinel
[2011.06.21 13:15:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SPSS
[2011.12.16 18:01:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Thomson.ResearchSoft.Installers
[2010.06.13 10:17:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TOSHIBA
[2010.06.01 19:47:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TrueSuite
[2010.06.14 12:58:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinBiAS
[2010.09.25 14:29:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.11.10 08:31:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EndNote
[2010.06.03 22:49:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EzValidation
[2011.04.10 15:20:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\GARMIN
[2010.10.08 09:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Gutscheinmieze
[2010.06.03 22:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Netscape
[2010.06.03 22:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Nokia
[2010.06.03 22:28:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Nokia Ovi Suite
[2010.06.03 22:28:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\PC Suite
[2011.12.21 15:22:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\PrimoPDF
[2010.06.03 22:27:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Protector Suite
[2010.06.03 22:27:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Qualcomm
[2010.06.03 22:27:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Subversion
[2010.06.03 22:27:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\T-DSL SpeedManager
[2011.09.22 15:56:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\toshiba
[2010.06.02 04:02:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\WinBatch
[2010.06.14 12:56:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\WinBiAS
[2010.06.03 22:27:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Windows Desktop Search
[2012.01.13 19:36:40 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2011.06.21 13:16:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\SPSS
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.08.31 16:30:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\AAV
[2011.08.08 17:00:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\Adobe
[2010.09.26 16:36:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\Apple Computer
[2010.06.03 22:27:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\MathWorks
[2011.11.04 14:14:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\Microsoft
[2010.06.03 22:27:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\QuosaDDM
[2011.06.21 20:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Application Data\SPSSInc
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\I386\sp3.cab:AGP440.sys
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\I386\sp3.cab:atapi.sys
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[1999.10.02 09:24:46 | 000,017,408 | ---- | M] () MD5=1363337A5301619F00F8033835EF30E9 -- C:\Programme\MATLAB7\sys\perl\win32\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2010.01.15 12:06:00 | 000,433,176 | ---- | M] (Intel Corporation) MD5=39F7C9AEEE865FE8E98CF3EDD2B4BB4A -- C:\WINDOWS\OemDir\iaStor.sys
[2010.01.15 11:06:56 | 000,433,176 | ---- | M] (Intel Corporation) MD5=39F7C9AEEE865FE8E98CF3EDD2B4BB4A -- C:\WINDOWS\system32\drivers\iaStor.sys
[2010.01.15 11:06:56 | 000,433,176 | ---- | M] (Intel Corporation) MD5=39F7C9AEEE865FE8E98CF3EDD2B4BB4A -- C:\WINDOWS\system32\DRVSTORE\iaAHCI_568A0751782CD1DB2201E057768013BA8516BE67\iaStor.sys
[2010.01.15 12:06:00 | 000,433,176 | ---- | M] (Intel Corporation) MD5=39F7C9AEEE865FE8E98CF3EDD2B4BB4A -- C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2002.10.14 06:34:16 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2002.10.14 06:34:16 | 001,093,632 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2002.10.14 06:34:15 | 000,462,848 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---

cosinus 13.01.2012 20:09
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
DRV - (xpsec) --  File not found
DRV - (xcpip) --  File not found
FF - prefs.js..keyword.URL: "http://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - user.js..browser.search.selectedEngine: "foxsearch"
FF - user.js..browser.search.order.1: "foxsearch"
FF - user.js..browser.search.defaultenginename: "foxsearch"
FF - user.js..keyword.URL: "http://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - prefs.js..browser.search.defaultenginename: "foxsearch"
FF - prefs.js..browser.search.order.1: "foxsearch"
FF - prefs.js..browser.search.selectedEngine: "foxsearch"
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [Mozilla Firefox] C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\firefox.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002.10.14 04:38:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\Shell - "" = AutoRun
O33 - MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\Shell - "" = AutoRun
O33 - MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\Shell\AutoRun\command - "" = Iomega Encryption Utility.exe
[2010.10.08 09:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Gutscheinmieze

:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

borodin 14.01.2012 09:12
So, hier ist der log vom OTL-Fix:.
Momentan bleibt die 50€-Meldung aus.

Code:
All processes killed
========== OTL ==========
Service xpsec stopped successfully!
Service xpsec deleted successfully!
File  File not found not found.
Service xcpip stopped successfully!
Service xcpip deleted successfully!
File  File not found not found.
Prefs.js: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\FireFox\Profiles\pckhf0tx.default\user.js moved successfully.
Prefs.js: "foxsearch" removed from browser.search.defaultenginename
Prefs.js: "foxsearch" removed from browser.search.order.1
Prefs.js: "foxsearch" removed from browser.search.selectedEngine
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Mozilla Firefox deleted successfully.
C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\firefox.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d34b3f0b-10f5-11e1-818a-0023148a61c4}\ not found.
File F:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e58d5173-a976-11e0-8167-0023148a61c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e58d5173-a976-11e0-8167-0023148a61c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e58d5173-a976-11e0-8167-0023148a61c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e58d5173-a976-11e0-8167-0023148a61c4}\ not found.
File Iomega Encryption Utility.exe not found.
C:\Dokumente und Einstellungen\***\Anwendungsdaten\Gutscheinmieze folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
 
User: All Users
 
User: ***
->Temp folder emptied: 93417533 bytes
->Temporary Internet Files folder emptied: 40230508 bytes
->Java cache emptied: 22345758 bytes
->FireFox cache emptied: 60289013 bytes
->Flash cache emptied: 207491 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: LocalService
->Temp folder emptied: 82191 bytes
->Temporary Internet Files folder emptied: 1132637 bytes
 
User: NetworkService
->Temp folder emptied: 98841 bytes
->Temporary Internet Files folder emptied: 15911267 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 370294 bytes
%systemroot%\System32 .tmp files removed: 2953095 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 961184876 bytes
RecycleBin emptied: 118873944 bytes
 
Total Files Cleaned = 1.256,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01142012_084027

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Bin gespannt,
Jens

cosinus 14.01.2012 15:37
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

borodin 14.01.2012 18:47
Liste der Anhänge anzeigen (Anzahl: 1)
So, nächste Iteration. Es ist unglaublich, was da alles zutage gefördert wird.
Ich habe das log als *.jpg angehängt.
Jens

cosinus 14.01.2012 20:33
Als jpg war nicht gefordert ich das richtige Text-Log sehen

borodin 14.01.2012 22:39
Zitat:
Zitat von cosinus (Beitrag 754717)
Als jpg war nicht gefordert ich das richtige Text-Log sehen
Da gab es aber keinen...

cosinus 15.01.2012 17:32
Bitte meine Anleitung genauer lesen:

Zitat:
Zitat von cosinus
dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C) nach, da speichert der TDSS-Killer seine Logs.

borodin 15.01.2012 17:44
OK, here we go:

Code:
18:41:29.0531 6080        TDSS rootkit removing tool 2.7.1.0 Jan 13 2012 15:24:05
18:41:29.0859 6080        ============================================================
18:41:29.0859 6080        Current date / time: 2012/01/14 18:41:29.0859
18:41:29.0859 6080        SystemInfo:
18:41:29.0859 6080       
18:41:29.0859 6080        OS Version: 5.1.2600 ServicePack: 3.0
18:41:29.0859 6080        Product type: Workstation
18:41:29.0859 6080        ComputerName: ***1
18:41:29.0859 6080        UserName: ***
18:41:29.0859 6080        Windows directory: C:\WINDOWS
18:41:29.0859 6080        System windows directory: C:\WINDOWS
18:41:29.0859 6080        Processor architecture: Intel x86
18:41:29.0859 6080        Number of processors: 4
18:41:29.0859 6080        Page size: 0x1000
18:41:29.0859 6080        Boot type: Normal boot
18:41:29.0859 6080        ============================================================
18:41:30.0312 6080        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000050
18:41:30.0312 6080        Drive \Device\Harddisk1\DR2 - Size: 0x7470C06000, SectorSize: 0x200, Cylinders: 0xEC93D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'W'
18:41:30.0406 6080        Initialize success
18:41:50.0281 0384        ============================================================
18:41:50.0281 0384        Scan started
18:41:50.0281 0384        Mode: Manual; SigCheck; TDLFS;
18:41:50.0281 0384        ============================================================
18:41:50.0609 0384        Abiosdsk - ok
18:41:50.0625 0384        abp480n5 - ok
18:41:50.0640 0384        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:41:50.0890 0384        ACPI - ok
18:41:50.0921 0384        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:41:51.0000 0384        ACPIEC - ok
18:41:51.0062 0384        adfs            (73685e15ef8b0bd9c30f1af413f13d49) C:\WINDOWS\system32\drivers\adfs.sys
18:41:51.0078 0384        adfs - ok
18:41:51.0078 0384        adpu160m - ok
18:41:51.0140 0384        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:41:51.0218 0384        aec - ok
18:41:51.0437 0384        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
18:41:51.0937 0384        AFD - ok
18:41:51.0953 0384        Aha154x - ok
18:41:51.0953 0384        aic78u2 - ok
18:41:51.0968 0384        aic78xx - ok
18:41:51.0984 0384        AliIde - ok
18:41:52.0031 0384        Ambfilt        (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
18:41:52.0109 0384        Ambfilt - ok
18:41:52.0265 0384        amsint - ok
18:41:52.0296 0384        ApfiltrService  (c5b1284c94c90d28e1876d350e9ca297) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
18:41:52.0312 0384        ApfiltrService - ok
18:41:52.0312 0384        asc - ok
18:41:52.0328 0384        asc3350p - ok
18:41:52.0328 0384        asc3550 - ok
18:41:52.0359 0384        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:41:52.0437 0384        AsyncMac - ok
18:41:52.0468 0384        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
18:41:52.0531 0384        atapi - ok
18:41:52.0531 0384        Atdisk - ok
18:41:52.0546 0384        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:41:52.0625 0384        Atmarpc - ok
18:41:52.0687 0384        ATSwpWDF        (b693cec3751764087b76648f7cf12651) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
18:41:52.0718 0384        ATSwpWDF - ok
18:41:52.0828 0384        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:41:52.0906 0384        audstub - ok
18:41:52.0953 0384        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:41:53.0062 0384        Beep - ok
18:41:53.0078 0384        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:41:53.0140 0384        cbidf2k - ok
18:41:53.0156 0384        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:41:53.0203 0384        CCDECODE - ok
18:41:53.0218 0384        cd20xrnt - ok
18:41:53.0218 0384        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:41:53.0281 0384        Cdaudio - ok
18:41:53.0312 0384        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:41:53.0390 0384        Cdfs - ok
18:41:53.0406 0384        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:41:53.0468 0384        Cdrom - ok
18:41:53.0484 0384        Changer - ok
18:41:53.0515 0384        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
18:41:53.0562 0384        CmBatt - ok
18:41:53.0578 0384        CmdIde - ok
18:41:53.0593 0384        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
18:41:53.0640 0384        Compbatt - ok
18:41:53.0656 0384        Cpqarray - ok
18:41:53.0671 0384        dac2w2k - ok
18:41:53.0671 0384        dac960nt - ok
18:41:53.0687 0384        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:41:53.0781 0384        Disk - ok
18:41:53.0812 0384        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
18:41:53.0937 0384        dmboot - ok
18:41:53.0968 0384        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
18:41:54.0031 0384        dmio - ok
18:41:54.0046 0384        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:41:54.0125 0384        dmload - ok
18:41:54.0171 0384        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:41:54.0234 0384        DMusic - ok
18:41:54.0343 0384        dpti2o - ok
18:41:54.0406 0384        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:41:54.0468 0384        drmkaud - ok
18:41:54.0515 0384        e1kexpress      (0c95246539ed1fbeb2d6b3b1f34cdd42) C:\WINDOWS\system32\DRIVERS\e1k5132.sys
18:41:54.0531 0384        e1kexpress - ok
18:41:54.0546 0384        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:41:54.0640 0384        Fastfat - ok
18:41:54.0656 0384        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
18:41:54.0812 0384        Fdc - ok
18:41:54.0828 0384        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
18:41:54.0921 0384        Fips - ok
18:41:54.0937 0384        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
18:41:55.0015 0384        Flpydisk - ok
18:41:55.0015 0384        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
18:41:55.0078 0384        FltMgr - ok
18:41:55.0093 0384        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:41:55.0156 0384        Fs_Rec - ok
18:41:55.0156 0384        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:41:55.0218 0384        Ftdisk - ok
18:41:55.0234 0384        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:41:55.0328 0384        Gpc - ok
18:41:55.0375 0384        guardian2      (db3794c1e876ca318d2ba3d1d38cba8a) C:\WINDOWS\system32\Drivers\oz776.sys
18:41:55.0390 0384        guardian2 - ok
18:41:55.0421 0384        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
18:41:55.0484 0384        HDAudBus - ok
18:41:55.0656 0384        HECI            (a88485dc6a7136c10d9a6c7e38fdfe3c) C:\WINDOWS\system32\DRIVERS\HECI.sys
18:41:55.0687 0384        HECI - ok
18:41:55.0718 0384        hpn - ok
18:41:55.0750 0384        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
18:41:55.0765 0384        HTTP - ok
18:41:55.0781 0384        i2omgmt - ok
18:41:55.0781 0384        i2omp - ok
18:41:55.0812 0384        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:41:55.0937 0384        i8042prt - ok
18:41:56.0000 0384        iaStor          (39f7c9aeee865fe8e98cf3edd2b4bb4a) C:\WINDOWS\system32\drivers\iaStor.sys
18:41:56.0015 0384        iaStor - ok
18:41:56.0031 0384        IFXTPM          (91c5e9f49f32110ced27e2f902fad607) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
18:41:56.0046 0384        IFXTPM - ok
18:41:56.0234 0384        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:41:56.0296 0384        Imapi - ok
18:41:56.0359 0384        Impcd          (03c0d99bc2913226f1cea7cb0d984659) C:\WINDOWS\system32\DRIVERS\Impcd.sys
18:41:56.0390 0384        Impcd - ok
18:41:56.0406 0384        ini910u - ok
18:41:56.0593 0384        IntcAzAudAddService (74bd9d8ede748b33b2f2aaba941cba5a) C:\WINDOWS\system32\drivers\RtkHDAud.sys
18:41:56.0796 0384        IntcAzAudAddService - ok
18:41:56.0953 0384        IntelIde - ok
18:41:56.0984 0384        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
18:41:57.0109 0384        intelppm - ok
18:41:57.0140 0384        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
18:41:57.0265 0384        Ip6Fw - ok
18:41:57.0281 0384        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:41:57.0406 0384        IpFilterDriver - ok
18:41:57.0421 0384        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:41:57.0546 0384        IpInIp - ok
18:41:57.0578 0384        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:41:57.0718 0384        IpNat - ok
18:41:57.0750 0384        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:41:57.0890 0384        IPSec - ok
