Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: ICq Virus, wie findest du das foto

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 09.06.2010, 21:48   #1
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



wie findest du das foto

NICHT KLICKEN: hxxp://www.images.photobucket.mylexa.com/show_images.php?id=3&image=IMG0737830249202010.JPG

den link hatte ich von nem bekannten aus der buddylist, und seit dem hab ich das ding und es verteil in meiner freundesliste

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 09.06.2010 21:56:59 - Run 2
OTL by OldTimer - Version 3.2.6.0     Folder = C:\Users\Toto\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,31 Gb Total Space | 1,84 Gb Free Space | 7,57% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 45,80 Gb Free Space | 93,80% Space Free | Partition Type: NTFS
Drive E: | 58,59 Gb Total Space | 26,97 Gb Free Space | 46,03% Space Free | Partition Type: NTFS
Drive F: | 101,04 Gb Total Space | 63,88 Gb Free Space | 63,22% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: TOTO-PC
Current User Name: Toto
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Toto\AppData\Local\Temp\Pcx.exe ()
PRC - C:\Windows\Ptuxub.exe ()
PRC - C:\Users\Toto\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Public\winscdvn.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - D:\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - D:\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
PRC - D:\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - D:\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Windows\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
PRC - C:\Programme\Firebird\Firebird_2_1\bin\fbguard.exe (FirebirdSQL Project)
PRC - C:\Programme\Firebird\Firebird_2_1\bin\fbserver.exe (FirebirdSQL Project)
PRC - D:\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Toto\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AntiVirService) -- D:\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (Netmannetprofm) -- C:\Windows\System32\amxreadt.exe ()
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- D:\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (NMSAccessU) -- D:\CDBurnerXP\NMSAccessU.exe ()
SRV - (FirebirdGuardianDefaultInstance) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe (FirebirdSQL Project)
SRV - (FirebirdServerDefaultInstance) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe (FirebirdSQL Project)
SRV - (StarWindServiceAE) -- D:\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ACEDRV06) -- C:\Windows\System32\drivers\ACEDRV06.sys (Protect Software GmbH)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (NPF) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (RTL8167) -- C:\Windows\System32\drivers\Rt86win7.sys (Realtek Corporation                                            )
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (PAC207) -- C:\Windows\System32\drivers\PFC027.SYS (PixArt Imaging Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (s1018mdm) -- C:\Windows\System32\drivers\s1018mdm.sys (MCCI Corporation)
DRV - (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1018unic.sys (MCCI Corporation)
DRV - (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1018mgmt.sys (MCCI Corporation)
DRV - (s1018obex) -- C:\Windows\System32\drivers\s1018obex.sys (MCCI Corporation)
DRV - (s1018bus) Sony Ericsson Device 1018 driver (WDM) -- C:\Windows\System32\drivers\s1018bus.sys (MCCI Corporation)
DRV - (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1018nd5.sys (MCCI Corporation)
DRV - (s1018mdfl) -- C:\Windows\System32\drivers\s1018mdfl.sys (MCCI Corporation)
DRV - (avgio) -- D:\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 2B 48 2F F6 87 CA 01  [binary data]
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.23
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.2&q="
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.04 10:22:34 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.04 10:22:34 | 000,000,000 | ---D | M]
 
[2009.10.30 16:40:05 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\mozilla\Extensions
[2010.06.09 20:54:47 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\mozilla\Firefox\Profiles\gp1pb4bm.default\extensions
[2010.06.09 20:54:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Toto\AppData\Roaming\mozilla\Firefox\Profiles\gp1pb4bm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010.06.06 21:26:22 | 000,000,947 | ---- | M] () -- C:\Users\Toto\AppData\Roaming\Mozilla\FireFox\Profiles\gp1pb4bm.default\searchplugins\icqplugin.xml
[2010.03.29 18:32:57 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.16 20:28:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.16 20:28:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.16 20:28:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.16 20:28:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.16 20:28:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\..\Toolbar\WebBrowser: (Foxit Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [avgnt] D:\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKU\S-1-5-21-625753107-3092379029-2642143614-1001..\Run: [M5T8QL3YW3] C:\Users\Toto\AppData\Local\Temp\Pcx.exe ()
O4 - HKU\S-1-5-21-625753107-3092379029-2642143614-1001..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe File not found
O4 - HKU\S-1-5-21-625753107-3092379029-2642143614-1001..\Run: [Windows Firewall Manager] C:\Users\Public\winscdvn.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Toto\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - D:\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0785a660-c7dd-11de-af1c-000c76d40655}\Shell - "" = AutoRun
O33 - MountPoints2\{0785a660-c7dd-11de-af1c-000c76d40655}\Shell\AutoRun\command - "" = I:\Startme.exe -- File not found
O33 - MountPoints2\{5fccea14-0073-11df-9daf-0009dd5005ea}\Shell - "" = AutoRun
O33 - MountPoints2\{5fccea14-0073-11df-9daf-0009dd5005ea}\Shell\AutoRun\command - "" = I:\setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009.07.14 04:37:08 | 000,000,000 | ---D | M]
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
 
