Verdacht auf üblen trojaner über Adopeseitenscript

Aaalucarddd

ComboFix 09-06-20.04 - Alucard 21.06.2009 17:44.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3327.1983 [GMT 2:00]
ausgeführt von:: c:\users\Alucard\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Alucard\Desktop\cfscript.txt
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\system32\perfc007.dat"
"c:\windows\system32\perfh007.dat"
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Spybot - Search & Destroy
C:\rsit
c:\users\alucard\AppData\Roaming\Azureus
c:\programdata\Spybot - Search & Destroy\Logs\Resident.log
c:\programdata\Spybot - Search & Destroy\ProcCache.sbc
c:\rsit\info.txt
c:\rsit\log.txt
c:\users\alucard\AppData\Roaming\Azureus\.certs
c:\users\alucard\AppData\Roaming\Azureus\.keystore
c:\users\alucard\AppData\Roaming\Azureus\.lock
c:\users\alucard\AppData\Roaming\Azureus\active\2154F539E0C130BFEA160045F90A94A01F6211B2.dat
c:\users\alucard\AppData\Roaming\Azureus\active\2154F539E0C130BFEA160045F90A94A01F6211B2.dat.bak
c:\users\alucard\AppData\Roaming\Azureus\active\6DCC2B5AD11BA61442C592CE6E238904E9C2FD20.dat
c:\users\alucard\AppData\Roaming\Azureus\active\6DCC2B5AD11BA61442C592CE6E238904E9C2FD20.dat.bak
c:\users\alucard\AppData\Roaming\Azureus\active\cache.dat
c:\users\alucard\AppData\Roaming\Azureus\azureus.config
c:\users\alucard\AppData\Roaming\Azureus\azureus.config.bak
c:\users\alucard\AppData\Roaming\Azureus\azureus.statistics
c:\users\alucard\AppData\Roaming\Azureus\azureus.statistics.bak
c:\users\alucard\AppData\Roaming\Azureus\banips.config
c:\users\alucard\AppData\Roaming\Azureus\banips.config.bak
c:\users\alucard\AppData\Roaming\Azureus\cache\1191085919.ico
c:\users\alucard\AppData\Roaming\Azureus\cnetworks.config
c:\users\alucard\AppData\Roaming\Azureus\devices.config
c:\users\alucard\AppData\Roaming\Azureus\devices.config.bak
c:\users\alucard\AppData\Roaming\Azureus\dht\addresses.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\contacts.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\diverse.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\general.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\net3\addresses.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\net3\contacts.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\net3\diverse.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\net3\version.dat
c:\users\alucard\AppData\Roaming\Azureus\dht\version.dat
c:\users\alucard\AppData\Roaming\Azureus\downloads.config
c:\users\alucard\AppData\Roaming\Azureus\downloads.config.bak
c:\users\alucard\AppData\Roaming\Azureus\friends.config
c:\users\alucard\AppData\Roaming\Azureus\friends.config.bak
c:\users\alucard\AppData\Roaming\Azureus\ipfilter.cache
c:\users\alucard\AppData\Roaming\Azureus\logs\MetaSearch_Engine_3.txt
c:\users\alucard\AppData\Roaming\Azureus\logs\MetaSearch_Engine_4.txt
c:\users\alucard\AppData\Roaming\Azureus\logs\MetaSearch_Engine_5.txt
c:\users\alucard\AppData\Roaming\Azureus\logs\MetaSearch_Engine_9.txt
c:\users\alucard\AppData\Roaming\Azureus\metasearch.config
c:\users\alucard\AppData\Roaming\Azureus\metasearch.config.bak
c:\users\alucard\AppData\Roaming\Azureus\net\pm_3320.dat
c:\users\alucard\AppData\Roaming\Azureus\net\pm_default.dat
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\azump_1.2.jar
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\azump_1.2.zip
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\azump_1.3.jar
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\azump_1.3.zip
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\mplayer.exe
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\mplayer.exe.bak
c:\users\alucard\AppData\Roaming\Azureus\plugins\azump\mplayer\config
c:\users\alucard\AppData\Roaming\Azureus\plugins\azupnpav\cd.dat
c:\users\alucard\AppData\Roaming\Azureus\restart.bat
c:\users\alucard\AppData\Roaming\Azureus\sidebarauto.config
c:\users\alucard\AppData\Roaming\Azureus\sidebarauto.config.bak
