Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: HiJackThis Log wegen Werbeseiten-Problem

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 25.06.2010, 08:18   #1
coolz3ro
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



Hallo!
Ich habe folgendes Problem: Wenn ich mit Firefox im Internet bin öffnen sich in unregelmäßigen Abständen und meistens wenn ich selber auf eine andere Seite gehe oder einen Link betätige völlig neue Fenster von Firefox im normalen Browser im Hintergrund mit Werbung.
Habe HijackThis benutzt, weiß nun aber nicht weiter an was es liegen kann. Unten sind die Ergebnisse.
Vielen Dank für die Hilfe!

-----------------------------------------------------------------
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\OEM04Mon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Join Air\UIExec.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE
C:\Users\aaekos\AppData\Local\ljheearo.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wbem\unsecapp.exe
C:\program files\mozilla firefox\firefox.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wuauclt.exe
C:\program files\mozilla firefox\firefox.exe
C:\Users\aaekos\Desktop\HiJackThis204.exe
C:\Windows\system32\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [OEM04Mon.exe] C:\Windows\OEM04Mon.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking10\Ereg.ini
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UIExec] "C:\Program Files\Join Air\UIExec.exe"
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_SB624.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_S23F8.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ljheearo] "c:\users\aaekos\appdata\local\ljheearo.exe" ljheearo
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB701\webserver\bin\win32\matlabserver.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: UGS-Lizenzserver (ugslmd) (UGS License Server (ugslmd)) - Macrovision Corporation - C:\Program Files\UGS\UGSLicensing\lmgrd.exe

Alt 25.06.2010, 10:46   #2
markusg
/// Malware-holic
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide.
__________________


Alt 25.06.2010, 11:07   #3
coolz3ro
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\aaekos\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)
PRC - C:\Program Files\Join Air\UIExec.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe ()
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe ()
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe ()
PRC - C:\Program Files\UGS\UGSLicensing\ugslmd.exe ()
PRC - C:\Program Files\UGS\UGSLicensing\lmgrd.exe (Macrovision Corporation)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe ()
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Windows\OEM04Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - c:\MATLAB701\bin\win32\MATLAB.exe (The MathWorks Inc.)
PRC - C:\MATLAB701\webserver\bin\win32\matlabserver.exe ()


========== Modules (SafeList) ==========

MOD - C:\Users\aaekos\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (UGS License Server (ugslmd)) UGS-Lizenzserver (ugslmd) -- C:\Program Files\UGS\UGSLicensing\lmgrd.exe (Macrovision Corporation)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (EvtEng) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (matlabserver) -- C:\MATLAB701\webserver\bin\win32\matlabserver.exe ()


========== Driver Services (SafeList) ==========

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (Applied Networking Inc.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (adfs) -- C:\Windows\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (TcUsb) -- C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (AF15BDA) -- C:\Windows\System32\drivers\AF15BDA.sys (AfaTech )
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (OEM04Vid) -- C:\Windows\System32\drivers\OEM04Vid.sys (Creative Technology Ltd.)
DRV - (OEM04Vfx) -- C:\Windows\System32\drivers\OEM04Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Uim_IM) -- C:\Windows\System32\drivers\Uim_IM.sys (Paragon)
DRV - (UimBus) -- C:\Windows\System32\drivers\UimBus.sys (Windows (R) 2000 DDK provider)
DRV - (hotcore3) -- C:\Windows\system32\drivers\hotcore3.sys (Paragon Software Group)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (WINIO) -- C:\Windows\System32\winio.sys ()
DRV - (Sentinel) -- C:\Windows\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.12.16 12:12:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.01.24 21:56:14 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\program files\Mozilla Firefox\components [2010.06.24 09:14:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\program files\Mozilla Firefox\plugins [2010.06.24 09:14:12 | 000,000,000 | ---D | M]

