| feuermelder1 | 08.04.2010 15:52 |
GMER Log
Hallo,
ich hatte (oder habe immer nohc?) auf meinem Rechner Malware. Das äußerte sich z.B. durch eine Datei namens syspck32.exe im Autostart-Ordner und avdrn.dat im "Anwendungsdaten"-Ordner. Ich habe Malwarebytes und meinen Virenscanner (ESET Nod32) genutzt, um etliche Einträge und Dateien (zumeist unter ...\system32\drivers - vom Virenscanner als "Win32/Rootkit.Kryptik.AF trojan" gekennzeichnet ~60 Dateien mit der gleichen Größe) zu entfernen. Nach erneutem Durchlauf findet Malwarebytes als auch der Virenscanner nichts Verdächtiges mehr. Lt. Anleitung in eienm Forumsbeitrag habe ich auch noch mal GMER durchlaufen lassen, kann das Ergebnis aber nicht interpretieren. Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-04-08 16:16:12
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOKUME~1\MAXIMI~1\LOKALE~1\Temp\kxrdqpow.sys
---- System - GMER 1.0.15 ----
SSDT 89B1E580 ZwAssignProcessToJobObject
SSDT sptd.sys ZwCreateKey [0xBA6D10B0]
SSDT 89B1F100 ZwDebugActiveProcess
SSDT 89B1EB30 ZwDuplicateObject
SSDT sptd.sys ZwEnumerateKey [0xBA6D684E]
SSDT sptd.sys ZwEnumerateValueKey [0xBA6D6BEE]
SSDT sptd.sys ZwOpenKey [0xBA6D1090]
SSDT 89B1DCC0 ZwOpenProcess
SSDT 89B1DFC0 ZwOpenThread
SSDT 89B1E9C0 ZwProtectVirtualMemory
SSDT sptd.sys ZwQueryKey [0xBA6D6CC6]
SSDT sptd.sys ZwQueryValueKey [0xBA6D6B46]
SSDT 89B1E860 ZwSetContextThread
SSDT 89B1E6E0 ZwSetInformationThread
SSDT 89B1B700 ZwSetSecurityObject
SSDT sptd.sys ZwSetValueKey [0xBA6D6D58]
SSDT 89B1E420 ZwSuspendProcess
SSDT 89B1E2C0 ZwSuspendThread
SSDT 89B1DE50 ZwTerminateProcess
SSDT 89B1E150 ZwTerminateThread
SSDT 89B1EF50 ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2590 80501DC8 4 Bytes JMP D3DCA77E
.text ntkrnlpa.exe!ZwCallbackReturn + 26C0 80501EF8 4 Bytes CALL 490EA8AE
? fjypj.sys Das System kann die angegebene Datei nicht finden. !
? C:\WINDOWS\system32\drivers\sptd.sys Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
.text USBPORT.SYS!DllUnload BA35E8AC 5 Bytes JMP 8A6851B8
init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xBA342ABF]
? System32\Drivers\a4nn9e9h.SYS Das System kann den angegebenen Pfad nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe[1392] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6D1ABA] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6D1C00] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6D1B82] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6D272E] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6D2604] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6E4A9A] sptd.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8A78F1D8
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
Device \Driver\NetBT \Device\NetBT_Tcpip_{29D2AB55-9157-43F5-AD00-C271CA3F84CE} 89A9E1D8
Device \Driver\usbuhci \Device\USBPDO-0 8A5BD1D8
Device \Driver\usbuhci \Device\USBPDO-1 8A5BD1D8
Device \Driver\usbuhci \Device\USBPDO-2 8A5BD1D8
Device \Driver\usbuhci \Device\USBPDO-3 8A5BD1D8
Device \Driver\usbehci \Device\USBPDO-4 8A6A91D8
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A7211D8
Device \Driver\NetBT \Device\NetBT_Tcpip_{9C623475-FAF8-4E0D-B897-EC7801EDBAE0} 89A9E1D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A7211D8
Device \Driver\Cdrom \Device\CdRom0 8A57B1D8
Device \Driver\Cdrom \Device\CdRom1 8A57B1D8
Device \Driver\atapi \Device\Ide\IdePort0 [BA62CB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 [BA62CB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c [BA62CB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\NetBT \Device\NetBt_Wins_Export 89A9E1D8
Device \Driver\NetBT \Device\NetbiosSmb 89A9E1D8
Device \Driver\00000043 \Device\0000004e sptd.sys
Device \Driver\usbuhci \Device\USBFDO-0 8A5BD1D8
Device \Driver\usbuhci \Device\USBFDO-1 8A5BD1D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89A5F1D8
Device \Driver\usbuhci \Device\USBFDO-2 8A5BD1D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89A5F1D8
Device \Driver\usbuhci \Device\USBFDO-3 8A5BD1D8
Device \Driver\usbehci \Device\USBFDO-4 8A6A91D8
Device \Driver\Ftdisk \Device\FtControl 8A7211D8
Device \Driver\a4nn9e9h \Device\Scsi\a4nn9e9h1Port1Path0Target0Lun0 8A68D1D8
Device \Driver\a4nn9e9h \Device\Scsi\a4nn9e9h1 8A68D1D8
Device \FileSystem\Cdfs \Cdfs 89A481D8