c:\users\alucard\AppData\Roaming\Azureus\subs\19D197C718E86D5B1B15.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\32E8D1849848B7F51127.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\35737C7E9156164699C4.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\4F5D92DCB17E8F9148BB.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\6CE4CD4B41EB765CCBCF.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\87E23B1872099785E348.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\88D6B1219DD77B56C9AA.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\8A9C835A293BF168D805.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\8DE6E5753F5ADF094F49.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\95B34C1A1F40931D0972.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\A57341AB2AA7A98D5F19.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\C732D6BA9C09C29B2FA3.vuze
c:\users\alucard\AppData\Roaming\Azureus\subs\E8139A68B1EC9E7A6DAD.vuze
c:\users\alucard\AppData\Roaming\Azureus\subscriptions.config
c:\users\alucard\AppData\Roaming\Azureus\subscriptions.config.bak
c:\users\alucard\AppData\Roaming\Azureus\tables.config
c:\users\alucard\AppData\Roaming\Azureus\tables.config.bak
c:\users\alucard\AppData\Roaming\Azureus\timingstats.dat
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2164.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2165.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2166.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2167.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2168.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2169.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2170.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2171.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2172.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2173.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2174.tmp
c:\users\alucard\AppData\Roaming\Azureus\tmp\AZU2175.tmp
c:\users\alucard\AppData\Roaming\Azureus\tracker.config
c:\users\alucard\AppData\Roaming\Azureus\tracker.config.bak
c:\users\alucard\AppData\Roaming\Azureus\unsentdata.config
c:\users\alucard\AppData\Roaming\Azureus\unsentdata.config.bak
c:\users\alucard\AppData\Roaming\Azureus\update.log
c:\users\alucard\AppData\Roaming\Azureus\update.properties
c:\users\alucard\AppData\Roaming\Azureus\v3.Friends.dat
c:\users\alucard\AppData\Roaming\Azureus\v3.Friends.dat.bak
c:\users\alucard\AppData\Roaming\Azureus\VuzeActivities.config
c:\users\alucard\AppData\Roaming\Azureus\VuzeActivities.config.bak
c:\windows\system32\perfc007.dat
c:\windows\system32\perfh007.dat

.
((((((((((((((((((((((( Dateien erstellt von 2009-05-21 bis 2009-06-21 ))))))))))))))))))))))))))))))
.

2009-06-21 15:46 . 2009-06-21 15:48 -------- d-----w- c:\users\Alucard\AppData\Local\temp
2009-06-20 06:51 . 2009-06-19 07:05 2052888 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-06-19 07:06 . 2009-06-11 06:04 3298072 ----a-w- c:\programdata\avg8\update\backup\setup.exe
2009-06-19 07:06 . 2009-06-11 06:04 1261344 ----a-w- c:\programdata\avg8\update\backup\avgwd.dll
2009-06-19 07:06 . 2009-06-11 06:04 829208 ----a-w- c:\programdata\avg8\update\backup\avgcfgx.dll
2009-06-19 07:05 . 2009-06-11 06:04 1452312 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-06-18 16:29 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-18 16:29 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-18 16:19 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-06-18 16:19 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-18 16:19 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-06-18 16:19 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-06-18 16:19 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-06-18 16:19 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-06-18 16:19 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-06-18 16:13 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-06-18 16:13 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-06-18 16:13 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-06-18 16:13 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-06-18 16:13 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-06-16 15:45 . 2009-06-16 15:45 -------- d-----w- c:\program files\ProtectDisc Driver Installer
