Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojan horse Dropper.Generic5.TDZ in C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Te (https://www.trojaner-board.de/108452-trojan-horse-dropper-generic5-tdz-c-dokumente-einstellungen-besitzer-lokale-einstellungen-te.html)

stefan100 01.02.2012 17:08
jetzt hats geklappt. nach drei sekunden war alles vorbei. hier das logfile.

Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
C:\Programme\Winamp\winampa.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Unable to delete ADS C:\WINDOWS\System32\rundll32.exe: SummaryInformation .
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:F4CE9946 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A66A990E deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Besitzer
->Temp folder emptied: 1323914 bytes
->Temporary Internet Files folder emptied: 33237 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 49136662 bytes
->Flash cache emptied: 858 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 282 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 50,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 02012012_164202

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
was sagste? siehts jut aus?

grüße
stefan

cosinus 02.02.2012 11:37
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

stefan100 02.02.2012 20:49
n`abend arne!

hier das log vom TDSS killer.

Code:
20:41:35.0218 3436        TDSS rootkit removing tool 2.7.9.0 Feb  1 2012 09:28:49
20:41:35.0359 3436        ============================================================
20:41:35.0359 3436        Current date / time: 2012/02/02 20:41:35.0359
20:41:35.0359 3436        SystemInfo:
20:41:35.0359 3436       
20:41:35.0359 3436        OS Version: 5.1.2600 ServicePack: 3.0
20:41:35.0359 3436        Product type: Workstation
20:41:35.0359 3436        ComputerName: PRIVAT-PC
20:41:35.0359 3436        UserName: Besitzer
20:41:35.0359 3436        Windows directory: C:\WINDOWS
20:41:35.0359 3436        System windows directory: C:\WINDOWS
20:41:35.0359 3436        Processor architecture: Intel x86
20:41:35.0359 3436        Number of processors: 2
20:41:35.0359 3436        Page size: 0x1000
20:41:35.0359 3436        Boot type: Normal boot
20:41:35.0359 3436        ============================================================
20:41:37.0078 3436        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
20:41:37.0109 3436        \Device\Harddisk0\DR0:
20:41:37.0109 3436        MBR used
20:41:37.0109 3436        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x800D0E7
20:41:37.0109 3436        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800D165, BlocksNum 0xAA07A9B
20:41:37.0156 3436        Initialize success
20:41:37.0156 3436        ============================================================
20:43:00.0390 1828        ============================================================
20:43:00.0390 1828        Scan started
20:43:00.0390 1828        Mode: Manual; SigCheck; TDLFS;
20:43:00.0390 1828        ============================================================
20:43:00.0609 1828        Abiosdsk - ok
20:43:00.0609 1828        abp480n5 - ok
20:43:00.0671 1828        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:43:02.0015 1828        ACPI - ok
20:43:02.0109 1828        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:43:02.0265 1828        ACPIEC - ok
20:43:02.0265 1828        adpu160m - ok
20:43:02.0312 1828        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:43:02.0437 1828        aec - ok
20:43:02.0484 1828        AegisP          (30bb1bde595ca65fd5549462080d94e5) C:\WINDOWS\system32\DRIVERS\AegisP.sys
20:43:02.0515 1828        AegisP ( UnsignedFile.Multi.Generic ) - warning
20:43:02.0515 1828        AegisP - detected UnsignedFile.Multi.Generic (1)
20:43:02.0562 1828        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:43:02.0609 1828        AFD - ok
20:43:02.0609 1828        Aha154x - ok
20:43:02.0625 1828        aic78u2 - ok
20:43:02.0640 1828        aic78xx - ok
20:43:02.0656 1828        AliIde - ok
20:43:02.0703 1828        AmdK8          (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
20:43:02.0750 1828        AmdK8 - ok
20:43:02.0750 1828        amsint - ok
20:43:02.0781 1828        asc - ok
20:43:02.0781 1828        asc3350p - ok
20:43:02.0796 1828        asc3550 - ok
20:43:02.0843 1828        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:43:02.0968 1828        AsyncMac - ok
20:43:02.0984 1828        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:43:03.0093 1828        atapi - ok
20:43:03.0109 1828        Atdisk - ok
20:43:03.0187 1828        ati2mtag        (2af4468ef3c960b9036a279b99d5840d) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
20:43:03.0359 1828        ati2mtag - ok
20:43:03.0421 1828        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:43:03.0546 1828        Atmarpc - ok
20:43:03.0593 1828        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:43:03.0718 1828        audstub - ok
20:43:03.0765 1828        AvgLdx86        (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
20:43:03.0828 1828        AvgLdx86 - ok
20:43:03.0859 1828        AvgMfx86        (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
20:43:03.0875 1828        AvgMfx86 - ok
20:43:03.0921 1828        AvgTdiX        (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
20:43:03.0953 1828        AvgTdiX - ok
20:43:03.0984 1828        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:43:04.0140 1828        Beep - ok
20:43:04.0187 1828        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:43:04.0343 1828        cbidf2k - ok
20:43:04.0343 1828        cd20xrnt - ok
20:43:04.0406 1828        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:43:04.0546 1828        Cdaudio - ok
20:43:04.0562 1828        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:43:04.0687 1828        Cdfs - ok
20:43:04.0718 1828        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:43:04.0828 1828        Cdrom - ok
20:43:04.0843 1828        Changer - ok
20:43:04.0859 1828        CmdIde - ok
20:43:04.0890 1828        Cpqarray - ok
20:43:04.0906 1828        dac2w2k - ok
20:43:04.0921 1828        dac960nt - ok
20:43:04.0937 1828        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:43:05.0062 1828        Disk - ok
20:43:05.0125 1828        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:43:05.0296 1828        dmboot - ok
20:43:05.0328 1828        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:43:05.0468 1828        dmio - ok
20:43:05.0500 1828        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:43:05.0625 1828        dmload - ok
20:43:05.0656 1828        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:43:05.0765 1828        DMusic - ok
20:43:05.0781 1828        dpti2o - ok
20:43:05.0828 1828        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:43:05.0937 1828        drmkaud - ok
20:43:06.0015 1828        EAPPkt          (c47e7c5e7410c7de98f7219e3008c23d) C:\WINDOWS\system32\DRIVERS\EAPPkt.sys
20:43:06.0031 1828        EAPPkt ( UnsignedFile.Multi.Generic ) - warning
20:43:06.0031 1828        EAPPkt - detected UnsignedFile.Multi.Generic (1)
20:43:06.0062 1828        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:43:06.0171 1828        Fastfat - ok
