Trojaner-Board - Win Defender meldet plötzlich trojanDownloader:Win32/Kargany.A

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Win Defender meldet plötzlich trojanDownloader:Win32/Kargany.A (https://www.trojaner-board.de/99117-win-defender-meldet-ploetzlich-trojandownloader-win32-kargany-a.html)

Win Defender meldet plötzlich trojanDownloader:Win32/Kargany.A

Hallo,

heute ist etwas sehr merkwürdiges passiert. Ich war auf einer normalen, seriösen Computerspielseite und als ich mir gerade ein Video anschaute, kommt auf einmal diese Windows 7 Frage ob ich Setup9055055646894.exe ausführen möchte. Ich habe mit Nein geantwortet und daraufhin kam immer die gleiche Frage nur das die Zahlenfolge hinter dem Setup verändert war. Ich habe immer auf Nein geklickt. Das ganze hätte ewig weiter laufen können, als plötzlich Windows Defender meldet, dass er TrojanDownloader:Win32/Kargany.A gefunden hat. Ich habe löschen ausgewählt und laut Win Defender ist die Datei nun jedenfalls in Quarantäne.
Während der Aufforderung zum ausführen der Setup Datei bemerkte ich das Java Icon, vielleicht hat das was damit zu tun ?

Vor alldem frage ich mich, wie das passieren konnte. Ich habe keine Fragwürdigen Seiten aufgerufen. Alle Seiten die offen wahren surfe ich täglich an.

Microsoft hat hier eine Beschreibung dazu..Verstehen tue ich sie leider kaum.
hxxp://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FKaragany.A&ThreatID=-2147328422

Habe gerade laut Hinweis hier im Forum Malwarebytes Quick Scan durchlaufen lassen und er hat 20 infizierte Dateien gefunden... Darunter die ganzen Setup95156842xx.exe.

Zitat:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6585

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15.05.2011 20:31:04
mbam-log-2011-05-15 (20-31-04).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 154404
Laufzeit: 1 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 20

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Infar\AppData\Local\Temp\E3B0.tmp (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup1273175168.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup1280905984.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup1546186528.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup2144701664.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup2152194208.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup2477241408.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup2727730528.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup3004092320.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup3092055936.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup3322390240.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup3522564512.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup3733440320.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup3934284800.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup400786272.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup455001152.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\setup778016896.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Local\Temp\0.027178985112120913.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Roaming\Adobe\plugs\mmc188.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Infar\AppData\Roaming\Adobe\plugs\mmc96.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Bin gerade ziemlich erstaunt :eek:.. Avast hat sich dazu noch garnicht gemeldet.
Wie sollte ich nun weiter vorgehen, kann mir da jemand helfen ?

lg
infar

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL-Custom:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hi Arne,

hier einmal der Full Scan von Malwarebyte:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6588
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

16.05.2011 14:33:02

mbam-log-2011-05-16 (14-33-02).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)

Durchsuchte Objekte: 396767

Laufzeit: 52 Minute(n), 17 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

OTL Scan:

Code:

OTL logfile created on: 16.05.2011 14:46:07 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\***\Downloads

64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 5,00 Gb Available Physical Memory | 60,00% Memory free

16,00 Gb Paging File | 13,00 Gb Available in Paging File | 81,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 931,41 Gb Total Space | 785,19 Gb Free Space | 84,30% Space Free | Partition Type: NTFS

Drive E: | 1397,27 Gb Total Space | 658,46 Gb Free Space | 47,12% Space Free | Partition Type: NTFS

 

Computer Name: *** | User Name: ***| Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\***\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Users\***\AppData\Local\Temp\NEV695C.exe (Microsoft Corporation)

PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)

PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\***\Downloads\OTL.exe (OldTimer Tools)

MOD - C:\Programme\Alwil Software\Avast5\snxhk.dll (AVAST Software)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)

DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)

DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros)

DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros)

DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros)

DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros)

DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros)

DRV:64bit: - (ATHDFU) -- C:\Windows\SysNative\drivers\AthDfu.sys (Windows (R) Win 7 DDK provider)

DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros)

DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (mv91xx) -- C:\Windows\SysNative\drivers\mv91xx.sys (Marvell Semiconductor, Inc.)

DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)

DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddr

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 14 41 C9 1B C6 B8 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"

FF - prefs.js..extensions.enabledItems: de_DE@dicts.j3e.de:20101229

FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.0

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..keyword.URL: "hxxp://start.facemoods.com/results.php?f=5&a=ddr&q="

 

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.04.29 18:29:54 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.24 16:38:40 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.04.30 09:46:29 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

 

[2011.01.20 22:43:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2011.01.20 22:43:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2011.05.14 21:31:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\7whi04bs.default\extensions

[2011.04.20 16:15:24 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\7whi04bs.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}

[2011.03.25 06:30:50 | 000,000,000 | ---D | M] (WÃ¶rterbuch Deutsch (de-DE), Hunspell-unterstÃ¼tzt) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\7whi04bs.default\extensions\de_DE@dicts.j3e.de

[2011.03.24 16:38:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.01.21 19:45:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.21 22:43:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

File not found (No name found) -- 

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WHI04BS.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2011.04.29 18:29:53 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2010.12.13 14:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKCU..\Run: [3A1BE7505F6BED46] C:\winxnet.bin\winxnet.bin.exe ()

O4 - HKCU..\Run: [FD5721C245EA0CBD] C:\x86winc.bin\x86winc.bin.exe ()

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVEMon.lnk = C:\Program Files (x86)\CCP\EVEMON\EVEMon.exe (EVEMon Development Team)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found

O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

O13 - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: AthBtTray - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)

MsConfig:64bit - StartUpReg: AtherosBtStack - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)

MsConfig:64bit - StartUpReg: FD5721C245EA0CBD - hkey= - key= - C:\x86winc.bin\x86winc.bin.exe ()

MsConfig:64bit - StartUpReg: GAINWARD - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig:64bit - StartUpReg: Ulead AutoDetector v2 - hkey= - key= - C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe (Ulead Systems, Inc.)