18:41:57.0906 0384        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:41:57.0984 0384        IRENUM - ok
18:41:58.0015 0384        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:41:58.0140 0384        isapnp - ok
18:41:58.0343 0384        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:41:58.0468 0384        Kbdclass - ok
18:41:58.0515 0384        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:41:58.0609 0384        kmixer - ok
18:41:58.0609 0384        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:41:58.0625 0384        KSecDD - ok
18:41:58.0640 0384        lbrtfdc - ok
18:41:58.0687 0384        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
18:41:58.0703 0384        MBAMProtector - ok
18:41:58.0796 0384        mfeavfk        (cde41293db871a75cd99eb0ce781356b) C:\WINDOWS\system32\drivers\mfeavfk.sys
18:41:58.0812 0384        mfeavfk - ok
18:41:58.0875 0384        mfebopk        (e22385f64bdf0ad81157479496e33c4a) C:\WINDOWS\system32\drivers\mfebopk.sys
18:41:58.0890 0384        mfebopk - ok
18:41:58.0968 0384        mfehidk        (56d330981866a72f061dd16cc5004513) C:\WINDOWS\system32\drivers\mfehidk.sys
18:41:59.0000 0384        mfehidk - ok
18:41:59.0000 0384        mferkdk - ok
18:41:59.0015 0384        mfesmfk - ok
18:41:59.0031 0384        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:41:59.0140 0384        mnmdd - ok
18:41:59.0203 0384        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
18:41:59.0281 0384        Modem - ok
18:41:59.0406 0384        Monfilt        (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
18:41:59.0500 0384        Monfilt - ok
18:41:59.0562 0384        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:41:59.0640 0384        Mouclass - ok
18:41:59.0750 0384        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:41:59.0875 0384        MountMgr - ok
18:41:59.0921 0384        MPFP - ok
18:41:59.0937 0384        mraid35x - ok
18:41:59.0953 0384        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:42:00.0031 0384        MRxDAV - ok
18:42:00.0093 0384        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:42:00.0125 0384        MRxSmb - ok
18:42:00.0203 0384        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:42:00.0265 0384        Msfs - ok
18:42:00.0343 0384        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:42:00.0453 0384        MSKSSRV - ok
18:42:00.0453 0384        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:42:00.0546 0384        MSPCLOCK - ok
18:42:00.0562 0384        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:42:00.0656 0384        MSPQM - ok
18:42:00.0703 0384        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:42:00.0765 0384        mssmbios - ok
18:42:00.0796 0384        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
18:42:00.0906 0384        MSTEE - ok
18:42:01.0046 0384        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
18:42:01.0046 0384        Mup - ok
18:42:01.0140 0384        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:42:01.0281 0384        NABTSFEC - ok
18:42:01.0312 0384        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:42:01.0375 0384        NDIS - ok
18:42:01.0421 0384        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:42:01.0500 0384        NdisIP - ok
18:42:01.0531 0384        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:42:01.0562 0384        NdisTapi - ok
18:42:01.0671 0384        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:42:01.0750 0384        Ndisuio - ok
18:42:01.0828 0384        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:42:01.0906 0384        NdisWan - ok
18:42:01.0937 0384        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
18:42:01.0968 0384        NDProxy - ok
18:42:02.0000 0384        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:42:02.0078 0384        NetBIOS - ok
18:42:02.0265 0384        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:42:02.0390 0384        NetBT - ok
18:42:02.0531 0384        Netdevio        (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
18:42:02.0531 0384        Netdevio ( UnsignedFile.Multi.Generic ) - warning
18:42:02.0531 0384        Netdevio - detected UnsignedFile.Multi.Generic (1)
18:42:02.0703 0384        NETw5x32        (580207a7c9bde8ba65401f51f9ba9741) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
18:42:02.0875 0384        NETw5x32 - ok
18:42:03.0078 0384        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:42:03.0203 0384        Npfs - ok
18:42:03.0250 0384        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:42:03.0359 0384        Ntfs - ok
18:42:03.0390 0384        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:42:03.0484 0384        Null - ok
18:42:03.0703 0384        nv              (3aa257bbeccc1cef9b305ed2dd86d032) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:42:03.0906 0384        nv - ok
18:42:04.0109 0384        NVHDA          (04b3177ed656f1d3a6ebf48f5beea8a8) C:\WINDOWS\system32\drivers\nvhda32.sys
18:42:04.0125 0384        NVHDA - ok
18:42:04.0156 0384        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:42:04.0296 0384        NwlnkFlt - ok
18:42:04.0328 0384        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:42:04.0390 0384        NwlnkFwd - ok
18:42:04.0421 0384        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
18:42:04.0484 0384        Parport - ok
18:42:04.0500 0384        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:42:04.0562 0384        PartMgr - ok
18:42:04.0593 0384        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
18:42:04.0671 0384        ParVdm - ok
18:42:04.0703 0384        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
18:42:04.0718 0384        pccsmcfd - ok
18:42:04.0890 0384        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
18:42:04.0968 0384        PCI - ok
18:42:04.0984 0384        PCIDump - ok
18:42:04.0984 0384        PCIIde - ok
18:42:05.0015 0384        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:42:05.0078 0384        Pcmcia - ok
18:42:05.0093 0384        PDCOMP - ok
18:42:05.0093 0384        PDFRAME - ok
18:42:05.0109 0384        PDRELI - ok
18:42:05.0109 0384        PDRFRAME - ok
18:42:05.0125 0384        perc2 - ok
18:42:05.0140 0384        perc2hib - ok
18:42:05.0171 0384        PGEffect        (1b5011dd8d57f53aed31ff0f7d635802) C:\WINDOWS\system32\DRIVERS\pgeffect.sys
18:42:05.0187 0384        PGEffect - ok
18:42:05.0218 0384        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:42:05.0312 0384        PptpMiniport - ok
18:42:05.0343 0384        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
18:42:05.0421 0384        PSched - ok
18:42:05.0437 0384        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:42:05.0500 0384        Ptilink - ok
18:42:05.0515 0384        ql1080 - ok
18:42:05.0531 0384        Ql10wnt - ok
18:42:05.0531 0384        ql12160 - ok
18:42:05.0531 0384        ql1240 - ok
18:42:05.0546 0384        ql1280 - ok
18:42:05.0578 0384        QsFsFltr        (8b1d0cdd82174c5421a1fc547a15f724) C:\WINDOWS\system32\DRIVERS\QsFsFltr.sys
18:42:05.0609 0384        QsFsFltr ( UnsignedFile.Multi.Generic ) - warning
18:42:05.0609 0384        QsFsFltr - detected UnsignedFile.Multi.Generic (1)
18:42:05.0796 0384        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:42:05.0906 0384        RasAcd - ok
18:42:05.0921 0384        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:42:06.0000 0384        Rasl2tp - ok
18:42:06.0000 0384        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:42:06.0078 0384        RasPppoe - ok
18:42:06.0109 0384        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:42:06.0171 0384        Raspti - ok
18:42:06.0203 0384        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:42:06.0265 0384        Rdbss - ok
18:42:06.0296 0384        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:42:06.0375 0384        RDPCDD - ok
18:42:06.0593 0384        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
18:42:06.0671 0384        rdpdr - ok
18:42:06.0718 0384        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
18:42:06.0734 0384        RDPWD - ok
18:42:06.0765 0384        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:42:06.0843 0384        redbook - ok
18:42:06.0875 0384        rimspci        (af213955c4d952c914620e8db0cd0cf7) C:\WINDOWS\system32\DRIVERS\rimspe86.sys
18:42:06.0890 0384        rimspci - ok
18:42:06.0890 0384        risdpcie        (85cba4b868a9daaa2dd5e3952f396982) C:\WINDOWS\system32\DRIVERS\risdpe86.sys
18:42:06.0906 0384        risdpcie - ok
18:42:06.0921 0384        rixdpcie        (764c1f3453e779724ba647327de7ddd4) C:\WINDOWS\system32\DRIVERS\rixdpe86.sys
18:42:06.0921 0384        rixdpcie - ok
18:42:07.0140 0384        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
18:42:07.0250 0384        sdbus - ok
18:42:07.0265 0384        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:42:07.0312 0384        Secdrv - ok
18:42:07.0343 0384        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
18:42:07.0421 0384        Serial - ok
18:42:07.0453 0384        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
18:42:07.0546 0384        Sfloppy - ok
18:42:07.0562 0384        Simbad - ok
18:42:07.0562 0384        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:42:07.0656 0384        SLIP - ok
18:42:07.0671 0384        Sparrow - ok
18:42:07.0703 0384        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:42:07.0796 0384        splitter - ok
18:42:07.0812 0384        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
18:42:07.0859 0384        sr - ok
18:42:07.0890 0384        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
18:42:07.0906 0384        Srv - ok
18:42:07.0921 0384        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:42:08.0000 0384        streamip - ok
18:42:08.0171 0384        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:42:08.0265 0384        swenum - ok
18:42:08.0296 0384        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:42:08.0406 0384        swmidi - ok
18:42:08.0421 0384        symc810 - ok
18:42:08.0437 0384        symc8xx - ok
18:42:08.0437 0384        sym_hi - ok
18:42:08.0453 0384        sym_u3 - ok
18:42:08.0468 0384        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:42:08.0531 0384        sysaudio - ok
18:42:08.0562 0384        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:42:08.0578 0384        Tcpip - ok
18:42:08.0593 0384        tdcmdpst        (2f8bfbdb5824c71f672779b4b8cf8b01) C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys
18:42:08.0625 0384        tdcmdpst - ok
18:42:08.0656 0384        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:42:08.0781 0384        TDPIPE - ok
18:42:08.0875 0384        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:42:08.0953 0384        TDTCP - ok
18:42:09.0031 0384        tdudf          (f56a9327c58ff985616c5e197472932c) C:\WINDOWS\system32\DRIVERS\tdudf.sys
18:42:09.0031 0384        tdudf - ok
18:42:09.0062 0384        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:42:09.0125 0384        TermDD - ok
18:42:09.0156 0384        Thpdrv          (e00f0f7e4d4412da2f1b82a873229e47) C:\WINDOWS\system32\DRIVERS\thpdrv.sys
18:42:09.0156 0384        Thpdrv - ok
18:42:09.0171 0384        Thpevm          (beeca51c9ef368a1038e455278e4715e) C:\WINDOWS\system32\DRIVERS\Thpevm.SYS
18:42:09.0171 0384        Thpevm - ok
18:42:09.0203 0384        TMEI3E          (684bfb1e9abb05d3f48c53f3cd16a3e6) C:\WINDOWS\system32\Drivers\TMEI3E.SYS
18:42:09.0218 0384        TMEI3E ( UnsignedFile.Multi.Generic ) - warning
18:42:09.0218 0384        TMEI3E - detected UnsignedFile.Multi.Generic (1)
18:42:09.0234 0384        TosIde - ok
18:42:09.0281 0384        Tosrfcom        (1ad9eb1b5abd0aeee4084c8153476f1e) C:\WINDOWS\system32\drivers\Tosrfcom.sys
18:42:09.0296 0384        Tosrfcom - ok
18:42:09.0328 0384        tosrfec        (9ee240f7029771b21cc6200be6516d60) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
18:42:09.0343 0384        tosrfec - ok
18:42:09.0359 0384        tos_sps32      (4399a9bf7d8f49991a07fd86590a1619) C:\WINDOWS\system32\DRIVERS\tos_sps32.sys
18:42:09.0375 0384        tos_sps32 - ok
18:42:09.0390 0384        trudf          (3f9ba8878aa26d0831116733f9bc53ff) C:\WINDOWS\system32\DRIVERS\trudf.sys
18:42:09.0390 0384        trudf - ok
18:42:09.0406 0384        TVALZ          (73d3312955f805054e32fabdca5230b1) C:\WINDOWS\system32\DRIVERS\TVALZ.SYS
18:42:09.0421 0384        TVALZ - ok
18:42:09.0437 0384        TVALZFL        (e03f5ca8d4edb4ce8141a3242e1261f8) C:\WINDOWS\system32\DRIVERS\TVALZFL.sys
18:42:09.0453 0384        TVALZFL ( UnsignedFile.Multi.Generic ) - warning
18:42:09.0453 0384        TVALZFL - detected UnsignedFile.Multi.Generic (1)
18:42:09.0593 0384        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:42:09.0703 0384        Udfs - ok
18:42:09.0750 0384        ultra - ok
18:42:09.0781 0384        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:42:09.0875 0384        Update - ok
18:42:09.0890 0384        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:42:10.0015 0384        usbccgp - ok
18:42:10.0031 0384        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:42:10.0109 0384        usbehci - ok
18:42:10.0125 0384        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:42:10.0234 0384        usbhub - ok
18:42:10.0281 0384        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:42:10.0375 0384        USBSTOR - ok
18:42:10.0375 0384        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
18:42:10.0500 0384        usbvideo - ok
18:42:10.0531 0384        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:42:10.0609 0384        VgaSave - ok
18:42:10.0625 0384        ViaIde - ok
18:42:10.0656 0384        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
18:42:10.0750 0384        VolSnap - ok
18:42:10.0765 0384        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:42:10.0859 0384        Wanarp - ok
18:42:10.0890 0384        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
18:42:10.0921 0384        Wdf01000 - ok
18:42:11.0015 0384        WDICA - ok
18:42:11.0125 0384        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:42:11.0234 0384        wdmaud - ok
18:42:11.0312 0384        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:42:11.0375 0384        WSTCODEC - ok
18:42:11.0421 0384        WudfPf          (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:42:11.0437 0384        WudfPf - ok
18:42:11.0500 0384        WudfRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:42:11.0531 0384        WudfRd - ok
18:42:11.0531 0384        xcpip - ok
18:42:11.0546 0384        xpsec - ok
18:42:11.0562 0384        MBR (0x1B8)    (f381baacfc1778337c007982b0c32d82) \Device\Harddisk0\DR0
18:42:11.0562 0384        \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - infected
18:42:11.0562 0384        \Device\Harddisk0\DR0 - detected Backdoor.Win32.Sinowal.knf (0)
18:42:11.0593 0384        \Device\Harddisk0\DR0 ( TDSS File System ) - warning
18:42:11.0593 0384        \Device\Harddisk0\DR0 - detected TDSS File System (1)
18:42:11.0593 0384        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR2
18:42:11.0750 0384        \Device\Harddisk1\DR2 - ok
18:42:11.0750 0384        Boot (0x1200)  (d197ec57a47729b3667f4c56a4b6427b) \Device\Harddisk0\DR0\Partition0
18:42:11.0750 0384        \Device\Harddisk0\DR0\Partition0 - ok
18:42:11.0750 0384        Boot (0x1200)  (da5def75bb81028110fdb12e54669dc1) \Device\Harddisk1\DR2\Partition0
18:42:11.0750 0384        \Device\Harddisk1\DR2\Partition0 - ok
18:42:11.0750 0384        ============================================================
18:42:11.0750 0384        Scan finished
18:42:11.0750 0384        ============================================================
18:42:11.0859 2744        Detected object count: 6
18:42:11.0859 2744        Actual detected object count: 6
18:42:37.0765 2744        Netdevio ( UnsignedFile.Multi.Generic ) - skipped by user
18:42:37.0765 2744        Netdevio ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:42:37.0765 2744        QsFsFltr ( UnsignedFile.Multi.Generic ) - skipped by user
18:42:37.0765 2744        QsFsFltr ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:42:37.0765 2744        TMEI3E ( UnsignedFile.Multi.Generic ) - skipped by user
18:42:37.0765 2744        TMEI3E ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:42:37.0781 2744        TVALZFL ( UnsignedFile.Multi.Generic ) - skipped by user
18:42:37.0781 2744        TVALZFL ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:42:37.0781 2744        \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - skipped by user
18:42:37.0781 2744        \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - User select action: Skip
18:42:37.0781 2744        \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
18:42:37.0781 2744        \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
18:45:51.0828 4012        Deinitialize success