[2009.11.20 18:35:54 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Mozilla\Extensions
[2010.06.24 21:19:28 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Mozilla\Firefox\Profiles\edqcq0xz.default\extensions
[2010.06.19 01:17:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\aaekos\AppData\Roaming\Mozilla\Firefox\Profiles\edqcq0xz.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.04.20 13:55:58 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.06.09 10:32:57 | 000,000,000 | ---D | M] (Kwinzy) -- C:\Program Files\Mozilla Firefox\extensions\{52EF0988-5232-4465-86E7-6434B5891030}
[2010.04.20 13:55:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.11.20 18:35:49 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2006.07.31 17:07:16 | 000,098,304 | ---- | M] (Zylom) -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.02.19 01:14:56 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.02.19 01:14:56 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.06.09 10:32:57 | 000,002,381 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\kwinzy119.xml
[2010.02.19 01:14:56 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.02.19 01:14:56 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.02.19 01:14:56 | 000,000,801 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.
O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM04Mon.exe] C:\Windows\OEM04Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UIExec] C:\Program Files\Join Air\UIExec.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [Center Agent] C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe ()
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [EPSON Stylus DX4400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{13942303-f159-11de-bd4a-fa1b4c8f428d}\Shell\AutoRun\command - "" = G:\SamsungSoftware\APPInst.exe -- File not found
O33 - MountPoints2\{19e54bfb-a11b-11dd-b4df-0015c585e7eb}\Shell - "" = AutoRun
O33 - MountPoints2\{19e54bfb-a11b-11dd-b4df-0015c585e7eb}\Shell\AutoRun\command - "" = F:\Setup.EXE -- File not found
O33 - MountPoints2\{5bf939fc-bbde-11dd-a0ae-0015c585e7eb}\Shell - "" = AutoRun
O33 - MountPoints2\{5bf939fc-bbde-11dd-a0ae-0015c585e7eb}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{5bf939fd-bbde-11dd-a0ae-0015c585e7eb}\Shell - "" = AutoRun
O33 - MountPoints2\{5bf939fd-bbde-11dd-a0ae-0015c585e7eb}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{afa272ba-b726-11dd-8c0e-0015c585e7eb}\Shell - "" = AutoRun
O33 - MountPoints2\{afa272ba-b726-11dd-8c0e-0015c585e7eb}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{afa272d9-b726-11dd-8c0e-0015c585e7eb}\Shell - "" = AutoRun
O33 - MountPoints2\{afa272d9-b726-11dd-8c0e-0015c585e7eb}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{e9502098-70d4-11df-968e-f8e81ad8a133}\Shell - "" = AutoRun
O33 - MountPoints2\{e9502098-70d4-11df-968e-f8e81ad8a133}\Shell\AutoRun\command - "" = F:\Install.exe -- File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\SamsungSoftware\APPInst.exe -- File not found
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009.03.25 15:16:34 | 000,000,000 | ---D | M]
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIEActiveSetup SIGNUP

