Hab ich einen Backdoortrojaner?

Clockwork

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3685
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

03.02.2010 21:55:28
mbam-log-2010-02-03 (21-55-28).txt

Scan-Methode: Vollständiger Scan (C:\|F:\|G:\|)
Durchsuchte Objekte: 270875
Laufzeit: 42 minute(s), 29 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 10
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
c:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{c4bf49a2-94f1-42bd-f034-3604811c807d} (Trojan.Ertfor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c4bf49a2-94f1-42bd-f034-3604811c807d} (Trojan.Ertfor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lixgax (Rootkit.Goldun) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\F5JMWNZTHI (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\lixgap (Rootkit.Goldun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lixgax.sys (Trojan.Goldun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\lixgax.sys (Trojan.Goldun) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c4bf49a2-94f1-42bd-f034-3604811c807d} (Trojan.Ertfor) -> Quarantined and deleted successfully.

sooo

das ist der Bericht von malwarebyte:

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Programme\Crypt Load\ocr\netload.in\asmCaptcha\test.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lixgax.sys (Rootkit.Goldun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\ymsfa.sys (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

und das der bericht von RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Privat at 2010-02-03 22:01:33
Microsoft Windows XP Professional Service Pack 3
System drive C: has 207 GB (87%) free of 238 GB
Total RAM: 3326 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:01:36, on 03.02.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gigabyte\EasySaver\ESSVR.EXE
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\McAfee\SiteAdvisor\McSACore.exe
C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\Explorer.EXE
G:\CAD-CAM Programme\Solid Works 2009 - Cosmos Flow Simulation\binCFW\StandAloneSlv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programme\VisualTaskTips\VisualTaskTips.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Privat\Desktop\RSIT.exe
C:\Programme\trend micro\Privat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [BDRegion] C:\Programme\Cyberlink\Shared Files\brs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VisualTaskTips] C:\Programme\VisualTaskTips\VisualTaskTips.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systèmes SolidWorks Corp. - G:\CAD-CAM Programme\Solid Works 2009+\swScheduler\DTSCoordinatorService.exe
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Programme\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Programme\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
O23 - Service: Remote Solver for Flow Simulation 2009 - Unknown owner - G:\CAD-CAM Programme\Solid Works 2009 - Cosmos Flow Simulation\binCFW\StandAloneSlv.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 6549 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Klick-Wartung.job
C:\WINDOWS\tasks\payagxm.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{7EE0162D-72C2-4F79-9EF7-4237D3804A66}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-01-13 18084864]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"VirtualCloneDrive"=C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2009-05-26 85160]
"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-04 98304]
"BDRegion"=C:\Programme\Cyberlink\Shared Files\brs.exe [2009-02-28 75048]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"VisualTaskTips"=C:\Programme\VisualTaskTips\VisualTaskTips.exe [2008-06-22 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-11-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE"="C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE"="C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Programme\uTorrent\uTorrent.exe"="C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Programme\Java\jre6\bin\javaw.exe"="C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*isabled:Firefox"