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x05 0x8E 0xBD 0x29 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x98 0x3F 0xBE 0x1C ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC7 0x2B 0xB1 0xB1 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x62 0x2B 0x08 0xDF ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xDB 0x11 0x49 0xEB ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xCF 0x01 0x7D ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x98 0x3F 0xBE 0x1C ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x47 0x91 0xD7 0xA0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xDA 0x31 0x5B 0xF1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x34 0x44 0x60 0x5D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xCF 0x01 0x7D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x98 0x3F 0xBE 0x1C ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x5A 0xF3 0xEB 0x13 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xB7 0x16 0x05 0x61 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x34 0x44 0x60 0x5D ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xCF 0x01 0x7D ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x1E 0x9D 0xC7 0x27 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xF0 0x1B 0x3E 0x8E ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xDA 0x31 0x5B 0xF1 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x34 0x44 0x60 0x5D ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xCF 0x01 0x7D ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x1E 0x9D 0xC7 0x27 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xCD 0x4E 0xC2 0x36 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xDA 0x31 0x5B 0xF1 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x34 0x44 0x60 0x5D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -1493536636
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 1102557427
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xCF 0x01 0x7D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x1E 0x9D 0xC7 0x27 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xCD 0x4E 0xC2 0x36 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xDA 0x31 0x5B 0xF1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x34 0x44 0x60 0x5D ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xCF 0x01 0x7D ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x1E 0x9D 0xC7 0x27 ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xCD 0x4E 0xC2 0x36 ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xDA 0x31 0x5B 0xF1 ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x34 0x44 0x60 0x5D ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION 3B2C00A74762A1F89A4A9495728923323A7727628EF902060A668ACABA6B6301D84373FC0C36695852B00CD3606FC78B94899C65B857FCD451FE3DDD1D2209F50200A12F1E7E40C526EDED08597C27999BA99BA51B3C62747C6CF0EE806DB392936B0ADC3A238CB4DDD1E83FD070A64E9F8FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933FEBC9E127BECC74C5D575E7D6A3B9808C038D530D6EB345254EC4C8791926AF11C50EA4BD63E00D251FB123311B4C0DF8087C4BB1D67D1C270E8434D6917B320B7314A579AFE53E66817F7C4B3422EE644D4ADBA5C3404B77F5311A9266A976F9CA714AC74A387B4CEDE0B3C627DA889749C62ACC7F27B7F9A85CBFE45B634A913F8138261D5C2E51E26F244B82BFD799D5F8150BEA5D3F2DC4BAA42855C0968E8DF3B22A2718E7DF3B2791D9BC6633B4D8FCFFB630507BB67E58BFB6A6FFB1DEE8BA26BBC8659CE72418C182EFBEEAA9595B5169EF975585B8B6FCA3E37568A781C01CEF9D975043F80419EDDAC9BF38E4DBD1C19A2651CE1637A5F8C2FC5C75F28365367E41B978391CCAAD6EDCA99D208191E4452FD2DA68CF47E2406DCC100B94492D4D2E1DDEB8D0BCB8A0B3E717F081A40D10FCB87D816CD029A200FB9BA4E50BC5905C9F72CFE79A532801E24B8873BB93A9
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG11.00.00.01WORKSTATION 539D3ED1966AF8AFA671C2B66CE4F82E44721BCF221C3EB25FA863369F3A29150A834F4FB9B18200B1F5D4CCAFCB70182467E07FB771F6F5A069AA71A15A0CEE08CB09DD027C39AB8C71DD6F704ECF12F804904E5ADF28FB076B9701DABDF644CB9D1720AEA32F97A4368353330473A6C2E9E6266CDA1994453D20A2AF513B4857144646C835DD7EECFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6171C11EC38DE3DA6171C11EC38DE3DE69390472A03F2EDB053C3577738BD9B986A3AD0B8125D0D4BED55BAE9EAED7212F37A507A07D7F55AF18E2F47BC606E1722AD135B2297AAE981C02A05540F451E595A6B3B47DF097BD86B0D512A096BDB41BFFEFC5412111A1E5176A7D005665212669595EA394067308411DA4E6B9BE5E6B0701E4222DAABF97BE02E636C22688EE710E37A64BB66419A1B5CDE0D0FAAD7538CF6E7F4A7DEF448ED2E6F35C90E65BFE03965B51B32FC7E5384F14658117C12BA71A4071BE60ED6E3EE3FA3316451DC4F59FD5604F9F49A223481460D76DEE7A4ACBEAC5CEEE95650EA00CD32032FC7E83C7AC2A061606737816F8EC7A8B0663B7A5D0C1813D28C825344A1A7F3029A008E764B9EFE19F584B57EF4296DC4B031610D9FFCE435D30F8AFEDCF333EE02A9B06E9
---- EOF - GMER 1.0.15 ----
Kann mir jemand sagen, ob es da noch irgendetwas Auffäliges gibt?
Vielen Dank im Voraus | 