"Your system is infected with virus"-PopUp..Brauch Hilfe von euch um ihn loszuwerden!

soulmage

Deckard's System Scanner v20071014.68
Run by *** on 2008-06-04 08:42:28
Computer is in Normal Mode.
--------------

-- System Restore -----

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
10: 2008-06-04 06:42:33 UTC - RP477 - Deckard's System Scanner Restore Point
9: 2008-06-04 06:14:22 UTC - RP476 - Ad-Aware wird installiert
8: 2008-06-01 17:35:37 UTC - RP475 - Software Distribution Service 3.0
7: 2008-05-31 12:42:21 UTC - RP474 - Software Distribution Service 3.0
6: 2008-05-30 14:17:21 UTC - RP473 - Windows Internet Explorer 7 wurde installiert.


-- First Restore Point --
1: 2008-05-29 19:38:28 UTC - RP468 - Windows Live Messenger wird installiert


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as ***.exe) ------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:45:07, on 04.06.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\FolderSize\FolderSizeSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
C:\Dokumente und Einstellungen\***\Desktop\Neuer Ordner\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\***.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = h**p://seek.yisou.com/srchcust.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SVC plugin - {C12FC24B-A7B9-487F-9603-5481EBF00C6F} - C:\WINDOWS\odsagy.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [BearShare] "C:\Programme\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Programme\MP3 Player Utilities 3.74\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Programme\MP3 Player Utilities 4.04\AMVConverter\grab.html
O8 - Extra context menu item: Add to Windows &Live Favorites - h**p://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Programme\MP3 Player Utilities 4.04\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - h**p://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - h**p://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - h**p://webcam03.lugano.ch/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - h**p://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - h**p://by136fd.bay136.hotmail.msn.com/activex/HMAtchmt.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Programme\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 8115 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) --------

backup-20080526-220306-964 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = h**p://search.bearshare.com/sidebar.html?src=ssb
backup-20080526-220307-922 O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
backup-20080526-220307-171 O2 - BHO: (no name) - {62EED7C6-9F02-42f9-B634-98E2899E147B} - (no file)
backup-20080526-220307-910 O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqnnno.dll
backup-20080526-220307-473 O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - (no file)
backup-20080526-220307-357 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
backup-20080526-220307-292 O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
backup-20080526-220307-961 O4 - HKCU\..\Run: [antispy] C:\Programme\IEAntiVirus\ANTIVIRUS.exe
backup-20080526-220812-461 O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqnnno.dll
backup-20080526-223932-994 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll
backup-20080526-223932-440 O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
backup-20080526-223932-970 O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
backup-20080526-223933-594 O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Dokumente und Einstellungen\***\Startmenü\Programme\IMVU\Run IMVU.lnk (file missing)
backup-20080526-223933-156 O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
backup-20080526-224842-360 O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
backup-20080528-211423-557 O2 - BHO: {7af2de21-6ef2-a08b-4624-5386404b1c25} - {52c1b404-6835-4264-b80a-2fe612ed2fa7} - C:\WINDOWS\system32\bcmhsqdb.dll (file missing)
backup-20080528-211423-412 O2 - BHO: IE - {616D534C-3CA8-43AB-B439-618F850F1D2B} - C:\WINDOWS\apsagy.dll (file missing)
backup-20080528-211423-192 O17 - HKLM\System\CCS\Services\Tcpip\..\{2C0D3CD0-613D-42C6-B1BA-5C97D71501BF}: NameServer = 85.255.115.53,85.255.112.217
backup-20080528-211423-741 O17 - HKLM\System\CCS\Services\Tcpip\..\{2E1ACCC7-6B9F-4559-BE66-36FB0D40491D}: NameServer = 85.255.115.53,85.255.112.217
backup-20080528-211423-556 O17 - HKLM\System\CCS\Services\Tcpip\..\{90A32034-E0C3-4B2E-A251-79F513396827}: NameServer = 85.255.115.53,85.255.112.217
backup-20080528-211423-378 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.53 85.255.112.217
backup-20080528-211423-645 O17 - HKLM\System\CS1\Services\Tcpip\..\{2C0D3CD0-613D-42C6-B1BA-5C97D71501BF}: NameServer = 85.255.115.53,85.255.112.217
backup-20080528-211423-844 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.53 85.255.112.217
backup-20080528-211423-513 O17 - HKLM\System\CS2\Services\Tcpip\..\{2C0D3CD0-613D-42C6-B1BA-5C97D71501BF}: NameServer = 85.255.115.53,85.255.112.217
backup-20080528-211423-507 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.53 85.255.112.217
backup-20080528-211423-261 O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll (file missing)