"C:\Programme\SopCast\adv\SopAdver.exe"="C:\Programme\SopCast\adv\SopAdver.exe:*isabled:SopCast Adver"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:rundll32"
"C:\Dokumente und Einstellungen\Privat\Lokale Einstellungen\Temp\mvNat.exe"="C:\Dokumente und Einstellungen\Privat\Lokale Einstellungen\Temp\mvNat.exe:*:Enabled:mvNat.exe"
"\??\C:\WINDOWS\system32\winlogon.exe"="\??\C:\WINDOWS\system32\winlogon.exe:*:Enabled:rundll32"
"C:\Dokumente und Einstellungen\Privat\Lokale Einstellungen\Temp\a2dspi.exe"="C:\Dokumente und Einstellungen\Privat\Lokale Einstellungen\Temp\a2dspi.exe:*:Enabled:74584"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-02-03 21:12:21 ----D---- C:\rsit
2010-02-03 21:12:21 ----D---- C:\Programme\trend micro
2010-02-03 20:10:32 ----D---- C:\Programme\MozBackup
2010-02-03 19:56:12 ----D---- C:\Programme\GRISOFT
2010-02-03 19:25:26 ----D---- C:\Programme\Gemeinsame Dateien\Data Dynamics
2010-02-03 17:47:49 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\Help
2010-02-03 17:43:01 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
2010-02-03 17:42:53 ----D---- C:\Programme\Security Task Manager
2010-02-03 16:42:27 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\Desktopicon
2010-02-03 16:42:26 ----D---- C:\Programme\Unlocker
2010-02-03 16:16:33 ----RASH---- C:\WINDOWS\system32\ALSNDMGR1.dll
2010-01-25 20:27:37 ----D---- C:\WINDOWS\system32\Adobe
2010-01-25 20:25:15 ----A---- C:\WINDOWS\system32\MFC71.dll
2010-01-25 20:25:15 ----A---- C:\WINDOWS\system32\libmmd.dll
2010-01-25 20:24:49 ----D---- C:\Programme\MTS
2010-01-25 20:24:40 ----A---- C:\WINDOWS\IsUn0407.exe
2010-01-24 21:22:06 ----D---- C:\Programme\JDownloader
2010-01-23 18:25:56 ----D---- C:\Programme\AC3Filter
2010-01-23 18:23:20 ----A---- C:\WINDOWS\system32\DivXc32f.dll
2010-01-23 18:23:20 ----A---- C:\WINDOWS\system32\DivXc32.dll
2010-01-23 14:01:10 ----D---- C:\Programme\MSD 0.655
2010-01-23 13:42:11 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\AVS4YOU
2010-01-23 13:42:10 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVS4YOU
2010-01-23 13:41:27 ----D---- C:\Programme\Gemeinsame Dateien\AVSMedia
2010-01-23 13:41:24 ----D---- C:\Programme\AVS4YOU
2010-01-23 13:41:24 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2010-01-19 19:56:46 ----A---- C:\WINDOWS\system32\scrnrdr.exe
2010-01-19 19:51:30 ----D---- C:\Programme\windows 7 theme
2010-01-19 19:43:07 ----D---- C:\Programme\VisualTaskTips
2010-01-19 19:41:29 ----D---- C:\Programme\Winflip
2010-01-19 19:37:21 ----D---- C:\Programme\TrueTransparency
2010-01-19 19:25:05 ----D---- C:\Programme\Alastria Software
2010-01-19 19:23:56 ----D---- C:\Programme\Taskbar Shuffle
2010-01-18 19:49:27 ----D---- C:\Programme\Gemeinsame Dateien\G DATA
2010-01-18 19:49:27 ----D---- C:\Programme\G Data
2010-01-18 19:49:27 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\G DATA
2010-01-15 18:50:45 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\CyberLink
2010-01-15 18:49:13 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2010-01-15 18:49:06 ----D---- C:\Programme\Gemeinsame Dateien\CyberLink
2010-01-15 18:48:40 ----D---- C:\Programme\CyberLink
2010-01-15 18:48:13 ----A---- C:\WINDOWS\system32\msxml3a.dll
2010-01-15 18:47:53 ----AD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp
2010-01-15 18:41:41 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\DivX
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\vxblock.dll
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxwave.dll
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxsfs.dll
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxmas.dll
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxinsi64.exe
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxdrv.dll
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\pxafs.dll
2010-01-15 18:40:06 ----N---- C:\WINDOWS\system32\px.dll
2010-01-15 18:39:42 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared
2010-01-15 18:39:42 ----D---- C:\Programme\DivX
2010-01-13 15:53:35 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 15:53:29 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 1 months======