MsConfig:64bit - StartUpReg: UPI11_COM - hkey= - key= - C:\Windows\SysWow64\regsvr32.exe (Microsoft Corporation)

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.15 19:58:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2011.05.15 19:58:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

[2011.05.15 19:58:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.15 19:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.05.15 19:57:56 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2011.05.15 19:57:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2011.05.07 09:19:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Technology Lighthouse

[2011.05.05 20:02:54 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Felgen

[2011.04.26 11:18:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks

[2011.04.23 13:12:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\World_of_Tanks

[2011.04.21 12:14:49 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ElevatedDiagnostics

[2011.04.21 12:10:27 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\OLYMPUS

[2011.04.21 12:10:01 | 000,000,000 | ---D | C] -- C:\Programme\DIFX

[2011.04.21 12:05:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0

[2011.04.21 12:05:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OLYMPUS

[2011.04.20 20:28:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Cassandra's_Light

[2011.04.20 20:28:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\My POS

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.16 11:40:12 | 000,013,424 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.16 11:40:12 | 000,013,424 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.16 11:37:24 | 001,611,396 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.05.16 11:37:24 | 000,696,354 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2011.05.16 11:37:24 | 000,651,672 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.05.16 11:37:24 | 000,147,650 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2011.05.16 11:37:24 | 000,120,604 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.05.16 11:33:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.16 11:32:52 | 2132,025,343 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.15 19:58:00 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes'.lnk

[2011.05.15 14:51:42 | 000,000,000 | ---- | M] () -- C:\Users\***\2gweorjqjutp92vjy9gake

[2011.04.26 11:18:42 | 000,001,064 | ---- | M] () -- C:\Users\Public\Desktop\World of Tanks.lnk

[2011.04.20 20:28:52 | 000,001,330 | ---- | M] () -- C:\Users\***\Desktop\MyPOS.lnk

 
 ========== Files Created - No Company Name ==========

 

[2011.05.15 19:58:00 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes'.lnk

[2011.05.15 14:51:42 | 000,000,000 | ---- | C] () -- C:\Users\***\2gweorjqjutp92vjy9gake

[2011.04.26 11:18:42 | 000,001,064 | ---- | C] () -- C:\Users\Public\Desktop\World of Tanks.lnk

[2011.04.20 20:28:52 | 000,001,330 | ---- | C] () -- C:\Users\***\Desktop\MyPOS.lnk

[2011.01.21 21:33:16 | 001,574,212 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.01.20 19:05:27 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.01.20 19:05:23 | 000,023,926 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

[2010.09.02 05:07:24 | 000,007,764 | ---- | C] () -- C:\Windows\cadx2.ini

[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2009.04.02 14:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS

 
 ========== LOP Check ==========

 

[2011.04.13 16:07:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EVEMon

[2011.01.30 14:26:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ImgBurn

[2011.02.24 14:51:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.04.17 10:18:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RIFT

[2011.01.20 22:43:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird

[2011.01.20 20:41:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ulead Systems

[2011.01.29 16:37:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\wargaming.net

[2011.05.06 14:07:30 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.05.15 14:51:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe

[2011.05.10 12:56:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\dvdcss

[2011.04.13 16:07:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EVEMon

[2011.01.20 19:03:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities

[2011.01.30 14:26:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ImgBurn

[2011.01.20 19:32:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InstallShield

[2011.01.20 19:20:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia

[2011.05.15 19:58:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2009.07.14 20:18:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs

[2011.04.21 16:28:24 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft

[2011.01.20 19:43:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla

[2011.02.24 14:51:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.04.17 10:18:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RIFT

[2011.01.20 22:43:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird

[2011.01.20 20:41:26 | 000,000,000 | ---D | M] -- C:\Users***\AppData\Roaming\Ulead Systems

[2011.04.13 19:22:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\vlc

[2011.01.29 16:37:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\wargaming.net

[2011.01.22 20:17:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

lg
Ben

Hat MBAM also nur im Quickscan was gefunden? Du hast jetzt MBAM insgesamt wie oft scannen lassen?

Insgesamt 2 mal Quickscan und jetzt einmal den Full Scan. Hab aber die Dateien aus der Quarantäne via MBAN gelöscht, deshalb werden sie wohl nicht wieder angezeigt.

lg

Zitat:

Insgesamt 2 mal Quickscan und jetzt einmal den Full Scan.

Also müsste es drei Logs geben, ich seh aber nur zwei hier im Strang...

Achso, habe den zweiten Quick Scan nicht weiter dokumentiert, da nichts mehr gefunden wurde.

lg

Nagut, dann kann man den ignorieren. Ich frag nur so penetrant nach, weil es wirklich einige gibt, die Logs mit anderen Funde einfach weglassen :pfeiff:

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

:OTL

O4 - HKCU..\Run: [3A1BE7505F6BED46] C:\winxnet.bin\winxnet.bin.exe ()

O4 - HKCU..\Run: [FD5721C245EA0CBD] C:\x86winc.bin\x86winc.bin.exe ()

[2011.05.15 14:51:42 | 000,000,000 | ---- | C] () -- C:\Users\***\2gweorjqjutp92vjy9gake

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Ok, habe es wie beschrieben durchgeführt.
Hier das Ergebnis:

Code:

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\3A1BE7505F6BED46 deleted successfully.

C:\winxnet.bin\winxnet.bin.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\FD5721C245EA0CBD deleted successfully.

File C:\x86winc.bin\x86winc.bin.exe not found.

C:\Users\***\2gweorjqjutp92vjy9gake moved successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.22.3 log created on 05172011_150124

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hat wohl nichts weiter gefunden, hier der Log:

Code:

2011/05/17 15:35:13.0911 3192        TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29

2011/05/17 15:35:14.0279 3192        ================================================================================

2011/05/17 15:35:14.0279 3192        SystemInfo:

2011/05/17 15:35:14.0279 3192        

2011/05/17 15:35:14.0279 3192        OS Version: 6.1.7600 ServicePack: 0.0

2011/05/17 15:35:14.0279 3192        Product type: Workstation

2011/05/17 15:35:14.0280 3192        ComputerName: ***

2011/05/17 15:35:14.0280 3192        UserName: ***

2011/05/17 15:35:14.0280 3192        Windows directory: C:\Windows

2011/05/17 15:35:14.0280 3192        System windows directory: C:\Windows

2011/05/17 15:35:14.0280 3192        Running under WOW64

2011/05/17 15:35:14.0280 3192        Processor architecture: Intel x64

2011/05/17 15:35:14.0280 3192        Number of processors: 4

2011/05/17 15:35:14.0280 3192        Page size: 0x1000

2011/05/17 15:35:14.0280 3192        Boot type: Normal boot

2011/05/17 15:35:14.0280 3192        ================================================================================

2011/05/17 15:35:14.0519 3192        Initialize success

2011/05/17 15:35:28.0955 3792        ================================================================================

2011/05/17 15:35:28.0955 3792        Scan started

2011/05/17 15:35:28.0955 3792        Mode: Manual; 

2011/05/17 15:35:28.0955 3792        ================================================================================

2011/05/17 15:35:36.0601 3792        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys

2011/05/17 15:35:36.0620 3792        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys

2011/05/17 15:35:36.0639 3792        AcpiPmi         (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys

2011/05/17 15:35:36.0683 3792        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

2011/05/17 15:35:36.0705 3792        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

2011/05/17 15:35:36.0717 3792        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

2011/05/17 15:35:36.0749 3792        AFD             (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys

2011/05/17 15:35:36.0766 3792        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys

2011/05/17 15:35:36.0779 3792        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys

2011/05/17 15:35:36.0797 3792        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys

2011/05/17 15:35:36.0809 3792        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

2011/05/17 15:35:36.0827 3792        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

2011/05/17 15:35:36.0855 3792        amdsata         (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys

2011/05/17 15:35:36.0890 3792        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

2011/05/17 15:35:36.0907 3792        amdxata         (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys

2011/05/17 15:35:36.0959 3792        AppID           (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

2011/05/17 15:35:37.0000 3792        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

2011/05/17 15:35:37.0041 3792        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

2011/05/17 15:35:37.0171 3792        aswFsBlk        (f810e3ea3d1f3c3ba26f2f4719bdca4f) C:\Windows\system32\drivers\aswFsBlk.sys

2011/05/17 15:35:37.0217 3792        aswMonFlt       (3687fd9cedf56d3b9f18923f4e14f3f9) C:\Windows\system32\drivers\aswMonFlt.sys

2011/05/17 15:35:37.0233 3792        aswRdr          (e99e48596b35e5d5240104bcd61b3471) C:\Windows\system32\drivers\aswRdr.sys

2011/05/17 15:35:37.0297 3792        aswSnx          (84ad8fb3fd2efa52d8599a0028bbb6fe) C:\Windows\system32\drivers\aswSnx.sys

2011/05/17 15:35:37.0315 3792        aswSP           (8cba6cc5dca9e3829f1792bf98f06901) C:\Windows\system32\drivers\aswSP.sys

2011/05/17 15:35:37.0337 3792        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/05/17 15:35:37.0346 3792        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys

2011/05/17 15:35:37.0365 3792        AthBTPort       (aaae03f8eda817ec28c5445193ea8bf3) C:\Windows\system32\DRIVERS\btath_flt.sys

2011/05/17 15:35:37.0389 3792        ATHDFU          (4ecc791539f23982411864037d1ac8fc) C:\Windows\system32\Drivers\AthDfu.sys

2011/05/17 15:35:37.0422 3792        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

2011/05/17 15:35:37.0453 3792        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

2011/05/17 15:35:37.0504 3792        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

2011/05/17 15:35:37.0533 3792        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

2011/05/17 15:35:37.0574 3792        bowser          (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys

2011/05/17 15:35:37.0584 3792        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

2011/05/17 15:35:37.0594 3792        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

2011/05/17 15:35:37.0612 3792        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

2011/05/17 15:35:37.0637 3792        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

2011/05/17 15:35:37.0646 3792        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

2011/05/17 15:35:37.0655 3792        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

2011/05/17 15:35:37.0687 3792        BTATH_A2DP      (3b1b573371b206d1d5f25e0ef5fcd6d6) C:\Windows\system32\drivers\btath_a2dp.sys

2011/05/17 15:35:37.0754 3792        BTATH_BUS       (2d0446336d9db55a742b999ec16adf15) C:\Windows\system32\DRIVERS\btath_bus.sys

2011/05/17 15:35:37.0785 3792        BTATH_HCRP      (9a9694bbeb2849eaf95dffcae5df02ad) C:\Windows\system32\DRIVERS\btath_hcrp.sys

2011/05/17 15:35:37.0807 3792        BTATH_LWFLT     (fc0a8075ddf2e9c66267aec91e0676f9) C:\Windows\system32\DRIVERS\btath_lwflt.sys

2011/05/17 15:35:37.0826 3792        BTATH_RCP       (5eb4815cbddba4541f2380dae6e269ab) C:\Windows\system32\DRIVERS\btath_rcp.sys

2011/05/17 15:35:37.0875 3792        BtFilter        (0ecede7b33cfd9a52a61220abbd09a50) C:\Windows\system32\DRIVERS\btfilter.sys

2011/05/17 15:35:37.0886 3792        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys

2011/05/17 15:35:37.0895 3792        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

2011/05/17 15:35:37.0923 3792        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys

2011/05/17 15:35:37.0936 3792        BTHPORT         (a51fa9d0e85d5adabef72e67f386309c) C:\Windows\system32\Drivers\BTHport.sys

2011/05/17 15:35:37.0962 3792        BTHUSB          (f740b9a16b2c06700f2130e19986bf3b) C:\Windows\system32\Drivers\BTHUSB.sys

2011/05/17 15:35:38.0002 3792        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/05/17 15:35:38.0019 3792        cdrom           (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

2011/05/17 15:35:38.0041 3792        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

2011/05/17 15:35:38.0073 3792        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

2011/05/17 15:35:38.0161 3792        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/05/17 15:35:38.0209 3792        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys

2011/05/17 15:35:38.0257 3792        CNG             (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys

2011/05/17 15:35:38.0321 3792        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

2011/05/17 15:35:38.0368 3792        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys

2011/05/17 15:35:38.0394 3792        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

2011/05/17 15:35:38.0442 3792        CSC             (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys

2011/05/17 15:35:38.0470 3792        DfsC            (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys

2011/05/17 15:35:38.0494 3792        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

2011/05/17 15:35:38.0526 3792        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

2011/05/17 15:35:38.0563 3792        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

2011/05/17 15:35:38.0636 3792        DXGKrnl         (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys

2011/05/17 15:35:38.0692 3792        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

2011/05/17 15:35:38.0796 3792        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

2011/05/17 15:35:38.0820 3792        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys

2011/05/17 15:35:38.0847 3792        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

2011/05/17 15:35:38.0863 3792        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

2011/05/17 15:35:38.0874 3792        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

2011/05/17 15:35:38.0897 3792        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

2011/05/17 15:35:38.0909 3792        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

2011/05/17 15:35:38.0918 3792        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/05/17 15:35:38.0938 3792        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

2011/05/17 15:35:38.0963 3792        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

2011/05/17 15:35:38.0982 3792        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

2011/05/17 15:35:39.0011 3792        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys

2011/05/17 15:35:39.0029 3792        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

2011/05/17 15:35:39.0053 3792        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

2011/05/17 15:35:39.0088 3792        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

2011/05/17 15:35:39.0192 3792        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/05/17 15:35:39.0230 3792        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

2011/05/17 15:35:39.0266 3792        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

2011/05/17 15:35:39.0284 3792        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

2011/05/17 15:35:39.0306 3792        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

2011/05/17 15:35:39.0327 3792        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys

2011/05/17 15:35:39.0357 3792        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

2011/05/17 15:35:39.0377 3792        hwpolicy        (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

2011/05/17 15:35:39.0412 3792        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/05/17 15:35:39.0454 3792        iaStorV         (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys

2011/05/17 15:35:39.0484 3792        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

2011/05/17 15:35:39.0558 3792        IntcAzAudAddService (dab7318ccfa8081200d5b7b486793f74) C:\Windows\system32\drivers\RTKVHD64.sys

2011/05/17 15:35:39.0606 3792        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys

2011/05/17 15:35:39.0628 3792        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

2011/05/17 15:35:39.0646 3792        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/05/17 15:35:39.0664 3792        IPMIDRV         (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys

2011/05/17 15:35:39.0756 3792        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

2011/05/17 15:35:39.0775 3792        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

2011/05/17 15:35:39.0825 3792        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys

2011/05/17 15:35:39.0898 3792        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/05/17 15:35:39.0946 3792        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/05/17 15:35:39.0974 3792        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/05/17 15:35:39.0990 3792        KSecDD          (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys

2011/05/17 15:35:40.0022 3792        KSecPkg         (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys

2011/05/17 15:35:40.0036 3792        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

2011/05/17 15:35:40.0064 3792        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

2011/05/17 15:35:40.0096 3792        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

2011/05/17 15:35:40.0113 3792        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

2011/05/17 15:35:40.0131 3792        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

2011/05/17 15:35:40.0147 3792        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

2011/05/17 15:35:40.0169 3792        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

2011/05/17 15:35:40.0189 3792        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

2011/05/17 15:35:40.0218 3792        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

2011/05/17 15:35:40.0266 3792        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

2011/05/17 15:35:40.0284 3792        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

2011/05/17 15:35:40.0297 3792        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

2011/05/17 15:35:40.0314 3792        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

2011/05/17 15:35:40.0328 3792        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

2011/05/17 15:35:40.0352 3792        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys

2011/05/17 15:35:40.0379 3792        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

2011/05/17 15:35:40.0451 3792        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

2011/05/17 15:35:40.0494 3792        mrxsmb          (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/05/17 15:35:40.0529 3792        mrxsmb10        (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/05/17 15:35:40.0649 3792        mrxsmb20        (b081069251c8e9f42cb8769d07148f9c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/05/17 15:35:40.0691 3792        msahci          (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys

2011/05/17 15:35:40.0966 3792        msdsm           (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys

2011/05/17 15:35:41.0057 3792        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

2011/05/17 15:35:41.0102 3792        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

2011/05/17 15:35:41.0125 3792        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys

2011/05/17 15:35:41.0161 3792        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

2011/05/17 15:35:41.0176 3792        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/05/17 15:35:41.0188 3792        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

2011/05/17 15:35:41.0214 3792        MsRPC           (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

2011/05/17 15:35:41.0231 3792        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/05/17 15:35:41.0255 3792        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

2011/05/17 15:35:41.0270 3792        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

2011/05/17 15:35:41.0288 3792        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

2011/05/17 15:35:41.0327 3792        mv91xx          (34d08c9c64f657d194961e96c47e9c69) C:\Windows\system32\DRIVERS\mv91xx.sys

2011/05/17 15:35:41.0350 3792        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

2011/05/17 15:35:41.0379 3792        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

2011/05/17 15:35:41.0402 3792        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

2011/05/17 15:35:41.0427 3792        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/05/17 15:35:41.0445 3792        Ndisuio         (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/05/17 15:35:41.0467 3792        NdisWan         (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/05/17 15:35:41.0477 3792        NDProxy         (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

2011/05/17 15:35:41.0489 3792        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

2011/05/17 15:35:41.0509 3792        NetBT           (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

2011/05/17 15:35:41.0661 3792        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

2011/05/17 15:35:41.0743 3792        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

2011/05/17 15:35:41.0762 3792        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

2011/05/17 15:35:41.0821 3792        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys

2011/05/17 15:35:41.0862 3792        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

2011/05/17 15:35:41.0900 3792        nusb3hub        (285acec1b13a15ba520aae06bacb9cff) C:\Windows\system32\DRIVERS\nusb3hub.sys

2011/05/17 15:35:41.0929 3792        nusb3xhc        (f6d625ff7b56bb6ea063f0d3a5bbc996) C:\Windows\system32\DRIVERS\nusb3xhc.sys

2011/05/17 15:35:41.0995 3792        NVHDA           (857fb74754ebff94ee3ad40788740916) C:\Windows\system32\drivers\nvhda64v.sys

2011/05/17 15:35:42.0290 3792        nvlddmkm        (f12c5f17d48d9f5c70e4408b3ccb5443) C:\Windows\system32\DRIVERS\nvlddmkm.sys

2011/05/17 15:35:42.0378 3792        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys

2011/05/17 15:35:42.0408 3792        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys

2011/05/17 15:35:42.0497 3792        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys

2011/05/17 15:35:42.0554 3792        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys

2011/05/17 15:35:42.0628 3792        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

2011/05/17 15:35:42.0672 3792        partmgr         (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

2011/05/17 15:35:42.0700 3792        pci             (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys

2011/05/17 15:35:42.0726 3792        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys

2011/05/17 15:35:42.0746 3792        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

2011/05/17 15:35:42.0767 3792        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

2011/05/17 15:35:42.0788 3792        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

2011/05/17 15:35:42.0889 3792        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

2011/05/17 15:35:42.0899 3792        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

2011/05/17 15:35:42.0974 3792        Psched          (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

2011/05/17 15:35:43.0220 3792        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

2011/05/17 15:35:43.0347 3792        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

2011/05/17 15:35:43.0421 3792        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

2011/05/17 15:35:43.0446 3792        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

2011/05/17 15:35:43.0470 3792        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

2011/05/17 15:35:43.0494 3792        Rasl2tp         (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/05/17 15:35:43.0517 3792        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/05/17 15:35:43.0537 3792        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

2011/05/17 15:35:43.0552 3792        rdbss           (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

2011/05/17 15:35:43.0563 3792        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

2011/05/17 15:35:43.0572 3792        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/05/17 15:35:43.0626 3792        RDPDR           (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys

2011/05/17 15:35:43.0637 3792        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

2011/05/17 15:35:43.0651 3792        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

2011/05/17 15:35:43.0668 3792        RDPWD           (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys

2011/05/17 15:35:43.0843 3792        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys

2011/05/17 15:35:44.0200 3792        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys

2011/05/17 15:35:44.0246 3792        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

2011/05/17 15:35:44.0286 3792        RTL8167         (2777226ee8bf50b059d7a7c90177e99c) C:\Windows\system32\DRIVERS\Rt64win7.sys

2011/05/17 15:35:44.0321 3792        s3cap           (88af6e02ab19df7fd07ecdf9c91e9af6) C:\Windows\system32\DRIVERS\vms3cap.sys

2011/05/17 15:35:44.0352 3792        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys

2011/05/17 15:35:44.0409 3792        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

2011/05/17 15:35:44.0429 3792        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

2011/05/17 15:35:44.0459 3792        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

2011/05/17 15:35:44.0476 3792        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

2011/05/17 15:35:44.0505 3792        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

2011/05/17 15:35:44.0531 3792        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/05/17 15:35:44.0541 3792        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys

2011/05/17 15:35:44.0609 3792        sffp_sd         (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/05/17 15:35:44.0624 3792        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

2011/05/17 15:35:44.0652 3792        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

2011/05/17 15:35:44.0669 3792        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

2011/05/17 15:35:44.0702 3792        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

2011/05/17 15:35:44.0777 3792        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

2011/05/17 15:35:44.0848 3792        srv             (148d50904d2a0df29a19778715eb35bb) C:\Windows\system32\DRIVERS\srv.sys

2011/05/17 15:35:44.0866 3792        srv2            (ce2189fe31d36678ac9eb7ddee08ec96) C:\Windows\system32\DRIVERS\srv2.sys

2011/05/17 15:35:44.0901 3792        srvnet          (cb69edeb069a49577592835659cd0e46) C:\Windows\system32\DRIVERS\srvnet.sys