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: SENTINEL - C:\Windows\System32\snti386.dll (Rainbow Technologies, Inc.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.lsgc - C:\Windows\System32\lsgc.dll (imc AG)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010.06.25 11:47:35 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\aaekos\Desktop\OTL.exe
[2010.06.25 08:51:14 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\aaekos\Desktop\HiJackThis204.exe
[2010.06.24 09:32:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010.06.24 09:32:58 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010.06.22 18:48:55 | 000,000,000 | ---D | C] -- C:\Users\aaekos\Desktop\France
[2010.06.21 08:54:53 | 000,000,000 | ---D | C] -- C:\Users\aaekos\Desktop\Juni 2010.2 Soul jazz
[2010.06.20 21:54:33 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml4a.dll
[2010.06.19 01:17:38 | 000,000,000 | ---D | C] -- C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.06.19 01:17:31 | 000,000,000 | ---D | C] -- C:\Users\aaekos\Documents\DVDVideoSoft
[2010.06.16 12:44:02 | 000,544,768 | ---- | C] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe
[2010.06.06 01:04:12 | 000,000,000 | ---D | C] -- C:\Users\aaekos\{6833305a-8ce8-4b9b-95c8-b377aaa82491}
[2010.06.06 01:02:13 | 000,110,080 | ---- | C] (ZTE Corporation) -- C:\Windows\System32\drivers\ZTEusbnet.sys
[2010.06.06 01:02:13 | 000,105,344 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbnmea.sys
[2010.06.06 01:02:13 | 000,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbser6k.sys
[2010.06.06 01:02:13 | 000,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys
[2010.06.06 01:02:13 | 000,009,728 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\massfilter.sys
[2010.06.06 01:01:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\SupportAppCB
[2010.06.06 01:01:58 | 000,000,000 | ---D | C] -- C:\Program Files\Join Air
[2009.06.16 14:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.06.25 11:52:57 | 004,718,592 | -HS- | M] () -- C:\Users\aaekos\ntuser.dat
[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat
[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat
[2010.06.25 11:47:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\aaekos\Desktop\OTL.exe
[2010.06.25 11:44:56 | 000,700,548 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.06.25 11:44:56 | 000,591,872 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.06.25 11:44:56 | 000,105,752 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.06.25 11:41:08 | 000,079,478 | ---- | M] () -- C:\Users\aaekos\AppData\Roaming\nvModes.001
[2010.06.25 11:40:55 | 000,000,092 | ---- | M] () -- C:\Users\aaekos\AppData\Local\wwswc.bat
[2010.06.25 11:39:49 | 000,000,416 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job
[2010.06.25 11:38:39 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.25 11:38:38 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.25 11:38:36 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.06.25 11:38:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.06.25 11:38:26 | 3756,044,288 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.25 10:14:20 | 000,001,660 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.06.25 10:14:17 | 000,524,288 | -HS- | M] () -- C:\Users\aaekos\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010.06.25 10:14:17 | 000,065,536 | -HS- | M] () -- C:\Users\aaekos\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.06.25 10:14:08 | 003,600,358 | -H-- | M] () -- C:\Users\aaekos\AppData\Local\IconCache.db
[2010.06.25 08:51:18 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\aaekos\Desktop\HiJackThis204.exe
[2010.06.24 23:16:04 | 001,408,590 | ---- | M] () -- C:\Users\aaekos\Desktop\IMGP0158.JPG
[2010.06.24 13:17:41 | 001,175,460 | ---- | M] () -- C:\Users\aaekos\Desktop\Ausgew_hlte_Konzepte_PDP_2010_7406653.pdf
[2010.06.24 12:22:25 | 000,021,858 | ---- | M] () -- C:\Users\aaekos\Desktop\Materialeigenschaften_PA_66.pdf
[2010.06.24 09:33:02 | 000,001,081 | ---- | M] () -- C:\Users\aaekos\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010.06.24 09:26:26 | 000,020,568 | ---- | M] () -- C:\Users\aaekos\Desktop\Schichtplan_Jubi_Rosenhöhe_Stand 24.06.10.pdf
[2010.06.23 16:09:21 | 000,066,955 | ---- | M] () -- C:\Users\aaekos\Desktop\t_567_1.pdf
[2010.06.23 13:24:51 | 000,026,897 | ---- | M] () -- C:\Users\aaekos\Desktop\gsm.mdl
[2010.06.19 12:11:18 | 000,005,190 | -HS- | M] () -- C:\Users\aaekos\Desktop\Folder.jpg
[2010.06.19 12:11:18 | 000,001,795 | -HS- | M] () -- C:\Users\aaekos\Desktop\AlbumArtSmall.jpg
[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat
[2010.06.16 17:12:48 | 000,219,136 | ---- | M] () -- C:\Users\aaekos\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe
[2010.06.08 18:45:19 | 011,040,765 | ---- | M] () -- C:\Users\aaekos\Desktop\Daimler%20Rettungskarten%2004_2010_de.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.06.24 23:16:20 | 001,408,590 | ---- | C] () -- C:\Users\aaekos\Desktop\IMGP0158.JPG
[2010.06.24 13:17:40 | 001,175,460 | ---- | C] () -- C:\Users\aaekos\Desktop\Ausgew_hlte_Konzepte_PDP_2010_7406653.pdf
[2010.06.24 12:22:25 | 000,021,858 | ---- | C] () -- C:\Users\aaekos\Desktop\Materialeigenschaften_PA_66.pdf
[2010.06.24 09:33:02 | 000,001,081 | ---- | C] () -- C:\Users\aaekos\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010.06.24 09:26:26 | 000,020,568 | ---- | C] () -- C:\Users\aaekos\Desktop\Schichtplan_Jubi_Rosenhöhe_Stand 24.06.10.pdf
[2010.06.23 16:09:21 | 000,066,955 | ---- | C] () -- C:\Users\aaekos\Desktop\t_567_1.pdf
[2010.06.23 10:07:13 | 000,026,897 | ---- | C] () -- C:\Users\aaekos\Desktop\gsm.mdl
[2010.06.16 12:44:02 | 000,243,202 | ---- | C] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat
[2010.06.16 12:44:02 | 000,005,030 | ---- | C] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat
[2010.06.16 12:44:02 | 000,003,421 | ---- | C] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat
[2010.06.08 18:45:19 | 011,040,765 | ---- | C] () -- C:\Users\aaekos\Desktop\Daimler%20Rettungskarten%2004_2010_de.pdf
[2009.06.16 14:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll
[2009.03.22 19:32:26 | 000,013,120 | ---- | C] () -- C:\Windows\System32\drivers\UimFIO.sys
[2009.03.22 19:32:21 | 004,244,992 | ---- | C] () -- C:\Windows\System32\qtp-mt334.dll
[2009.03.22 19:32:21 | 000,247,808 | ---- | C] () -- C:\Windows\System32\prgiso.dll
[2009.03.22 19:32:21 | 000,013,824 | ---- | C] () -- C:\Windows\System32\wnaspi32.dll
[2009.03.13 15:27:41 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.03.13 15:27:41 | 000,383,238 | ---- | C] () -- C:\Windows\System32\libmp3lame-0.dll
[2008.10.29 14:19:59 | 000,041,324 | ---- | C] () -- C:\Windows\System32\winio.sys
[2008.10.29 14:19:54 | 000,000,157 | ---- | C] () -- C:\Windows\matlab.ini
[2008.10.23 18:11:46 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.10.17 09:48:32 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008.10.17 09:42:32 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX7400DEFGIPS.ini
[2008.09.03 16:20:39 | 000,000,952 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2008.09.01 13:57:11 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.08.31 18:36:46 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2008.04.17 09:08:56 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2007.10.08 14:21:46 | 000,958,464 | ---- | C] () -- C:\Windows\System32\WLIHVUI.dll
[2007.03.29 23:00:40 | 000,203,264 | ---- | C] () -- C:\Windows\System32\CddbCdda.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.05.06 20:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2003.01.07 15:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2010.06.19 01:17:38 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.02.11 16:46:22 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\EPSON
[2009.01.11 22:21:56 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQ
[2008.08.31 18:40:12 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQLite
[2009.02.26 00:09:36 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Micrografx
[2009.01.05 15:26:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nokia
[2009.04.06 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nuance
[2008.10.12 05:24:06 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\OpenOffice.org
[2009.01.05 15:25:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PC Suite
[2009.10.09 12:06:46 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PlayFirst
[2009.09.23 20:35:52 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\uTorrent
[2008.10.01 20:53:19 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\X-TENSIONS Multimedia
[2010.06.25 11:39:49 | 000,000,416 | ---- | M] () -- C:\Windows\Tasks\PCConfidential.job
[2010.06.25 10:14:20 | 000,032,600 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2009.05.04 18:06:59 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Adobe
[2008.12.20 00:57:55 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Apple Computer
[2008.09.03 16:19:30 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Corel
[2008.09.01 11:00:32 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Creative
[2009.06.09 10:24:10 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Digsby
[2008.11.21 01:45:58 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\DivX
[2010.06.19 01:17:38 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.02.11 16:46:22 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\EPSON
[2008.08.31 18:39:34 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Hamachi
[2009.01.11 22:21:56 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQ
[2008.08.31 18:40:12 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQLite
[2008.08.31 18:12:55 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Identities
[2008.08.31 22:58:38 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\InstallShield
[2008.08.31 23:42:22 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Intel
[2008.08.31 23:49:11 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Macromedia
[2008.10.29 14:19:44 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\MathWorks
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Media Center Programs
[2009.02.26 00:09:36 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Micrografx
[2010.05.12 20:24:28 | 000,000,000 | --SD | M] -- C:\Users\aaekos\AppData\Roaming\Microsoft
[2009.11.20 18:35:54 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Mozilla
[2008.08.31 18:56:43 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nero
[2009.01.05 15:26:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nokia
[2009.04.06 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nuance
[2008.10.12 05:24:06 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\OpenOffice.org
[2009.01.05 15:25:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PC Suite
[2009.10.09 12:06:46 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PlayFirst
[2008.12.16 12:13:53 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Real
[2010.04.16 00:45:50 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Skype
[2010.04.16 00:45:04 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\skypePM
[2009.09.23 20:35:52 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\uTorrent
[2008.08.31 18:51:58 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\WinRAR
[2008.10.01 20:53:19 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\X-TENSIONS Multimedia