2009-06-16 15:33 . 2009-06-16 15:33 -------- d-----w- c:\users\Alucard\AppData\Roaming\MAGIX
2009-06-16 15:27 . 2006-02-14 12:03 24576 ----a-w- c:\programdata\MAGIX\Video_deluxe_2008_Premium\Default\Validation.exe
2009-06-16 15:20 . 2003-11-04 16:20 6144 ----a-w- c:\programdata\MAGIX\Video_deluxe_2008_Premium\DVD\WMV_DISC\components\videowritetest.exe
2009-06-16 15:20 . 1997-10-15 20:03 18944 ----a-w- c:\programdata\MAGIX\Video_deluxe_2008_Premium\DVD\WMV_DISC\components\shelexec.exe
2009-06-16 15:20 . 2004-09-13 11:29 200704 ----a-w- c:\programdata\MAGIX\Video_deluxe_2008_Premium\DVD\WMV_DISC\licgen.exe
2009-06-16 15:20 . 2003-10-09 09:56 513088 ----a-w- c:\programdata\MAGIX\Video_deluxe_2008_Premium\DVD\WMV_DISC\WMDS.dll
2009-06-16 15:19 . 2005-10-08 14:14 40960 ----a-w- c:\programdata\MAGIX\Video_deluxe_2008_Premium\Default\fcdummy.exe
2009-06-13 19:40 . 2009-06-13 19:40 -------- d-----w- c:\program files\Avira GmbH
2009-06-13 08:23 . 2009-06-13 08:30 -------- d-----w- c:\program files\The KMPlayer
2009-06-13 03:11 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-13 03:11 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-12 23:05 . 2009-06-12 23:05 -------- d-----w- c:\users\Alucard\AppData\Local\Apple Computer
2009-06-12 23:01 . 2009-06-12 23:01 -------- d-----w- c:\users\Alucard\AppData\Local\Apple
2009-06-12 23:01 . 2009-06-12 23:01 -------- d-----w- c:\program files\Apple Software Update
2009-06-12 23:01 . 2009-06-12 23:01 -------- d-----w- c:\programdata\Apple
2009-06-10 20:00 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-10 20:00 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-10 20:00 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-09 21:29 . 2009-06-09 21:29 -------- d-----w- c:\users\Alucard\AppData\Roaming\Malwarebytes
2009-06-09 21:29 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 21:29 . 2009-06-09 23:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-09 21:29 . 2009-06-09 21:29 -------- d-----w- c:\programdata\Malwarebytes
2009-06-09 21:29 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 11:59 . 2009-06-09 11:59 -------- d-----w- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 07:05 . 2008-06-02 19:41 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-17 12:57 . 2008-05-17 09:48 86792 ----a-w- c:\users\Alucard\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-16 15:31 . 2009-01-21 22:24 -------- d-----w- c:\program files\MAGIX
2009-06-16 15:31 . 2009-01-21 22:24 -------- d-----w- c:\programdata\MAGIX
2009-06-16 15:29 . 2009-06-16 15:28 -------- d-----w- c:\program files\Common Files\MAGIX Shared
2009-06-14 01:24 . 2008-04-22 13:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-13 21:40 . 2008-05-20 16:31 -------- d-----w- c:\users\Alucard\AppData\Roaming\teamspeak2
2009-06-13 08:49 . 2008-05-17 10:53 -------- d-----w- c:\program files\Opera
2009-06-13 08:43 . 2008-11-24 23:49 -------- d-----w- c:\program files\WinPcap
2009-06-13 08:16 . 2008-05-20 22:13 -------- d-----w- c:\users\Alucard\AppData\Roaming\Orbit
2009-06-12 22:26 . 2008-04-22 13:47 -------- d-----w- c:\program files\Google
2009-06-12 22:19 . 2008-06-16 21:34 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-11 06:04 . 2008-06-02 19:41 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-09 09:45 . 2008-06-02 21:27 680 ----a-w- c:\users\Alucard\AppData\Local\d3d9caps.dat
2009-06-09 08:55 . 2008-06-11 18:34 -------- d-----w- c:\program files\a-squared Anti-Dialer
2009-05-14 01:00 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-02 12:56 . 2008-05-19 20:03 -------- d-----w- c:\users\Alucard\AppData\Roaming\gtk-2.0
2009-04-29 09:47 . 2009-04-29 08:24 -------- d-----w- c:\programdata\AAV