2011/05/17 15:35:44.0930 3792        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

2011/05/17 15:35:44.0949 3792        storflt         (ffd7a6f15b14234b5b0e5d49e7961895) C:\Windows\system32\DRIVERS\vmstorfl.sys

2011/05/17 15:35:44.0977 3792        storvsc         (8fccbefc5c440b3c23454656e551b09a) C:\Windows\system32\DRIVERS\storvsc.sys

2011/05/17 15:35:44.0993 3792        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

2011/05/17 15:35:45.0052 3792        Tcpip           (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys

2011/05/17 15:35:45.0110 3792        TCPIP6          (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys

2011/05/17 15:35:45.0164 3792        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

2011/05/17 15:35:45.0185 3792        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

2011/05/17 15:35:45.0195 3792        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

2011/05/17 15:35:45.0246 3792        tdx             (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

2011/05/17 15:35:45.0258 3792        TermDD          (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys

2011/05/17 15:35:45.0296 3792        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/05/17 15:35:45.0321 3792        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

2011/05/17 15:35:45.0342 3792        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

2011/05/17 15:35:45.0363 3792        udfs            (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys

2011/05/17 15:35:45.0389 3792        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys

2011/05/17 15:35:45.0406 3792        umbus           (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

2011/05/17 15:35:45.0425 3792        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

2011/05/17 15:35:45.0458 3792        usbccgp         (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/05/17 15:35:45.0478 3792        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys

2011/05/17 15:35:45.0538 3792        usbehci         (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\drivers\usbehci.sys

2011/05/17 15:35:45.0669 3792        usbhub          (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys

2011/05/17 15:35:46.0086 3792        usbohci         (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys

2011/05/17 15:35:46.0115 3792        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

2011/05/17 15:35:46.0155 3792        USBSTOR         (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\drivers\USBSTOR.SYS

2011/05/17 15:35:46.0196 3792        usbuhci         (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys

2011/05/17 15:35:46.0218 3792        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys

2011/05/17 15:35:46.0336 3792        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/05/17 15:35:46.0385 3792        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

2011/05/17 15:35:46.0407 3792        vhdmp           (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys

2011/05/17 15:35:46.0429 3792        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys

2011/05/17 15:35:46.0458 3792        vmbus           (1501699d7eda984abc4155a7da5738d1) C:\Windows\system32\DRIVERS\vmbus.sys

2011/05/17 15:35:46.0490 3792        VMBusHID        (ae10c35761889e65a6f7176937c5592c) C:\Windows\system32\DRIVERS\VMBusHID.sys

2011/05/17 15:35:46.0512 3792        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys

2011/05/17 15:35:46.0535 3792        volmgrx         (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

2011/05/17 15:35:46.0558 3792        volsnap         (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys

2011/05/17 15:35:46.0583 3792        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

2011/05/17 15:35:46.0605 3792        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys

2011/05/17 15:35:46.0624 3792        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

2011/05/17 15:35:46.0644 3792        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

2011/05/17 15:35:46.0651 3792        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

2011/05/17 15:35:46.0720 3792        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

2011/05/17 15:35:46.0754 3792        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

2011/05/17 15:35:46.0794 3792        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

2011/05/17 15:35:46.0808 3792        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

2011/05/17 15:35:46.0875 3792        WinUsb          (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys

2011/05/17 15:35:46.0892 3792        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

2011/05/17 15:35:46.0963 3792        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

2011/05/17 15:35:47.0028 3792        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys

2011/05/17 15:35:47.0120 3792        WUDFRd          (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/05/17 15:35:47.0173 3792        ================================================================================

2011/05/17 15:35:47.0173 3792        Scan finished

2011/05/17 15:35:47.0173 3792        ================================================================================

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Erledigt.

Code:

ComboFix 11-05-16.03 - *** 17.05.2011  15:52:40.1.4 - x64

Microsoft Windows 7 Professional   6.1.7600.0.1252.49.1031.18.8172.6604 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\cofi.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\***\AppData\Roaming\Adobe\plugs

c:\users\***\AppData\Roaming\Adobe\plugs\mmc19005336.txt

c:\users\***\AppData\Roaming\Adobe\shed

c:\users\***\AppData\Roaming\Adobe\shed\thr1.chm

C:\winxnet.bin

c:\winxnet.bin\config.bin

C:\x86winc.bin

c:\x86winc.bin\config.bin

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-17 bis 2011-05-17  ))))))))))))))))))))))))))))))

.

.

2011-05-17 13:55 . 2011-05-17 13:55        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-17 13:01 . 2011-05-17 13:01        --------        d-----w-        C:\_OTL

2011-05-15 17:58 . 2011-05-15 17:58        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2011-05-15 17:58 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-05-15 17:57 . 2011-05-15 17:57        --------        d-----w-        c:\programdata\Malwarebytes

2011-05-15 17:57 . 2011-05-15 17:58        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2011-05-15 17:57 . 2010-12-20 16:08        24152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-14 17:10 . 2011-04-09 06:58        142336        ----a-w-        c:\windows\system32\poqexec.exe

2011-05-14 17:10 . 2011-04-09 05:56        123904        ----a-w-        c:\windows\SysWow64\poqexec.exe

2011-05-13 12:40 . 2011-04-11 08:21        8802128        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E1316F9-5E2E-405B-9B8B-C3F7FF4446C0}\mpengine.dll

2011-05-11 16:39 . 2011-04-09 06:45        5509504        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-05-11 16:39 . 2011-04-09 06:13        3957632        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2011-05-11 16:39 . 2011-04-09 06:13        3901824        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2011-05-11 16:39 . 2011-03-25 03:23        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2011-05-11 16:39 . 2011-03-25 03:23        98816        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2011-05-11 16:39 . 2011-03-25 03:23        324608        ----a-w-        c:\windows\system32\drivers\usbport.sys

2011-05-11 16:39 . 2011-03-25 03:22        52224        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2011-05-11 16:39 . 2011-03-25 03:22        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2011-05-11 16:39 . 2011-03-25 03:22        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2011-05-11 16:39 . 2011-03-25 03:22        7936        ----a-w-        c:\windows\system32\drivers\usbd.sys

2011-05-07 07:19 . 2011-05-07 07:19        --------        d-----w-        c:\program files (x86)\Technology Lighthouse

2011-04-27 03:34 . 2011-02-18 06:33        31232        ----a-w-        c:\windows\system32\prevhost.exe

2011-04-27 03:34 . 2011-02-18 05:33        31232        ----a-w-        c:\windows\SysWow64\prevhost.exe

2011-04-23 11:12 . 2011-05-17 13:37        --------        d-----w-        c:\program files (x86)\World_of_Tanks

2011-04-21 10:14 . 2011-05-15 12:54        --------        d-----w-        c:\users\***\AppData\Local\ElevatedDiagnostics

2011-04-21 10:10 . 2011-04-21 10:10        --------        d-----w-        c:\users\***\AppData\Local\OLYMPUS