MsConfig - StartUpReg: AlcoholAutomount - hkey= - key= - D:\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
MsConfig - StartUpReg: BitTorrent DNA - hkey= - key= - C:\Program Files\DNA\btdna.exe File not found
MsConfig - StartUpReg: DAEMON Tools Pro Agent - hkey= - key= - C:\Program Files\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd)
MsConfig - StartUpReg: EA Core - hkey= - key= - C:\Program Files\Electronic Arts\EADM\Core.exe File not found
MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Program Files\ICQ7.1\ICQ.exe (ICQ, LLC.)
MsConfig - StartUpReg: Picasa Media Detector - hkey= - key= - C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: Sony Ericsson PC Companion - hkey= - key= - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB)
MsConfig - StartUpReg: Sony Ericsson PC Suite - hkey= - key= - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootMin: Primary disk - Driver Group
SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.XFR1 - C:\Windows\System32\xfcodec.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.09 21:09:11 | 000,000,000 | ---D | C] -- C:\Users\Toto\AppData\Roaming\Malwarebytes
[2010.06.09 21:09:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.06.09 21:08:58 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.06.09 21:08:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.06.09 21:08:57 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.09 20:57:29 | 000,000,000 | ---D | C] -- C:\Users\Toto\AppData\Roaming\QuickScan
[2010.05.27 20:36:20 | 000,000,000 | ---D | C] -- C:\Programme\Network Stumbler
[2010.05.27 15:56:24 | 000,000,000 | ---D | C] -- C:\Users\Toto\AppData\Roaming\Wireshark
[2010.05.27 15:52:24 | 000,000,000 | ---D | C] -- C:\Programme\WinPcap
[2010.05.27 11:42:17 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.05.19 17:28:06 | 000,000,000 | ---D | C] -- C:\Users\Toto\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.05.19 17:27:52 | 000,000,000 | ---D | C] -- C:\Users\Toto\Documents\DVDVideoSoft
[2010.05.19 17:27:40 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft
[2010.05.19 17:27:40 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DVDVideoSoft
[2010.05.14 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Toto\Desktop\Fotos
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.09 21:56:37 | 001,480,600 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.06.09 21:56:37 | 000,647,128 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.06.09 21:56:37 | 000,609,896 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.06.09 21:56:37 | 000,127,206 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.06.09 21:56:37 | 000,104,214 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.06.09 21:53:05 | 000,000,244 | -H-- | M] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.06.09 21:53:01 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010.06.09 21:52:54 | 000,164,864 | ---- | M] () -- C:\Windows\Ptuxub.exe
[2010.06.09 21:52:19 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.06.09 21:52:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.06.09 21:52:08 | 1609,474,048 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.09 21:51:14 | 002,097,152 | -HS- | M] () -- C:\Users\Toto\ntuser.dat
[2010.06.09 21:51:09 | 002,535,475 | -H-- | M] () -- C:\Users\Toto\AppData\Local\IconCache.db
[2010.06.09 21:09:03 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.09 20:47:32 | 000,000,100 | --S- | M] () -- C:\Windows\System32\1578054983.dat
[2010.06.09 20:45:33 | 000,000,004 | ---- | M] () -- C:\Users\Toto\AppData\Roaming\dhxiuw.dat
[2010.06.09 20:41:00 | 000,164,864 | ---- | M] () -- C:\Windows\Ptuxua.exe
[2010.06.09 20:01:24 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.09 20:01:24 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.09 16:30:08 | 000,524,288 | -HS- | M] () -- C:\Users\Toto\ntuser.dat{ad7a5d6d-73c7-11df-aa85-000c76d40655}.TMContainer00000000000000000002.regtrans-ms
[2010.06.09 16:30:08 | 000,524,288 | -HS- | M] () -- C:\Users\Toto\ntuser.dat{ad7a5d6d-73c7-11df-aa85-000c76d40655}.TMContainer00000000000000000001.regtrans-ms
[2010.06.09 16:30:08 | 000,065,536 | -HS- | M] () -- C:\Users\Toto\ntuser.dat{ad7a5d6d-73c7-11df-aa85-000c76d40655}.TM.blf
[2010.05.31 17:30:11 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\000001E4.LCS
[2010.05.27 20:36:20 | 000,001,036 | ---- | M] () -- C:\Users\Toto\Desktop\Network Stumbler.lnk