cosinus 15.01.2012 18:39
Zitat:
\Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf )
\Device\Harddisk0\DR0 ( TDSS File System )
Das TDSS File System und den Sinowal (und bitte nur diese beiden!!) bitte mit dem TDSS-Killer löschen lassen, starte Windows danach neu und mach ein neues Log mit diesem Tool. Poste es wieder mit CODE-Tags umschlossen.

borodin 15.01.2012 22:04
So, hier ist der nächste log:
Code:
21:57:14.0078 5928        TDSS rootkit removing tool 2.7.1.0 Jan 13 2012 15:24:05
21:57:14.0093 5928        ============================================================
21:57:14.0093 5928        Current date / time: 2012/01/15 21:57:14.0093
21:57:14.0093 5928        SystemInfo:
21:57:14.0093 5928       
21:57:14.0093 5928        OS Version: 5.1.2600 ServicePack: 3.0
21:57:14.0093 5928        Product type: Workstation
21:57:14.0093 5928        ComputerName: ***1
21:57:14.0093 5928        UserName: ***
21:57:14.0093 5928        Windows directory: C:\WINDOWS
21:57:14.0093 5928        System windows directory: C:\WINDOWS
21:57:14.0093 5928        Processor architecture: Intel x86
21:57:14.0093 5928        Number of processors: 4
21:57:14.0093 5928        Page size: 0x1000
21:57:14.0093 5928        Boot type: Normal boot
21:57:14.0093 5928        ============================================================
21:57:14.0453 5928        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000050
21:57:14.0515 5928        Drive \Device\Harddisk1\DR2 - Size: 0x7470C06000, SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:57:14.0578 5928        Initialize success
21:57:21.0406 4692        ============================================================
21:57:21.0406 4692        Scan started
21:57:21.0406 4692        Mode: Manual; SigCheck; TDLFS;
21:57:21.0406 4692        ============================================================
21:57:22.0453 4692        Abiosdsk - ok
21:57:22.0453 4692        abp480n5 - ok
21:57:22.0500 4692        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:57:24.0140 4692        ACPI - ok
21:57:24.0234 4692        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:57:24.0437 4692        ACPIEC - ok
21:57:24.0531 4692        adfs            (73685e15ef8b0bd9c30f1af413f13d49) C:\WINDOWS\system32\drivers\adfs.sys
21:57:24.0531 4692        adfs - ok
21:57:24.0546 4692        adpu160m - ok
21:57:24.0593 4692        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:57:24.0703 4692        aec - ok
21:57:24.0750 4692        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:57:24.0781 4692        AFD - ok
21:57:24.0796 4692        Aha154x - ok
21:57:24.0812 4692        aic78u2 - ok
21:57:24.0812 4692        aic78xx - ok
21:57:24.0828 4692        AliIde - ok
21:57:24.0890 4692        Ambfilt        (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
21:57:25.0078 4692        Ambfilt - ok
21:57:25.0156 4692        amsint - ok
21:57:25.0187 4692        ApfiltrService  (c5b1284c94c90d28e1876d350e9ca297) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
21:57:25.0203 4692        ApfiltrService - ok
21:57:25.0218 4692        asc - ok
21:57:25.0218 4692        asc3350p - ok
21:57:25.0234 4692        asc3550 - ok
21:57:25.0250 4692        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:57:25.0390 4692        AsyncMac - ok
21:57:25.0421 4692        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
21:57:25.0515 4692        atapi - ok
21:57:25.0531 4692        Atdisk - ok
21:57:25.0546 4692        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:57:25.0656 4692        Atmarpc - ok
21:57:25.0718 4692        ATSwpWDF        (b693cec3751764087b76648f7cf12651) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
21:57:25.0734 4692        ATSwpWDF - ok
21:57:25.0828 4692        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:57:25.0937 4692        audstub - ok
21:57:25.0953 4692        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:57:26.0062 4692        Beep - ok
21:57:26.0078 4692        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:57:26.0171 4692        cbidf2k - ok
21:57:26.0171 4692        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:57:26.0265 4692        CCDECODE - ok
21:57:26.0265 4692        cd20xrnt - ok
21:57:26.0265 4692        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:57:26.0375 4692        Cdaudio - ok
21:57:26.0406 4692        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:57:26.0515 4692        Cdfs - ok
21:57:26.0531 4692        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:57:26.0625 4692        Cdrom - ok
21:57:26.0625 4692        Changer - ok
21:57:26.0656 4692        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:57:26.0781 4692        CmBatt - ok
21:57:26.0796 4692        CmdIde - ok
21:57:26.0812 4692        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:57:26.0921 4692        Compbatt - ok
21:57:26.0937 4692        Cpqarray - ok
21:57:26.0937 4692        dac2w2k - ok
21:57:26.0953 4692        dac960nt - ok
21:57:26.0984 4692        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:57:27.0062 4692        Disk - ok
21:57:27.0109 4692        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
21:57:27.0234 4692        dmboot - ok
21:57:27.0328 4692        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
21:57:27.0406 4692        dmio - ok
21:57:27.0421 4692        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:57:27.0484 4692        dmload - ok
21:57:27.0531 4692        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:57:27.0593 4692        DMusic - ok
21:57:27.0609 4692        dpti2o - ok
21:57:27.0640 4692        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:57:27.0734 4692        drmkaud - ok
21:57:27.0781 4692        e1kexpress      (0c95246539ed1fbeb2d6b3b1f34cdd42) C:\WINDOWS\system32\DRIVERS\e1k5132.sys
21:57:27.0796 4692        e1kexpress - ok
21:57:27.0828 4692        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:57:27.0890 4692        Fastfat - ok
21:57:27.0906 4692        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
21:57:27.0968 4692        Fdc - ok
21:57:27.0968 4692        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
21:57:28.0062 4692        Fips - ok
21:57:28.0171 4692        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
21:57:28.0234 4692        Flpydisk - ok
21:57:28.0265 4692        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
21:57:28.0343 4692        FltMgr - ok
21:57:28.0359 4692        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:57:28.0421 4692        Fs_Rec - ok
21:57:28.0437 4692        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:57:28.0500 4692        Ftdisk - ok
21:57:28.0515 4692        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:57:28.0593 4692        Gpc - ok
21:57:28.0671 4692        guardian2      (db3794c1e876ca318d2ba3d1d38cba8a) C:\WINDOWS\system32\Drivers\oz776.sys
21:57:28.0671 4692        guardian2 - ok
21:57:28.0718 4692        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:57:28.0843 4692        HDAudBus - ok
21:57:28.0890 4692        HECI            (a88485dc6a7136c10d9a6c7e38fdfe3c) C:\WINDOWS\system32\DRIVERS\HECI.sys
21:57:28.0921 4692        HECI - ok
21:57:28.0953 4692        hpn - ok
21:57:28.0984 4692        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:57:29.0046 4692        HTTP - ok
21:57:29.0093 4692        i2omgmt - ok
21:57:29.0125 4692        i2omp - ok
21:57:29.0140 4692        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:57:29.0234 4692        i8042prt - ok
21:57:29.0265 4692        iaStor          (39f7c9aeee865fe8e98cf3edd2b4bb4a) C:\WINDOWS\system32\drivers\iaStor.sys
21:57:29.0296 4692        iaStor - ok
21:57:29.0312 4692        IFXTPM          (91c5e9f49f32110ced27e2f902fad607) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
21:57:29.0359 4692        IFXTPM - ok
21:57:29.0421 4692        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:57:29.0484 4692        Imapi - ok
21:57:29.0531 4692        Impcd          (03c0d99bc2913226f1cea7cb0d984659) C:\WINDOWS\system32\DRIVERS\Impcd.sys
21:57:29.0562 4692        Impcd - ok
21:57:29.0562 4692        ini910u - ok
21:57:29.0734 4692        IntcAzAudAddService (74bd9d8ede748b33b2f2aaba941cba5a) C:\WINDOWS\system32\drivers\RtkHDAud.sys
21:57:29.0921 4692        IntcAzAudAddService - ok
21:57:30.0000 4692        IntelIde - ok
21:57:30.0031 4692        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:57:30.0125 4692        intelppm - ok
21:57:30.0140 4692        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
21:57:30.0234 4692        Ip6Fw - ok
21:57:30.0234 4692        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:57:30.0296 4692        IpFilterDriver - ok
21:57:30.0312 4692        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:57:30.0421 4692        IpInIp - ok
21:57:30.0453 4692        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:57:30.0531 4692        IpNat - ok
21:57:30.0593 4692        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:57:30.0687 4692        IPSec - ok
21:57:30.0718 4692        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:57:30.0750 4692        IRENUM - ok
21:57:30.0828 4692        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:57:30.0906 4692        isapnp - ok
21:57:30.0937 4692        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:57:31.0015 4692        Kbdclass - ok
21:57:31.0062 4692        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:57:31.0156 4692        kmixer - ok
21:57:31.0156 4692        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:57:31.0234 4692        KSecDD - ok
21:57:31.0250 4692        lbrtfdc - ok
21:57:31.0296 4692        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
21:57:31.0296 4692        MBAMProtector - ok
21:57:31.0359 4692        mfeavfk        (cde41293db871a75cd99eb0ce781356b) C:\WINDOWS\system32\drivers\mfeavfk.sys
21:57:31.0359 4692        mfeavfk - ok
21:57:31.0468 4692        mfebopk        (e22385f64bdf0ad81157479496e33c4a) C:\WINDOWS\system32\drivers\mfebopk.sys
21:57:31.0468 4692        mfebopk - ok
21:57:31.0500 4692        mfehidk        (56d330981866a72f061dd16cc5004513) C:\WINDOWS\system32\drivers\mfehidk.sys
21:57:31.0531 4692        mfehidk - ok
21:57:31.0531 4692        mferkdk - ok
21:57:31.0546 4692        mfesmfk - ok
21:57:31.0562 4692        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:57:31.0640 4692        mnmdd - ok
21:57:31.0671 4692        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
21:57:31.0750 4692        Modem - ok
21:57:31.0890 4692        Monfilt        (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
21:57:31.0968 4692        Monfilt - ok
21:57:31.0984 4692        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:57:32.0078 4692        Mouclass - ok
21:57:32.0109 4692        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:57:32.0171 4692        MountMgr - ok
21:57:32.0250 4692        MPFP - ok
21:57:32.0250 4692        mraid35x - ok
21:57:32.0265 4692        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:57:32.0343 4692        MRxDAV - ok
21:57:32.0390 4692        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:57:32.0437 4692        MRxSmb - ok
21:57:32.0515 4692        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:57:32.0578 4692        Msfs - ok
21:57:32.0609 4692        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:57:32.0687 4692        MSKSSRV - ok
21:57:32.0703 4692        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:57:32.0765 4692        MSPCLOCK - ok
21:57:32.0796 4692        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:57:32.0875 4692        MSPQM - ok
21:57:32.0890 4692        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:57:32.0953 4692        mssmbios - ok
21:57:32.0968 4692        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
21:57:33.0078 4692        MSTEE - ok
21:57:33.0187 4692        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:57:33.0218 4692        Mup - ok
21:57:33.0250 4692        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:57:33.0343 4692        NABTSFEC - ok
21:57:33.0375 4692        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:57:33.0500 4692        NDIS - ok
21:57:33.0531 4692        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:57:33.0609 4692        NdisIP - ok
21:57:33.0640 4692        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:57:33.0671 4692        NdisTapi - ok
21:57:33.0765 4692        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:57:33.0875 4692        Ndisuio - ok
21:57:33.0906 4692        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:57:33.0968 4692        NdisWan - ok
21:57:33.0984 4692        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:57:34.0031 4692        NDProxy - ok
21:57:34.0046 4692        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:57:34.0156 4692        NetBIOS - ok
21:57:34.0203 4692        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:57:34.0312 4692        NetBT - ok
21:57:34.0406 4692        Netdevio        (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
21:57:34.0421 4692        Netdevio ( UnsignedFile.Multi.Generic ) - warning
21:57:34.0421 4692        Netdevio - detected UnsignedFile.Multi.Generic (1)
21:57:34.0546 4692        NETw5x32        (580207a7c9bde8ba65401f51f9ba9741) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
21:57:34.0812 4692        NETw5x32 - ok
21:57:34.0906 4692        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:57:34.0968 4692        Npfs - ok
21:57:34.0984 4692        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:57:35.0062 4692        Ntfs - ok
21:57:35.0078 4692        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:57:35.0156 4692        Null - ok
21:57:35.0375 4692        nv              (3aa257bbeccc1cef9b305ed2dd86d032) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
21:57:35.0796 4692        nv - ok
21:57:35.0906 4692        NVHDA          (04b3177ed656f1d3a6ebf48f5beea8a8) C:\WINDOWS\system32\drivers\nvhda32.sys
21:57:35.0906 4692        NVHDA - ok
21:57:35.0921 4692        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:57:36.0015 4692        NwlnkFlt - ok
21:57:36.0031 4692        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:57:36.0109 4692        NwlnkFwd - ok
21:57:36.0140 4692        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
21:57:36.0203 4692        Parport - ok
21:57:36.0234 4692        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:57:36.0296 4692        PartMgr - ok
21:57:36.0312 4692        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
21:57:36.0390 4692        ParVdm - ok
21:57:36.0500 4692        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
21:57:36.0531 4692        pccsmcfd - ok
21:57:36.0546 4692        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
21:57:36.0609 4692        PCI - ok
21:57:36.0625 4692        PCIDump - ok
21:57:36.0640 4692        PCIIde - ok
21:57:36.0656 4692        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:57:36.0718 4692        Pcmcia - ok
21:57:36.0734 4692        PDCOMP - ok
21:57:36.0734 4692        PDFRAME - ok
21:57:36.0750 4692        PDRELI - ok
21:57:36.0750 4692        PDRFRAME - ok
21:57:36.0765 4692        perc2 - ok
21:57:36.0765 4692        perc2hib - ok
21:57:36.0796 4692        PGEffect        (1b5011dd8d57f53aed31ff0f7d635802) C:\WINDOWS\system32\DRIVERS\pgeffect.sys
21:57:36.0843 4692        PGEffect - ok
21:57:36.0875 4692        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:57:37.0015 4692        PptpMiniport - ok
21:57:37.0062 4692        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:57:37.0140 4692        PSched - ok
21:57:37.0187 4692        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:57:37.0281 4692        Ptilink - ok
21:57:37.0281 4692        ql1080 - ok
21:57:37.0296 4692        Ql10wnt - ok
21:57:37.0296 4692        ql12160 - ok
21:57:37.0312 4692        ql1240 - ok
21:57:37.0312 4692        ql1280 - ok
21:57:37.0359 4692        QsFsFltr        (8b1d0cdd82174c5421a1fc547a15f724) C:\WINDOWS\system32\DRIVERS\QsFsFltr.sys
21:57:37.0375 4692        QsFsFltr ( UnsignedFile.Multi.Generic ) - warning
21:57:37.0375 4692        QsFsFltr - detected UnsignedFile.Multi.Generic (1)
21:57:37.0390 4692        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:57:37.0484 4692        RasAcd - ok
21:57:37.0484 4692        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:57:37.0562 4692        Rasl2tp - ok
21:57:37.0640 4692        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:57:37.0718 4692        RasPppoe - ok
21:57:37.0765 4692        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:57:37.0843 4692        Raspti - ok
21:57:37.0859 4692        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:57:37.0937 4692        Rdbss - ok
21:57:37.0953 4692        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:57:38.0000 4692        RDPCDD - ok
21:57:38.0046 4692        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:57:38.0125 4692        rdpdr - ok
21:57:38.0203 4692        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
21:57:38.0234 4692        RDPWD - ok
21:57:38.0312 4692        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:57:38.0406 4692        redbook - ok
21:57:38.0453 4692        rimspci        (af213955c4d952c914620e8db0cd0cf7) C:\WINDOWS\system32\DRIVERS\rimspe86.sys
21:57:38.0468 4692        rimspci - ok
21:57:38.0468 4692        risdpcie        (85cba4b868a9daaa2dd5e3952f396982) C:\WINDOWS\system32\DRIVERS\risdpe86.sys
21:57:38.0484 4692        risdpcie - ok
21:57:38.0500 4692        rixdpcie        (764c1f3453e779724ba647327de7ddd4) C:\WINDOWS\system32\DRIVERS\rixdpe86.sys
21:57:38.0531 4692        rixdpcie - ok
21:57:38.0578 4692        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
21:57:38.0640 4692        sdbus - ok
21:57:38.0656 4692        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:57:38.0687 4692        Secdrv - ok
21:57:38.0734 4692        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
21:57:38.0796 4692        Serial - ok
21:57:38.0812 4692        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:57:38.0906 4692        Sfloppy - ok
21:57:38.0921 4692        Simbad - ok
21:57:38.0937 4692        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:57:39.0000 4692        SLIP - ok
21:57:39.0000 4692        Sparrow - ok
21:57:39.0031 4692        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:57:39.0109 4692        splitter - ok
21:57:39.0140 4692        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
21:57:39.0171 4692        sr - ok
21:57:39.0187 4692        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:57:39.0218 4692        Srv - ok
21:57:39.0281 4692        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:57:39.0359 4692        streamip - ok
21:57:39.0390 4692        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:57:39.0468 4692        swenum - ok
21:57:39.0500 4692        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:57:39.0562 4692        swmidi - ok
21:57:39.0562 4692        symc810 - ok
21:57:39.0578 4692        symc8xx - ok
21:57:39.0578 4692        sym_hi - ok
21:57:39.0593 4692        sym_u3 - ok
21:57:39.0625 4692        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:57:39.0687 4692        sysaudio - ok
21:57:39.0734 4692        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:57:39.0812 4692        Tcpip - ok
21:57:39.0828 4692        tdcmdpst        (2f8bfbdb5824c71f672779b4b8cf8b01) C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys
21:57:39.0875 4692        tdcmdpst - ok
21:57:39.0953 4692        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:57:40.0031 4692        TDPIPE - ok
21:57:40.0078 4692        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:57:40.0140 4692        TDTCP - ok
21:57:40.0171 4692        tdudf          (f56a9327c58ff985616c5e197472932c) C:\WINDOWS\system32\DRIVERS\tdudf.sys
21:57:40.0187 4692        tdudf - ok
21:57:40.0203 4692        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:57:40.0265 4692        TermDD - ok
21:57:40.0296 4692        Thpdrv          (e00f0f7e4d4412da2f1b82a873229e47) C:\WINDOWS\system32\DRIVERS\thpdrv.sys
21:57:40.0296 4692        Thpdrv - ok
21:57:40.0312 4692        Thpevm          (beeca51c9ef368a1038e455278e4715e) C:\WINDOWS\system32\DRIVERS\Thpevm.SYS
21:57:40.0359 4692        Thpevm - ok
21:57:40.0375 4692        TMEI3E          (684bfb1e9abb05d3f48c53f3cd16a3e6) C:\WINDOWS\system32\Drivers\TMEI3E.SYS
21:57:40.0390 4692        TMEI3E ( UnsignedFile.Multi.Generic ) - warning
21:57:40.0390 4692        TMEI3E - detected UnsignedFile.Multi.Generic (1)
21:57:40.0453 4692        TosIde - ok
21:57:40.0500 4692        Tosrfcom        (1ad9eb1b5abd0aeee4084c8153476f1e) C:\WINDOWS\system32\drivers\Tosrfcom.sys
21:57:40.0515 4692        Tosrfcom - ok
21:57:40.0546 4692        tosrfec        (9ee240f7029771b21cc6200be6516d60) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
21:57:40.0546 4692        tosrfec - ok
21:57:40.0578 4692        tos_sps32      (4399a9bf7d8f49991a07fd86590a1619) C:\WINDOWS\system32\DRIVERS\tos_sps32.sys
21:57:40.0593 4692        tos_sps32 - ok
21:57:40.0609 4692        trudf          (3f9ba8878aa26d0831116733f9bc53ff) C:\WINDOWS\system32\DRIVERS\trudf.sys
21:57:40.0640 4692        trudf - ok
21:57:40.0656 4692        TVALZ          (73d3312955f805054e32fabdca5230b1) C:\WINDOWS\system32\DRIVERS\TVALZ.SYS
21:57:40.0671 4692        TVALZ - ok
21:57:40.0703 4692        TVALZFL        (e03f5ca8d4edb4ce8141a3242e1261f8) C:\WINDOWS\system32\DRIVERS\TVALZFL.sys
21:57:40.0718 4692        TVALZFL ( UnsignedFile.Multi.Generic ) - warning
21:57:40.0718 4692        TVALZFL - detected UnsignedFile.Multi.Generic (1)
21:57:40.0750 4692        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:57:40.0828 4692        Udfs - ok
21:57:40.0859 4692        ultra - ok
21:57:40.0890 4692        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:57:41.0000 4692        Update - ok
21:57:41.0031 4692        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:57:41.0093 4692        usbccgp - ok
21:57:41.0125 4692        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:57:41.0187 4692        usbehci - ok
21:57:41.0187 4692        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:57:41.0250 4692        usbhub - ok
21:57:41.0296 4692        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:57:41.0390 4692        USBSTOR - ok
21:57:41.0406 4692        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
21:57:41.0468 4692        usbvideo - ok
21:57:41.0484 4692        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:57:41.0546 4692        VgaSave - ok
21:57:41.0562 4692        ViaIde - ok
21:57:41.0578 4692        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
21:57:41.0640 4692        VolSnap - ok
21:57:41.0656 4692        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:57:41.0734 4692        Wanarp - ok
21:57:41.0750 4692        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
21:57:41.0765 4692        Wdf01000 - ok
21:57:41.0781 4692        WDICA - ok
21:57:41.0812 4692        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:57:41.0890 4692        wdmaud - ok
21:57:41.0984 4692        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:57:42.0062 4692        WSTCODEC - ok
21:57:42.0109 4692        WudfPf          (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:57:42.0187 4692        WudfPf - ok
21:57:42.0250 4692        WudfRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:57:42.0281 4692        WudfRd - ok
21:57:42.0281 4692        xcpip - ok
21:57:42.0296 4692        xpsec - ok
21:57:42.0312 4692        MBR (0x1B8)    (f381baacfc1778337c007982b0c32d82) \Device\Harddisk0\DR0
21:57:42.0312 4692        \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - infected
21:57:42.0312 4692        \Device\Harddisk0\DR0 - detected Backdoor.Win32.Sinowal.knf (0)
21:57:42.0343 4692        \Device\Harddisk0\DR0 ( TDSS File System ) - warning
21:57:42.0343 4692        \Device\Harddisk0\DR0 - detected TDSS File System (1)
21:57:42.0343 4692        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR2
21:57:42.0515 4692        \Device\Harddisk1\DR2 - ok
21:57:42.0515 4692        Boot (0x1200)  (d197ec57a47729b3667f4c56a4b6427b) \Device\Harddisk0\DR0\Partition0
21:57:42.0531 4692        \Device\Harddisk0\DR0\Partition0 - ok
21:57:42.0531 4692        Boot (0x1200)  (da5def75bb81028110fdb12e54669dc1) \Device\Harddisk1\DR2\Partition0
21:57:42.0531 4692        \Device\Harddisk1\DR2\Partition0 - ok
21:57:42.0531 4692        ============================================================
21:57:42.0531 4692        Scan finished
21:57:42.0531 4692        ============================================================
21:57:42.0640 2992        Detected object count: 6
21:57:42.0640 2992        Actual detected object count: 6
21:58:10.0140 2992        Netdevio ( UnsignedFile.Multi.Generic ) - skipped by user
21:58:10.0140 2992        Netdevio ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:58:10.0140 2992        QsFsFltr ( UnsignedFile.Multi.Generic ) - skipped by user
21:58:10.0140 2992        QsFsFltr ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:58:10.0140 2992        TMEI3E ( UnsignedFile.Multi.Generic ) - skipped by user
21:58:10.0140 2992        TMEI3E ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:58:10.0140 2992        TVALZFL ( UnsignedFile.Multi.Generic ) - skipped by user
21:58:10.0140 2992        TVALZFL ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:58:10.0156 2992        \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - will be cured on reboot
21:58:10.0187 2992        \Device\Harddisk0\DR0 - ok
21:58:10.0187 2992        \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - User select action: Cure
21:58:10.0187 2992        \Device\Harddisk0\DR0\TDLFS - deleted
21:58:10.0187 2992        \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete
21:58:14.0765 4616        Deinitialize success

cosinus 16.01.2012 13:56
Du solltest neu starten und ein neues Log machen

borodin 17.01.2012 17:07
So, nun der log nach Neustart!