-- File Associations ----------

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------

R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfvfs02 (StarForce Protection VFS Driver (version 2.x)) - c:\windows\system32\drivers\sfvfs02.sys <Not Verified; Protection Technology; StarForce Protection System>
R1 ssmdrv - c:\windows\system32\drivers\ssmdrv.sys <Not Verified; AVIRA GmbH; >
R1 UBHelper - c:\windows\system32\drivers\ubhelper.sys
R2 int15.sys - c:\acer\empowering technology\erecovery\int15.sys
R2 STEC3 - c:\windows\system32\stec3.sys <Not Verified; AntiCracking; SVKP driver for NT>
R3 CLEDX (Team H2O CLEDX service) - c:\windows\system32\drivers\cledx.sys <Not Verified; Team H2O; CLEDX>
R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >

S3 ASPI (Advanced SCSI Programming Interface Driver) - c:\windows\system32\drivers\aspi32.sys <Not Verified; Adaptec; Adaptec's ASPI Layer>
S3 C-Dilla - c:\windows\system32\drivers\cdant.sys (file missing)
S3 DMSKSSRh - c:\dokume~1\***\lokale~1\temp\dmskssrh.sys (file missing)
S3 MagixASIODrv (MAGIX_ASIO_BoostDriver) - c:\programme\magix\samplitude_se_no9\mxasio.sys <Not Verified; MAGIX AG; MAGIX ASIO BoostDriver>
S3 SNPSTD3 (USB PC Camera (SNPSTD3)) - c:\windows\system32\drivers\snpstd3.sys <Not Verified; ; PC Camera driver>
S3 sony_ssm.sys - c:\dokume~1\***\lokale~1\temp\sony_ssm.sys (file missing)
S3 SymIM (Symantec Network Security Intermediate Filter Service) - c:\windows\system32\drivers\symim.sys (file missing)
S3 SymIMMP - c:\windows\system32\drivers\symim.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ----------

R2 AntiVirScheduler (Avira AntiVir Personal – Free Antivirus Planer) - "c:\programme\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>
R2 Apple Mobile Device - "c:\programme\gemeinsame dateien\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 FolderSize (Folder Size) - c:\programme\foldersize\foldersizesvc.exe <Not Verified; Brio; Folder Size for Windows>
R2 UserAccess7 (SecuROM User Access Service (V7)) - c:\windows\system32\uaservice7.exe

S2 Automatisches LiveUpdate - Scheduler - "c:\programme\symantec\liveupdate\aluschedulersvc.exe" (file missing)


-- Device Manager: Disabled ----------

No disabled devices found.


-- Scheduled Tasks ----------------------

2008-04-19 07:53:50 276 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-08-15 14:03:48 418 --a------ C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job


-- Files created between 2008-05-04 and 2008-06-04 --------------

2008-06-04 08:14:26 0 d-------- C:\Programme\Lavasoft
2008-06-04 08:00:10 0 d--hs---- C:\FOUND.000
2008-06-03 19:55:23 251904 --a------ C:\WINDOWS\odsagy.dll
2008-06-03 19:55:22 53 --a------ C:\smp.bat
2008-05-29 11:25:01 0 d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-05-28 23:40:08 0 d-------- C:\Programme\Safari
2008-05-28 21:15:03 68096 --a------ C:\WINDOWS\zip.exe
2008-05-28 21:15:03 49152 --a------ C:\WINDOWS\VFind.exe
2008-05-28 21:15:03 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-05-28 21:15:03 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-05-28 21:15:03 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-05-28 21:15:03 98816 --a------ C:\WINDOWS\sed.exe
2008-05-28 21:15:03 80412 --a------ C:\WINDOWS\grep.exe
2008-05-28 21:15:03 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-05-27 22:04:23 0 d-------- C:\Programme\Image-Line
2008-05-26 21:50:22 0 d-------- C:\Programme\Trend Micro
2008-05-26 13:58:55 0 d-------- C:\Programme\Avira
2008-05-25 19:57:30 0 d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-05-13 03:53:16 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-05-13 03:50:16 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-05-13 03:50:16 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-05-13 03:50:08 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-05-13 03:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 03:50:08 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-05-13 03:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 03:50:06 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 03:49:02 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-09 15:00:39 233472 --a------ C:\WINDOWS\system32\REX Shared Library.dll <Not Verified; Propellerhead Software AB; REX SDK>
2008-05-04 00:12:52 664 --a------ C:\WINDOWS\system32\d3d9caps.dat