[2010.05.23 13:45:43 | 000,524,288 | -HS- | M] () -- C:\Users\Toto\ntuser.dat{3e2649a8-6658-11df-80a4-000c76d40655}.TMContainer00000000000000000002.regtrans-ms
[2010.05.23 13:45:43 | 000,524,288 | -HS- | M] () -- C:\Users\Toto\ntuser.dat{3e2649a8-6658-11df-80a4-000c76d40655}.TMContainer00000000000000000001.regtrans-ms
[2010.05.23 13:45:43 | 000,065,536 | -HS- | M] () -- C:\Users\Toto\ntuser.dat{3e2649a8-6658-11df-80a4-000c76d40655}.TM.blf
[2010.05.19 17:28:01 | 000,001,197 | ---- | M] () -- C:\Users\Toto\Desktop\DVDVideoSoft Free Studio.lnk
[2010.05.19 16:37:00 | 001,050,690 | ---- | M] () -- C:\Users\Toto\Desktop\IMG_1049.JPG
[2010.05.17 14:45:59 | 000,076,340 | ---- | M] () -- C:\Users\Toto\Desktop\cIw23D94IrfDEFfES4X2kw.jpg
[2010.05.14 21:56:42 | 000,219,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.05.14 21:13:32 | 000,138,592 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.05.14 20:59:35 | 000,000,518 | ---- | M] () -- C:\Users\Toto\Desktop\Der Tiberiumkonflikt.lnk
[2010.05.12 11:21:16 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.05.11 20:37:10 | 000,041,872 | ---- | M] () -- C:\Windows\System32\xfcodec.dll
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.06.09 21:53:00 | 000,164,864 | ---- | C] () -- C:\Windows\Ptuxub.exe
[2010.06.09 21:52:57 | 000,000,282 | -H-- | C] () -- C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010.06.09 21:52:55 | 000,000,244 | -H-- | C] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.06.09 21:09:03 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.09 20:45:34 | 000,000,100 | --S- | C] () -- C:\Windows\System32\1578054983.dat
[2010.06.09 20:45:33 | 000,000,004 | ---- | C] () -- C:\Users\Toto\AppData\Roaming\dhxiuw.dat
[2010.06.09 20:41:05 | 000,164,864 | ---- | C] () -- C:\Windows\Ptuxua.exe
[2010.06.09 15:05:56 | 000,524,288 | -HS- | C] () -- C:\Users\Toto\ntuser.dat{ad7a5d6d-73c7-11df-aa85-000c76d40655}.TMContainer00000000000000000002.regtrans-ms
[2010.06.09 15:05:56 | 000,524,288 | -HS- | C] () -- C:\Users\Toto\ntuser.dat{ad7a5d6d-73c7-11df-aa85-000c76d40655}.TMContainer00000000000000000001.regtrans-ms
[2010.06.09 15:05:56 | 000,065,536 | -HS- | C] () -- C:\Users\Toto\ntuser.dat{ad7a5d6d-73c7-11df-aa85-000c76d40655}.TM.blf
[2010.05.27 20:36:20 | 000,001,036 | ---- | C] () -- C:\Users\Toto\Desktop\Network Stumbler.lnk
[2010.05.23 12:46:27 | 000,524,288 | -HS- | C] () -- C:\Users\Toto\ntuser.dat{3e2649a8-6658-11df-80a4-000c76d40655}.TMContainer00000000000000000002.regtrans-ms
[2010.05.23 12:46:27 | 000,524,288 | -HS- | C] () -- C:\Users\Toto\ntuser.dat{3e2649a8-6658-11df-80a4-000c76d40655}.TMContainer00000000000000000001.regtrans-ms
[2010.05.23 12:46:27 | 000,065,536 | -HS- | C] () -- C:\Users\Toto\ntuser.dat{3e2649a8-6658-11df-80a4-000c76d40655}.TM.blf
[2010.05.19 17:27:53 | 000,001,197 | ---- | C] () -- C:\Users\Toto\Desktop\DVDVideoSoft Free Studio.lnk
[2010.05.19 16:36:58 | 001,050,690 | ---- | C] () -- C:\Users\Toto\Desktop\IMG_1049.JPG
[2010.05.17 14:45:04 | 000,076,340 | ---- | C] () -- C:\Users\Toto\Desktop\cIw23D94IrfDEFfES4X2kw.jpg
[2010.05.14 20:59:35 | 000,000,518 | ---- | C] () -- C:\Users\Toto\Desktop\Der Tiberiumkonflikt.lnk
[2010.05.11 20:37:10 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.03.27 04:37:37 | 000,000,566 | ---- | C] () -- C:\Windows\System32\SP207.ini
[2010.01.23 15:13:31 | 000,000,226 | ---- | C] () -- C:\Windows\bienemaja.ini
[2010.01.19 15:01:20 | 000,000,023 | ---- | C] () -- C:\Windows\qtw.ini
[2010.01.19 14:25:50 | 000,003,007 | ---- | C] () -- C:\Windows\Wickie.ini
[2010.01.13 20:52:55 | 000,056,320 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
[2010.01.13 20:40:59 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2010.01.08 14:43:08 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.12.27 17:25:35 | 000,307,200 | ---- | C] () -- C:\Windows\System32\AscSQLite.dll
[2009.11.29 23:09:41 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.11.29 23:09:41 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.11.07 14:13:06 | 000,000,065 | ---- | C] () -- C:\Windows\Maus2.INI
[2009.11.04 19:43:54 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.10.30 17:27:49 | 000,138,592 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.10.30 17:27:15 | 000,000,245 | ---- | C] () -- C:\Windows\game.ini
[2009.10.20 20:19:30 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
 