Code:
17:05:47.0703 7104        TDSS rootkit removing tool 2.7.1.0 Jan 13 2012 15:24:05
17:05:47.0718 7104        ============================================================
17:05:47.0718 7104        Current date / time: 2012/01/17 17:05:47.0718
17:05:47.0718 7104        SystemInfo:
17:05:47.0718 7104       
17:05:47.0718 7104        OS Version: 5.1.2600 ServicePack: 3.0
17:05:47.0718 7104        Product type: Workstation
17:05:47.0718 7104        ComputerName: ***1
17:05:47.0718 7104        UserName: ***
17:05:47.0718 7104        Windows directory: C:\WINDOWS
17:05:47.0718 7104        System windows directory: C:\WINDOWS
17:05:47.0718 7104        Processor architecture: Intel x86
17:05:47.0718 7104        Number of processors: 4
17:05:47.0718 7104        Page size: 0x1000
17:05:47.0718 7104        Boot type: Normal boot
17:05:47.0718 7104        ============================================================
17:05:48.0078 7104        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000050
17:05:48.0109 7104        Initialize success
17:05:54.0687 1860        ============================================================
17:05:54.0687 1860        Scan started
17:05:54.0687 1860        Mode: Manual; SigCheck; TDLFS;
17:05:54.0687 1860        ============================================================
17:05:54.0984 1860        Abiosdsk - ok
17:05:55.0000 1860        abp480n5 - ok
17:05:55.0062 1860        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:05:55.0406 1860        ACPI - ok
17:05:55.0437 1860        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
17:05:55.0531 1860        ACPIEC - ok
17:05:55.0578 1860        adfs            (73685e15ef8b0bd9c30f1af413f13d49) C:\WINDOWS\system32\drivers\adfs.sys
17:05:55.0593 1860        adfs - ok
17:05:55.0593 1860        adpu160m - ok
17:05:55.0640 1860        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
17:05:55.0765 1860        aec - ok
17:05:55.0859 1860        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
17:05:55.0921 1860        AFD - ok
17:05:55.0921 1860        Aha154x - ok
17:05:55.0937 1860        aic78u2 - ok
17:05:55.0937 1860        aic78xx - ok
17:05:55.0953 1860        AliIde - ok
17:05:56.0031 1860        Ambfilt        (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
17:05:56.0218 1860        Ambfilt - ok
17:05:56.0281 1860        amsint - ok
17:05:56.0328 1860        ApfiltrService  (c5b1284c94c90d28e1876d350e9ca297) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
17:05:56.0359 1860        ApfiltrService - ok
17:05:56.0375 1860        asc - ok
17:05:56.0375 1860        asc3350p - ok
17:05:56.0390 1860        asc3550 - ok
17:05:56.0406 1860        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:05:56.0546 1860        AsyncMac - ok
17:05:56.0578 1860        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
17:05:56.0718 1860        atapi - ok
17:05:56.0718 1860        Atdisk - ok
17:05:56.0734 1860        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:05:56.0906 1860        Atmarpc - ok
17:05:56.0984 1860        ATSwpWDF        (b693cec3751764087b76648f7cf12651) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
17:05:57.0031 1860        ATSwpWDF - ok
17:05:57.0125 1860        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:05:57.0187 1860        audstub - ok
17:05:57.0203 1860        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:05:57.0296 1860        Beep - ok
17:05:57.0312 1860        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:05:57.0375 1860        cbidf2k - ok
17:05:57.0375 1860        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:05:57.0515 1860        CCDECODE - ok
17:05:57.0515 1860        cd20xrnt - ok
17:05:57.0531 1860        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:05:57.0593 1860        Cdaudio - ok
17:05:57.0625 1860        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
17:05:57.0718 1860        Cdfs - ok
17:05:57.0718 1860        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:05:57.0796 1860        Cdrom - ok
17:05:57.0812 1860        Changer - ok
17:05:57.0843 1860        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
17:05:58.0000 1860        CmBatt - ok
17:05:58.0000 1860        CmdIde - ok
17:05:58.0015 1860        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
17:05:58.0093 1860        Compbatt - ok
17:05:58.0093 1860        Cpqarray - ok
17:05:58.0109 1860        dac2w2k - ok
17:05:58.0109 1860        dac960nt - ok
17:05:58.0140 1860        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
17:05:58.0203 1860        Disk - ok
17:05:58.0250 1860        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
17:05:58.0328 1860        dmboot - ok
17:05:58.0406 1860        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
17:05:58.0500 1860        dmio - ok
17:05:58.0515 1860        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:05:58.0593 1860        dmload - ok
17:05:58.0640 1860        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
17:05:58.0781 1860        DMusic - ok
17:05:58.0796 1860        dpti2o - ok
17:05:58.0843 1860        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
17:05:58.0968 1860        drmkaud - ok
17:05:59.0015 1860        e1kexpress      (0c95246539ed1fbeb2d6b3b1f34cdd42) C:\WINDOWS\system32\DRIVERS\e1k5132.sys
17:05:59.0031 1860        e1kexpress - ok
17:05:59.0062 1860        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
17:05:59.0187 1860        Fastfat - ok
17:05:59.0203 1860        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
17:05:59.0328 1860        Fdc - ok
17:05:59.0343 1860        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
17:05:59.0500 1860        Fips - ok
17:05:59.0609 1860        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
17:05:59.0734 1860        Flpydisk - ok
17:05:59.0750 1860        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:05:59.0906 1860        FltMgr - ok
17:05:59.0921 1860        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:06:00.0046 1860        Fs_Rec - ok
17:06:00.0062 1860        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:06:00.0187 1860        Ftdisk - ok
17:06:00.0218 1860        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:06:00.0359 1860        Gpc - ok
17:06:00.0406 1860        guardian2      (db3794c1e876ca318d2ba3d1d38cba8a) C:\WINDOWS\system32\Drivers\oz776.sys
17:06:00.0421 1860        guardian2 - ok
17:06:00.0515 1860        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:06:00.0671 1860        HDAudBus - ok
17:06:00.0703 1860        HECI            (a88485dc6a7136c10d9a6c7e38fdfe3c) C:\WINDOWS\system32\DRIVERS\HECI.sys
17:06:00.0734 1860        HECI - ok
17:06:00.0796 1860        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:06:00.0921 1860        HidUsb - ok
17:06:00.0921 1860        hpn - ok
17:06:00.0968 1860        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
17:06:01.0031 1860        HTTP - ok
17:06:01.0109 1860        i2omgmt - ok
17:06:01.0125 1860        i2omp - ok
17:06:01.0140 1860        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:06:01.0296 1860        i8042prt - ok
17:06:01.0328 1860        iaStor          (39f7c9aeee865fe8e98cf3edd2b4bb4a) C:\WINDOWS\system32\drivers\iaStor.sys
17:06:01.0343 1860        iaStor - ok
17:06:01.0375 1860        IFXTPM          (91c5e9f49f32110ced27e2f902fad607) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
17:06:01.0437 1860        IFXTPM - ok
17:06:01.0500 1860        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:06:01.0593 1860        Imapi - ok
17:06:01.0640 1860        Impcd          (03c0d99bc2913226f1cea7cb0d984659) C:\WINDOWS\system32\DRIVERS\Impcd.sys
17:06:01.0671 1860        Impcd - ok
17:06:01.0687 1860        ini910u - ok
17:06:01.0875 1860        IntcAzAudAddService (74bd9d8ede748b33b2f2aaba941cba5a) C:\WINDOWS\system32\drivers\RtkHDAud.sys
17:06:02.0156 1860        IntcAzAudAddService - ok
17:06:02.0234 1860        IntelIde - ok
17:06:02.0265 1860        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:06:02.0406 1860        intelppm - ok
17:06:02.0437 1860        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:06:02.0562 1860        Ip6Fw - ok
17:06:02.0562 1860        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:06:02.0703 1860        IpFilterDriver - ok
17:06:02.0703 1860        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:06:02.0796 1860        IpInIp - ok
17:06:02.0828 1860        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:06:02.0890 1860        IpNat - ok
17:06:02.0937 1860        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:06:03.0015 1860        IPSec - ok
17:06:03.0031 1860        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:06:03.0062 1860        IRENUM - ok
17:06:03.0093 1860        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:06:03.0171 1860        isapnp - ok
17:06:03.0265 1860        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:06:03.0406 1860        Kbdclass - ok
17:06:03.0453 1860        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:06:03.0593 1860        kbdhid - ok
17:06:03.0671 1860        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
17:06:03.0812 1860        kmixer - ok
17:06:03.0828 1860        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
17:06:03.0906 1860        KSecDD - ok
17:06:03.0921 1860        lbrtfdc - ok
17:06:03.0968 1860        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
17:06:03.0984 1860        MBAMProtector - ok
17:06:04.0109 1860        mfeavfk        (cde41293db871a75cd99eb0ce781356b) C:\WINDOWS\system32\drivers\mfeavfk.sys
17:06:04.0125 1860        mfeavfk - ok
17:06:04.0187 1860        mfebopk        (e22385f64bdf0ad81157479496e33c4a) C:\WINDOWS\system32\drivers\mfebopk.sys
17:06:04.0187 1860        mfebopk - ok
17:06:04.0250 1860        mfehidk        (56d330981866a72f061dd16cc5004513) C:\WINDOWS\system32\drivers\mfehidk.sys
17:06:04.0265 1860        mfehidk - ok
17:06:04.0281 1860        mferkdk - ok
17:06:04.0281 1860        mfesmfk - ok
17:06:04.0328 1860        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:06:04.0468 1860        mnmdd - ok
17:06:04.0546 1860        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
17:06:04.0687 1860        Modem - ok
17:06:04.0812 1860        Monfilt        (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
17:06:04.0906 1860        Monfilt - ok
17:06:04.0937 1860        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:06:05.0078 1860        Mouclass - ok
17:06:05.0171 1860        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:06:05.0312 1860        mouhid - ok
17:06:05.0343 1860        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
17:06:05.0468 1860        MountMgr - ok
17:06:05.0468 1860        MPFP - ok
17:06:05.0484 1860        mraid35x - ok
17:06:05.0484 1860        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:06:05.0593 1860        MRxDAV - ok
17:06:05.0640 1860        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:06:05.0671 1860        MRxSmb - ok
17:06:05.0687 1860        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
17:06:05.0796 1860        Msfs - ok
17:06:05.0812 1860        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:06:05.0968 1860        MSKSSRV - ok
17:06:06.0031 1860        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:06:06.0093 1860        MSPCLOCK - ok
17:06:06.0125 1860        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
17:06:06.0203 1860        MSPQM - ok
17:06:06.0218 1860        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:06:06.0281 1860        mssmbios - ok
17:06:06.0312 1860        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
17:06:06.0390 1860        MSTEE - ok
17:06:06.0421 1860        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
17:06:06.0453 1860        Mup - ok
17:06:06.0531 1860        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:06:06.0687 1860        NABTSFEC - ok
17:06:06.0718 1860        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
17:06:06.0843 1860        NDIS - ok
17:06:06.0875 1860        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:06:07.0015 1860        NdisIP - ok
17:06:07.0046 1860        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:06:07.0093 1860        NdisTapi - ok
17:06:07.0171 1860        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:06:07.0296 1860        Ndisuio - ok
17:06:07.0343 1860        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:06:07.0406 1860        NdisWan - ok
17:06:07.0437 1860        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
17:06:07.0500 1860        NDProxy - ok
17:06:07.0515 1860        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:06:07.0578 1860        NetBIOS - ok
17:06:07.0625 1860        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:06:07.0703 1860        NetBT - ok
17:06:07.0781 1860        Netdevio        (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
17:06:07.0796 1860        Netdevio ( UnsignedFile.Multi.Generic ) - warning
17:06:07.0796 1860        Netdevio - detected UnsignedFile.Multi.Generic (1)
17:06:07.0953 1860        NETw5x32        (580207a7c9bde8ba65401f51f9ba9741) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
17:06:08.0171 1860        NETw5x32 - ok
17:06:08.0281 1860        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
17:06:08.0421 1860        Npfs - ok
17:06:08.0437 1860        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
17:06:08.0625 1860        Ntfs - ok
17:06:08.0656 1860        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:06:08.0781 1860        Null - ok
17:06:09.0046 1860        nv              (3aa257bbeccc1cef9b305ed2dd86d032) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:06:09.0578 1860        nv - ok
17:06:09.0687 1860        NVHDA          (04b3177ed656f1d3a6ebf48f5beea8a8) C:\WINDOWS\system32\drivers\nvhda32.sys
17:06:09.0703 1860        NVHDA - ok
17:06:09.0718 1860        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:06:09.0843 1860        NwlnkFlt - ok
17:06:09.0875 1860        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:06:10.0000 1860        NwlnkFwd - ok
17:06:10.0046 1860        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
17:06:10.0187 1860        Parport - ok
17:06:10.0203 1860        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
17:06:10.0328 1860        PartMgr - ok
17:06:10.0359 1860        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
17:06:10.0500 1860        ParVdm - ok
17:06:10.0593 1860        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
17:06:10.0656 1860        pccsmcfd - ok
17:06:10.0671 1860        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
17:06:10.0796 1860        PCI - ok
17:06:10.0796 1860        PCIDump - ok
17:06:10.0812 1860        PCIIde - ok
17:06:10.0843 1860        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:06:10.0937 1860        Pcmcia - ok
17:06:10.0937 1860        PDCOMP - ok
17:06:10.0953 1860        PDFRAME - ok
17:06:10.0968 1860        PDRELI - ok
17:06:10.0968 1860        PDRFRAME - ok
17:06:10.0984 1860        perc2 - ok
17:06:10.0984 1860        perc2hib - ok
17:06:11.0015 1860        PGEffect        (1b5011dd8d57f53aed31ff0f7d635802) C:\WINDOWS\system32\DRIVERS\pgeffect.sys
17:06:11.0062 1860        PGEffect - ok
17:06:11.0109 1860        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:06:11.0234 1860        PptpMiniport - ok
17:06:11.0265 1860        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
17:06:11.0328 1860        PSched - ok
17:06:11.0343 1860        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:06:11.0421 1860        Ptilink - ok
17:06:11.0500 1860        ql1080 - ok
17:06:11.0515 1860        Ql10wnt - ok
17:06:11.0531 1860        ql12160 - ok
17:06:11.0531 1860        ql1240 - ok
17:06:11.0546 1860        ql1280 - ok
17:06:11.0562 1860        QsFsFltr        (8b1d0cdd82174c5421a1fc547a15f724) C:\WINDOWS\system32\DRIVERS\QsFsFltr.sys
17:06:11.0593 1860        QsFsFltr ( UnsignedFile.Multi.Generic ) - warning
17:06:11.0593 1860        QsFsFltr - detected UnsignedFile.Multi.Generic (1)
17:06:11.0593 1860        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:06:11.0750 1860        RasAcd - ok
17:06:11.0781 1860        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:06:11.0890 1860        Rasl2tp - ok
17:06:11.0906 1860        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:06:12.0015 1860        RasPppoe - ok
17:06:12.0031 1860        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:06:12.0093 1860        Raspti - ok
17:06:12.0187 1860        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:06:12.0265 1860        Rdbss - ok
17:06:12.0296 1860        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:06:12.0359 1860        RDPCDD - ok
17:06:12.0390 1860        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:06:12.0468 1860        rdpdr - ok
17:06:12.0515 1860        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
17:06:12.0546 1860        RDPWD - ok
17:06:12.0671 1860        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:06:12.0796 1860        redbook - ok
17:06:12.0843 1860        rimspci        (af213955c4d952c914620e8db0cd0cf7) C:\WINDOWS\system32\DRIVERS\rimspe86.sys
17:06:12.0859 1860        rimspci - ok
17:06:12.0875 1860        risdpcie        (85cba4b868a9daaa2dd5e3952f396982) C:\WINDOWS\system32\DRIVERS\risdpe86.sys
17:06:12.0890 1860        risdpcie - ok
17:06:12.0906 1860        rixdpcie        (764c1f3453e779724ba647327de7ddd4) C:\WINDOWS\system32\DRIVERS\rixdpe86.sys
17:06:12.0921 1860        rixdpcie - ok
17:06:12.0953 1860        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
17:06:13.0109 1860        sdbus - ok
17:06:13.0187 1860        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:06:13.0218 1860        Secdrv - ok
17:06:13.0250 1860        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
17:06:13.0375 1860        Serial - ok
17:06:13.0390 1860        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:06:13.0531 1860        Sfloppy - ok
17:06:13.0546 1860        Simbad - ok
17:06:13.0546 1860        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:06:13.0671 1860        SLIP - ok
17:06:13.0687 1860        Sparrow - ok
17:06:13.0718 1860        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
17:06:13.0828 1860        splitter - ok
17:06:13.0859 1860        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
17:06:13.0921 1860        sr - ok
17:06:14.0015 1860        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
17:06:14.0093 1860        Srv - ok
17:06:14.0125 1860        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:06:14.0265 1860        streamip - ok
17:06:14.0265 1860        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:06:14.0343 1860        swenum - ok
17:06:14.0375 1860        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
17:06:14.0437 1860        swmidi - ok
17:06:14.0437 1860        symc810 - ok
17:06:14.0453 1860        symc8xx - ok
17:06:14.0453 1860        sym_hi - ok
17:06:14.0468 1860        sym_u3 - ok
17:06:14.0484 1860        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
17:06:14.0546 1860        sysaudio - ok
17:06:14.0656 1860        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:06:14.0750 1860        Tcpip - ok
17:06:14.0765 1860        tdcmdpst        (2f8bfbdb5824c71f672779b4b8cf8b01) C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys
17:06:14.0828 1860        tdcmdpst - ok
17:06:14.0859 1860        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:06:15.0000 1860        TDPIPE - ok
17:06:15.0046 1860        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
17:06:15.0187 1860        TDTCP - ok
17:06:15.0218 1860        tdudf          (f56a9327c58ff985616c5e197472932c) C:\WINDOWS\system32\DRIVERS\tdudf.sys
17:06:15.0234 1860        tdudf - ok
17:06:15.0250 1860        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:06:15.0390 1860        TermDD - ok
17:06:15.0421 1860        Thpdrv          (e00f0f7e4d4412da2f1b82a873229e47) C:\WINDOWS\system32\DRIVERS\thpdrv.sys
17:06:15.0421 1860        Thpdrv - ok
17:06:15.0437 1860        Thpevm          (beeca51c9ef368a1038e455278e4715e) C:\WINDOWS\system32\DRIVERS\Thpevm.SYS
17:06:15.0453 1860        Thpevm - ok
17:06:15.0484 1860        TMEI3E          (684bfb1e9abb05d3f48c53f3cd16a3e6) C:\WINDOWS\system32\Drivers\TMEI3E.SYS
17:06:15.0515 1860        TMEI3E ( UnsignedFile.Multi.Generic ) - warning
17:06:15.0515 1860        TMEI3E - detected UnsignedFile.Multi.Generic (1)
17:06:15.0546 1860        TosIde - ok
17:06:15.0578 1860        Tosrfcom        (1ad9eb1b5abd0aeee4084c8153476f1e) C:\WINDOWS\system32\drivers\Tosrfcom.sys
17:06:15.0593 1860        Tosrfcom - ok
17:06:15.0625 1860        tosrfec        (9ee240f7029771b21cc6200be6516d60) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
17:06:15.0625 1860        tosrfec - ok
17:06:15.0640 1860        tos_sps32      (4399a9bf7d8f49991a07fd86590a1619) C:\WINDOWS\system32\DRIVERS\tos_sps32.sys
17:06:15.0656 1860        tos_sps32 - ok
17:06:15.0671 1860        trudf          (3f9ba8878aa26d0831116733f9bc53ff) C:\WINDOWS\system32\DRIVERS\trudf.sys
17:06:15.0703 1860        trudf - ok
17:06:15.0734 1860        TVALZ          (73d3312955f805054e32fabdca5230b1) C:\WINDOWS\system32\DRIVERS\TVALZ.SYS
17:06:15.0765 1860        TVALZ - ok
17:06:15.0796 1860        TVALZFL        (e03f5ca8d4edb4ce8141a3242e1261f8) C:\WINDOWS\system32\DRIVERS\TVALZFL.sys
17:06:15.0828 1860        TVALZFL ( UnsignedFile.Multi.Generic ) - warning
17:06:15.0828 1860        TVALZFL - detected UnsignedFile.Multi.Generic (1)
17:06:15.0859 1860        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
17:06:15.0968 1860        Udfs - ok
17:06:15.0984 1860        ultra - ok
17:06:16.0015 1860        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
17:06:16.0093 1860        Update - ok
17:06:16.0156 1860        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:06:16.0218 1860        usbccgp - ok
17:06:16.0234 1860        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:06:16.0312 1860        usbehci - ok
17:06:16.0328 1860        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:06:16.0390 1860        usbhub - ok
17:06:16.0421 1860        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:06:16.0500 1860        usbprint - ok
17:06:16.0546 1860        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:06:16.0593 1860        USBSTOR - ok
17:06:16.0609 1860        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
17:06:16.0671 1860        usbvideo - ok
17:06:16.0687 1860        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
17:06:16.0750 1860        VgaSave - ok
17:06:16.0750 1860        ViaIde - ok
17:06:16.0781 1860        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
17:06:16.0843 1860        VolSnap - ok
17:06:16.0859 1860        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:06:16.0937 1860        Wanarp - ok
17:06:16.0984 1860        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
17:06:17.0015 1860        Wdf01000 - ok
17:06:17.0078 1860        WDICA - ok
17:06:17.0125 1860        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
17:06:17.0203 1860        wdmaud - ok
17:06:17.0281 1860        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:06:17.0343 1860        WSTCODEC - ok
17:06:17.0390 1860        WudfPf          (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:06:17.0437 1860        WudfPf - ok
17:06:17.0484 1860        WudfRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:06:17.0515 1860        WudfRd - ok
17:06:17.0546 1860        xcpip - ok
17:06:17.0578 1860        xpsec - ok
17:06:17.0609 1860        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
17:06:17.0843 1860        \Device\Harddisk0\DR0 - ok
17:06:17.0859 1860        Boot (0x1200)  (d197ec57a47729b3667f4c56a4b6427b) \Device\Harddisk0\DR0\Partition0
17:06:17.0859 1860        \Device\Harddisk0\DR0\Partition0 - ok
17:06:17.0859 1860        ============================================================
17:06:17.0859 1860        Scan finished
17:06:17.0859 1860        ============================================================
17:06:17.0968 5936        Detected object count: 4
17:06:17.0968 5936        Actual detected object count: 4
17:06:22.0203 5936        Netdevio ( UnsignedFile.Multi.Generic ) - skipped by user
17:06:22.0203 5936        Netdevio ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:06:22.0203 5936        QsFsFltr ( UnsignedFile.Multi.Generic ) - skipped by user
17:06:22.0203 5936        QsFsFltr ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:06:22.0203 5936        TMEI3E ( UnsignedFile.Multi.Generic ) - skipped by user
17:06:22.0203 5936        TMEI3E ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:06:22.0203 5936        TVALZFL ( UnsignedFile.Multi.Generic ) - skipped by user
17:06:22.0203 5936        TVALZFL ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:06:24.0531 0304        Deinitialize success