2010-02-03 21:58:00 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-03 21:57:58 ----D---- C:\WINDOWS\Temp
2010-02-03 21:57:18 ----D---- C:\WINDOWS\system32\drivers
2010-02-03 21:57:18 ----D---- C:\WINDOWS\system32
2010-02-03 21:56:55 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-03 21:56:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-02-03 21:12:21 ----RD---- C:\Programme
2010-02-03 21:11:41 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-02-03 20:15:29 ----D---- C:\Programme\Mozilla Firefox
2010-02-03 19:58:07 ----AD---- C:\WINDOWS
2010-02-03 19:27:53 ----D---- C:\mcamx
2010-02-03 19:26:32 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-03 19:26:23 ----HD---- C:\Programme\InstallShield Installation Information
2010-02-03 19:26:18 ----SHD---- C:\WINDOWS\Installer
2010-02-03 19:26:17 ----D---- C:\Config.Msi
2010-02-03 19:25:26 ----D---- C:\Programme\Gemeinsame Dateien
2010-02-03 18:27:35 ----SD---- C:\WINDOWS\Tasks
2010-02-03 16:53:22 ----D---- C:\WINDOWS\Downloaded Installations
2010-02-03 16:23:05 ----D---- C:\WINDOWS\system32\Restore
2010-02-03 16:23:04 ----SHD---- C:\System Volume Information
2010-02-03 16:21:14 ----HD---- C:\WINDOWS\inf
2010-02-03 16:16:24 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-03 15:59:18 ----D---- C:\WINDOWS\Prefetch
2010-02-02 22:32:40 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\uTorrent
2010-01-31 19:09:09 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\SolidWorks
2010-01-31 18:43:47 ----D---- C:\Downloads
2010-01-30 18:46:26 ----D---- C:\Programme\AskTBar
2010-01-25 20:27:37 ----D---- C:\Programme\Gemeinsame Dateien\Adobe
2010-01-22 17:00:31 ----D---- C:\Programme\Internet Explorer
2010-01-22 17:00:25 ----D---- C:\WINDOWS\ie8updates
2010-01-22 17:00:15 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-20 15:29:48 ----A---- C:\WINDOWS\NeroDigital.ini
2010-01-19 19:49:21 ----D---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\ICQ
2010-01-19 19:45:08 ----RSD---- C:\WINDOWS\assembly
2010-01-19 16:42:27 ----D---- C:\WINDOWS\WinSxS
2010-01-16 14:33:44 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2010-01-13 19:42:02 ----SD---- C:\Dokumente und Einstellungen\Privat\Anwendungsdaten\Microsoft
2010-01-13 17:13:30 ----D---- C:\WINDOWS\AppPatch
2010-01-13 15:54:10 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help
2010-01-13 15:53:38 ----A---- C:\WINDOWS\imsins.BAK
2010-01-08 19:55:29 ----D---- C:\Programme\Crypt Load
2010-01-06 21:33:51 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-04 17:26:01 ----D---- C:\Programme\ICQ6.5
2010-01-04 15:05:56 ----D---- C:\Programme\McAfee

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;AMD HwPState Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2009-11-13 33792]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver; C:\WINDOWS\System32\DRIVERS\AvgArCln.sys [2007-01-18 3968]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 WmiAcpi;Microsoft Windows-Verwaltungsschnittstelle für ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/01/15 18:49:12]; \??\C:\Programme\CyberLink\PowerDVD9\000.fcl []
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]
R2 CBN;CBN; \??\C:\WINDOWS\System32\Drivers\CBN.SYS []
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 vusbbus;Virtual Usb Bus Enumerator; C:\WINDOWS\system32\DRIVERS\vusbbus.sys [2007-10-21 18432]
R3 akshasp;Aladdin HASP Key; C:\WINDOWS\system32\DRIVERS\akshasp.sys [2006-11-22 327168]
R3 aksusb;Aladdin USB Key; C:\WINDOWS\system32\DRIVERS\aksusb.sys [2006-11-22 100096]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2006-01-11 19200]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-11-04 4423168]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2005-04-12 4608]
R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
R3 GearAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\drivers\GEARAspiWDM.sys [2008-02-22 16168]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-01-20 5027840]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2003-04-02 12288]
R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtKHDMI.sys [2008-12-25 3721664]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 VClone;VClone; C:\WINDOWS\system32\DRIVERS\VClone.sys [2009-05-23 29696]
S3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Filtertreiber für Systemwiederherstellung; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-11-04 602112]
R2 ES lite Service;ES lite Service for program management.; C:\Programme\Gigabyte\EasySaver\ESSVR.EXE [2009-02-05 68136]
R2 ICQ Service;ICQ Service; C:\Programme\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Programme\McAfee\SiteAdvisor\McSACore.exe [2009-12-08 93320]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe [2007-08-08 836904]
R2 Remote Solver for Flow Simulation 2009;Remote Solver for Flow Simulation 2009; G:\CAD-CAM Programme\Solid Works 2009 - Cosmos Flow Simulation\binCFW\StandAloneSlv.exe [2008-09-03 210216]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-11-15 603904]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe []
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service; G:\CAD-CAM Programme\Solid Works 2009+\swScheduler\DTSCoordinatorService.exe [2008-09-09 79144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe [2007-08-03 382248]
S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe [2009-11-15 79360]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-11-15 360192]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------