20:43:06.0234 1828        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:43:06.0343 1828        Fdc - ok
20:43:06.0359 1828        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:43:06.0484 1828        Fips - ok
20:43:06.0500 1828        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:43:06.0609 1828        Flpydisk - ok
20:43:06.0625 1828        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
20:43:06.0765 1828        FltMgr - ok
20:43:06.0781 1828        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:43:06.0921 1828        Fs_Rec - ok
20:43:06.0937 1828        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:43:07.0109 1828        Ftdisk - ok
20:43:07.0140 1828        GEARAspiWDM    (ab8a6a87d9d7255c3884d5b9541a6e80) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
20:43:07.0156 1828        GEARAspiWDM - ok
20:43:07.0171 1828        GMSIPCI - ok
20:43:07.0218 1828        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:43:07.0328 1828        Gpc - ok
20:43:07.0343 1828        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:43:07.0468 1828        HDAudBus - ok
20:43:07.0484 1828        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:43:07.0625 1828        hidusb - ok
20:43:07.0640 1828        hpn - ok
20:43:07.0687 1828        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:43:07.0750 1828        HTTP - ok
20:43:07.0765 1828        i2omgmt - ok
20:43:07.0765 1828        i2omp - ok
20:43:07.0781 1828        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:43:07.0906 1828        i8042prt - ok
20:43:07.0937 1828        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:43:08.0031 1828        Imapi - ok
20:43:08.0046 1828        ini910u - ok
20:43:08.0203 1828        IntcAzAudAddService (cdfd5a68a2e1caa89c5c0e0b3cb98731) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:43:08.0468 1828        IntcAzAudAddService - ok
20:43:08.0531 1828        IntelIde - ok
20:43:08.0578 1828        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
20:43:08.0703 1828        Ip6Fw - ok
20:43:08.0718 1828        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:43:08.0875 1828        IpFilterDriver - ok
20:43:08.0890 1828        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:43:09.0015 1828        IpInIp - ok
20:43:09.0031 1828        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:43:09.0156 1828        IpNat - ok
20:43:09.0171 1828        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:43:09.0281 1828        IPSec - ok
20:43:09.0312 1828        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:43:09.0421 1828        IRENUM - ok
20:43:09.0484 1828        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:43:09.0609 1828        isapnp - ok
20:43:09.0625 1828        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:43:09.0734 1828        Kbdclass - ok
20:43:09.0781 1828        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:43:09.0890 1828        kbdhid - ok
20:43:09.0921 1828        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:43:10.0031 1828        kmixer - ok
20:43:10.0062 1828        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:43:10.0140 1828        KSecDD - ok
20:43:10.0156 1828        lbrtfdc - ok
20:43:10.0187 1828        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
20:43:10.0218 1828        MBAMProtector - ok
20:43:10.0265 1828        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:43:10.0390 1828        mnmdd - ok
20:43:10.0453 1828        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:43:10.0562 1828        Modem - ok
20:43:10.0578 1828        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:43:10.0687 1828        Mouclass - ok
20:43:10.0734 1828        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:43:10.0875 1828        mouhid - ok
20:43:10.0937 1828        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:43:11.0046 1828        MountMgr - ok
20:43:11.0062 1828        mraid35x - ok
20:43:11.0093 1828        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:43:11.0203 1828        MRxDAV - ok
20:43:11.0250 1828        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:43:11.0343 1828        MRxSmb - ok
20:43:11.0359 1828        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:43:11.0484 1828        Msfs - ok
20:43:11.0515 1828        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:43:11.0625 1828        MSKSSRV - ok
20:43:11.0640 1828        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:43:11.0734 1828        MSPCLOCK - ok
20:43:11.0750 1828        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:43:11.0859 1828        MSPQM - ok
20:43:11.0890 1828        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:43:12.0000 1828        mssmbios - ok
20:43:12.0031 1828        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:43:12.0078 1828        Mup - ok
20:43:12.0109 1828        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:43:12.0234 1828        NDIS - ok
20:43:12.0250 1828        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:43:12.0296 1828        NdisTapi - ok
20:43:12.0312 1828        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:43:12.0421 1828        Ndisuio - ok
20:43:12.0453 1828        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:43:12.0578 1828        NdisWan - ok
20:43:12.0609 1828        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:43:12.0640 1828        NDProxy - ok
20:43:12.0656 1828        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:43:12.0765 1828        NetBIOS - ok
20:43:12.0796 1828        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:43:12.0921 1828        NetBT - ok
20:43:12.0968 1828        nmwcd          (c82f4cc10ad315b6d6bcb14d0a7cad66) C:\WINDOWS\system32\drivers\ccdcmb.sys
20:43:13.0062 1828        nmwcd - ok
20:43:13.0093 1828        nmwcdc          (60ef5f5621d7832f00a3f190a0c905e2) C:\WINDOWS\system32\drivers\ccdcmbo.sys
20:43:13.0156 1828        nmwcdc - ok
20:43:13.0187 1828        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:43:13.0296 1828        Npfs - ok
20:43:13.0328 1828        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:43:13.0484 1828        Ntfs - ok
20:43:13.0593 1828        NTIDrvr - ok
20:43:13.0625 1828        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:43:13.0765 1828        Null - ok
20:43:13.0796 1828        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:43:13.0968 1828        NwlnkFlt - ok
20:43:13.0984 1828        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:43:14.0171 1828        NwlnkFwd - ok
20:43:14.0218 1828        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
20:43:14.0328 1828        Parport - ok
20:43:14.0328 1828        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:43:14.0453 1828        PartMgr - ok
20:43:14.0468 1828        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:43:14.0625 1828        ParVdm - ok
20:43:14.0656 1828        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:43:14.0765 1828        PCI - ok
20:43:14.0781 1828        PCIDump - ok
20:43:14.0796 1828        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:43:14.0953 1828        PCIIde - ok