cosinus 17.01.2012 21:25
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

borodin 19.01.2012 14:28
Hallo Arne,
ich habe Probleme, McAfee Internet Security (Toshiba-Lizensierung) abzuschalten. Recherche hierzu brachte nichts zu Tage. Kann ich ComboFix auch im abgesicherten Modus laufen lassen?
Besten Dank,
Jens

cosinus 19.01.2012 16:42
Ja geht notfalls auch. Ich würde dir aber eh empfehlen diese Suite nicht zu nutzen und daher zu deinstallieren. Reiner Virenscanner plus Windows-Firefall ist sinnvoller

borodin 20.01.2012 10:11
So, hier ist nun der log von ComboFix:

Code:
ComboFix 12-01-18.04 -  20.01.2012  7:21.1.4 - x86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3056.2741 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\ComboFix.exe
AV: McAfee  Anti-Virus und Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Installer\$PatchCache$\Managed\3706342866B54DD48A51342744051302\15.1.0\distributor.ini2
c:\windows\IsUn0407.exe
c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-20 bis 2012-01-20  ))))))))))))))))))))))))))))))
.
.
2012-01-14 14:09 . 2012-01-16 06:34        --------        d-----w-        c:\windows\LastGood
2012-01-13 20:09 . 2012-01-13 20:09        --------        d-----w-        C:\_OTL
2012-01-12 20:06 . 2012-01-12 20:06        --------        d-----w-        c:\programme\ESET
2012-01-11 13:30 . 2012-01-11 13:30        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-11 13:30 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-11 08:24 . 2008-04-13 23:10        36352        -c--a-w-        c:\windows\system32\dllcache\disk.sys
2012-01-11 08:24 . 2008-04-13 23:10        36352        ----a-w-        c:\windows\system32\drivers\disk.sys
2012-01-06 15:47 . 2008-04-14 12:00        15360        ----a-w-        c:\windows\system32\PJLMON.DLL
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2010-03-31 04:27        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2010-03-31 04:27        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2010-03-31 04:27        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2010-03-31 04:27        152064        ----a-w-        c:\windows\system32\schannel.dll
2011-11-14 16:10 . 2011-06-01 17:54        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-03 15:28 . 2010-03-31 04:27        387072        ----a-w-        c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2010-03-31 04:27        1297920        ----a-w-        c:\windows\system32\quartz.dll
2011-11-01 20:35 . 2010-03-31 04:27        672768        ----a-w-        c:\windows\system32\wininet.dll
2011-11-01 20:35 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\tdc.ocx
2011-11-01 20:35 . 2010-03-31 04:27        81920        ----a-w-        c:\windows\system32\ieencode.dll
2011-11-01 20:34 . 2010-03-31 04:27        371200        ----a-w-        c:\windows\system32\html.iec
2011-11-01 16:07 . 2010-03-31 04:27        1288704        ----a-w-        c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2010-03-31 04:27        33280        ----a-w-        c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2008-04-14 07:30        2029568        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-10-26 10:49 . 2008-04-14 07:29        2151424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-14 12:01 . 2010-09-17 10:03        24376        ----a-w-        c:\programme\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TSFPLOlayIcon]
@="{F4DD9208-8229-492D-BCBF-2955F7AC38F4}"
[HKEY_CLASSES_ROOT\CLSID\{F4DD9208-8229-492D-BCBF-2955F7AC38F4}]
2010-02-04 00:38        285504        ----a-w-        c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-02-24 385928]
"ANT Agent"="c:\programme\Garmin\ANT Agent\ANT Agent.exe" [2011-11-07 14767976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2009-06-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"Apoint"="c:\programme\Apoint2K\Apoint.exe" [2009-09-10 241664]
"TouchED"="c:\programme\TOSHIBA\TouchED\TouchED.exe" [2005-09-01 118784]
"TMERzCtl.EXE"="c:\programme\TOSHIBA\TME3\TMERzCtl.EXE" [2009-12-10 86016]
"TMESRV.EXE"="c:\programme\TOSHIBA\TME3\TMESRV31.EXE" [2009-11-20 118784]
"TNRotate"="c:\programme\TOSHIBA\TNRotate\TNRotate.exe" [2010-02-22 607616]
"SmoothView"="c:\programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe" [2009-08-31 143360]
"TosHKCW.exe"="c:\programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2009-07-02 225280]
"TUSBSleepChargeSrv"="c:\programme\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe" [2009-10-26 253312]
"DDWMon"="c:\programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IMSS"="c:\programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-09-30 111640]
"nwiz"="nwiz.exe" [2009-12-08 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-08 14786560]
"RTHDCPL"="RTHDCPL.EXE" [2009-11-02 18782720]
"TFncKy"="TFncKy.exe" [BU]
"ITSecMng"="c:\programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosSENotify"="c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 611672]
"TFNF5"="TFNF5.exe" [2010-02-02 1140032]
"TPSODDCtl"="TPSODDCtl.exe" [2009-11-23 118784]
"TPSMain"="TPSMain.exe" [2009-11-23 303104]
"TWebCamera"="c:\programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-12-09 2454840]
"TosWaitSrv"="c:\programme\TOSHIBA\TPHM\TosWaitSrv.exe" [2010-02-05 611672]
"ClientAppLogon"="c:\programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe" [2010-02-04 307008]
"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-08-08 611712]
"mcui_exe"="c:\programme\McAfee.com\Agent\mcagent.exe" [2011-11-22 1318816]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"QuiKProtect"="c:\programme\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]
"PrnStatusMX"="c:\programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\programme\real\realplayer\update\realsched.exe" [2011-10-26 273528]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Bluetooth Manager.lnk - c:\programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2010-1-6 2717024]
McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [29.06.2009 09:25 29760]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [11.05.2009 18:11 6528]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [01.06.2010 19:41 47104]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [01.06.2010 19:41 48128]
R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [01.06.2010 19:41 38400]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [30.04.2008 20:09 4992]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [31.03.2010 05:27 160424]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [14.10.2002 04:45 44800]
S1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [14.10.2002 05:24 5888]
S2 ATService;AuthenTec Fingerprint Service;c:\programme\Fingerprint Sensor\ATService.exe [16.11.2009 01:10 2034936]
S2 FPLService;TrueSuiteService;c:\programme\TrueSuite\TrueSuite.Service.exe [04.02.2010 01:38 108352]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [11.01.2012 14:30 652872]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\programme\McAfee\SiteAdvisor\McSACore.exe [14.10.2002 05:45 94880]
S2 QSCopyEngine;QSCopyEngine;c:\programme\Iomega\QuikProtect\QpMonitor.exe [24.06.2010 16:04 247088]
S2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26.03.2007 12:22 105856]
S2 Tmesrv;Tmesrv3;c:\programme\TOSHIBA\TME3\TMESRV31.exe [14.10.2002 05:24 118784]
S2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19.02.2007 12:15 134016]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [01.06.2010 19:31 2320920]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [01.06.2010 19:36 1684736]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [01.06.2010 19:47 671488]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [01.06.2010 19:36 132352]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.01.2012 14:30 20464]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [12.10.2009 22:33 57576]
S3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [01.06.2010 19:46 24064]
S3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [10.11.2010 21:00 13824]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [05.11.2009 08:15 111960]
S3 TPCHSrv;TPCH Service;c:\programme\TOSHIBA\TPHM\TPCHSrv.exe [05.02.2010 16:48 677232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [31.03.2010 05:27 14336]
S3 xcpip;TCP/IP-Protokolltreiber;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM        REG_MULTI_SZ          WINRM
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-19 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-19 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-04 20:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 141.2.22.74 141.2.149.10 141.2.86.211
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: McAfee SiteAdvisor: {4ED1F68A-5463-4931-9384-8FFF5ED91D92} - c:\programme\McAfee\SiteAdvisor
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-20 07:25
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(876)
c:\windows\system32\TrueSuite.GINA.dll
c:\windows\system32\AFSSClientLib.dll
c:\programme\TrueSuite\TrueSuite.MuiResource.dll
c:\programme\TrueSuite\TrueSuite.AUTH.dll
c:\programme\TrueSuite\TrueSuite.OAE.dll
c:\programme\TrueSuite\TrueSuite.TBAUtilities.dll
c:\programme\TrueSuite\NLog.dll
c:\programme\TrueSuite\TrueSuite.MuiDll.dll
.
Zeit der Fertigstellung: 2012-01-20  07:26:50
ComboFix-quarantined-files.txt  2012-01-20 06:26
.
Vor Suchlauf: 15 Verzeichnis(se), 244.232.851.456 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 244.384.272.384 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - CB4AEE3B60B1C63760C96011003490CE

cosinus 20.01.2012 12:25
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"=-
"5353:TCP"=-
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-

File::
c:\windows\system32\drivers\xcpip.sys
c:\windows\system32\drivers\xpsec.sys
       
Driver::
xcpip
xpsec
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

borodin 20.01.2012 14:43
Und der nächste log (auch im abgesichterten Modus lief McAfee):
Code:
ComboFix 12-01-18.04 -  20.01.2012  12:47:18.2.4 - x86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3056.2750 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\***\Desktop\CFScript.txt
AV: McAfee  Anti-Virus und Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-20 bis 2012-01-20  ))))))))))))))))))))))))))))))
.
.
2012-01-14 14:09 . 2012-01-16 06:34        --------        d-----w-        c:\windows\LastGood
2012-01-13 20:09 . 2012-01-13 20:09        --------        d-----w-        C:\_OTL
2012-01-12 20:06 . 2012-01-12 20:06        --------        d-----w-        c:\programme\ESET
2012-01-11 13:30 . 2012-01-11 13:30        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-11 13:30 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-11 08:24 . 2008-04-13 23:10        36352        -c--a-w-        c:\windows\system32\dllcache\disk.sys
2012-01-11 08:24 . 2008-04-13 23:10        36352        ----a-w-        c:\windows\system32\drivers\disk.sys
2012-01-06 15:47 . 2008-04-14 12:00        15360        ----a-w-        c:\windows\system32\PJLMON.DLL
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2010-03-31 04:27        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2010-03-31 04:27        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2010-03-31 04:27        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2010-03-31 04:27        152064        ----a-w-        c:\windows\system32\schannel.dll
2011-11-14 16:10 . 2011-06-01 17:54        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-03 15:28 . 2010-03-31 04:27        387072        ----a-w-        c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2010-03-31 04:27        1297920        ----a-w-        c:\windows\system32\quartz.dll
2011-11-01 20:35 . 2010-03-31 04:27        672768        ----a-w-        c:\windows\system32\wininet.dll
2011-11-01 20:35 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\tdc.ocx
2011-11-01 20:35 . 2010-03-31 04:27        81920        ----a-w-        c:\windows\system32\ieencode.dll
2011-11-01 20:34 . 2010-03-31 04:27        371200        ----a-w-        c:\windows\system32\html.iec
2011-11-01 16:07 . 2010-03-31 04:27        1288704        ----a-w-        c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2010-03-31 04:27        33280        ----a-w-        c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2008-04-14 07:30        2029568        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-10-26 10:49 . 2008-04-14 07:29        2151424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-14 12:01 . 2010-09-17 10:03        24376        ----a-w-        c:\programme\mozilla firefox\components\Scriptff.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-01-20_06.25.39  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-20 11:55 . 2012-01-20 11:55        53248              c:\windows\temp\catchme.dll
- 2012-01-20 06:25 . 2012-01-20 06:25        53248              c:\windows\temp\catchme.dll
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TSFPLOlayIcon]
@="{F4DD9208-8229-492D-BCBF-2955F7AC38F4}"
[HKEY_CLASSES_ROOT\CLSID\{F4DD9208-8229-492D-BCBF-2955F7AC38F4}]
2010-02-04 00:38        285504        ----a-w-        c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-02-24 385928]
"ANT Agent"="c:\programme\Garmin\ANT Agent\ANT Agent.exe" [2011-11-07 14767976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2009-06-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"Apoint"="c:\programme\Apoint2K\Apoint.exe" [2009-09-10 241664]
"TouchED"="c:\programme\TOSHIBA\TouchED\TouchED.exe" [2005-09-01 118784]
"TMERzCtl.EXE"="c:\programme\TOSHIBA\TME3\TMERzCtl.EXE" [2009-12-10 86016]
"TMESRV.EXE"="c:\programme\TOSHIBA\TME3\TMESRV31.EXE" [2009-11-20 118784]
"TNRotate"="c:\programme\TOSHIBA\TNRotate\TNRotate.exe" [2010-02-22 607616]
"SmoothView"="c:\programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe" [2009-08-31 143360]
"TosHKCW.exe"="c:\programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2009-07-02 225280]
"TUSBSleepChargeSrv"="c:\programme\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe" [2009-10-26 253312]
"DDWMon"="c:\programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IMSS"="c:\programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-09-30 111640]
"nwiz"="nwiz.exe" [2009-12-08 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-08 14786560]
"RTHDCPL"="RTHDCPL.EXE" [2009-11-02 18782720]
"TFncKy"="TFncKy.exe" [BU]
"ITSecMng"="c:\programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosSENotify"="c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 611672]
"TFNF5"="TFNF5.exe" [2010-02-02 1140032]
"TPSODDCtl"="TPSODDCtl.exe" [2009-11-23 118784]
"TPSMain"="TPSMain.exe" [2009-11-23 303104]
"TWebCamera"="c:\programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-12-09 2454840]
"TosWaitSrv"="c:\programme\TOSHIBA\TPHM\TosWaitSrv.exe" [2010-02-05 611672]
"ClientAppLogon"="c:\programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe" [2010-02-04 307008]
"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-08-08 611712]
"mcui_exe"="c:\programme\McAfee.com\Agent\mcagent.exe" [2011-11-22 1318816]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"QuiKProtect"="c:\programme\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]
"PrnStatusMX"="c:\programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\programme\real\realplayer\update\realsched.exe" [2011-10-26 273528]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Bluetooth Manager.lnk - c:\programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2010-1-6 2717024]
McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [29.06.2009 09:25 29760]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [11.05.2009 18:11 6528]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [01.06.2010 19:41 47104]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [01.06.2010 19:41 48128]
R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [01.06.2010 19:41 38400]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [30.04.2008 20:09 4992]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [31.03.2010 05:27 160424]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [14.10.2002 04:45 44800]
S1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [14.10.2002 05:24 5888]
S2 ATService;AuthenTec Fingerprint Service;c:\programme\Fingerprint Sensor\ATService.exe [16.11.2009 01:10 2034936]
S2 FPLService;TrueSuiteService;c:\programme\TrueSuite\TrueSuite.Service.exe [04.02.2010 01:38 108352]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [11.01.2012 14:30 652872]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\programme\McAfee\SiteAdvisor\McSACore.exe [14.10.2002 05:45 94880]
S2 QSCopyEngine;QSCopyEngine;c:\programme\Iomega\QuikProtect\QpMonitor.exe [24.06.2010 16:04 247088]
S2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26.03.2007 12:22 105856]
S2 Tmesrv;Tmesrv3;c:\programme\TOSHIBA\TME3\TMESRV31.exe [14.10.2002 05:24 118784]
S2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19.02.2007 12:15 134016]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [01.06.2010 19:31 2320920]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [01.06.2010 19:36 1684736]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [01.06.2010 19:47 671488]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [01.06.2010 19:36 132352]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.01.2012 14:30 20464]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [12.10.2009 22:33 57576]
S3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [01.06.2010 19:46 24064]
S3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [10.11.2010 21:00 13824]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [05.11.2009 08:15 111960]
S3 TPCHSrv;TPCH Service;c:\programme\TOSHIBA\TPHM\TPCHSrv.exe [05.02.2010 16:48 677232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [31.03.2010 05:27 14336]
S3 xcpip;TCP/IP-Protokolltreiber;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM        REG_MULTI_SZ          WINRM
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-20 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-20 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-20 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-04 20:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 141.2.22.74 141.2.149.10 141.2.86.211
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: McAfee SiteAdvisor: {4ED1F68A-5463-4931-9384-8FFF5ED91D92} - c:\programme\McAfee\SiteAdvisor
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-20 12:55
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(872)
c:\windows\system32\TrueSuite.GINA.dll
c:\windows\system32\AFSSClientLib.dll
c:\programme\TrueSuite\TrueSuite.MuiResource.dll
c:\programme\TrueSuite\TrueSuite.AUTH.dll
c:\programme\TrueSuite\TrueSuite.OAE.dll
c:\programme\TrueSuite\TrueSuite.TBAUtilities.dll
c:\programme\TrueSuite\NLog.dll
c:\programme\TrueSuite\TrueSuite.MuiDll.dll
.
- - - - - - - > 'Explorer.exe'(1948)
c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
Zeit der Fertigstellung: 2012-01-20  12:56:09
ComboFix-quarantined-files.txt  2012-01-20 11:56
ComboFix2.txt  2012-01-20 06:26
.
Vor Suchlauf: 15 Verzeichnis(se), 244.319.555.584 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 244.303.568.896 Bytes frei
.
- - End Of File - - C68F55B1E045E3079112AF6BA2CE746B

cosinus 20.01.2012 21:03
Also irgendwie war das nichts :wtf:
Hast du alles so in die CFScript.txt kopiert wie es sollte?
Wiederhol das bitte. Wenn's geht im normalen Modus

borodin 21.01.2012 12:35
Hallo Arne,
habe wahrscheinlich wieder den gleichen log.
Ich schaffe es nicht, McAfee abzuschalten. Soll ich die Suite deinstallieren und dann noch einmal alles laufen lassen?
Anbei der log:

Code:
ComboFix 12-01-19.02 -  21.01.2012  12:21:46.3.4 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3056.2085 [GMT 1:00]
ausgeführt von:: c:\combofix\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\***\Desktop\CFScript.txt
AV: McAfee  Anti-Virus und Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-21 bis 2012-01-21  ))))))))))))))))))))))))))))))
.
.
2012-01-14 14:09 . 2012-01-16 06:34        --------        d-----w-        c:\windows\LastGood
2012-01-13 20:09 . 2012-01-13 20:09        --------        d-----w-        C:\_OTL
2012-01-12 20:06 . 2012-01-12 20:06        --------        d-----w-        c:\programme\ESET
2012-01-11 13:30 . 2012-01-11 13:30        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-11 13:30 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-11 08:24 . 2008-04-13 23:10        36352        -c--a-w-        c:\windows\system32\dllcache\disk.sys
2012-01-11 08:24 . 2008-04-13 23:10        36352        ----a-w-        c:\windows\system32\drivers\disk.sys
2012-01-06 15:47 . 2008-04-14 12:00        15360        ----a-w-        c:\windows\system32\PJLMON.DLL
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2010-03-31 04:27        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2010-03-31 04:27        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2010-03-31 04:27        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2010-03-31 04:27        152064        ----a-w-        c:\windows\system32\schannel.dll
2011-11-14 16:10 . 2011-06-01 17:54        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-03 15:28 . 2010-03-31 04:27        387072        ----a-w-        c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2010-03-31 04:27        1297920        ----a-w-        c:\windows\system32\quartz.dll
2011-11-01 20:35 . 2010-03-31 04:27        672768        ----a-w-        c:\windows\system32\wininet.dll
2011-11-01 20:35 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\tdc.ocx
2011-11-01 20:35 . 2010-03-31 04:27        81920        ----a-w-        c:\windows\system32\ieencode.dll
2011-11-01 20:34 . 2010-03-31 04:27        371200        ----a-w-        c:\windows\system32\html.iec
2011-11-01 16:07 . 2010-03-31 04:27        1288704        ----a-w-        c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2010-03-31 04:27        33280        ----a-w-        c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2008-04-14 07:30        2029568        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-10-26 10:49 . 2008-04-14 07:29        2151424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-14 12:01 . 2010-09-17 10:03        24376        ----a-w-        c:\programme\mozilla firefox\components\Scriptff.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-01-20_06.25.39  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-20 13:37 . 2012-01-20 13:37        16384              c:\windows\temp\Perflib_Perfdata_784.dat
+ 2012-01-21 11:29 . 2012-01-21 11:29        53248              c:\windows\temp\catchme.dll
- 2012-01-20 06:25 . 2012-01-20 06:25        53248              c:\windows\temp\catchme.dll
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TSFPLOlayIcon]
@="{F4DD9208-8229-492D-BCBF-2955F7AC38F4}"
[HKEY_CLASSES_ROOT\CLSID\{F4DD9208-8229-492D-BCBF-2955F7AC38F4}]
2010-02-04 00:38        285504        ----a-w-        c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-02-24 385928]
"ANT Agent"="c:\programme\Garmin\ANT Agent\ANT Agent.exe" [2011-11-07 14767976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2009-06-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"Apoint"="c:\programme\Apoint2K\Apoint.exe" [2009-09-10 241664]
"TouchED"="c:\programme\TOSHIBA\TouchED\TouchED.exe" [2005-09-01 118784]
"TMERzCtl.EXE"="c:\programme\TOSHIBA\TME3\TMERzCtl.EXE" [2009-12-10 86016]
"TMESRV.EXE"="c:\programme\TOSHIBA\TME3\TMESRV31.EXE" [2009-11-20 118784]
"TNRotate"="c:\programme\TOSHIBA\TNRotate\TNRotate.exe" [2010-02-22 607616]
"SmoothView"="c:\programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe" [2009-08-31 143360]
"TosHKCW.exe"="c:\programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2009-07-02 225280]
"TUSBSleepChargeSrv"="c:\programme\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe" [2009-10-26 253312]
"DDWMon"="c:\programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IMSS"="c:\programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-09-30 111640]
"nwiz"="nwiz.exe" [2009-12-08 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-08 14786560]
"RTHDCPL"="RTHDCPL.EXE" [2009-11-02 18782720]
"TFncKy"="TFncKy.exe" [BU]
"ITSecMng"="c:\programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosSENotify"="c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 611672]
"TFNF5"="TFNF5.exe" [2010-02-02 1140032]
"TPSODDCtl"="TPSODDCtl.exe" [2009-11-23 118784]
"TPSMain"="TPSMain.exe" [2009-11-23 303104]
"TWebCamera"="c:\programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-12-09 2454840]
"TosWaitSrv"="c:\programme\TOSHIBA\TPHM\TosWaitSrv.exe" [2010-02-05 611672]
"ClientAppLogon"="c:\programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe" [2010-02-04 307008]
"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-08-08 611712]
"mcui_exe"="c:\programme\McAfee.com\Agent\mcagent.exe" [2011-11-22 1318816]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"QuiKProtect"="c:\programme\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]
"PrnStatusMX"="c:\programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\programme\real\realplayer\update\realsched.exe" [2011-10-26 273528]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Bluetooth Manager.lnk - c:\programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2010-1-6 2717024]
McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [29.06.2009 09:25 29760]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [11.05.2009 18:11 6528]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [14.10.2002 05:24 5888]
R2 ATService;AuthenTec Fingerprint Service;c:\programme\Fingerprint Sensor\ATService.exe [16.11.2009 01:10 2034936]
R2 FPLService;TrueSuiteService;c:\programme\TrueSuite\TrueSuite.Service.exe [04.02.2010 01:38 108352]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [11.01.2012 14:30 652872]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\programme\McAfee\SiteAdvisor\McSACore.exe [14.10.2002 05:45 94880]
R2 QSCopyEngine;QSCopyEngine;c:\programme\Iomega\QuikProtect\QpMonitor.exe [24.06.2010 16:04 247088]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [01.06.2010 19:41 47104]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [01.06.2010 19:41 48128]
R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [01.06.2010 19:41 38400]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26.03.2007 12:22 105856]
R2 Tmesrv;Tmesrv3;c:\programme\TOSHIBA\TME3\TMESRV31.exe [14.10.2002 05:24 118784]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19.02.2007 12:15 134016]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [30.04.2008 20:09 4992]
R2 UNS;Intel(R) Management & Security Application User Notification Service;c:\programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [01.06.2010 19:31 2320920]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [01.06.2010 19:47 671488]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [31.03.2010 05:27 160424]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [14.10.2002 04:45 44800]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [01.06.2010 19:36 132352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.01.2012 14:30 20464]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [12.10.2009 22:33 57576]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [01.06.2010 19:46 24064]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [05.11.2009 08:15 111960]
R3 TPCHSrv;TPCH Service;c:\programme\TOSHIBA\TPHM\TPCHSrv.exe [05.02.2010 16:48 677232]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [01.06.2010 19:36 1684736]
S3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [10.11.2010 21:00 13824]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [31.03.2010 05:27 14336]
S3 xcpip;TCP/IP-Protokolltreiber;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM        REG_MULTI_SZ          WINRM
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-21 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-21 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-20 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-04 20:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: McAfee SiteAdvisor: {4ED1F68A-5463-4931-9384-8FFF5ED91D92} - c:\programme\McAfee\SiteAdvisor
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-21 12:29
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(996)
c:\windows\system32\TrueSuite.GINA.dll
c:\windows\system32\AFSSClientLib.dll
c:\programme\TrueSuite\TrueSuite.MuiResource.dll
c:\programme\TrueSuite\TrueSuite.AUTH.dll
c:\programme\TrueSuite\TrueSuite.OAE.dll
c:\programme\TrueSuite\TrueSuite.TBAUtilities.dll
c:\programme\TrueSuite\NLog.dll
c:\programme\TrueSuite\TrueSuite.MuiDll.dll
c:\programme\TrueSuite\TrueSuite.EDS.dll
c:\programme\TrueSuite\Authentec.DotNetClientLib.dll
c:\programme\TrueSuite\en-US\TrueSuite.AUTH.resources.dll
c:\programme\TrueSuite\AT7Support.dll
c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
c:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
.
- - - - - - - > 'Explorer.exe'(7492)
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
c:\programme\TOSHIBA\TME3\TMEEJMD.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
Zeit der Fertigstellung: 2012-01-21  12:30:46
ComboFix-quarantined-files.txt  2012-01-21 11:30
ComboFix2.txt  2012-01-20 13:44
ComboFix3.txt  2012-01-20 06:26
.
Vor Suchlauf: 15 Verzeichnis(se), 241.161.080.832 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 241.150.959.616 Bytes frei
.
- - End Of File - - 594632290B91DBAB65FC304C7455E03E
Besten Dank im Voraus und ein schönes Wochenende wünscht
Jens

cosinus 23.01.2012 11:32
Zitat:
McAfee abzuschalten. Soll ich die Suite deinstallieren und dann noch einmal alles laufen lassen?
Ja deinstallier den Unsinn mal. Eine Suite ist eh kontraproduktiver Mist.

borodin 25.01.2012 07:24
So, nach Deistallation und Neustart meledete ComboFix wieder McAfee. Lief aber weiter. Allerdings mit "eingeschränkter Funktionalität", da es "abgelaufen" sei.

Hier ist ist der log:
Code:
ComboFix 12-01-18.04 -  24.01.2012  21:56:50.4.4 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3056.2226 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\***\Desktop\CFScript.txt
AV: McAfee  Anti-Virus und Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
- REDUZIERTER FUNKTIONALITÄTSMODUS -
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Temp\log.txt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-24 bis 2012-01-24  ))))))))))))))))))))))))))))))
.
.
2012-01-24 12:23 . 2012-01-24 12:24        --------        d-----w-        c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\ScreeNet iSaver
2012-01-24 12:23 . 2012-01-24 12:24        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\ScreeNet iSaver
2012-01-24 12:23 . 2012-01-24 12:23        --------        d-----w-        c:\programme\iSaver
2012-01-14 14:09 . 2012-01-16 06:34        --------        d-----w-        c:\windows\LastGood
2012-01-13 20:09 . 2012-01-13 20:09        --------        d-----w-        C:\_OTL
2012-01-12 20:06 . 2012-01-12 20:06        --------        d-----w-        c:\programme\ESET
2012-01-11 13:30 . 2012-01-11 13:30        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-11 13:30 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-11 08:24 . 2008-04-13 23:10        36352        -c--a-w-        c:\windows\system32\dllcache\disk.sys
2012-01-11 08:24 . 2008-04-13 23:10        36352        ----a-w-        c:\windows\system32\drivers\disk.sys
2012-01-06 15:47 . 2008-04-14 12:00        15360        ----a-w-        c:\windows\system32\PJLMON.DLL
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2010-03-31 04:27        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2010-03-31 04:27        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2010-03-31 04:27        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2010-03-31 04:27        152064        ----a-w-        c:\windows\system32\schannel.dll
2011-11-14 16:10 . 2011-06-01 17:54        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-03 15:28 . 2010-03-31 04:27        387072        ----a-w-        c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2010-03-31 04:27        1297920        ----a-w-        c:\windows\system32\quartz.dll
2011-11-01 20:35 . 2010-03-31 04:27        672768        ----a-w-        c:\windows\system32\wininet.dll
2011-11-01 20:35 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\tdc.ocx
2011-11-01 20:35 . 2010-03-31 04:27        81920        ----a-w-        c:\windows\system32\ieencode.dll
2011-11-01 20:34 . 2010-03-31 04:27        371200        ----a-w-        c:\windows\system32\html.iec
2011-11-01 16:07 . 2010-03-31 04:27        1288704        ----a-w-        c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2010-03-31 04:27        33280        ----a-w-        c:\windows\system32\csrsrv.dll
2011-04-14 12:01 . 2010-09-17 10:03        24376        ----a-w-        c:\programme\mozilla firefox\components\Scriptff.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-01-20_06.25.39  )))))))))))))))))))))))))))))))))))))))))
.
+ 1601-01-01 00:00 . 1601-01-01 00:00        0              c:\windows\temp\catchme.dll
+ 2012-01-24 20:52 . 2012-01-24 20:52        16384              c:\windows\temp\Perflib_Perfdata_6a8.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TSFPLOlayIcon]
@="{F4DD9208-8229-492D-BCBF-2955F7AC38F4}"
[HKEY_CLASSES_ROOT\CLSID\{F4DD9208-8229-492D-BCBF-2955F7AC38F4}]
2010-02-04 00:38        285504        ----a-w-        c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-02-24 385928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2009-06-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"Apoint"="c:\programme\Apoint2K\Apoint.exe" [2009-09-10 241664]
"TouchED"="c:\programme\TOSHIBA\TouchED\TouchED.exe" [2005-09-01 118784]
"TMERzCtl.EXE"="c:\programme\TOSHIBA\TME3\TMERzCtl.EXE" [2009-12-10 86016]
"TMESRV.EXE"="c:\programme\TOSHIBA\TME3\TMESRV31.EXE" [2009-11-20 118784]
"TNRotate"="c:\programme\TOSHIBA\TNRotate\TNRotate.exe" [2010-02-22 607616]
"SmoothView"="c:\programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe" [2009-08-31 143360]
"TosHKCW.exe"="c:\programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2009-07-02 225280]
"TUSBSleepChargeSrv"="c:\programme\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe" [2009-10-26 253312]
"DDWMon"="c:\programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IMSS"="c:\programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-09-30 111640]
"nwiz"="nwiz.exe" [2009-12-08 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-08 14786560]
"RTHDCPL"="RTHDCPL.EXE" [2009-11-02 18782720]
"TFncKy"="TFncKy.exe" [BU]
"ITSecMng"="c:\programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosSENotify"="c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 611672]
"TFNF5"="TFNF5.exe" [2010-02-02 1140032]
"TPSODDCtl"="TPSODDCtl.exe" [2009-11-23 118784]
"TPSMain"="TPSMain.exe" [2009-11-23 303104]
"TWebCamera"="c:\programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-12-09 2454840]
"TosWaitSrv"="c:\programme\TOSHIBA\TPHM\TosWaitSrv.exe" [2010-02-05 611672]
"ClientAppLogon"="c:\programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe" [2010-02-04 307008]
"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-08-08 611712]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"QuiKProtect"="c:\programme\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]
"PrnStatusMX"="c:\programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\programme\real\realplayer\update\realsched.exe" [2011-10-26 273528]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
"iSaverCtrl"="c:\programme\iSaver\iSaverCtrl.exe" [2008-07-07 1142784]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Bluetooth Manager.lnk - c:\programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2010-1-6 2717024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [29.06.2009 09:25 29760]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [11.05.2009 18:11 6528]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [14.10.2002 05:24 5888]
R2 ATService;AuthenTec Fingerprint Service;c:\programme\Fingerprint Sensor\ATService.exe [16.11.2009 01:10 2034936]
R2 FPLService;TrueSuiteService;c:\programme\TrueSuite\TrueSuite.Service.exe [04.02.2010 01:38 108352]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [11.01.2012 14:30 652872]
R2 QSCopyEngine;QSCopyEngine;c:\programme\Iomega\QuikProtect\QpMonitor.exe [24.06.2010 16:04 247088]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [01.06.2010 19:41 47104]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [01.06.2010 19:41 48128]
R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [01.06.2010 19:41 38400]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26.03.2007 12:22 105856]
R2 Tmesrv;Tmesrv3;c:\programme\TOSHIBA\TME3\TMESRV31.exe [14.10.2002 05:24 118784]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19.02.2007 12:15 134016]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [30.04.2008 20:09 4992]
R2 UNS;Intel(R) Management & Security Application User Notification Service;c:\programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [01.06.2010 19:31 2320920]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [01.06.2010 19:47 671488]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [31.03.2010 05:27 160424]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [14.10.2002 04:45 44800]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [01.06.2010 19:36 132352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.01.2012 14:30 20464]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [12.10.2009 22:33 57576]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [01.06.2010 19:46 24064]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [05.11.2009 08:15 111960]
R3 TPCHSrv;TPCH Service;c:\programme\TOSHIBA\TPHM\TPCHSrv.exe [05.02.2010 16:48 677232]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [01.06.2010 19:36 1684736]
S3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [10.11.2010 21:00 13824]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [31.03.2010 05:27 14336]
S3 xcpip;TCP/IP-Protokolltreiber;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM        REG_MULTI_SZ          WINRM
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-24 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-04 20:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-McAfee Update - c:\windows\TEMP\mcupdate_1327437487.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-24 21:59
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(968)
c:\windows\system32\TrueSuite.GINA.dll
c:\windows\system32\AFSSClientLib.dll
c:\programme\TrueSuite\TrueSuite.MuiResource.dll
c:\programme\TrueSuite\TrueSuite.AUTH.dll
c:\programme\TrueSuite\TrueSuite.OAE.dll
c:\programme\TrueSuite\TrueSuite.TBAUtilities.dll
c:\programme\TrueSuite\NLog.dll
c:\programme\TrueSuite\TrueSuite.MuiDll.dll
c:\programme\TrueSuite\TrueSuite.EDS.dll
c:\programme\TrueSuite\Authentec.DotNetClientLib.dll
c:\programme\TrueSuite\en-US\TrueSuite.AUTH.resources.dll
c:\programme\TrueSuite\AT7Support.dll
c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
.
Zeit der Fertigstellung: 2012-01-24  22:00:51
ComboFix-quarantined-files.txt  2012-01-24 21:00
ComboFix2.txt  2012-01-21 11:30
ComboFix3.txt  2012-01-20 13:44
ComboFix4.txt  2012-01-20 06:26
.
Vor Suchlauf: 15 Verzeichnis(se), 241.346.019.328 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 241.350.361.088 Bytes frei
.
- - End Of File - - D62154094CBAD19B2A9F92F427039887
Vielen Dank,
Jens

p.s.: welche Antivirus-Software empfiehlst Du anstelle von McAfee?

cosinus 25.01.2012 11:04
Zitat:
Allerdings mit "eingeschränkter Funktionalität", da es "abgelaufen" sei.
Dann musst du CF neu runterladen und nochmal ausführen...

borodin 25.01.2012 11:52
OK, noch mal ComboFix heruntergeladen und ausgeführt. Trotz Deinstallation über Systemsteuerung scheint der Geist von McAfee noch über dem PC zu schweben.