2009-04-29 09:40 . 2009-04-29 09:40 6058 ----a-w- c:\programdata\AAV\SSE\14\UpdateFiles\SSE_Patch_14.11.bat
2009-04-29 09:38 . 2009-04-29 08:23 -------- d-----w- c:\program files\Akademische Arbeitsgemeinschaft
2009-04-29 08:24 . 2009-04-29 08:24 -------- d-----w- c:\program files\Common Files\AAV
2009-04-25 06:13 . 2008-06-02 19:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-04-25 06:13 . 2008-06-12 22:06 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-04-25 06:13 . 2008-10-24 06:32 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-03-24 11:03 . 2009-03-24 11:03 7808 ----a-w- c:\windows\system32\drivers\psi_mf.sys
2009-03-11 18:48 . 2008-07-30 13:27 952 --sha-w- c:\windows\System32\KGyGaAvL.sys
2007-11-02 23:53 . 2007-11-02 23:15 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-06-21_12.33.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-22 13:45 . 2009-06-21 12:55 39842 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-06-21 12:55 69394 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-17 09:49 . 2009-06-21 12:55 10256 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2335038868-1735721012-585069593-1000_UserData.bin
- 2006-11-02 10:33 . 2009-06-19 01:13 625384 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-06-21 12:59 625384 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-06-19 01:13 116946 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-06-21 12:59 116946 c:\windows\System32\perfc009.dat
- 2006-11-02 10:22 . 2009-06-19 01:08 6553600 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2006-11-02 10:22 . 2009-06-21 12:51 6553600 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-19 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-02-20 170528]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-20 13507104]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-20 92704]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-11 1948440]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_2008_Premium\TrayServer.exe" [2008-01-17 90112]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-02-26 4939776]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{34AD743B-48F5-4818-9F99-7CEA43C5EB50}"= UDP:c:\program files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe:FSCLBaseUpdaterService.exe
"{018AD98C-247D-4381-806A-DE070126D325}"= TCP:c:\program files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe:FSCLBaseUpdaterService.exe
"{31B3837B-A5CD-490B-BF53-FA5511B6F52B}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{75C27343-3CF0-4CBB-BC58-4AD80EE812DB}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{B01DFEFD-5AC1-48DE-A3B4-5D2317E48A2B}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{48A9DA42-3B5F-4987-B775-35134130F15A}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{4BE5A303-F781-45B5-A733-75CF64FC58B2}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{77C56B8C-79DB-49AB-BBA2-DAA8FB661763}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{D4406505-4D03-450D-95B5-B6D3815572A5}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{8BA71F6E-65B4-4B3B-8BB1-1F89061903A7}d:\\world of warcraft\\backgrounddownloader.exe"= UDP:d:\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"UDP Query User{E2331E3A-CB71-4450-8D05-F03E44AE2B89}d:\\world of warcraft\\backgrounddownloader.exe"= TCP:d:\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"{B86E87F5-4CBE-4F7C-9172-213B2A4F769D}"= UDP:c:\warhammer online - age of reckoning\warpatch.exe:Warhammer Online - Age of Reckoning
"{B1595382-BF6B-4843-8A34-62BC8167C14B}"= TCP:c:\warhammer online - age of reckoning\warpatch.exe:Warhammer Online - Age of Reckoning
"TCP Query User{0AA02000-1A9B-4B25-AA54-CB8725C769E5}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{F85A3530-4028-400F-A7C3-BC2E2FD61102}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"TCP Query User{EB589538-DE4C-47C9-8B9A-7B7BD8EF0A98}c:\\program files\\orbitdownloader\\orbitnet.exe"= UDP:c:\program files\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader
"UDP Query User{F7F1FF14-7753-4CAC-8DA3-2D7297FF69C6}c:\\program files\\orbitdownloader\\orbitnet.exe"= TCP:c:\program files\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader
"TCP Query User{C10DDC41-F195-4F64-8C1F-E2A1CC668171}d:\\icq6.5\\icq.exe"= UDP:d:\icq6.5\icq.exe:ICQ Library
"UDP Query User{2C35997F-30DB-4E4E-B679-C52863F9F035}d:\\icq6.5\\icq.exe"= TCP:d:\icq6.5\icq.exe:ICQ Library
"TCP Query User{2946E59C-6876-400B-BC4E-333A3E8764BD}c:\\program files\\activision\\call of duty - world at war\\codwaw.unpacked.exe"= UDP:c:\program files\activision\call of duty - world at war\codwaw.unpacked.exe:Call of Duty(R): World at War Campaign/Coop
"UDP Query User{D50C3052-BCCE-4E14-8EC0-AB3ECBB2E047}c:\\program files\\activision\\call of duty - world at war\\codwaw.unpacked.exe"= TCP:c:\program files\activision\call of duty - world at war\codwaw.unpacked.exe:Call of Duty(R): World at War Campaign/Coop
"TCP Query User{0EB3D148-B8BE-4CC1-9035-B0D8808240A2}c:\\program files\\left 4 dead\\left4dead.exe"= UDP:c:\program files\left 4 dead\left4dead.exe:left4dead
"UDP Query User{29D5D24D-4E88-41A9-B598-88A57A2E1CE5}c:\\program files\\left 4 dead\\left4dead.exe"= TCP:c:\program files\left 4 dead\left4dead.exe:left4dead
"TCP Query User{2043AD30-A207-43F0-BFFA-640507FFF540}c:\\users\\alucard\\appdata\\local\\temp\\blizzard launcher temporary - 9d46e3a0\\launcher.exe"= UDP:c:\users\alucard\appdata\local\temp\blizzard launcher temporary - 9d46e3a0\launcher.exe:launcher.exe
"UDP Query User{86EDF7F6-A5F0-4E91-8DCE-71D50432A050}c:\\users\\alucard\\appdata\\local\\temp\\blizzard launcher temporary - 9d46e3a0\\launcher.exe"= TCP:c:\users\alucard\appdata\local\temp\blizzard launcher temporary - 9d46e3a0\launcher.exe:launcher.exe
"TCP Query User{DA772D42-3B8B-450A-8909-C1907B7B4B32}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{134C1919-6570-4B00-BDAD-F5E6C5D3F5B0}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
"TCP Query User{8F13F884-C67A-4A35-B05E-B1D099A4BF97}c:\\users\\alucard\\appdata\\local\\temp\\blizzard launcher temporary - afb9dc18\\launcher.exe"= UDP:c:\users\alucard\appdata\local\temp\blizzard launcher temporary - afb9dc18\launcher.exe:launcher.exe
"UDP Query User{E3E2701F-8641-41C5-9DB2-F85459884A6D}c:\\users\\alucard\\appdata\\local\\temp\\blizzard launcher temporary - afb9dc18\\launcher.exe"= TCP:c:\users\alucard\appdata\local\temp\blizzard launcher temporary - afb9dc18\launcher.exe:launcher.exe
"TCP Query User{A8067403-D65B-469E-B07E-9CFD65AAD8FA}d:\\world of warcraft\\launcher.exe"= UDP:d:\world of warcraft\launcher.exe:Blizzard Launcher
"UDP Query User{68C5B48F-67B2-4E91-833D-CC78D75636D9}d:\\world of warcraft\\launcher.exe"= TCP:d:\world of warcraft\launcher.exe:Blizzard Launcher

R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [13.06.2008 00:06 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [02.06.2008 21:41 327688]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [24.10.2008 08:32 108552]
R2 a2AntiDialer;a-squared Anti-Dialer Service;c:\program files\a-squared Anti-Dialer\a2service.exe [11.06.2008 20:34 425080]
R2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [24.10.2008 15:35 128296]
R2 acedrv11;acedrv11;c:\windows\System32\drivers\ACEDRV11.sys [23.01.2008 10:19 501560]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [09.01.2009 10:52 906520]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [09.01.2009 10:52 298776]
R3 PSI;PSI;c:\windows\System32\drivers\psi_mf.sys [24.03.2009 13:03 7808]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [16.06.2009 17:30 1527900]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [06.11.2007 22:22 34064]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Inhalt des "geplante Tasks" Ordners

2009-06-20 c:\windows\Tasks\User_Feed_Synchronization-{14A97E71-6865-42C5-9CA6-DF07F71973DF}.job
- c:\windows\system32\msfeedssync.exe [2009-06-18 11:31]
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
.