20:43:14.0984 1828        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:43:15.0078 1828        Pcmcia - ok
20:43:15.0093 1828        PDCOMP - ok
20:43:15.0109 1828        PDFRAME - ok
20:43:15.0125 1828        PDRELI - ok
20:43:15.0125 1828        PDRFRAME - ok
20:43:15.0140 1828        perc2 - ok
20:43:15.0156 1828        perc2hib - ok
20:43:15.0218 1828        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:43:15.0328 1828        PptpMiniport - ok
20:43:15.0359 1828        Processor      (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
20:43:15.0468 1828        Processor - ok
20:43:15.0484 1828        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:43:15.0593 1828        PSched - ok
20:43:15.0625 1828        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:43:15.0781 1828        Ptilink - ok
20:43:15.0812 1828        PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:43:15.0828 1828        PxHelp20 - ok
20:43:15.0843 1828        ql1080 - ok
20:43:15.0843 1828        Ql10wnt - ok
20:43:15.0859 1828        ql12160 - ok
20:43:15.0875 1828        ql1240 - ok
20:43:15.0890 1828        ql1280 - ok
20:43:15.0921 1828        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:43:16.0062 1828        RasAcd - ok
20:43:16.0078 1828        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:43:16.0187 1828        Rasl2tp - ok
20:43:16.0203 1828        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:43:16.0312 1828        RasPppoe - ok
20:43:16.0328 1828        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:43:16.0468 1828        Raspti - ok
20:43:16.0500 1828        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:43:16.0609 1828        Rdbss - ok
20:43:16.0625 1828        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:43:16.0750 1828        RDPCDD - ok
20:43:16.0796 1828        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
20:43:16.0843 1828        RDPWD - ok
20:43:16.0890 1828        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:43:17.0000 1828        redbook - ok
20:43:17.0062 1828        RTL8187B        (60aecd4284317784111716bb88342f46) C:\WINDOWS\system32\DRIVERS\wg111v3.sys
20:43:17.0109 1828        RTL8187B - ok
20:43:17.0156 1828        RTLE8023xp      (bb0ae2171f08129f4f3ff9df20ffbf89) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
20:43:17.0203 1828        RTLE8023xp - ok
20:43:17.0250 1828        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:43:17.0359 1828        Secdrv - ok
20:43:17.0390 1828        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:43:17.0500 1828        Serial - ok
20:43:17.0531 1828        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:43:17.0656 1828        Sfloppy - ok
20:43:17.0671 1828        Simbad - ok
20:43:17.0703 1828        SLEE_16_DRIVER  (4723512c035a3a880db4657705466240) C:\WINDOWS\system32\drivers\Sleen16.sys
20:43:17.0734 1828        SLEE_16_DRIVER - ok
20:43:17.0734 1828        Sparrow - ok
20:43:17.0796 1828        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:43:17.0906 1828        splitter - ok
20:43:17.0953 1828        spvads          (34f713210ff0b61f0ce3fee2d330b304) C:\WINDOWS\system32\drivers\spvads.sys
20:43:17.0984 1828        spvads ( UnsignedFile.Multi.Generic ) - warning
20:43:17.0984 1828        spvads - detected UnsignedFile.Multi.Generic (1)
20:43:18.0000 1828        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:43:18.0109 1828        sr - ok
20:43:18.0140 1828        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:43:18.0218 1828        Srv - ok
20:43:18.0265 1828        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:43:18.0375 1828        swenum - ok
20:43:18.0390 1828        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:43:18.0500 1828        swmidi - ok
20:43:18.0515 1828        symc810 - ok
20:43:18.0531 1828        symc8xx - ok
20:43:18.0546 1828        sym_hi - ok
20:43:18.0546 1828        sym_u3 - ok
20:43:18.0578 1828        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:43:18.0671 1828        sysaudio - ok
20:43:18.0734 1828        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:43:18.0812 1828        Tcpip - ok
20:43:18.0843 1828        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:43:18.0968 1828        TDPIPE - ok
20:43:18.0984 1828        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:43:19.0093 1828        TDTCP - ok
20:43:19.0125 1828        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:43:19.0234 1828        TermDD - ok
20:43:19.0250 1828        TosIde - ok
20:43:19.0281 1828        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:43:19.0406 1828        Udfs - ok
20:43:19.0421 1828        ultra - ok
20:43:19.0453 1828        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:43:19.0609 1828        Update - ok
20:43:19.0656 1828        USBAAPL        (df38374e12e73c25b37b6f8a9b8622ef) C:\WINDOWS\system32\Drivers\usbaapl.sys
20:43:19.0703 1828        USBAAPL - ok
20:43:19.0750 1828        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
20:43:19.0859 1828        usbaudio - ok
20:43:19.0906 1828        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:43:20.0031 1828        usbccgp - ok
20:43:20.0046 1828        USBCM          (d21cde1c635bcc5053463579eee453cf) C:\WINDOWS\system32\DRIVERS\Sacm2K.sys
20:43:20.0093 1828        USBCM - ok
20:43:20.0109 1828        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:43:20.0218 1828        usbehci - ok
20:43:20.0265 1828        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:43:20.0375 1828        usbhub - ok
20:43:20.0406 1828        usbohci        (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
20:43:20.0515 1828        usbohci - ok
20:43:20.0531 1828        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:43:20.0640 1828        usbprint - ok
20:43:20.0656 1828        usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
20:43:20.0781 1828        usbser - ok
20:43:20.0828 1828        UsbserFilt      (e748d50b3b2ec7f40a2ba67fb094cf01) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
20:43:20.0859 1828        UsbserFilt - ok
20:43:20.0906 1828        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:43:21.0000 1828        USBSTOR - ok
20:43:21.0031 1828        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:43:21.0140 1828        VgaSave - ok
20:43:21.0140 1828        ViaIde - ok
20:43:21.0171 1828        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:43:21.0281 1828        VolSnap - ok
20:43:21.0328 1828        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:43:21.0421 1828        Wanarp - ok
20:43:21.0453 1828        wceusbsh        (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
20:43:21.0500 1828        wceusbsh - ok
20:43:21.0546 1828        Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
20:43:21.0593 1828        Wdf01000 - ok
20:43:21.0609 1828        WDICA - ok
20:43:21.0640 1828        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:43:21.0750 1828        wdmaud - ok
20:43:21.0828 1828        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:43:21.0921 1828        WpdUsb - ok
20:43:21.0953 1828        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:43:22.0015 1828        WudfPf - ok