========== LOP Check ==========
 
[2009.11.01 15:02:04 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Canneverbe_Limited
[2010.04.01 20:18:29 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\DAEMON Tools Pro
[2010.05.19 17:28:06 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.01.17 02:16:13 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\FileZilla
[2009.10.30 17:49:10 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Foxit
[2009.12.29 18:49:21 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\GGC Client
[2010.01.13 20:53:46 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\GitarreroBeginner
[2010.06.09 21:46:22 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\ICQ
[2010.04.28 09:50:45 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Mindscape
[2009.12.24 13:43:44 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Printparade
[2010.06.09 20:58:52 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\QuickScan
[2009.11.03 22:25:48 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Sony
[2009.11.03 22:07:05 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Sony Setup
[2009.12.23 22:40:55 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\TeamViewer
[2010.04.01 23:05:35 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\TS3Client
[2009.11.29 23:10:57 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Ubisoft
[2010.05.27 15:56:24 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Wireshark
[2010.05.14 22:01:29 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\X-Chat 2
[2010.05.13 07:45:11 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.06.09 21:53:05 | 000,000,244 | -H-- | M] () -- C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.06.09 21:53:01 | 000,000,282 | -H-- | M] () -- C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.01.22 10:14:29 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Adobe
[2009.11.01 15:02:04 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Canneverbe_Limited
[2010.04.01 20:18:29 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\DAEMON Tools Pro
[2009.11.04 21:49:09 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\DivX
[2009.12.16 20:08:46 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\dvdcss
[2010.05.19 17:28:06 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.01.17 02:16:13 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\FileZilla
[2009.10.30 17:49:10 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Foxit
[2009.12.29 18:49:21 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\GGC Client
[2010.01.13 20:53:46 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\GitarreroBeginner
[2010.06.09 21:46:22 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\ICQ
[2009.10.30 16:27:12 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Identities
[2009.10.30 16:44:32 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Macromedia
[2010.06.09 21:09:11 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Media Center Programs
[2010.05.07 14:29:06 | 000,000,000 | --SD | M] -- C:\Users\Toto\AppData\Roaming\Microsoft
[2010.04.28 09:50:45 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Mindscape
[2009.10.30 16:40:05 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Mozilla
[2009.12.24 13:43:44 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Printparade
[2010.06.09 20:58:52 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\QuickScan
[2010.03.27 04:41:39 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Skype
[2010.03.27 04:21:14 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\skypePM
[2009.11.03 22:25:48 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Sony
[2009.11.03 22:07:05 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Sony Setup
[2009.10.30 18:02:34 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\teamspeak2
[2009.12.23 22:40:55 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\TeamViewer
[2010.04.01 23:05:35 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\TS3Client
[2009.11.29 23:10:57 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Ubisoft
[2010.06.02 11:05:19 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\vlc
[2009.11.01 16:00:56 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\WinRAR
[2010.05.27 15:56:24 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Wireshark
[2010.05.14 22:01:29 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\X-Chat 2
[2010.05.14 20:30:27 | 000,000,000 | ---D | M] -- C:\Users\Toto\AppData\Roaming\Xfire
 