2011-04-21 10:10 . 2011-04-21 10:10        --------        d-----w-        c:\program files\DIFX

2011-04-21 10:05 . 2011-04-21 10:05        --------        d-----w-        c:\program files (x86)\MSXML 4.0

2011-04-21 10:05 . 2005-09-22 22:07        95744        ----a-r-        c:\windows\SysWow64\atl80.dll

2011-04-21 10:05 . 2005-09-22 22:05        626688        ----a-r-        c:\windows\SysWow64\msvcr80.dll

2011-04-21 10:05 . 2005-09-22 22:05        548864        ----a-r-        c:\windows\SysWow64\msvcp80.dll

2011-04-21 10:05 . 2011-04-24 12:15        --------        d-----w-        c:\program files (x86)\OLYMPUS

2011-04-20 18:28 . 2011-04-20 18:28        --------        d-----w-        c:\users\***\AppData\Local\Cassandra's_Light

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-11 06:19 . 2011-04-15 12:16        1359872        ----a-w-        c:\windows\system32\mfc42u.dll

2011-03-11 06:19 . 2011-04-15 12:16        1395712        ----a-w-        c:\windows\system32\mfc42.dll

2011-03-11 05:40 . 2011-04-15 12:16        1137664        ----a-w-        c:\windows\SysWow64\mfc42.dll

2011-03-11 05:40 . 2011-04-15 12:16        1164288        ----a-w-        c:\windows\SysWow64\mfc42u.dll

2011-03-08 06:14 . 2011-04-15 12:16        976896        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-08 05:38 . 2011-04-15 12:16        740864        ----a-w-        c:\windows\SysWow64\inetcomm.dll

2011-03-04 06:17 . 2011-04-27 03:35        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:17 . 2011-04-27 03:35        347648        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2011-03-03 06:17 . 2011-04-15 12:16        182272        ----a-w-        c:\windows\system32\dnsrslvr.dll

2011-03-03 06:14 . 2011-04-15 12:16        30208        ----a-w-        c:\windows\system32\dnscacheugc.exe

2011-03-03 05:27 . 2011-04-15 12:16        28672        ----a-w-        c:\windows\SysWow64\dnscacheugc.exe

2011-03-03 03:58 . 2011-04-15 12:16        3133440        ----a-w-        c:\windows\system32\win32k.sys

2011-02-24 06:30 . 2011-04-15 12:16        476160        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-02-24 06:29 . 2011-04-15 12:16        1197056        ----a-w-        c:\windows\system32\wininet.dll

2011-02-24 06:24 . 2011-04-15 12:16        57856        ----a-w-        c:\windows\system32\licmgr10.dll

2011-02-24 05:32 . 2011-04-15 12:16        288256        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2011-02-24 05:32 . 2011-04-15 12:16        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

2011-02-24 05:30 . 2011-04-15 12:16        44544        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2011-02-24 05:05 . 2011-04-15 12:16        482816        ----a-w-        c:\windows\system32\html.iec

2011-02-24 04:24 . 2011-04-15 12:16        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2011-02-24 04:23 . 2011-04-15 12:16        386048        ----a-w-        c:\windows\SysWow64\html.iec

2011-02-24 03:50 . 2011-04-15 12:16        1638912        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2011-02-23 15:04 . 2011-01-21 16:36        40648        ----a-w-        c:\windows\avastSS.scr

2011-02-23 15:04 . 2011-01-21 16:36        190016        ----a-w-        c:\windows\SysWow64\aswBoot.exe

2011-02-23 15:04 . 2011-01-21 16:37        238968        ----a-w-        c:\windows\system32\aswBoot.exe

2011-02-23 14:57 . 2011-01-21 16:37        280408        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2011-02-23 14:57 . 2011-03-19 19:33        505176        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2011-02-23 14:55 . 2011-01-21 16:37        31064        ----a-w-        c:\windows\system32\drivers\aswRdr.sys

2011-02-23 14:55 . 2011-01-21 16:37        64344        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2011-02-23 14:54 . 2011-01-21 16:37        22360        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2011-02-23 05:16 . 2011-04-15 12:16        461312        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-23 05:16 . 2011-04-15 12:16        401920        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-02-23 05:15 . 2011-04-15 12:16        161792        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-02-23 05:15 . 2011-04-15 12:16        157696        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-23 05:15 . 2011-04-15 12:16        286720        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-02-23 05:15 . 2011-04-15 12:16        126464        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-02-23 05:15 . 2011-04-15 12:16        90624        ----a-w-        c:\windows\system32\drivers\bowser.sys

2011-02-19 06:37 . 2011-03-10 05:08        1135104        ----a-w-        c:\windows\system32\FntCache.dll

2011-02-19 06:37 . 2011-03-10 05:08        1540608        ----a-w-        c:\windows\system32\DWrite.dll

2011-02-19 06:36 . 2011-03-10 05:08        902656        ----a-w-        c:\windows\system32\d2d1.dll

2011-02-19 06:36 . 2011-04-15 12:16        46080        ----a-w-        c:\windows\system32\atmlib.dll

2011-02-19 05:32 . 2011-03-10 05:08        1074176        ----a-w-        c:\windows\SysWow64\DWrite.dll

2011-02-19 05:32 . 2011-03-10 05:08        739840        ----a-w-        c:\windows\SysWow64\d2d1.dll

2011-02-19 05:32 . 2011-04-15 12:16        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2011-02-19 04:13 . 2011-04-15 12:16        367104        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-19 03:37 . 2011-04-15 12:16        294912        ----a-w-        c:\windows\SysWow64\atmfd.dll

2011-02-18 06:37 . 2011-04-15 12:16        612352        ----a-w-        c:\windows\system32\vbscript.dll

2011-02-18 05:36 . 2011-04-15 12:16        428032        ----a-w-        c:\windows\SysWow64\vbscript.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]

2010-10-27 15:19        60576        ----a-w-        c:\program files (x86)\Bluetooth Suite\IEPlugIn.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

EVEMon.lnk - c:\program files (x86)\CCP\EVEMON\EVEMon.exe [2011-2-12 1724928]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]

R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]

R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]

R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]

S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-10-27 52896]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]

S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - KLMD25

*Deregistered* - klmd25

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-02-23 15:04        134384        ----a-w-        c:\program files\Alwil Software\Avast5\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-02 11545192]

"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1783296]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://start.facemoods.com/?a=ddr

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: {{7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - c:\program files (x86)\Bluetooth Suite\IEPlugIn.dll

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7whi04bs.default\

FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official

FF - prefs.js: keyword.URL - hxxp://start.facemoods.com/results.php?f=5&a=ddr&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-3A1BE7505F6BED46 - c:\winxnet.bin\winxnet.bin.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-05-17  15:56:03

ComboFix-quarantined-files.txt  2011-05-17 13:56

.

Vor Suchlauf: 9 Verzeichnis(se), 891.301.707.776 Bytes frei

Nach Suchlauf: 12 Verzeichnis(se), 890.706.817.024 Bytes frei

.