20:43:22.0031 1828        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:43:22.0062 1828        WudfRd - ok
20:43:22.0281 1828        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
20:43:23.0421 1828        \Device\Harddisk0\DR0 - ok
20:43:23.0421 1828        Boot (0x1200)  (fb1b7271090b731826c2587f6e9358fa) \Device\Harddisk0\DR0\Partition0
20:43:23.0437 1828        \Device\Harddisk0\DR0\Partition0 - ok
20:43:23.0437 1828        Boot (0x1200)  (a3203fce4bd62655420c7ccc910ddbfe) \Device\Harddisk0\DR0\Partition1
20:43:23.0437 1828        \Device\Harddisk0\DR0\Partition1 - ok
20:43:23.0437 1828        ============================================================
20:43:23.0437 1828        Scan finished
20:43:23.0437 1828        ============================================================
20:43:23.0546 1648        Detected object count: 3
20:43:23.0546 1648        Actual detected object count: 3
20:44:03.0015 1648        AegisP ( UnsignedFile.Multi.Generic ) - skipped by user
20:44:03.0015 1648        AegisP ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:44:03.0031 1648        EAPPkt ( UnsignedFile.Multi.Generic ) - skipped by user
20:44:03.0031 1648        EAPPkt ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:44:03.0031 1648        spvads ( UnsignedFile.Multi.Generic ) - skipped by user
20:44:03.0031 1648        spvads ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:44:10.0109 1916        ============================================================
20:44:10.0109 1916        Scan started
20:44:10.0109 1916        Mode: Manual; SigCheck; TDLFS;
20:44:10.0109 1916        ============================================================
20:44:10.0468 1916        Abiosdsk - ok
20:44:10.0484 1916        abp480n5 - ok
20:44:10.0531 1916        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:44:10.0640 1916        ACPI - ok
20:44:10.0671 1916        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:44:10.0796 1916        ACPIEC - ok
20:44:10.0812 1916        adpu160m - ok
20:44:10.0843 1916        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:44:10.0937 1916        aec - ok
20:44:10.0984 1916        AegisP          (30bb1bde595ca65fd5549462080d94e5) C:\WINDOWS\system32\DRIVERS\AegisP.sys
20:44:11.0000 1916        AegisP ( UnsignedFile.Multi.Generic ) - warning
20:44:11.0000 1916        AegisP - detected UnsignedFile.Multi.Generic (1)
20:44:11.0046 1916        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:44:11.0078 1916        AFD - ok
20:44:11.0078 1916        Aha154x - ok
20:44:11.0093 1916        aic78u2 - ok
20:44:11.0109 1916        aic78xx - ok
20:44:11.0125 1916        AliIde - ok
20:44:11.0156 1916        AmdK8          (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
20:44:11.0156 1916        AmdK8 - ok
20:44:11.0171 1916        amsint - ok
20:44:11.0187 1916        asc - ok
20:44:11.0203 1916        asc3350p - ok
20:44:11.0218 1916        asc3550 - ok
20:44:11.0265 1916        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:44:11.0375 1916        AsyncMac - ok
20:44:11.0375 1916        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:44:11.0484 1916        atapi - ok
20:44:11.0484 1916        Atdisk - ok
20:44:11.0562 1916        ati2mtag        (2af4468ef3c960b9036a279b99d5840d) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
20:44:11.0671 1916        ati2mtag - ok
20:44:11.0718 1916        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:44:11.0828 1916        Atmarpc - ok
20:44:11.0859 1916        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:44:12.0000 1916        audstub - ok
20:44:12.0046 1916        AvgLdx86        (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
20:44:12.0062 1916        AvgLdx86 - ok
20:44:12.0078 1916        AvgMfx86        (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
20:44:12.0078 1916        AvgMfx86 - ok
20:44:12.0125 1916        AvgTdiX        (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
20:44:12.0125 1916        AvgTdiX - ok
20:44:12.0156 1916        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:44:12.0296 1916        Beep - ok
20:44:12.0328 1916        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:44:12.0468 1916        cbidf2k - ok
20:44:12.0468 1916        cd20xrnt - ok
20:44:12.0500 1916        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:44:12.0625 1916        Cdaudio - ok
20:44:12.0656 1916        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:44:12.0750 1916        Cdfs - ok
20:44:12.0796 1916        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:44:12.0875 1916        Cdrom - ok
20:44:12.0890 1916        Changer - ok
20:44:12.0906 1916        CmdIde - ok
20:44:12.0937 1916        Cpqarray - ok
20:44:12.0953 1916        dac2w2k - ok
20:44:12.0968 1916        dac960nt - ok
20:44:12.0984 1916        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:44:13.0078 1916        Disk - ok
20:44:13.0140 1916        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:44:13.0265 1916        dmboot - ok
20:44:13.0296 1916        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:44:13.0406 1916        dmio - ok
20:44:13.0437 1916        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:44:13.0546 1916        dmload - ok
20:44:13.0578 1916        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:44:13.0671 1916        DMusic - ok
20:44:13.0687 1916        dpti2o - ok
20:44:13.0734 1916        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:44:13.0828 1916        drmkaud - ok
20:44:13.0875 1916        EAPPkt          (c47e7c5e7410c7de98f7219e3008c23d) C:\WINDOWS\system32\DRIVERS\EAPPkt.sys
20:44:13.0875 1916        EAPPkt ( UnsignedFile.Multi.Generic ) - warning
20:44:13.0875 1916        EAPPkt - detected UnsignedFile.Multi.Generic (1)
20:44:13.0921 1916        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:44:14.0015 1916        Fastfat - ok
20:44:14.0062 1916        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:44:14.0156 1916        Fdc - ok
20:44:14.0187 1916        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:44:14.0281 1916        Fips - ok
20:44:14.0296 1916        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:44:14.0390 1916        Flpydisk - ok
20:44:14.0421 1916        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
20:44:14.0515 1916        FltMgr - ok
20:44:14.0531 1916        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:44:14.0671 1916        Fs_Rec - ok
20:44:14.0687 1916        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:44:14.0812 1916        Ftdisk - ok
20:44:14.0843 1916        GEARAspiWDM    (ab8a6a87d9d7255c3884d5b9541a6e80) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
20:44:14.0859 1916        GEARAspiWDM - ok
20:44:14.0859 1916        GMSIPCI - ok
20:44:14.0906 1916        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:44:15.0000 1916        Gpc - ok
20:44:15.0015 1916        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:44:15.0109 1916        HDAudBus - ok
20:44:15.0140 1916        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:44:15.0234 1916        hidusb - ok
20:44:15.0250 1916        hpn - ok
20:44:15.0312 1916        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:44:15.0312 1916        HTTP - ok