< %APPDATA%\*.exe /s >
[2010.02.16 10:37:22 | 000,038,784 | ---- | M] () -- C:\Users\Toto\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.01.19 15:03:58 | 000,010,134 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{09E4C6A0-AB81-4ADA-9163-DD7B724E0BB6}\HTML.exe
[2010.01.19 15:03:58 | 000,405,594 | R--- | M] (.) -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{09E4C6A0-AB81-4ADA-9163-DD7B724E0BB6}\JanoschVorschule.exe
[2010.01.19 15:03:58 | 000,001,078 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{09E4C6A0-AB81-4ADA-9163-DD7B724E0BB6}\Readme.exe
[2010.01.19 15:03:58 | 000,040,960 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{09E4C6A0-AB81-4ADA-9163-DD7B724E0BB6}\_AE73BFE3BF70_4E5F_BEF9_16CF469CE3E3.exe
[2009.11.03 22:25:26 | 000,010,134 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
[2010.04.19 14:10:09 | 000,065,536 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{7CFC17CE-0A66-46B0-BA57-BF8AB674BF5C}\AppName_3D33920276E6481589D0B59A8654B812.exe
[2010.04.19 14:10:09 | 000,026,510 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{7CFC17CE-0A66-46B0-BA57-BF8AB674BF5C}\ARPPRODUCTICON.exe
[2010.02.13 21:41:42 | 000,050,534 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{8F259DC2-51CA-4EBE-8320-E22B9C34AD01}\app_icon.exe
[2009.12.27 19:53:45 | 000,010,134 | R--- | M] () -- C:\Users\Toto\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2009.11.03 22:08:05 | 021,935,408 | ---- | M] (Apple Inc.) -- C:\Users\Toto\AppData\Roaming\Sony Setup\A189E68E-2253-4c3b-86B7-D77E36F13C55\QuickTimeInstaller.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.04.01 20:14:43 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< 5. Klicke "run Scan" >
 
< 6. 2 reporte werden erstellt: >
 
< OTL.Txt >
 
< Extras.Txt >

< End of report >
         
--- --- ---

Geändert von Toto1980 (09.06.2010 um 22:13 Uhr)

Alt 09.06.2010, 22:14   #2
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 09.06.2010 21:56:59 - Run 2
OTL by OldTimer - Version 3.2.6.0     Folder = C:\Users\Toto\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,31 Gb Total Space | 1,84 Gb Free Space | 7,57% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 45,80 Gb Free Space | 93,80% Space Free | Partition Type: NTFS
Drive E: | 58,59 Gb Total Space | 26,97 Gb Free Space | 46,03% Space Free | Partition Type: NTFS
Drive F: | 101,04 Gb Total Space | 63,88 Gb Free Space | 63,22% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: TOTO-PC
Current User Name: Toto
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-625753107-3092379029-2642143614-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\xchat\xchat.exe" = D:\xchat\xchat.exe:*:Enabled:XChat IRC Client -- ()
"C:\Users\Public\winscdvn.exe" = C:\Users\Public\winscdvn.exe:*:Enabled:Windows Firewall Manager -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
""Lass uns reiten 2" = "Lass uns reiten 2 - Special Edition"
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{09E4C6A0-AB81-4ADA-9163-DD7B724E0BB6}" = Janosch Vorschule
"{0B9E0BD1-328D-415C-80A5-6B0028F0C104}" = Call of Duty(R) 2 Patch 1.2
"{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}" = HP USB Disk Storage Format Tool
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{202BACA0-AA91-11D4-A5EE-004095501894}" = Wendy
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.009.00
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4E5EE953-0D92-A385-E3A0-FBFCB2DE15AA}" = EA Download Manager UI
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = Die Sims™ 3 Luxus-Accessoires
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7CFC17CE-0A66-46B0-BA57-BF8AB674BF5C}" = Loewenzahn 6
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8F259DC2-51CA-4EBE-8320-E22B9C34AD01}" = Mall Tycoon 3
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AEE307D5-9E65-4971-818E-C4D96DF55C64}" = Media Go
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3F00286-9D4A-11D6-A4D6-0030847A41CE}" = Janosch - Ich mach dich gesund
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{D07C4EDD-1E82-4D66-A2E9-2A819A9E8A0D}" = Kids entdecken den menschlichen Körper
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{DA703982C580418795BF4001AA9D7061}" = DivX Plus Media Foundation Components
"{DD6A0EE6-A8D3-449F-95B7-C971FBB0D19D}" = Call of Duty(R) 2 Patch 1.01
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{ED15D271-34AB-438C-BFDC-AE6F110ACCBB}" = Eye 110
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 1.50.52
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1D02AA9-23DE-47D6-8549-042C58B5DDC3}" = GGC Client
"Abenteuer Pferderücken Demo" = Abenteuer Pferderücken Demo
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Ask Toolbar_is1" = Foxit Toolbar
"Audacity_is1" = Audacity 1.2.3
"Audiograbber" = Audiograbber 1.83 SE 
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"AutumnMahjongg_is1" = AutumnMahjongg
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Biene Maja - Das große Gewitter" = Biene Maja - Das große Gewitter
"Build-a-lot" = Build-a-lot
"C&C Der Tiberiumkonflikt_is1" = C&C Der Tiberiumkonflikt
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Digitale Bibliothek 4" = Digitale Bibliothek 4
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EA Download Manager" = EA Download Manager
"FBDBServer_2_0_is1" = Firebird 2.1.0.16780 (Win32)
"FileZilla Client" = FileZilla Client 3.2.7.1
"Foxit Reader" = Foxit Reader
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.5
"Indeo® Software" = Indeo® Software
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{B3F00286-9D4A-11D6-A4D6-0030847A41CE}" = Janosch - Ich mach dich gesund
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Maus2" = Maus2
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Network Stumbler" = Network Stumbler 0.4.0 (remove only)
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Picasa 3" = Picasa 3
"PokerStars" = PokerStars
"PrintParade Studio" = PrintParade Studio
"PunkBusterSvc" = PunkBuster Services
"SAM3" = SAM Broadcaster (remove only)
"SUPER ©" = SUPER © Version 2009.bld.36 (June 10, 2009)
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 5" = TeamViewer 5
"Uninstall_is1" = Uninstall 1.0.0.1
"Update Service" = Update Service
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"VLC media player" = VLC media player 1.0.3
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR
"Wireshark" = Wireshark 1.2.8
"xchat" = XChat 2 (remove only)
"Xfire" = Xfire (remove only)
"XP-Games JRE" = XP-Games JREe only)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.06.2010 07:07:34 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 06.06.2010 15:26:22 | Computer Name = Toto-PC | Source = Windows Backup | ID = 4103
Description = 
 