< %APPDATA%\*.exe /s >

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007.02.21 21:49:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007.02.21 21:49:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007.02.21 21:49:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2008.09.02 10:27:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.09.02 10:27:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.09.02 10:27:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: EVENTLOG.DLL >
[1999.10.02 12:24:46 | 000,017,408 | ---- | M] () MD5=1363337A5301619F00F8033835EF30E9 -- C:\MATLAB701\sys\perl\win32\site\lib\auto\Win32\EventLog\EventLog.dll

< MD5 for: IASTOR.SYS >
[2007.04.26 07:23:58 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Drivers\storage\R154200\iastor.sys

< MD5 for: IASTORV.SYS >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys
[2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvstor.inf_f48b8337\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: USERINIT.EXE >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WS2IFSL.SYS >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008.10.23 17:55:13 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys

< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008.01.19 09:38:03 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2008.01.19 09:36:10 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:24051EFF
@Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\words:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\projekte:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\movies:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\aktuelles:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\Aktien:Roxio EMC Stream
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:1A60DE96
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:F35A93AD
< End of report >
__________________

Alt 25.06.2010, 11:52   #4
markusg
/// Malware-holic
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



hör bitte auf die köpfe der logs weg zu lassen, poste das komplett!
spybot kann unsere arbeit stören, deinstaliere es, starte neu.


Fixen mit OTL

• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.
O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)
[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat
[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat
[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat
[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe
:Files
C:\Users\aaekos\AppData\Local\ljheearo.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten

Alt 25.06.2010, 12:11   #5
coolz3ro
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



All processes killed
Error: Unable to interpret <PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)> in the current context!
Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context!
Error: Unable to interpret <O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.> in the current context!
Error: Unable to interpret <O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context!
Error: Unable to interpret <[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat> in the current context!
Error: Unable to interpret <[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat> in the current context!
Error: Unable to interpret <[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat> in the current context!
Error: Unable to interpret <[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe> in the current context!
========== FILES ==========
File\Folder C:\Users\aaekos\AppData\Local\ljheearo.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: aaekos
->Flash cache emptied: 0 bytes

User: All Users

User: Default

User: Default User

User: Guest

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: aaekos
->Temp folder emptied: 1418621 bytes
->Java cache emptied: 51816413 bytes
->FireFox cache emptied: 33085966 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 55835 bytes
->FireFox cache emptied: 3000492 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 20326619 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 105,00 mb


OTL by OldTimer - Version 3.2.7.0 log created on 06252010_130650

Files\Folders moved on Reboot...
C:\Windows\temp\hsperfdata_AAEKOS-PC$\2204 moved successfully.
File\Folder C:\Windows\temp\TMP0000003076F9B4DDD137D18B not found!

Registry entries deleted on Reboot...


Alt 25.06.2010, 12:55   #6
markusg
/// Malware-holic
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



kannst du noch mal das neue otl script probieren:

:OTL
PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.
O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)
O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)
[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat
[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat
[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat
[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

Alt 25.06.2010, 13:11   #7
coolz3ro
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



All processes killed
Error: Unable to interpret <PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)> in the current context!
Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context!
Error: Unable to interpret <O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.> in the current context!
Error: Unable to interpret <O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context!
Error: Unable to interpret <[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat> in the current context!
Error: Unable to interpret <[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat> in the current context!
Error: Unable to interpret <[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat> in the current context!
Error: Unable to interpret <[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe> in the current context!
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: aaekos
->Flash cache emptied: 405 bytes

User: All Users

User: Default

User: Default User

User: Guest

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: aaekos
->Temp folder emptied: 1418794 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 21549254 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 399045 bytes

Total Files Cleaned = 22,00 mb


OTL by OldTimer - Version 3.2.7.0 log created on 06252010_140144

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\hsperfdata_AAEKOS-PC$\1360 not found!