-- Find3M Report -------------------------

2008-05-29 11:25:18 0 d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
2008-05-27 21:53:28 0 d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Morphine
2008-05-19 23:57:42 41472 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\RBShell400.dll
2008-05-19 23:57:42 75776 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\rbqt450.DLL
2008-05-19 23:57:42 64512 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\rbap450.dll
2008-05-19 23:57:40 36352 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSRegistryPlugin1636.dll
2008-05-19 23:57:40 32256 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSProcessPlugin1636.dll
2008-05-19 23:57:40 33280 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSEncryptPlugin1636.dll
2008-05-19 23:57:40 52224 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EHZComp.dll
2008-05-19 23:57:40 19968 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EHMD5.dll
2008-05-19 23:57:40 18432 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EHEncrypt.dll
2008-05-19 23:57:38 26112 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSRegistrationPlugin1636.dll
2008-05-19 23:57:38 29184 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSRectPlugin1635.dll
2008-05-19 23:57:38 49664 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSQuickTimePlugin1636.dll
2008-05-19 23:57:38 54272 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSQTImporterPlugin1635.dll
2008-05-19 23:57:38 25088 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSPluginVersionPlugin1635.dll
2008-05-19 23:57:38 37376 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSPictureMacPlugin1635.dll
2008-05-19 23:57:36 51712 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSWinPlugin1635.dll
2008-05-19 23:57:36 26624 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSUsernamePlugin1635.dll
2008-05-19 23:57:36 26112 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSResStreamPlugin1635.dll
2008-05-19 23:57:36 53760 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSPicturePlugin1635.dll
2008-05-19 23:57:36 32256 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSIconPlugin1635.dll
2008-05-19 23:57:34 48128 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSResPlugin1635.dll
2008-05-19 23:57:34 29184 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSMemoryPlugin1635.dll
2008-05-19 23:57:34 41984 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSMainPlugin1635.dll
2008-05-19 23:57:34 36352 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSFolderitemsCreatePlugin1635.dll
2008-05-19 23:56:52 28672 --ah----- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MBSMacOSXPlugin1635.dll
2008-05-17 18:05:16 115684 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-05-09 15:00:28 0 d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Propellerhead Software
2008-05-03 21:44:12 0 d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\IMVU
2008-05-03 21:44:04 0 d-------- C:\Programme\IMVU
2008-05-02 16:29:30 0 d-------- C:\Programme\4Movy DVD Video Converter
2008-04-29 13:11:44 0 d-------- C:\Programme\FLV Player
2008-04-28 12:10:40 5104 --a------ C:\WINDOWS\mozver.dat
2008-04-26 20:52:22 0 d-------- C:\Programme\ASIO4ALL v2
2008-04-26 20:50:14 0 d-------- C:\Programme\Outsim
2008-04-16 21:02:44 0 d-------- C:\Programme\iPod
2008-04-16 21:02:22 0 d-------- C:\Programme\iTunes
2008-03-19 09:59:28 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-03-06 07:59:42 0 --a------ C:\WINDOWS\nsreg.dat


-- Registry Dump -------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}]
03.06.2008 19:55 251904 --a------ C:\WINDOWS\odsagy.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [04.08.2004 05:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [04.08.2004 05:00]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [16.11.2005 17:00]
"BearShare"="C:\Programme\BearShare\BearShare.exe" [26.07.2006 13:48]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [12.02.2008 10:06]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [28.03.2008 23:37]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [08.07.2006 11:49]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [30.03.2008 10:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Programme\Windows Live\Messenger\MsnMsgr.exe" [18.10.2007 11:34]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"=C:\Programme\ICQLite\ICQLite.exe -trayboot

C:\Dokumente und Einstellungen\***\Startmen�\Programme\Autostart\
Adobe Gamma.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [16.03.2005 19:16:50]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Programme\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [21.06.2006 18:43:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

*Newly Created Service* - AAWSERVICE
*Newly Created Service* - INT15.SYS



-- End of Deckard's System Scanner: finished at 2008-06-04 08:46:22 --