Error - 07.06.2010 04:50:27 | Computer Name = Toto-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 07.06.2010 04:50:54 | Computer Name = Toto-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 07.06.2010 05:10:14 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files\Common
 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei
 "c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.
Der
 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
Error - 07.06.2010 05:10:56 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.06.2010 05:11:06 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.06.2010 08:08:40 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files\Common
 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei
 "c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.
Der
 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
Error - 09.06.2010 08:09:17 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.06.2010 08:09:27 | Computer Name = Toto-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ System Events ]
Error - 05.04.2010 04:51:20 | Computer Name = Toto-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 05.04.2010 07:45:33 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 05.04.2010 14:16:00 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 05.04.2010 16:51:51 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 06.04.2010 04:36:46 | Computer Name = Toto-PC | Source = atapi | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort4 gefunden.
 
Error - 06.04.2010 07:50:43 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 06.04.2010 09:58:01 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 06.04.2010 16:48:18 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 07.04.2010 02:29:34 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 07.04.2010 02:48:47 | Computer Name = Toto-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
 
< End of report >
         
--- --- ---
__________________


Alt 09.06.2010, 22:14   #3
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4184

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

09.06.2010 22:07:29
mbam-log-2010-06-09 (22-07-29).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 121759
Laufzeit: 4 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\V71IQL7HI7 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Toto\AppData\Local\Temp\Pcx.exe (Trojan.FakeAlert) -> Delete on reboot.
__________________

Alt 09.06.2010, 22:28   #4
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



OTL gefixt

All processes killed
========== OTL ==========
No active process named winscdvn.exe was found!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_USERS\S-1-5-21-843073269-2462608560-2482103128-1000\Software\Microsoft\Windows\CurrentVersion\Run not found.
File C:\Users\Public\winscdvn.exe not found.
========== FILES ==========
File\Folder C:\Users\Public\winscdvn.exe not found.
File\Folder C:\Users\Paddy\Documents\update.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Toto
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Toto
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 70852218 bytes
->Java cache emptied: 59796470 bytes
->FireFox cache emptied: 36091141 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 14648 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5709860 bytes
RecycleBin emptied: 7057305800 bytes

Total Files Cleaned = 6.895,00 mb

Error: Unable to interpret <PRC - C:\Users\Public\winscdvn.exe ()> in the current context!
Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-843073269-2462608560-2482103128-1000..\Run: [Windows Firewall Manager] C:\Users\Public\winscdvn.exe ()> in the current context!
========== FILES ==========
File\Folder C:\Users\Public\winscdvn.exe not found.
File\Folder C:\Users\Paddy\Documents\update.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Toto
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Toto
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 0,00 mb

Error: Unable to interpret <[Reboot]emptytemp]> in the current context!
Error: Unable to interpret <[Reboot][emptytemp]> in the current context!

OTL by OldTimer - Version 3.2.6.0 log created on 06092010_222519

Files\Folders moved on Reboot...
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\blueCloseBtn_ver812198[1].gif not found!
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\bottom_right[1].jpg not found!
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\browserUpgradeLayer_ver814799[1].gif not found!
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\btn-alle-tv-sender[1].gif not found!
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\btn-home[2].png not found!
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\btn-question[1].gif not found!
File\Folder C:\Users\Toto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97O0ADB3\btn-shop[1].png not found!