20:44:15.0328 1916        i2omgmt - ok
20:44:15.0343 1916        i2omp - ok
20:44:15.0359 1916        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:44:15.0453 1916        i8042prt - ok
20:44:15.0484 1916        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:44:15.0562 1916        Imapi - ok
20:44:15.0578 1916        ini910u - ok
20:44:15.0750 1916        IntcAzAudAddService (cdfd5a68a2e1caa89c5c0e0b3cb98731) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:44:15.0906 1916        IntcAzAudAddService - ok
20:44:15.0984 1916        IntelIde - ok
20:44:16.0015 1916        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
20:44:16.0125 1916        Ip6Fw - ok
20:44:16.0156 1916        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:44:16.0265 1916        IpFilterDriver - ok
20:44:16.0296 1916        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:44:16.0406 1916        IpInIp - ok
20:44:16.0406 1916        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:44:16.0515 1916        IpNat - ok
20:44:16.0531 1916        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:44:16.0625 1916        IPSec - ok
20:44:16.0656 1916        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:44:16.0765 1916        IRENUM - ok
20:44:16.0812 1916        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:44:16.0906 1916        isapnp - ok
20:44:16.0937 1916        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:44:17.0031 1916        Kbdclass - ok
20:44:17.0062 1916        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:44:17.0156 1916        kbdhid - ok
20:44:17.0187 1916        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:44:17.0281 1916        kmixer - ok
20:44:17.0312 1916        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:44:17.0328 1916        KSecDD - ok
20:44:17.0343 1916        lbrtfdc - ok
20:44:17.0375 1916        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
20:44:17.0390 1916        MBAMProtector - ok
20:44:17.0437 1916        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:44:17.0546 1916        mnmdd - ok
20:44:17.0593 1916        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:44:17.0703 1916        Modem - ok
20:44:17.0703 1916        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:44:17.0812 1916        Mouclass - ok
20:44:17.0843 1916        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:44:17.0968 1916        mouhid - ok
20:44:18.0000 1916        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:44:18.0109 1916        MountMgr - ok
20:44:18.0109 1916        mraid35x - ok
20:44:18.0140 1916        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:44:18.0250 1916        MRxDAV - ok
20:44:18.0312 1916        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:44:18.0343 1916        MRxSmb - ok
20:44:18.0359 1916        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:44:18.0468 1916        Msfs - ok
20:44:18.0500 1916        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:44:18.0593 1916        MSKSSRV - ok
20:44:18.0609 1916        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:44:18.0703 1916        MSPCLOCK - ok
20:44:18.0718 1916        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:44:18.0812 1916        MSPQM - ok
20:44:18.0828 1916        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:44:18.0921 1916        mssmbios - ok
20:44:18.0937 1916        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:44:18.0953 1916        Mup - ok
20:44:18.0984 1916        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:44:19.0078 1916        NDIS - ok
20:44:19.0109 1916        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:44:19.0109 1916        NdisTapi - ok
20:44:19.0140 1916        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:44:19.0234 1916        Ndisuio - ok
20:44:19.0265 1916        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:44:19.0359 1916        NdisWan - ok
20:44:19.0390 1916        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:44:19.0406 1916        NDProxy - ok
20:44:19.0421 1916        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:44:19.0515 1916        NetBIOS - ok
20:44:19.0546 1916        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:44:19.0640 1916        NetBT - ok
20:44:19.0687 1916        nmwcd          (c82f4cc10ad315b6d6bcb14d0a7cad66) C:\WINDOWS\system32\drivers\ccdcmb.sys
20:44:19.0734 1916        nmwcd - ok
20:44:19.0765 1916        nmwcdc          (60ef5f5621d7832f00a3f190a0c905e2) C:\WINDOWS\system32\drivers\ccdcmbo.sys
20:44:19.0812 1916        nmwcdc - ok
20:44:19.0828 1916        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:44:19.0937 1916        Npfs - ok
20:44:19.0968 1916        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:44:20.0093 1916        Ntfs - ok
20:44:20.0187 1916        NTIDrvr - ok
20:44:20.0218 1916        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:44:20.0359 1916        Null - ok
20:44:20.0406 1916        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:44:20.0515 1916        NwlnkFlt - ok
20:44:20.0531 1916        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:44:20.0671 1916        NwlnkFwd - ok
20:44:20.0734 1916        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
20:44:20.0828 1916        Parport - ok
20:44:20.0843 1916        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:44:20.0937 1916        PartMgr - ok
20:44:20.0953 1916        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:44:21.0093 1916        ParVdm - ok
20:44:21.0125 1916        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:44:21.0218 1916        PCI - ok
20:44:21.0234 1916        PCIDump - ok
20:44:21.0250 1916        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:44:21.0390 1916        PCIIde - ok
20:44:21.0406 1916        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:44:21.0500 1916        Pcmcia - ok
20:44:21.0515 1916        PDCOMP - ok
20:44:21.0515 1916        PDFRAME - ok
20:44:21.0531 1916        PDRELI - ok
20:44:21.0546 1916        PDRFRAME - ok
20:44:21.0546 1916        perc2 - ok
20:44:21.0562 1916        perc2hib - ok
20:44:21.0625 1916        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:44:21.0718 1916        PptpMiniport - ok
20:44:21.0734 1916        Processor      (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
20:44:21.0812 1916        Processor - ok
20:44:21.0828 1916        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:44:21.0937 1916        PSched - ok
20:44:21.0984 1916        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:44:22.0109 1916        Ptilink - ok
20:44:22.0140 1916        PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:44:22.0156 1916        PxHelp20 - ok
20:44:22.0156 1916        ql1080 - ok
20:44:22.0171 1916        Ql10wnt - ok
20:44:22.0187 1916        ql12160 - ok
20:44:22.0187 1916        ql1240 - ok
20:44:22.0203 1916        ql1280 - ok
20:44:22.0234 1916        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:44:22.0343 1916        RasAcd - ok
20:44:22.0359 1916        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:44:22.0453 1916        Rasl2tp - ok