- - End Of File - - C7AAAFE68B6B9667172BF030A9093632

Bitte nun Logs mit GMER und mbrcheck erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg

Anleitung zu mbrcheck:
Downloade Dir MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Ok, hier einmal der GMER Log:

Code:

GMER 1.0.15.15627 - hxxp://www.gmer.net

Rootkit scan 2011-05-17 17:12:36

Windows 6.1.7600  

Running: 168rckwj.exe
 
 

---- Registry - GMER 1.0.15 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683112bd2                      

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683112bd2 (not active ControlSet)  
 

---- EOF - GMER 1.0.15 ----

und die MBRCheck Datei:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows 7 Professional

Windows Information:                 (build 7600), 64-bit

Base Board Manufacturer:        ASUSTeK Computer INC.

BIOS Manufacturer:                American Megatrends Inc.

System Manufacturer:                System manufacturer

System Product Name:                System Product Name

Logical Drives Mask:                0x0000001c
 

Kernel Drivers (total 192):

  0x0301A000 \SystemRoot\system32\ntoskrnl.exe

  0x035F6000 \SystemRoot\system32\hal.dll

  0x00BA7000 \SystemRoot\system32\kdcom.dll

  0x00C0D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x00C51000 \SystemRoot\system32\PSHED.dll

  0x00C65000 \SystemRoot\system32\CLFS.SYS

  0x00CC3000 \SystemRoot\system32\CI.dll

  0x00E44000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x00EE8000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x00EF7000 \SystemRoot\system32\DRIVERS\ACPI.sys

  0x00F4E000 \SystemRoot\system32\DRIVERS\WMILIB.SYS

  0x00F57000 \SystemRoot\system32\DRIVERS\msisadrv.sys

  0x00F61000 \SystemRoot\system32\DRIVERS\pci.sys

  0x00F94000 \SystemRoot\system32\DRIVERS\vdrvroot.sys

  0x00FA1000 \SystemRoot\System32\drivers\partmgr.sys

  0x00FB6000 \SystemRoot\system32\DRIVERS\volmgr.sys

  0x00D83000 \SystemRoot\System32\drivers\volmgrx.sys

  0x00FCB000 \SystemRoot\System32\drivers\mountmgr.sys

  0x00FE5000 \SystemRoot\system32\DRIVERS\atapi.sys

  0x00E00000 \SystemRoot\system32\DRIVERS\ataport.SYS

  0x00E2A000 \SystemRoot\system32\DRIVERS\msahci.sys

  0x00FEE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

  0x01060000 \SystemRoot\system32\DRIVERS\mv91xx.sys

  0x010EC000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS

  0x0111B000 \SystemRoot\system32\DRIVERS\mvxxmm.sys

  0x01123000 \SystemRoot\system32\drivers\amdxata.sys

  0x0112E000 \SystemRoot\system32\drivers\fltmgr.sys

  0x0117A000 \SystemRoot\system32\drivers\fileinfo.sys

  0x01237000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x0118E000 \SystemRoot\System32\Drivers\msrpc.sys

  0x013D9000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x014C6000 \SystemRoot\System32\Drivers\cng.sys

  0x01539000 \SystemRoot\System32\drivers\pcw.sys

  0x0154A000 \SystemRoot\System32\Drivers\Fs_Rec.sys

  0x016CD000 \SystemRoot\system32\drivers\ndis.sys

  0x01600000 \SystemRoot\system32\drivers\NETIO.SYS

  0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys

  0x01802000 \SystemRoot\System32\drivers\tcpip.sys

  0x01554000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x0168B000 \SystemRoot\system32\DRIVERS\vmstorfl.sys

  0x0159E000 \SystemRoot\system32\DRIVERS\volsnap.sys

  0x0169B000 \SystemRoot\System32\Drivers\spldr.sys

  0x017BF000 \SystemRoot\System32\drivers\rdyboost.sys

  0x016A3000 \SystemRoot\System32\Drivers\mup.sys

  0x016B5000 \SystemRoot\System32\drivers\hwpolicy.sys

  0x01400000 \SystemRoot\System32\DRIVERS\fvevol.sys

  0x0143A000 \SystemRoot\system32\DRIVERS\disk.sys

  0x01450000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS

  0x01200000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x02CF7000 \SystemRoot\System32\Drivers\aswSnx.SYS

  0x02D77000 \SystemRoot\System32\Drivers\Null.SYS

  0x02D80000 \SystemRoot\System32\Drivers\Beep.SYS

  0x02D87000 \SystemRoot\System32\drivers\vga.sys

  0x02D95000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x02DBA000 \SystemRoot\System32\drivers\watchdog.sys

  0x02DCA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x02DD3000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x02DDC000 \SystemRoot\system32\drivers\rdprefmp.sys

  0x02DE5000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x02C00000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x02C11000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x02C2F000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x02C3C000 \SystemRoot\system32\drivers\afd.sys

  0x02CC6000 \SystemRoot\System32\Drivers\aswRdr.SYS

  0x01000000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x02CD0000 \SystemRoot\system32\DRIVERS\wfplwf.sys

  0x03E48000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x03E6E000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x03E7D000 \SystemRoot\system32\DRIVERS\serial.sys

  0x03E9A000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x03EB5000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x03EC9000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x03F1A000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x03F26000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x03F31000 \SystemRoot\System32\drivers\discache.sys

  0x03F40000 \SystemRoot\system32\drivers\csc.sys

  0x03FC3000 \SystemRoot\System32\Drivers\dfsc.sys

  0x03FE1000 \SystemRoot\system32\DRIVERS\blbdrive.sys

  0x04035000 \SystemRoot\System32\Drivers\aswSP.SYS

  0x04080000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x0FEC3000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys

  0x10B1E000 \SystemRoot\System32\Drivers\nvBridge.kmd

  0x040A6000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x10B20000 \SystemRoot\System32\drivers\dxgmms1.sys

  0x10B66000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x10B8A000 \SystemRoot\system32\drivers\usbehci.sys

  0x10B9B000 \SystemRoot\system32\drivers\USBPORT.SYS

  0x0FE00000 \SystemRoot\system32\DRIVERS\nusb3xhc.sys

  0x0FE30000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x0FE32000 \SystemRoot\system32\DRIVERS\Rt64win7.sys

  0x0419A000 \SystemRoot\system32\DRIVERS\1394ohci.sys

  0x0FE97000 \SystemRoot\system32\DRIVERS\serenum.sys

  0x0FEA3000 \SystemRoot\system32\DRIVERS\wmiacpi.sys

  0x0FEAC000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x041D8000 \SystemRoot\system32\DRIVERS\CompositeBus.sys

  0x041E8000 \SystemRoot\system32\DRIVERS\AgileVpn.sys

  0x04000000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x10BF1000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x03E00000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x02CD9000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x00DDF000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x014AA000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x04024000 \SystemRoot\system32\DRIVERS\rdpbus.sys

  0x03E2F000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x02DF0000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x10BFD000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x0443C000 \SystemRoot\system32\DRIVERS\ks.sys