Registry entries deleted on Reboot...

Alt 09.06.2010, 22:35   #5
matschi
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



hey hast du dich jetzt selbst geheilt :-P ????


Alt 10.06.2010, 11:21   #6
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



Ich habe keine ahnung...

Alt 10.06.2010, 17:44   #7
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



muss ich noch irgendwas laufen lassen

Alt 10.06.2010, 18:46   #8
Toto1980
 
ICq Virus, wie findest du das foto - Standard

ICq Virus, wie findest du das foto



combo fix


Combofix Logfile:
Code:
ATTFilter
ComboFix 10-06-09.04 - Toto 10.06.2010  18:37:11.1.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.2047.1328 [GMT 2:00]
ausgeführt von:: c:\users\Toto\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\hpe93E2.dll
c:\windows\Ptuxua.exe
c:\windows\Ptuxub.exe
c:\windows\system32\1578054983.dat

.
(((((((((((((((((((((((   Dateien erstellt von 2010-05-10 bis 2010-06-10  ))))))))))))))))))))))))))))))
.

2010-06-10 16:42 . 2010-06-10 16:42	--------	d-----w-	c:\users\Toto\AppData\Local\temp
2010-06-10 16:42 . 2010-06-10 16:42	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-06-10 13:25 . 2010-05-01 14:49	2326528	----a-w-	c:\windows\system32\win32k.sys
2010-06-10 13:25 . 2010-03-05 07:42	67584	----a-w-	c:\windows\system32\asycfilt.dll
2010-06-10 13:25 . 2010-05-21 05:18	977920	----a-w-	c:\windows\system32\wininet.dll
2010-06-10 13:25 . 2010-05-27 07:24	34304	----a-w-	c:\windows\system32\atmlib.dll
2010-06-10 13:25 . 2010-05-27 03:49	293888	----a-w-	c:\windows\system32\atmfd.dll
2010-06-09 20:24 . 2010-06-09 20:24	--------	d-----w-	C:\_OTL
2010-06-09 19:09 . 2010-06-09 19:09	--------	d-----w-	c:\users\Toto\AppData\Roaming\Malwarebytes
2010-06-09 19:09 . 2010-04-29 10:19	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-09 19:08 . 2010-06-09 19:08	--------	d-----w-	c:\programdata\Malwarebytes
2010-06-09 19:08 . 2010-04-29 10:19	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-06-09 19:08 . 2010-06-09 19:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-06-09 18:57 . 2010-06-09 18:58	--------	d-----w-	c:\users\Toto\AppData\Roaming\QuickScan
2010-06-09 18:54 . 2010-05-31 14:34	702120	----a-w-	c:\users\Toto\AppData\Roaming\Mozilla\Firefox\Profiles\gp1pb4bm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-06-09 18:54 . 2010-05-31 14:34	868456	----a-w-	c:\users\Toto\AppData\Roaming\Mozilla\Firefox\Profiles\gp1pb4bm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-27 18:36 . 2010-05-27 18:36	--------	d-----w-	c:\program files\Network Stumbler
2010-05-27 13:56 . 2010-05-27 13:56	--------	d-----w-	c:\users\Toto\AppData\Roaming\Wireshark
2010-05-27 13:52 . 2010-05-27 13:52	--------	d-----w-	c:\program files\WinPcap
2010-05-27 09:42 . 2010-04-23 07:13	2048	----a-w-	c:\windows\system32\tzres.dll
2010-05-19 15:28 . 2010-05-19 15:28	--------	d-----w-	c:\users\Toto\AppData\Roaming\DVDVideoSoftIEHelpers
2010-05-19 15:27 . 2010-05-19 15:28	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-05-19 15:27 . 2010-05-19 15:27	--------	d-----w-	c:\program files\DVDVideoSoft
2010-05-12 06:55 . 2010-03-04 07:33	740864	----a-w-	c:\windows\system32\inetcomm.dll
2010-05-11 18:37 . 2010-05-11 18:37	41872	----a-w-	c:\windows\system32\xfcodec.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-10 16:40 . 2009-07-14 08:47	647128	----a-w-	c:\windows\system32\perfh007.dat
2010-06-10 16:40 . 2009-07-14 08:47	127206	----a-w-	c:\windows\system32\perfc007.dat
2010-06-10 16:35 . 2009-10-30 16:32	--------	d-----w-	c:\programdata\NVIDIA
2010-06-10 16:04 . 2009-10-30 14:52	--------	d-----w-	c:\users\Toto\AppData\Roaming\ICQ
2010-06-09 19:42 . 2010-04-26 16:53	--------	d-----w-	c:\program files\ICQ7.1
2010-06-09 18:45 . 2010-06-09 18:45	4	----a-w-	c:\users\Toto\AppData\Roaming\dhxiuw.dat