20:44:22.0468 1916        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:44:22.0562 1916        RasPppoe - ok
20:44:22.0578 1916        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:44:22.0703 1916        Raspti - ok
20:44:22.0718 1916        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:44:22.0812 1916        Rdbss - ok
20:44:22.0843 1916        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:44:22.0968 1916        RDPCDD - ok
20:44:23.0015 1916        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
20:44:23.0015 1916        RDPWD - ok
20:44:23.0046 1916        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:44:23.0156 1916        redbook - ok
20:44:23.0218 1916        RTL8187B        (60aecd4284317784111716bb88342f46) C:\WINDOWS\system32\DRIVERS\wg111v3.sys
20:44:23.0234 1916        RTL8187B - ok
20:44:23.0281 1916        RTLE8023xp      (bb0ae2171f08129f4f3ff9df20ffbf89) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
20:44:23.0296 1916        RTLE8023xp - ok
20:44:23.0343 1916        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:44:23.0546 1916        Secdrv - ok
20:44:23.0578 1916        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:44:23.0671 1916        Serial - ok
20:44:23.0687 1916        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:44:23.0781 1916        Sfloppy - ok
20:44:23.0796 1916        Simbad - ok
20:44:23.0828 1916        SLEE_16_DRIVER  (4723512c035a3a880db4657705466240) C:\WINDOWS\system32\drivers\Sleen16.sys
20:44:23.0843 1916        SLEE_16_DRIVER - ok
20:44:23.0859 1916        Sparrow - ok
20:44:23.0906 1916        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:44:24.0000 1916        splitter - ok
20:44:24.0046 1916        spvads          (34f713210ff0b61f0ce3fee2d330b304) C:\WINDOWS\system32\drivers\spvads.sys
20:44:24.0062 1916        spvads ( UnsignedFile.Multi.Generic ) - warning
20:44:24.0062 1916        spvads - detected UnsignedFile.Multi.Generic (1)
20:44:24.0078 1916        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:44:24.0171 1916        sr - ok
20:44:24.0234 1916        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:44:24.0281 1916        Srv - ok
20:44:24.0328 1916        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:44:24.0421 1916        swenum - ok
20:44:24.0437 1916        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:44:24.0531 1916        swmidi - ok
20:44:24.0546 1916        symc810 - ok
20:44:24.0546 1916        symc8xx - ok
20:44:24.0562 1916        sym_hi - ok
20:44:24.0578 1916        sym_u3 - ok
20:44:24.0593 1916        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:44:24.0671 1916        sysaudio - ok
20:44:24.0796 1916        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:44:24.0828 1916        Tcpip - ok
20:44:24.0906 1916        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:44:25.0031 1916        TDPIPE - ok
20:44:25.0093 1916        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:44:25.0187 1916        TDTCP - ok
20:44:25.0234 1916        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:44:25.0359 1916        TermDD - ok
20:44:25.0437 1916        TosIde - ok
20:44:25.0578 1916        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:44:25.0687 1916        Udfs - ok
20:44:25.0703 1916        ultra - ok
20:44:25.0750 1916        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:44:25.0859 1916        Update - ok
20:44:25.0906 1916        USBAAPL        (df38374e12e73c25b37b6f8a9b8622ef) C:\WINDOWS\system32\Drivers\usbaapl.sys
20:44:25.0937 1916        USBAAPL - ok
20:44:25.0968 1916        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
20:44:26.0078 1916        usbaudio - ok
20:44:26.0109 1916        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:44:26.0203 1916        usbccgp - ok
20:44:26.0234 1916        USBCM          (d21cde1c635bcc5053463579eee453cf) C:\WINDOWS\system32\DRIVERS\Sacm2K.sys
20:44:26.0234 1916        USBCM - ok
20:44:26.0265 1916        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:44:26.0375 1916        usbehci - ok
20:44:26.0406 1916        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:44:26.0500 1916        usbhub - ok
20:44:26.0515 1916        usbohci        (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
20:44:26.0625 1916        usbohci - ok
20:44:26.0640 1916        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:44:26.0750 1916        usbprint - ok
20:44:26.0781 1916        usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
20:44:26.0890 1916        usbser - ok
20:44:26.0921 1916        UsbserFilt      (e748d50b3b2ec7f40a2ba67fb094cf01) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
20:44:26.0953 1916        UsbserFilt - ok
20:44:26.0984 1916        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:44:27.0078 1916        USBSTOR - ok
20:44:27.0093 1916        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:44:27.0187 1916        VgaSave - ok
20:44:27.0203 1916        ViaIde - ok
20:44:27.0218 1916        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:44:27.0312 1916        VolSnap - ok
20:44:27.0359 1916        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:44:27.0453 1916        Wanarp - ok
20:44:27.0484 1916        wceusbsh        (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
20:44:27.0500 1916        wceusbsh - ok
20:44:27.0546 1916        Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
20:44:27.0562 1916        Wdf01000 - ok
20:44:27.0578 1916        WDICA - ok
20:44:27.0593 1916        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:44:27.0687 1916        wdmaud - ok
20:44:27.0765 1916        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:44:27.0781 1916        WpdUsb - ok
20:44:27.0812 1916        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:44:27.0828 1916        WudfPf - ok
20:44:27.0843 1916        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:44:27.0875 1916        WudfRd - ok
20:44:27.0906 1916        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
20:44:28.0859 1916        \Device\Harddisk0\DR0 - ok
20:44:28.0875 1916        Boot (0x1200)  (fb1b7271090b731826c2587f6e9358fa) \Device\Harddisk0\DR0\Partition0
20:44:28.0875 1916        \Device\Harddisk0\DR0\Partition0 - ok
20:44:28.0890 1916        Boot (0x1200)  (a3203fce4bd62655420c7ccc910ddbfe) \Device\Harddisk0\DR0\Partition1
20:44:28.0890 1916        \Device\Harddisk0\DR0\Partition1 - ok
20:44:28.0890 1916        ============================================================
20:44:28.0890 1916        Scan finished
20:44:28.0890 1916        ============================================================
20:44:28.0906 2704        Detected object count: 3
20:44:28.0906 2704        Actual detected object count: 3
20:44:44.0296 2704        AegisP ( UnsignedFile.Multi.Generic ) - skipped by user
20:44:44.0296 2704        AegisP ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:44:44.0296 2704        EAPPkt ( UnsignedFile.Multi.Generic ) - skipped by user
20:44:44.0296 2704        EAPPkt ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:44:44.0296 2704        spvads ( UnsignedFile.Multi.Generic ) - skipped by user
20:44:44.0296 2704        spvads ( UnsignedFile.Multi.Generic ) - User select action: Skip
viele grüße
stefan