Registry entries deleted on Reboot...

Alt 25.06.2010, 13:23   #8
markusg
/// Malware-holic
 
HiJackThis Log wegen Werbeseiten-Problem - Standard

HiJackThis Log wegen Werbeseiten-Problem



downloade dir navilog1.exe
Navilog1 - Accueil
führe das programm aus.
wähle e für englisch und dann den automatik modus aus, programm erstellt ein log, das posten.

Antwort

Themen zu HiJackThis Log wegen Werbeseiten-Problem
adobe, bho, browser, converter, defender, desktop, dll, excel, firefox, hijack, hijackthis, internet, internet explorer, mozilla, mp3, pdf, plug-in, problem, programdata, registry, rundll, server, software, system, temp, windows



Ähnliche Themen: HiJackThis Log wegen Werbeseiten-Problem


  1. Das Problem: Plus-HD-5.0c/es öffnet ungefragt Werbeseiten/Webpages sind voll von Werbung
    Log-Analyse und Auswertung - 24.09.2014 (13)
  2. Windows 8.1 Firefox: Problem mit Werbeseiten, Werbung beim Öffnen eines neuen Tabs
    Log-Analyse und Auswertung - 24.02.2014 (9)
  3. Problem mit dem Internet Explorer: Öffnet Werbeseiten
    Log-Analyse und Auswertung - 20.02.2011 (1)
  4. HijackThis Log wegen Anruf von Sparkasse
    Log-Analyse und Auswertung - 31.12.2010 (10)
  5. scan mit hijackThis wegen Virusverdacht!
    Log-Analyse und Auswertung - 29.03.2010 (24)
  6. Browser öffnet Werbeseiten, IExplorer stürzt ab, HiJackThis File beiliegend
    Log-Analyse und Auswertung - 06.02.2010 (2)
  7. HiJackThis Log wegen TR/TDss.yux
    Log-Analyse und Auswertung - 30.06.2009 (0)
  8. Problem wegen Malware > Dazu HiJackThis Logfile
    Log-Analyse und Auswertung - 19.06.2009 (0)
  9. HiJackThis Log-File --> wegen TR/Agent.105720 bitte Hilfe!!!
    Plagegeister aller Art und deren Bekämpfung - 25.03.2009 (1)
  10. Bitte um Auswertung von HiJackThis wegen Verdacht auf Spyware
    Log-Analyse und Auswertung - 09.07.2008 (9)
  11. HijackThis auswerten wegen trojan-spy.win32@mx
    Log-Analyse und Auswertung - 12.02.2008 (2)
  12. Bitte um Analyse des HiJackThis-Logfiles wegen Vundo
    Log-Analyse und Auswertung - 17.12.2007 (7)
  13. HiJackThis Log-File - Suche auswertung wegen Virenverdacht
    Log-Analyse und Auswertung - 08.10.2007 (10)
  14. Hijackthis Log auswerten, tastatur geht ncht mehr, wegen würmern
    Log-Analyse und Auswertung - 26.08.2007 (10)
  15. Brauche hilfe wegen auswertung meines Hijackthis
    Log-Analyse und Auswertung - 21.02.2005 (8)
  16. Frage wegen Hijackthis
    Log-Analyse und Auswertung - 14.01.2005 (7)
  17. Frage wegen HiJackThis-Log
    Log-Analyse und Auswertung - 02.11.2004 (1)

Zum Thema HiJackThis Log wegen Werbeseiten-Problem - Hallo! Ich habe folgendes Problem: Wenn ich mit Firefox im Internet bin öffnen sich in unregelmäßigen Abständen und meistens wenn ich selber auf eine andere Seite gehe oder einen Link - HiJackThis Log wegen Werbeseiten-Problem...
Archiv
Du betrachtest: HiJackThis Log wegen Werbeseiten-Problem auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.