Hier ist das Log

Code:
ComboFix 12-01-23.02 -  25.01.2012  11:35:27.5.4 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3056.2137 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\***\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: C:\Dokumente und Einstellungen\***\Desktop\CFScript.txt
AV: McAfee  Anti-Virus und Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\windows\system32\drivers\xcpip.sys"
"c:\windows\system32\drivers\xpsec.sys"

Gruß,
Jens

cosinus 25.01.2012 12:26
Dann probier es bitte im abgesicherten Modus mit Netzwerktreibern

borodin 25.01.2012 13:52
So, nun der log, abgesichert+Netzwerktreiber:
Code:
ComboFix 12-01-23.02 -  25.01.2012  12:38:12.6.4 - x86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3056.2736 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\ComboFix.exe
AV: McAfee  Anti-Virus und Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_xcpip
-------\Service_xpsec
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-25 bis 2012-01-25  ))))))))))))))))))))))))))))))
.
.
2012-01-24 12:23 . 2012-01-24 12:24        --------        d-----w-        c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\ScreeNet iSaver
2012-01-24 12:23 . 2012-01-24 12:24        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\ScreeNet iSaver
2012-01-24 12:23 . 2012-01-24 12:23        --------        d-----w-        c:\programme\iSaver
2012-01-14 14:09 . 2012-01-16 06:34        --------        d-----w-        c:\windows\LastGood
2012-01-13 20:09 . 2012-01-13 20:09        --------        d-----w-        C:\_OTL
2012-01-12 20:06 . 2012-01-12 20:06        --------        d-----w-        c:\programme\ESET
2012-01-11 13:30 . 2012-01-11 13:30        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-11 13:30 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2012-01-11 13:15 . 2012-01-11 13:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-11 08:24 . 2008-04-13 23:10        36352        -c--a-w-        c:\windows\system32\dllcache\disk.sys
2012-01-11 08:24 . 2008-04-13 23:10        36352        ----a-w-        c:\windows\system32\drivers\disk.sys
2012-01-06 15:47 . 2008-04-14 12:00        15360        ----a-w-        c:\windows\system32\PJLMON.DLL
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2010-03-31 04:27        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2010-03-31 04:27        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2010-03-31 04:27        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2010-03-31 04:27        152064        ----a-w-        c:\windows\system32\schannel.dll
2011-11-14 16:10 . 2011-06-01 17:54        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-03 15:28 . 2010-03-31 04:27        387072        ----a-w-        c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2010-03-31 04:27        1297920        ----a-w-        c:\windows\system32\quartz.dll
2011-11-01 20:35 . 2010-03-31 04:27        672768        ----a-w-        c:\windows\system32\wininet.dll
2011-11-01 20:35 . 2010-03-31 04:27        61952        ----a-w-        c:\windows\system32\tdc.ocx
2011-11-01 20:35 . 2010-03-31 04:27        81920        ----a-w-        c:\windows\system32\ieencode.dll
2011-11-01 20:34 . 2010-03-31 04:27        371200        ----a-w-        c:\windows\system32\html.iec
2011-11-01 16:07 . 2010-03-31 04:27        1288704        ----a-w-        c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2010-03-31 04:27        33280        ----a-w-        c:\windows\system32\csrsrv.dll
2011-04-14 12:01 . 2010-09-17 10:03        24376        ----a-w-        c:\programme\mozilla firefox\components\Scriptff.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-01-20_06.25.39  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-25 11:45 . 2012-01-25 11:45        53248              c:\windows\temp\catchme.dll
- 2012-01-20 06:25 . 2012-01-20 06:25        53248              c:\windows\temp\catchme.dll
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TSFPLOlayIcon]
@="{F4DD9208-8229-492D-BCBF-2955F7AC38F4}"
[HKEY_CLASSES_ROOT\CLSID\{F4DD9208-8229-492D-BCBF-2955F7AC38F4}]
2010-02-04 00:38        285504        ----a-w-        c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
"NokiaOviSuite2"="c:\programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-02-24 385928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2009-06-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"Apoint"="c:\programme\Apoint2K\Apoint.exe" [2009-09-10 241664]
"TouchED"="c:\programme\TOSHIBA\TouchED\TouchED.exe" [2005-09-01 118784]
"TMERzCtl.EXE"="c:\programme\TOSHIBA\TME3\TMERzCtl.EXE" [2009-12-10 86016]
"TMESRV.EXE"="c:\programme\TOSHIBA\TME3\TMESRV31.EXE" [2009-11-20 118784]
"TNRotate"="c:\programme\TOSHIBA\TNRotate\TNRotate.exe" [2010-02-22 607616]
"SmoothView"="c:\programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe" [2009-08-31 143360]
"TosHKCW.exe"="c:\programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2009-07-02 225280]
"TUSBSleepChargeSrv"="c:\programme\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe" [2009-10-26 253312]
"DDWMon"="c:\programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IMSS"="c:\programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-09-30 111640]
"nwiz"="nwiz.exe" [2009-12-08 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-08 14786560]
"RTHDCPL"="RTHDCPL.EXE" [2009-11-02 18782720]
"TFncKy"="TFncKy.exe" [BU]
"ITSecMng"="c:\programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosSENotify"="c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 611672]
"TFNF5"="TFNF5.exe" [2010-02-02 1140032]
"TPSODDCtl"="TPSODDCtl.exe" [2009-11-23 118784]
"TPSMain"="TPSMain.exe" [2009-11-23 303104]
"TWebCamera"="c:\programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-12-09 2454840]
"TosWaitSrv"="c:\programme\TOSHIBA\TPHM\TosWaitSrv.exe" [2010-02-05 611672]
"ClientAppLogon"="c:\programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe" [2010-02-04 307008]
"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-08-08 611712]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"QuiKProtect"="c:\programme\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]
"PrnStatusMX"="c:\programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1077248]
"TkBellExe"="c:\programme\real\realplayer\update\realsched.exe" [2011-10-26 273528]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
"iSaverCtrl"="c:\programme\iSaver\iSaverCtrl.exe" [2008-07-07 1142784]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"TOSHIBA Online Product Information"="c:\programme\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Bluetooth Manager.lnk - c:\programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2010-1-6 2717024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Programme\\Iomega\\QuikProtect\\QuikProtect.exe"=
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [29.06.2009 09:25 29760]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [11.05.2009 18:11 6528]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [01.06.2010 19:41 47104]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [01.06.2010 19:41 48128]
R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [01.06.2010 19:41 38400]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [30.04.2008 20:09 4992]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [31.03.2010 05:27 160424]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [14.10.2002 04:45 44800]
S1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [14.10.2002 05:24 5888]
S2 ATService;AuthenTec Fingerprint Service;c:\programme\Fingerprint Sensor\ATService.exe [16.11.2009 01:10 2034936]
S2 FPLService;TrueSuiteService;c:\programme\TrueSuite\TrueSuite.Service.exe [04.02.2010 01:38 108352]
S2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [11.01.2012 14:30 652872]
S2 QSCopyEngine;QSCopyEngine;c:\programme\Iomega\QuikProtect\QpMonitor.exe [24.06.2010 16:04 247088]
S2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26.03.2007 12:22 105856]
S2 Tmesrv;Tmesrv3;c:\programme\TOSHIBA\TME3\TMESRV31.exe [14.10.2002 05:24 118784]
S2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19.02.2007 12:15 134016]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [01.06.2010 19:31 2320920]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [01.06.2010 19:36 1684736]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [01.06.2010 19:47 671488]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [01.06.2010 19:36 132352]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.01.2012 14:30 20464]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [12.10.2009 22:33 57576]
S3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [01.06.2010 19:46 24064]
S3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [10.11.2010 21:00 13824]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [05.11.2009 08:15 111960]
S3 TPCHSrv;TPCH Service;c:\programme\TOSHIBA\TPHM\TPCHSrv.exe [05.02.2010 16:48 677232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [31.03.2010 05:27 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM        REG_MULTI_SZ          WINRM
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2011-09-27 17:40]
.
2012-01-25 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-04 20:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 141.2.22.74 141.2.149.10 141.2.86.211
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\pckhf0tx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-25 12:45
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(868)
c:\windows\system32\TrueSuite.GINA.dll
c:\windows\system32\AFSSClientLib.dll
c:\programme\TrueSuite\TrueSuite.MuiResource.dll
c:\programme\TrueSuite\TrueSuite.AUTH.dll
c:\programme\TrueSuite\TrueSuite.OAE.dll
c:\programme\TrueSuite\TrueSuite.TBAUtilities.dll
c:\programme\TrueSuite\NLog.dll
c:\programme\TrueSuite\TrueSuite.MuiDll.dll
c:\programme\TrueSuite\TrueSuite.EDS.dll
c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
c:\programme\TrueSuite\Authentec.DotNetClientLib.dll
c:\programme\TrueSuite\en-US\TrueSuite.AUTH.resources.dll
.
- - - - - - - > 'Explorer.exe'(1620)
c:\programme\TrueSuite\TrueSuite.FPLOlayIcon.dll
.
Zeit der Fertigstellung: 2012-01-25  12:46:52
ComboFix-quarantined-files.txt  2012-01-25 11:46
ComboFix2.txt  2012-01-24 21:00
ComboFix3.txt  2012-01-21 11:30
ComboFix4.txt  2012-01-20 13:44
ComboFix5.txt  2012-01-25 10:34
.
Vor Suchlauf: 15 Verzeichnis(se), 244.697.735.168 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 244.681.768.960 Bytes frei
.
- - End Of File - - 6C8958CEE17C3950E1A257B0B0B0770E
Gruß, Jens (:killpc:)

cosinus 25.01.2012 13:53
Mach wieder weiter im normalen Modus

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

borodin 27.01.2012 08:10
Guten Morgen Arne,
anbei die neuesten logs:

1. GMER
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-26 06:06:05
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PC3O
Running: s0ifz8bb.exe; Driver: C:\WINDOWS\TEMP\kwdyqpob.sys


---- Kernel code sections - GMER 1.0.15 ----

.text  C:\WINDOWS\system32\drivers\tos_sps32.sys                                                                                        section is writeable [0xB7C29480, 0x3C939, 0xE8000020]
.dsrt  C:\WINDOWS\system32\drivers\tos_sps32.sys                                                                                        unknown last section [0xB7C6A900, 0x3CA, 0x48000040]
.text  C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                          section is writeable [0xB7376380, 0x3E5D65, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text  C:\programme\real\realplayer\update\realsched.exe[2752] kernel32.dll!SetUnhandledExceptionFilter                                  7C84495D 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Registry - GMER 1.0.15 ----

Reg    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\ContentTypeSniffers\VideoFilesContentSniffer@RelPattern  *.asf?*.avi?*.divx?*.mov?*.mpeg?*.mpg?*.ogm?*.qt?*.rm?*.wmv?*.mkv?*.vob?*.m1v?*.m2v?*.swf?*.fli?*.flc?*.flic?*.dat?*.mp4?*.mpe?*.3gp?*.3g2?*.ts?*.tp?*.trp?*.k3g?*.flv?*.m4v?*.mpg?VIDEO\*.mpg?*.

---- Disk sectors - GMER 1.0.15 ----

Disk  \Device\Harddisk0\DR0                                                                                                            malicious Win32:MBRoot code @ sector 625137348

---- EOF - GMER 1.0.15 ----
2. OSAM
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:56:29 on 26.01.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.8

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"RealUpgradeLogonTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job" - "RealNetworks, Inc." - C:\Programme\Real\RealUpgrade\realupgrade.exe
"RealUpgradeScheduledTaskS-1-5-21-3823346913-4111906814-4157629624-1005.job" - "RealNetworks, Inc." - C:\Programme\Real\RealUpgrade\realupgrade.exe
"WGASetup.job" - "Microsoft Corporation" - C:\WINDOWS\system32\KB905474\wgasetup.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"Hwsetup.cpl" - "TOSHIBA Corp." - C:\WINDOWS\system32\Hwsetup.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
"tmeprop.cpl" - "TOSHIBA Corp." - C:\WINDOWS\system32\tmeprop.cpl
"TPwrSave.cpl" - "TOSHIBA Corporation" - C:\WINDOWS\system32\TPwrSave.cpl
"TUSBSleepCharge.cpl" - "TOSHIBA" - C:\WINDOWS\system32\TUSBSleepCharge.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
"TosBtLocalCOM" - "TOSHIBA CORPORATION" - C:\Programme\Toshiba\Bluetooth Toshiba Stack\sys\LocalCOM.cpl
"ToshSrv" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA Controls\ToshSrv.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"adfs" (adfs) - "Adobe Systems, Inc." - C:\WINDOWS\system32\drivers\adfs.sys
"catchme" (catchme) - ? - C:\WINDOWS\TEMP\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"McAfee Inc. mferkdk" (mferkdk) - ? - C:\WINDOWS\System32\drivers\mferkdk.sys  (File not found)
"McAfee Inc. mfesmfk" (mfesmfk) - ? - C:\WINDOWS\System32\drivers\mfesmfk.sys  (File not found)
"MPFP" (MPFP) - ? - C:\WINDOWS\System32\Drivers\Mpfp.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"QsFsFltr" (QsFsFltr) - "Windows (R) Codename Longhorn DDK provider" - C:\WINDOWS\System32\DRIVERS\QsFsFltr.sys
"TMEI3E" (TMEI3E) - "Toshiba Corporation" - C:\WINDOWS\System32\Drivers\TMEI3E.SYS
"TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver" (TVALZFL) - "TOSHIBA Corporation" - C:\WINDOWS\System32\DRIVERS\TVALZFL.sys
"TOSHIBA Network Device Usermode I/O Protocol" (Netdevio) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\netdevio.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682} "IZArc DragDrop Menu" - ? - C:\Programme\IZArc\IZArcCM.dll  (File found, but it contains no detailed information)
{BC593DF5-466F-44EC-8FFD-C4DBC603B917} "IZArc Shell Context Menu" - ? - C:\Programme\IZArc\IZArcCM.dll  (File found, but it contains no detailed information)
{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} "JetFlExt Class" - "JetAudio" - C:\Programme\JetAudio\JetFlExt.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{6D0E6651-1CD8-11d6-92C4-0003479E4848} "NVIDIA NT4 Multimon Control Panel Extension" - ? -  (File not found | COM-object registry key not found)
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\programme\real\realplayer\rpshell.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{C4213067-97B3-4929-9B98-B5600FBBBA13} "TouchShellExt Class" - "TOSHIBA Corporation" - C:\PROGRA~1\TOSHIBA\TouchED\TouchED.dll
{D7B901C9-669E-4D2D-9946-CB8701E102FF} "TrueSuiteCMenu" - "AuthenTec, Inc." - C:\Programme\TrueSuite\TrueSuite.CMShelExt.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{27B4851A-3207-45A2-B947-BE8AFE6163AB} "McAfee Phishing Filter" - ? - c:\progra~1\mcafee\msk\mskapbho.dll  (File not found)
{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{8590886E-EC8C-43C1-A32C-E4C2B0B6395B} "TrueSuite Website Log On" - "AuthenTec Inc." - C:\Programme\TrueSuite\TrueSuite.IEBHO.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"Bluetooth Manager.lnk" - "TOSHIBA CORPORATION." - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"NokiaOviSuite2" - "Nokia" - C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
"TOSHIBA Online Product Information" - "TOSHIBA" - C:\Programme\TOSHIBA\Toshiba Online Product Information\topi.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"000StTHK" - ? - 000StTHK.exe  (File found, but it contains no detailed information)
"00THotkey" - "TOSHIBA Corporation" - C:\WINDOWS\system32\00THotkey.exe
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"AdobeCS4ServiceManager" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"CFSServ.exe" - ? - CFSServ.exe -NoClient  (File not found)
"ClientAppLogon" - "AuthenTec, Inc." - C:\Programme\TrueSuite\TrueSuite.ClientAppLogonExe.exe
"DDWMon" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
"IMSS" - ? - "C:\Programme\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
"iSaverCtrl" - "infoMantis GmbH" - C:\Programme\iSaver\iSaverCtrl.exe --startup
"ITSecMng" - "TOSHIBA CORPORATION" - %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NDSTray.exe" - ? - NDSTray.exe  (File not found)
"NokiaMServer" - "Nokia" - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NvMediaCenter" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz" - "NVIDIA Corporation" - nwiz.exe /installquiet
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"QuiKProtect" - "Iomega Corporation - An EMC Company" - C:\Programme\Iomega\QuikProtect\StartQuikProtect.exe
"SmoothView" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe
"TFncKy" - ? - TFncKy.exe  (File not found)
"TFNF5" - "TOSHIBA Corp." - TFNF5.exe
"ThpSrv" - "TOSHIBA Corporation" - C:\WINDOWS\system32\thpsrv /logon
"TkBellExe" - "RealNetworks, Inc." - "C:\programme\real\realplayer\update\realsched.exe"  -osboot
"TMERzCtl.EXE" - "TOSHIBA" - C:\Programme\TOSHIBA\TME3\TMERzCtl.EXE /Service
"TMESRV.EXE" - "TOSHIBA" - C:\Programme\TOSHIBA\TME3\TMESRV31.EXE /Logon
"TNRotate" - "TOSHIBA Corporation" - %ProgramFiles%\TOSHIBA\TNRotate\TNRotate.exe
"TosHKCW.exe" - "TOSHIBA CORPORATION" - "C:\Programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
"TosSENotify" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
"TosWaitSrv" - "TOSHIBA Corporation" - %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
"TouchED" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TouchED\TouchED.exe
"TPSMain" - "TOSHIBA Corporation" - TPSMain.exe
"TPSODDCtl" - "TOSHIBA Corporation" - TPSODDCtl.exe
"TUSBSleepChargeSrv" - "TOSHIBA" - %ProgramFiles%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
"TWebCamera" - "TOSHIBA CORPORATION." - "C:\Programme\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"Adobe Drive CS4 Network" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Toshiba Bluetooth Monitor" - "TOSHIBA CORPORATION." - C:\WINDOWS\system32\tbtmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"AuthenTec Fingerprint Service" (ATService) - "AuthenTec, Inc." - C:\Programme\Fingerprint Sensor\atservice.exe
"ConfigFree Service" (CFSvcs) - "TOSHIBA CORPORATION" - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
"McAfee Personal Firewall Service" (MpfService) - ? - C:\Programme\McAfee\MPF\MPFSrv.exe  (File not found)
"McAfee SystemGuards" (McSysmon) - ? - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe  (File not found)
"Microsoft Office Diagnostics Service" (odserv) - ? - "C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE"  (File not found)
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"QSCopyEngine" (QSCopyEngine) - ? - C:\Programme\Iomega\QuikProtect\QpMonitor.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"Tmesrv3" (Tmesrv) - "TOSHIBA" - C:\Programme\TOSHIBA\TME3\Tmesrv31.exe
"TOSHIBA Bluetooth Service" (TOSHIBA Bluetooth Service) - "TOSHIBA CORPORATION" - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
"TOSHIBA Festplattenschutz" (Thpsrv) - "TOSHIBA Corporation" - C:\WINDOWS\system32\ThpSrv.exe
"TOSHIBA HDD SSD Alert Service" (TOSHIBA HDD SSD Alert Service) - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
"TOSHIBA Navi Support Service" (TNaviSrv) - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
"TOSHIBA Optical Disc Drive Service" (TODDSrv) - "TOSHIBA Corporation" - C:\WINDOWS\system32\TODDSrv.exe
"TPCH Service" (TPCHSrv) - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TPHM\TPCHSrv.exe
"TrueSuiteService" (FPLService) - "AuthenTec, Inc" - C:\Programme\TrueSuite\TrueSuite.Service.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - "Magiena" - C:\WINDOWS\system32\Fflower.scr
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----
"GinaDLL" - "AuthenTec" - C:\WINDOWS\system32\TrueSuite.GINA.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
3. aswMBR
Code:
aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-01-26 20:59:40
-----------------------------
20:59:40.265    OS Version: Windows 5.1.2600 Service Pack 3
20:59:40.265    Number of processors: 4 586 0x2502
20:59:40.265    ComputerName: ***1  UserName: ***
20:59:41.390    Initialize success
21:11:44.078    AVAST engine defs: 12012602
21:12:54.375    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:12:54.375    Disk 0 Vendor: Hitachi_ PC3O Size: 305245MB BusType: 3
21:12:54.703    Disk 0 MBR read successfully
21:12:54.703    Disk 0 MBR scan
21:12:54.734    Disk 0 Windows XP default MBR code
21:12:54.734    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      305242 MB offset 63
21:12:54.750    Disk 0 scanning sectors +625137345
21:12:54.765    Disk 0 malicious Win32:MBRoot code @ sector 625137348 !
21:12:54.796    Disk 0 scanning C:\WINDOWS\system32\drivers
21:13:01.343    Service scanning
21:13:02.234    Modules scanning
21:13:07.890    Disk 0 trace - called modules:
21:13:07.890    ntkrnlpa.exe CLASSPNP.SYS disk.sys thpdrv.sys hal.dll ACPI.sys iaStor.sys
21:13:07.906    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x895795c8]
21:13:07.906    3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\THPDRV1[0x8af228f8]
21:13:07.906    5 thpdrv.sys[b833ae1f] -> nt!IofCallDriver -> \Device\00000072[0x8a57f920]
21:13:07.906    7 ACPI.sys[b7f7e620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8a57a028]
21:13:09.015    AVAST engine scan C:\WINDOWS
21:13:21.156    AVAST engine scan C:\WINDOWS\system32
21:15:33.796    AVAST engine scan C:\WINDOWS\system32\drivers
21:15:49.250    AVAST engine scan C:\Dokumente und Einstellungen\***
00:39:50.015    AVAST engine scan C:\Dokumente und Einstellungen\All Users
00:41:06.359    Scan finished successfully
06:32:42.203    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\***\Desktop\MBR.dat"
06:32:42.203    The log file has been saved successfully to "C:\Dokumente und Einstellungen\***\Desktop\aswMBR.txt"
Gruß,
Jens