cosinus 02.02.2012 23:39
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

stefan100 03.02.2012 13:59
hi arne!

hier die logdatei vom soeben durchgeführten ComboFix-Scan.

[code]
Combofix Logfile:
Code:
ComboFix 12-02-03.02 - Besitzer 03.02.2012  13:46:53.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.895.251 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Besitzer\Desktop\trojaner board\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\windows\system32\winlogon.bak
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-01-03 bis 2012-02-03  ))))))))))))))))))))))))))))))
.
.
2012-01-31 21:06 . 2012-01-31 21:06        --------        d-----w-        C:\_OTL
2012-01-25 20:43 . 2012-01-25 20:43        --------        d-----w-        c:\programme\ESET
2012-01-23 21:00 . 2012-01-23 21:00        --------        d-----w-        c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Malwarebytes
2012-01-23 21:00 . 2012-01-23 21:00        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-23 20:59 . 2012-01-23 21:00        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-23 20:59 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-12 19:17 . 2012-02-02 20:24        45016        ----a-w-        c:\programme\Mozilla Firefox\mozutils.dll
2012-01-12 19:17 . 2012-01-12 19:17        626688        ----a-w-        c:\programme\Mozilla Firefox\msvcr80.dll
2012-01-12 19:17 . 2012-01-12 19:17        548864        ----a-w-        c:\programme\Mozilla Firefox\msvcp80.dll
2012-01-12 19:17 . 2012-01-12 19:17        479232        ----a-w-        c:\programme\Mozilla Firefox\msvcm80.dll
2012-01-07 18:47 . 2012-01-07 18:47        --------        d-----w-        c:\programme\Watchtower
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-16 17:55 . 2004-08-04 12:00        33792        ----a-w-        c:\windows\system32\rundll32.exe
2011-12-07 19:36 . 2011-12-07 19:36        73728        ----a-w-        c:\windows\system32\javacpl.cpl
2011-12-07 19:35 . 2011-12-07 19:36        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-11-25 21:57 . 2004-08-04 12:00        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2004-08-04 12:00        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2004-08-04 12:00        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2004-08-04 12:00        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2004-08-04 12:00        152064        ----a-w-        c:\windows\system32\schannel.dll
2010-12-10 13:27 . 2008-12-08 20:25        1456640        ----a-w-        c:\programme\Gemeinsame Dateien\Falk Navi-Manager.msi
2008-09-08 19:18 . 2006-10-10 15:59        1241600        ----a-w-        c:\programme\JPGCompressor.exe
2001-05-29 22:00 . 2001-05-29 22:00        352256        ----a-r-        c:\programme\ijl15.dll
2012-02-02 20:24 . 2011-05-01 12:57        134104        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-07-22 . 63F596358D91E0DE887E3D031CCCF5C6 . 513024 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[7] 2004-08-04 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
"NBJ"="c:\programme\Ahead\Nero BackItUp\NBJ.exe" [2006-09-15 2048000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2011-10-19 2042208]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"SAFEOEM HotKeys"="c:\programme\Steganos Safe OEM\SteganosHotKeyService.exe" [2008-12-11 26112]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
NETGEAR WG111v3 Setup-Assistent.lnk - c:\programme\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 1937408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-23 10:03        11952        ----a-w-        c:\windows\system32\avgrsstx.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\AVG\\AVG8\\avgemc.exe"=
"c:\\Programme\\AVG\\AVG8\\avgupd.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programme\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [22.07.2008 19:27 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [22.07.2008 19:27 108552]
R1 SLEE_16_DRIVER;Steganos Live Encryption Engine 16 [Driver];c:\windows\system32\drivers\sleen16.sys [01.10.2008 14:24 79104]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [22.07.2008 19:27 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22.07.2008 19:27 297752]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [09.10.2007 12:13 38144]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [28.12.2007 14:02 287232]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [31.03.2011 21:57 136176]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [31.03.2011 21:57 136176]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [23.01.2012 21:59 20464]
S3 spvads;SoundPlane Audio Device (S);c:\windows\system32\drivers\spvads.sys [04.08.2011 20:15 48128]
S4 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [23.01.2012 22:00 652872]
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-03-31 20:57]
.
2012-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-03-31 20:57]
.
2011-09-29 c:\windows\Tasks\switchSevenDays.job
- c:\programme\NCH Software\Switch\switch.exe [2011-09-29 17:53]
.
2011-09-29 c:\windows\Tasks\switchShakeIcon.job
- c:\programme\NCH Software\Switch\switch.exe [2011-09-29 17:53]
.
2011-09-29 c:\windows\Tasks\wavepadSevenDays.job
- c:\programme\NCH Software\WavePad\wavepad.exe [2011-09-29 17:53]
.
2011-09-29 c:\windows\Tasks\wavepadShakeIcon.job
- c:\programme\NCH Software\WavePad\wavepad.exe [2011-09-29 17:53]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\9noznw6a.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-02-03 13:50
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2012-02-03  13:51:41
ComboFix-quarantined-files.txt  2012-02-03 12:51
.
Vor Suchlauf: 7 Verzeichnis(se), 31.983.632.384 Bytes frei
Nach Suchlauf: 9 Verzeichnis(se), 32.199.000.064 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 288FEEEA3E7683806C0F8171364B24A2
--- --- ---


ich vertraue dir zu 100% arne und frage nicht, was ich eigentlich die letzten tage alles mit meinem rechner veranstaltet habe :dankeschoen:

ganz schön aufwendig die sache...aber für dich mit sicherheit viel aufwendiger als für mich.

viele grüße
stefan

cosinus 03.02.2012 14:52
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

stefan100 05.02.2012 10:49
hallo arne!

hat etwas gedauert. hier alle drei logs. zuerst aswMBR.

Code:
aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-02-05 10:18:49
-----------------------------
10:18:49.625    OS Version: Windows 5.1.2600 Service Pack 3
10:18:49.625    Number of processors: 2 586 0x4B02
10:18:49.625    ComputerName: PRIVAT-PC  UserName: Besitzer
10:18:49.843    Initialize success
10:25:00.156    AVAST engine defs: 12020401
10:30:36.187    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:30:36.187    Disk 0 Vendor: SAMSUNG_HD160JJ ZM100-37 Size: 152627MB BusType: 3
10:30:36.203    Disk 0 MBR read successfully
10:30:36.203    Disk 0 MBR scan
10:30:36.296    Disk 0 Windows XP default MBR code
10:30:36.296    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        65562 MB offset 63
10:30:36.296    Disk 0 Partition - 00    0F Extended LBA            87055 MB offset 134271270
10:30:36.312    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        87055 MB offset 134271333
10:30:36.312    Disk 0 scanning sectors +312560640
10:30:36.390    Disk 0 scanning C:\WINDOWS\system32\drivers
10:30:48.671    Service scanning
10:30:48.968    Service GMSIPCI E:\INSTALL\GMSIPCI.SYS **LOCKED** 21
10:30:49.656    Modules scanning
10:30:54.390    Disk 0 trace - called modules:
10:30:54.406    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
10:30:54.406    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84b89ab8]
10:30:54.406    3 CLASSPNP.SYS[f74dcfd7] -> nt!IofCallDriver -> \Device\00000068[0x84b76f18]
10:30:54.406    5 ACPI.sys[f7372620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x84b75d98]
10:30:54.796    AVAST engine scan C:\WINDOWS
10:31:06.000    AVAST engine scan C:\WINDOWS\system32
10:34:43.640    AVAST engine scan C:\WINDOWS\system32\drivers
10:35:00.812    AVAST engine scan C:\Dokumente und Einstellungen\Besitzer
10:39:40.656    AVAST engine scan C:\Dokumente und Einstellungen\All Users
10:40:35.015    Scan finished successfully
10:42:18.843    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Besitzer\Desktop\trojaner board\MBR.dat"
10:42:18.859    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Besitzer\Desktop\trojaner board\aswMBR.txt"
jetzt GMER

[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-02-04 16:09:13
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_HD160JJ rev.ZM100-37
Running: q9gxqbho.exe; Driver: C:\DOKUME~1\Besitzer\LOKALE~1\Temp\uwryapod.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                                        avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                                        avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                                        avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                                                      avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- Files - GMER 1.0.15 ----

File            D:\Musik\EpiphanyRadio -- the enlightenment of groove- smooth, ambient, trippy, jazzy, chill ..\incomplete                                                      0 bytes
File            D:\Musik\EpiphanyRadio -- the enlightenment of groove- smooth, ambient, trippy, jazzy, chill ..\incomplete\Genuine Childs - Take a Ride.mp3                      884736 bytes
File            D:\Musik\EpiphanyRadio -- the enlightenment of groove- smooth, ambient, trippy, jazzy, chill ..\incomplete\Lolight - Cotton Cradle.mp3                          2070884 bytes
File            D:\Musik\EpiphanyRadio -- the enlightenment of groove- smooth, ambient, trippy, jazzy, chill ..\incomplete\Sleepy Town Manufacture - Latatoo (Tao Calm Mix).mp3  856819 bytes

---- EOF - GMER 1.0.15 ----
--- --- ---


und zum schluss OSAM



alle scans liefen auf anhieb und tadellos.

viele grüße
stefan

stefan100 05.02.2012 10:51
war zu schnell. OSAM log fehlte.