  0x0447F000 \SystemRoot\system32\DRIVERS\btath_bus.sys

  0x0448A000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x0449C000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x044F6000 \SystemRoot\system32\DRIVERS\nusb3hub.sys

  0x0450E000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x04523000 \SystemRoot\system32\drivers\nvhda64v.sys

  0x0454C000 \SystemRoot\system32\drivers\portcls.sys

  0x04589000 \SystemRoot\system32\drivers\drmk.sys

  0x045AB000 \SystemRoot\system32\drivers\ksthunk.sys

  0x056D4000 \SystemRoot\system32\drivers\RTKVHD64.sys

  0x0593E000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x0594C000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x05958000 \SystemRoot\System32\Drivers\dump_msahci.sys

  0x05963000 \SystemRoot\System32\Drivers\dump_dumpfve.sys

  0x000B0000 \SystemRoot\System32\win32k.sys

  0x05976000 \SystemRoot\System32\drivers\Dxapi.sys

  0x05982000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x004D0000 \SystemRoot\System32\TSDDD.dll

  0x006F0000 \SystemRoot\System32\cdd.dll

  0x05990000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0x059AD000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x059BB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x059D4000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x059DD000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x059EA000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0x05600000 \SystemRoot\system32\drivers\USBSTOR.SYS

  0x0562C000 \SystemRoot\system32\drivers\luafv.sys

  0x0564F000 \??\C:\Windows\system32\drivers\aswMonFlt.sys

  0x05689000 \SystemRoot\System32\Drivers\aswFsBlk.SYS

  0x05692000 \SystemRoot\system32\drivers\WudfPf.sys

  0x056B3000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x045B1000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x06E2F000 \SystemRoot\system32\drivers\HTTP.sys

  0x06EF7000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x06F15000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x06F2D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x06F5A000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x06FA8000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x072F5000 \SystemRoot\system32\drivers\peauth.sys

  0x0739B000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x073A6000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x073D3000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x07200000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x074C2000 \SystemRoot\System32\DRIVERS\srv.sys

  0x075C8000 \SystemRoot\system32\DRIVERS\asyncmac.sys

  0x075F1000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS

  0x77840000 \Windows\System32\ntdll.dll

  0x47CC0000 \Windows\System32\smss.exe

  0xFFB60000 \Windows\System32\apisetschema.dll

  0xFFA20000 \Windows\System32\autochk.exe

  0x77A10000 \Windows\System32\psapi.dll

  0xFFA20000 \Windows\System32\autochk.exe

  0xFF9A0000 \Windows\System32\difxapi.dll

  0xFF900000 \Windows\System32\clbcatq.dll

  0xFF6A0000 \Windows\System32\iertutil.dll

  0xFF5C0000 \Windows\System32\advapi32.dll

  0x77A00000 \Windows\System32\normaliz.dll

  0xFF440000 \Windows\System32\urlmon.dll

  0x77740000 \Windows\System32\user32.dll

  0xFF3F0000 \Windows\System32\ws2_32.dll

  0xFF310000 \Windows\System32\oleaut32.dll

  0xFF200000 \Windows\System32\msctf.dll

  0xFF1F0000 \Windows\System32\nsi.dll

  0xFF010000 \Windows\System32\setupapi.dll

  0xFEFA0000 \Windows\System32\gdi32.dll

  0xFEF70000 \Windows\System32\imm32.dll

  0xFED60000 \Windows\System32\ole32.dll

  0xFED40000 \Windows\System32\sechost.dll

  0xFECA0000 \Windows\System32\msvcrt.dll

  0xFEC90000 \Windows\System32\lpk.dll

  0xFEC40000 \Windows\System32\Wldap32.dll

  0x77620000 \Windows\System32\kernel32.dll

  0xFDEB0000 \Windows\System32\shell32.dll

  0xFDD80000 \Windows\System32\rpcrt4.dll

  0xFDCB0000 \Windows\System32\usp10.dll

  0xFDC90000 \Windows\System32\imagehlp.dll

  0xFDBF0000 \Windows\System32\comdlg32.dll

  0xFDB70000 \Windows\System32\shlwapi.dll

  0xFDAD0000 \Windows\System32\comctl32.dll

  0xFDA90000 \Windows\System32\wintrust.dll

  0xFDA70000 \Windows\System32\devobj.dll

  0xFDA30000 \Windows\System32\cfgmgr32.dll

  0xFD8C0000 \Windows\System32\crypt32.dll

  0xFD850000 \Windows\System32\KernelBase.dll

  0xFD840000 \Windows\System32\msasn1.dll
 

Processes (total 46):

       0 System Idle Process

       4 System

     312 C:\Windows\System32\smss.exe

     476 csrss.exe

     536 C:\Windows\System32\wininit.exe

     560 csrss.exe

     604 C:\Windows\System32\services.exe

     632 C:\Windows\System32\lsass.exe

     644 C:\Windows\System32\lsm.exe

     740 C:\Windows\System32\winlogon.exe

     776 C:\Windows\System32\svchost.exe

     852 C:\Windows\System32\nvvsvc.exe

     892 C:\Windows\System32\svchost.exe

     956 C:\Windows\System32\svchost.exe

     128 C:\Windows\System32\svchost.exe

     344 C:\Windows\System32\svchost.exe

    1036 C:\Windows\System32\svchost.exe

    1132 C:\Windows\System32\svchost.exe

    1200 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

    1328 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

    1344 C:\Windows\System32\nvvsvc.exe

    1572 C:\Windows\System32\dwm.exe

    1636 C:\Windows\explorer.exe

    1896 C:\Windows\System32\spoolsv.exe

    1924 C:\Windows\System32\svchost.exe

    1964 C:\Windows\System32\taskhost.exe

    1064 C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

    1768 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

    1600 C:\Windows\System32\svchost.exe

    2528 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

    2740 C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

    2752 C:\Program Files\Alwil Software\Avast5\AvastUI.exe

    2836 C:\Windows\System32\SearchIndexer.exe

    3772 C:\Windows\System32\svchost.exe

    3856 C:\Windows\System32\svchost.exe

    4892 C:\Windows\SysWOW64\ctfmon.exe

    4840 C:\Windows\System32\audiodg.exe

    4184 C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    4684 C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

    4300 C:\Windows\System32\SearchProtocolHost.exe

    4760 C:\Windows\System32\SearchFilterHost.exe

    2332 MpCmdRun.exe

    3828 C:\Windows\explorer.exe

    4356 C:\Users\***\Desktop\MBRCheck.exe

    2224 C:\Windows\System32\conhost.exe

    2484 C:\Windows\System32\dllhost.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000  (NTFS)

\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (NTFS)
 

PhysicalDrive0 Model Number: ST31000528AS, Rev: CC38    

PhysicalDrive1 Model Number: WD15EADS External, Rev: 1.75
 

      Size  Device Name          MBR Status

  --------------------------------------------

    931 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected

            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

   1397 GB  \\.\PhysicalDrive1   RE: Windows XP MBR code detected

            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
 
 

Done!