cosinus 27.01.2012 11:05
Zitat:
Default Browser: Mozilla Corporation Firefox 3.6.8
Äh, du nutzt noch tatsächlich den alten 3.6er Zweig vom FF? Und wenn ja, warum nur Version 3.6.8, du hast schonmal von Browserupdates gehört? :(

Zitat:
21:12:54.750 Disk 0 scanning sectors +625137345
21:12:54.765 Disk 0 malicious Win32:MBRoot code @ sector 625137348 !
Ist nicht so wild wie es aussieht, man bekommt es aber weg. Mach aber erstmal einen Überblick für mich:

Live-System PartedMagic / GParted

1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein
2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist

http://partedmagic.com/lib/exe/fetch...ia=desktop.png

4. Du müsstest ein Symbol PartitionEditor auf dem Desktop finden, das doppelklicken
5. Wenn das Tool die Partitionen aufgelistet hat, bitte einen Screenshot mit Hilfe der Taste DRUCK auf der Tastatur erstellen, diesen Screenshot hier posten (idR hast du einen Internetzugang mit PartedMagic, wenn nicht einfach den Screenshot auf einem Stick abspeichern und unter Windows hier posten)

borodin 04.02.2012 14:53
Liste der Anhänge anzeigen (Anzahl: 1)
Hi Arne,
war eine Woche beschäftigt. Irgendwie hat das ganze für mich etwas von Schnitzeljagd...

Wie gewünscht, im Attachment der screenshot.
Jens

cosinus 05.02.2012 18:29
Klick bitte den unzugeordneten Bereich mit Rechts an und klick dann auf Info. Mach von dem Infofeld einen Screenshot und poste diesen hier auch

borodin 05.02.2012 21:48
Liste der Anhänge anzeigen (Anzahl: 1)
ignoriere diesen Anhang, er ist der alte screenshot

borodin 05.02.2012 21:50
Liste der Anhänge anzeigen (Anzahl: 1)
Jetzt der richtige Screenshot!

cosinus 05.02.2012 22:31
Willst du den Sektorenbereich mit dem bösen Code überschreiben (nullen) lassen?

Wenn ja dann bitte jetzt sorgfältig lesen und zuerst eine Sicherung aller Daten machen! Wenn die Sicherung erfolgte alle Sicherungsmedien vom Computer physikalisch trennen!

Wie gesagt was jetzt folgt und du hast Datenverluste seist du jetzt nochmal ausdrücklich gewarnt, alles richtig umzusetzen und vorher alles wichtige auf externe Platten zu sichern. Wenn du sicher bist, dass alle wichtige Daten in Sicherheit sind und die externen Datenträger auch nicht mehr am Rechner angeschlossen sind, dann fahre fort wir folgt:

Öffne das Terminal in PartedMagic. Ist unten in der Quicklaunch der schwarze Monitor. Eine schwarze Konsole öffnet sich. Tipp dort ein (du solltest root@partedmagic in der Zeile lesen können)

WARNUNG: Folgender Befehl auf eigene Gefahr! Für Datenverluste nicht rumheulen und wer das mitliest soll den Befehl ebenfalls nicht so ausführen!!

Bitte lieber eher 3x als 2x prüfen ob du alles so richtig eingetippt hast NACH der Datensicherung:

Code:
dd if=/dev/zero of=/dev/sda seek=625137346 bs=512
Wenn du dir sicher bist das genau so eingetippt zu haben wie es da bei mir steht, dann drücke die Eingabetaste. Es dauert nicht lange, dann hast du wieder die Zeile und sinngemäß so etwas wie

5102+0 Datensätze ein
5102+0 Datensätze aus

Wenn das so rauskaum (können auch 5103 statt 5102 sein) wurden die letzten 5102 Sekoren (und damit auch der bösartige Code in diesem unzugeordneten Bereich) auf der Platte mit Nullen überschrieben; starte den Rechner neu und boote Windows.
Mach dort einen neuen scan mit aswMBR und poste wieder das Log.

borodin 10.02.2012 09:09
Hallo Arne, ich habe die Bereinigung noch nicht durchgeführt weil mein Computer seit der Image-Aktion irgendwie unrund läuft. Das Booten ("Windows wird fortgesetzt") dauert ewig lange (mehrere Minuten) und in regelmäßigen Abständen macht die Festplatte ein merkwürdiges Geräusch, so ein "Klack", genau so wie wenn man das System mittels Hardware-Reset anhält. Ansonsten keine signifikanten Symptome.
Habe mehrmals neu gestartet; es hat sich hier aber nichts geändert.
Siehst Du Zusammenhänge mit den Aktionen?
Danke im Voraus, Jens

cosinus 10.02.2012 13:09
Nee nicht wirklich. Hast du schon mit dem Linux-Befehl die Sektoren am Ende überschrieben?
Falls was mit deiner Platte ist, es gibt einige Tools um die PLatte zu überprüfen. Im ersten Schritt reicht zB sowas wie der Piriform Defraggler, der ist zwar zum Defrag gedacht, kann aber auch die SMART Werte der Platte auslesen. Im nächsten Schritt müsste man mal die Platte mit dem Diagnosetools der Herstellers auf Herz&Nieren prüfen.

borodin 10.02.2012 15:13
Zitat:
Zitat von cosinus (Beitrag 769724)
[...]Hast du schon mit dem Linux-Befehl die Sektoren am Ende überschrieben?[...]
Definitiv nicht. Ich schau mal nach Deinen Vorschlägen...

cosinus 10.02.2012 16:39
Das hier war das => http://www.trojaner-board.de/107981-...tml#post766071

borodin 04.03.2012 09:34
So nach langer Zeit hier nun das log nach Sektorenbereinigung:

Code:
aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-03-03 18:55:11
-----------------------------
18:55:11.484    OS Version: Windows 5.1.2600 Service Pack 3
18:55:11.484    Number of processors: 4 586 0x2502
18:55:11.484    ComputerName: ***1  UserName: ***
18:55:25.421    Initialize success
19:01:40.968    AVAST engine defs: 12030301
19:04:15.359    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:04:15.359    Disk 0 Vendor: Hitachi_ PC3O Size: 305245MB BusType: 3
19:04:15.390    Disk 0 MBR read successfully
19:04:15.390    Disk 0 MBR scan
19:04:15.500    Disk 0 Windows XP default MBR code
19:04:15.500    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      305242 MB offset 63
19:04:15.500    Disk 0 scanning sectors +625137345
19:04:15.562    Disk 0 scanning C:\WINDOWS\system32\drivers
19:04:23.359    Service scanning
19:04:24.453    Modules scanning
19:04:32.156    Disk 0 trace - called modules:
19:04:32.203    ntkrnlpa.exe CLASSPNP.SYS disk.sys thpdrv.sys hal.dll ACPI.sys iaStor.sys
19:04:32.203    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8af3b030]
19:04:32.203    3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\THPDRV1[0x8af418f8]
19:04:32.203    5 thpdrv.sys[b833ae1f] -> nt!IofCallDriver -> \Device\00000073[0x8afb39a8]
19:04:32.203    7 ACPI.sys[b7f7e620] -> nt!IofCallDriver ->

\Device\Ide\IAAStorageDevice-1[0x8a4fc028]
19:04:34.250    AVAST engine scan C:\WINDOWS
19:04:53.812    AVAST engine scan C:\WINDOWS\system32
19:08:13.203    AVAST engine scan C:\WINDOWS\system32\drivers
19:08:32.000    AVAST engine scan C:\Dokumente und Einstellungen\***
22:42:35.828    AVAST engine scan C:\Dokumente und Einstellungen\All Users
22:44:07.437    Scan finished successfully
09:29:49.843    Disk 0 MBR has been saved successfully to "C:\Dokumente und

Einstellungen\***\Desktop\MBR.dat"
09:29:49.843    The log file has been saved successfully to "C:\Dokumente und

Einstellungen\***\Desktop\aswMBR_030412.txt"
Der Computer fährt im übrigen wieder schnell hoch, hatte wohl irgendetwas mit den Bootpräferenzen zu tun. Das "Klack" gibt es aber immer noch.
Grüße,
Jens

cosinus 05.03.2012 12:53
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

borodin 05.03.2012 20:49
So, Malwarebytes sagt:

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.04.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
*** :: ***1 [Administrator]

Schutz: Deaktiviert

05.03.2012 14:57:11
mbam-log-2012-03-05 (14-57-11).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 678051
Laufzeit: 2 Stunde(n), 51 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

und SuperAntiSpy meint:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/05/2012 at 08:43 PM

Application Version : 5.0.1144

Core Rules Database Version : 8304
Trace Rules Database Version: 6116

Scan type      : Quick Scan
Total Scan Time : 00:12:42

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 764
Memory threats detected  : 0
Registry items scanned    : 29727
Registry threats detected : 0
File items scanned        : 7928
File threats detected    : 25

Adware.Tracking Cookie
        C:\Dokumente und Einstellungen\***\Cookies\***@tto2.traffictrack[1].txt [

/tto2.traffictrack ]
        C:\Dokumente und Einstellungen\***\Cookies\CA3FDWYT.txt [ /traffictrack.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAOPYNKL.txt [ /adtech.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAIBLA3Q.txt [ /imrworldwide.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAGL2B0L.txt [ /unitymedia.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAV3LLSE.txt [ /ad.zanox.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA5KLOXN.txt [ /revsci.net ]
        C:\Dokumente und Einstellungen\***\Cookies\CAAR7V3V.txt [ /hightraffic.hugoboss.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA723YJ3.txt [ /atdmt.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAG1MNEL.txt [ /zanox.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAOX6PJ4.txt [ /in.getclicky.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA3GP7NW.txt [ /serving-sys.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAQNWP6P.txt [ /adfarm1.adition.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAKN6VYZ.txt [ /ads.immobilienscout24.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAST2JCD.txt [ /ad3.adfarm1.adition.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAYJZW5C.txt [ /apmebf.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAOB6FUC.txt [ /c.atdmt.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA67WL2N.txt [ /bs.serving-sys.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA6TETC9.txt [ /de.sitestat.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CARUNQ3R.txt [ /tracking.quisma.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAEVGFJW.txt [ /tradedoubler.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAMAB7DW.txt [ /webmasterplan.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CALDRZ2K.txt [ /doubleclick.net ]
        C:\Dokumente und Einstellungen\***\Cookies\CAM38PC9.txt [ /ad2.adfarm1.adition.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAFVTPOQ.txt [ /zanox-affiliate.de ]

cosinus 06.03.2012 11:31
Zitat:
Scan type : Quick Scan
ich hab doch geschrieben Vollscan :(

borodin 06.03.2012 20:42
Yup, her der vollständige scan. Da scheint immer noch etwas da zu sein...

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/06/2012 at 03:31 PM

Application Version : 5.0.1144

Core Rules Database Version : 8304
Trace Rules Database Version: 6116

Scan type      : Complete Scan
Total Scan Time : 03:29:38

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 832
Memory threats detected  : 0
Registry items scanned    : 35575
Registry threats detected : 0
File items scanned        : 497722
File threats detected    : 33

Adware.Tracking Cookie
        C:\Dokumente und Einstellungen\***\Cookies\***@tto2.traffictrack[1].txt [ /tto2.traffictrack ]
        C:\Dokumente und Einstellungen\***\Cookies\CA3FDWYT.txt [ /traffictrack.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAOPYNKL.txt [ /adtech.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAIBLA3Q.txt [ /imrworldwide.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAGL2B0L.txt [ /unitymedia.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAV3LLSE.txt [ /ad.zanox.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA5KLOXN.txt [ /revsci.net ]
        C:\Dokumente und Einstellungen\***\Cookies\CAAR7V3V.txt [ /hightraffic.hugoboss.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA723YJ3.txt [ /atdmt.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAG1MNEL.txt [ /zanox.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAOX6PJ4.txt [ /in.getclicky.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA3GP7NW.txt [ /serving-sys.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAQNWP6P.txt [ /adfarm1.adition.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAKN6VYZ.txt [ /ads.immobilienscout24.de ]
        C:\Dokumente und Einstellungen\***\Cookies\CAST2JCD.txt [ /ad3.adfarm1.adition.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAYJZW5C.txt [ /apmebf.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAOB6FUC.txt [ /c.atdmt.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA67WL2N.txt [ /bs.serving-sys.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CA6TETC9.txt [ /de.sitestat.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CARUNQ3R.txt [ /tracking.quisma.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAEVGFJW.txt [ /tradedoubler.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAMAB7DW.txt [ /webmasterplan.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CALDRZ2K.txt [ /doubleclick.net ]
        C:\Dokumente und Einstellungen\***\Cookies\CAM38PC9.txt [ /ad2.adfarm1.adition.com ]
        C:\Dokumente und Einstellungen\***\Cookies\CAFVTPOQ.txt [ /zanox-affiliate.de ]
        adserv.quality-channel.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XX3MBZZG ]
        delivery.ibanner.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XX3MBZZG ]
        ia.media-imdb.com [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XX3MBZZG ]
        imagesrv.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XX3MBZZG ]
        msnbcmedia.msn.com [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XX3MBZZG ]
        s0.2mdn.net [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XX3MBZZG ]

Trojan.Agent/Gen-Nullo[Short]
        C:\SYSTEM VOLUME INFORMATION\_RESTORE{CA5B07AF-D50C-4037-8005-0F42F3EA2681}\RP504\A0177907.EXE
        C:\SYSTEM VOLUME INFORMATION\_RESTORE{CA5B07AF-D50C-4037-8005-0F42F3EA2681}\RP510\A0188190.EXE

cosinus 06.03.2012 21:19
Sieht ok aus, da wurden nur Cookies und 2 Überreste (wenn es mal keine Fehlalarme sind) gefunden. Die können weg.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist das System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

borodin 14.03.2012 14:50
Zitat:
Zitat von cosinus (Beitrag 787184)
[...]
Ist das System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
Nein, es scheint alles sauber zu laufen!
Wenn es das war, dann sage ich mal vielen herzliche Dank für die Mühe! Manchmal hatte es ja schon etwas von Schnitzeljagd!
Zum Abschluß eine Frage: Welche Kombination von Virenscanner und Anti-Malware-Programm empfiehlst Du?
Jens

cosinus 14.03.2012 15:51
Zitat:
Zum Abschluß eine Frage: Welche Kombination von Virenscanner und Anti-Malware-Programm empfiehlst Du?
Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen. Geld ausgeben muss man nicht für einen Scanner, sowas wie Avast oder Microsoft Security Essentials sind für die privaten Gebrauch völlig ausreichend.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:
  1. Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
  2. Halte Windows und alle verwendeten Programme immer aktuell - unterstützen kann dich dabei Secunia PSI
  3. Führe regelmäßig Backups auf externe Medien durch
  4. Arbeite mit eingeschränkten Rechten
  5. Nutze sicherere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
  6. automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko
  7. Bei der Installation von Software möglichst darauf achten, dass die Setups aus offiziellen Quellen stammen und du bei der Installation nach Möglichkeit die benutzerdefinierte Methode wählst - dann hast du die Möglichkeit etwaigen Schrott (wie Toolbars oder sowas wie RegistryBooster) abzuwählen, welcher sonst einfach mitinstalliert wird.
  8. Bösartige bzw. ungewollte Sites von vornherein blockieren lassen mit Hilfe der MVPS Hosts File => Blocking Unwanted Parasites with a Hosts File
  9. Finger weg von: TuneUp, Registry-Cleanern aller Art, Softonic sowie illegalen Cracks/Keygens oder anderen "Tools" um ein kommerzielles Programm ohne Lizenz nutzen zu können
  10. dubiose Seiten bzw. Kinofilm-Streaming-Portale ebenfalls sein lassen, erstens handelt man sich dort schnell Malware ein oder kann in Abofallen geraten und zweitens bewegen sich diese Seiten in einer rechtlichen Grauzone.


Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?



Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:22 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131