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 15:27:31 on 04.02.2012

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 10.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"switchSevenDays.job" - "NCH Software" - C:\Programme\NCH Software\Switch\switch.exe
"switchShakeIcon.job" - "NCH Software" - C:\Programme\NCH Software\Switch\switch.exe
"wavepadSevenDays.job" - "NCH Software" - C:\Programme\NCH Software\WavePad\wavepad.exe
"wavepadShakeIcon.job" - "NCH Software" - C:\Programme\NCH Software\WavePad\wavepad.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"ImageDrive.cpl" - "Ahead Software AG" - C:\WINDOWS\system32\ImageDrive.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AEGIS Protocol (IEEE 802.1x) v3.4.5.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys
"AVG Free AVI Loader Driver x86" (AvgLdx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\Drivers\avgldx86.sys
"AVG Free On-access Scanner Minifilter Driver x86" (AvgMfx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\Drivers\avgmfx86.sys
"AVG Free8 Network Redirector" (AvgTdiX) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\Drivers\avgtdix.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Besitzer\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"GMSIPCI" (GMSIPCI) - ? - E:\INSTALL\GMSIPCI.SYS  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"NTIDrvr" (NTIDrvr) - ? - C:\Programme\muvee Technologies\muvee autoProducer 6.1\mvBurnerDll\NTIDrvr.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Realtek EAPPkt Protocol" (EAPPkt) - "Realtek" - C:\WINDOWS\System32\DRIVERS\EAPPkt.sys
"SoundPlane Audio Device (S)" (spvads) - "Windows (R) Codename Longhorn DDK provider" - C:\WINDOWS\System32\drivers\spvads.sys
"Steganos Live Encryption Engine 16 [Driver]" (SLEE_16_DRIVER) - "Softwareentwicklung Remus - ArchiCrypt " - C:\WINDOWS\system32\drivers\Sleen16.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL
{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} "XPLPPFilter Class" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG8\avgpp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{5071CDA5-D3E1-11D5-BFC0-005004A71005} "Advanced JPEG Compressor Context Menu Shell Extension" - ? -  (File not found | COM-object registry key not found)
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} "AVG8 Find Extension" - ? -  (File not found | COM-object registry key not found)
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "AVG8 Shell Extension Class" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG8\avgse.dll
{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Wcesview.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{BDAA6E01-669F-4783-8831-1648CEB8A16C} "Phoenix Backup Context Menu Shell Extension" - ? -  (File not found | COM-object registry key not found)
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{FAE0A3E0-3010-41BA-9DDC-A631394F047F} "SteganosShellExtension" - ? - C:\Programme\Steganos Safe OEM\ShellExtension.dll  (File found, but it contains no detailed information)
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx / https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\INetRepl.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\INetRepl.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} "AVG Safe Search" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG8\avgssie.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"NETGEAR WG111v3 Setup-Assistent.lnk" - ? - C:\Programme\NETGEAR\WG111v3\WG111v3.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Besitzer\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"H/PC Connection Agent" - "Microsoft Corporation" - "C:\Programme\Microsoft ActiveSync\Wcescomm.exe"
"NBJ" - "Ahead Software AG" - "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
"StartCCC" - ? - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  (File found, but it contains no detailed information)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"AVG8_TRAY" - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG8\avgtray.exe
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"NeroFilterCheck" - "Nero AG" - C:\WINDOWS\system32\NeroCheck.exe
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"SAFEOEM HotKeys" - ? - "C:\Programme\Steganos Safe OEM\SteganosHotKeyService.exe"
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
"PDFCreator" - "internet-support foehr.com" - C:\WINDOWS\system32\pdfcmnnt.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"AVG Free8 E-mail Scanner" (avg8emc) - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG8\avgemc.exe
"AVG Free8 WatchDog" (avg8wd) - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"avgrsstarter" - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\system32\avgrsstx.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---



grüße
stefan

cosinus 05.02.2012 20:07
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

stefan100 09.02.2012 23:12
nabend arne!

beides durchgeführt. malwarebytes hat nix gefunden. superantispyware allerdings 2 funde.

malwarebytes
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.09.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
Besitzer :: PRIVAT-PC [Administrator]

Schutz: Aktiviert

09.02.2012 19:00:22
mbam-log-2012-02-09 (19-00-22).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 238400
Laufzeit: 43 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
superantispyware
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/09/2012 at 11:03 PM

Application Version : 5.0.1144

Core Rules Database Version : 8221
Trace Rules Database Version: 6033

Scan type      : Complete Scan
Total Scan Time : 02:55:24

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 634
Memory threats detected  : 0
Registry items scanned    : 34039
Registry threats detected : 0
File items scanned        : 73044
File threats detected    : 2

Trojan.Agent/Gen-FakeAV
        C:\PROGRAMME\WINRAR\DEFAULT.SFX

Trojan.Agent/Gen-Nullo[Short]
        C:\SYSTEM VOLUME INFORMATION\_RESTORE{452EA5BD-4B0F-4CCE-A8C9-81B9AED9B767}\RP714\A0070735.EXE
viele grüße
stefan

cosinus 10.02.2012 12:21
Nur ein Fehlalarm und ein Überrest in der SWH, sofern das nicht auch ein Fehlalarm ist.
Rechner wieder im Lot oder sind noch Probleme offen?

stefan100 10.02.2012 14:41
nee arne, alles super!
bist ein held:party:

gibt es ein programm mit dem ein regelmäßiger scan sinn macht?
z.b. malwarebytes oder superantispyware?

da wäre ja noch das problem mit meinem lappi :wtf:
soll ich ein neues thema aufmachen? wärst du nochmal so nett?

ich wünsche dir ein schönes wochenende und vielen lieben dank nochmal an dich!

-stefan-

cosinus 10.02.2012 16:09
Ja bitte mach für das andere Gerät einen neuen Strang auf

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

stefan100 25.02.2012 15:47
hallo arne!

will gerade ein neues thema wegen meines laptops eröffnen.

wollte es so nennen:

fehlermeldung C:\Windows\system32\dbghelp.dll und ePowerTray.exe

trojaner board lässt mich das thema aber nicht eröffnen mit dem hinweis, dass ich es deutlicher bezeichnen soll.

was soll ich da noch groß dazu schreiben. mehr ist ja nicht.

hast du einen tipp?

grüße
stefan

cosinus 26.02.2012 15:26
Schreib doch eifnach sowas wie: Fehlermeldung in zwei Dateien..." oder sowas


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:22 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131