2010-06-02 09:05 . 2009-12-05 01:17	--------	d-----w-	c:\users\Toto\AppData\Roaming\vlc
2010-05-27 15:45 . 2010-03-06 11:42	--------	d-----w-	c:\program files\JDownloader
2010-05-15 09:41 . 2009-10-30 15:36	--------	d-----w-	c:\programdata\Xfire
2010-05-14 20:01 . 2009-11-25 19:18	--------	d-----w-	c:\users\Toto\AppData\Roaming\X-Chat 2
2010-05-14 19:56 . 2009-10-30 15:27	219128	----a-w-	c:\windows\system32\PnkBstrB.exe
2010-05-14 19:13 . 2009-10-30 15:27	138592	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2010-05-14 18:30 . 2009-10-30 15:36	--------	d-----w-	c:\users\Toto\AppData\Roaming\Xfire
2010-05-12 09:21 . 2009-10-30 14:44	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-12 08:18 . 2009-07-14 02:37	--------	d-----w-	c:\program files\Windows Mail
2010-05-07 11:07 . 2010-05-07 11:07	99840	----a-w-	c:\windows\system32\drivers\ACEDRV06.sys
2010-05-07 11:07 . 2010-05-07 11:05	--------	d-----w-	c:\program files\Lass uns reiten 2 - SE
2010-04-28 07:51 . 2010-04-28 07:51	4096	----a-w-	c:\windows\d3dx.dat
2010-04-28 07:50 . 2010-04-28 07:50	--------	d-----w-	c:\users\Toto\AppData\Roaming\Mindscape
2010-04-27 11:22 . 2010-04-27 11:22	--------	d-----w-	c:\program files\Mindscape
2010-04-26 16:53 . 2010-04-26 16:53	--------	d-----w-	c:\program files\ICQ6Toolbar
2010-04-26 16:53 . 2010-04-26 16:53	--------	d-----w-	c:\programdata\ICQ
2010-04-26 16:53 . 2009-10-30 14:52	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-19 12:10 . 2010-04-19 12:10	--------	d-----w-	c:\programdata\Terzio
2010-04-19 12:10 . 2010-04-19 12:10	65536	----a-r-	c:\users\Toto\AppData\Roaming\Microsoft\Installer\{7CFC17CE-0A66-46B0-BA57-BF8AB674BF5C}\AppName_3D33920276E6481589D0B59A8654B812.exe
2010-04-19 12:10 . 2010-04-19 12:10	26510	----a-r-	c:\users\Toto\AppData\Roaming\Microsoft\Installer\{7CFC17CE-0A66-46B0-BA57-BF8AB674BF5C}\ARPPRODUCTICON.exe
2010-04-13 11:45 . 2010-04-13 11:45	--------	d-----w-	c:\programdata\HipSoft
2010-04-13 11:45 . 2010-04-13 11:45	--------	d-----w-	c:\program files\MumboJumbo
2010-04-01 18:14 . 2010-01-13 18:40	691696	----a-w-	c:\windows\system32\drivers\sptd.sys
2010-04-01 17:51 . 2009-10-30 15:27	138056	----a-w-	c:\users\Toto\AppData\Roaming\PnkBstrK.sys
2010-04-01 17:51 . 2009-10-30 15:27	138056	----a-w-	c:\users\Toto\AppData\Roaming\PnkBstrK.sys
2010-04-01 17:50 . 2010-04-01 17:50	2434856	----a-w-	c:\windows\system32\pbsvc_bc2.exe
2010-04-01 10:54 . 2009-10-30 16:53	64760	----a-w-	c:\users\Toto\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-27 02:21 . 2010-03-27 02:21	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2009-06-10 21:26 . 2009-07-14 02:04	9633792	--sha-r-	c:\windows\Fonts\StaticCache.dat
2006-05-03 09:06 . 2009-11-04 17:42	163328	--sh--r-	c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-11-04 17:42	31232	--sh--r-	c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-11-04 17:42	216064	--sh--r-	c:\windows\System32\nbDX.dll
2009-07-14 01:14 . 2009-07-13 23:42	396800	--sha-w-	c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 11:58	333192	----a-w-	c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="d:\quicktime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-21 149280]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-08 8120864]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:16	203928	----a-w-	d:\alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
2009-12-18 10:24	427328	----a-w-	c:\program files\DAEMON Tools Pro\DTProAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2010-06-08 11:39	133368	----a-w-	c:\program files\ICQ7.1\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
2008-08-21 01:18	443968	----a-w-	c:\program files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11	25623336	----a-r-	c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2009-06-18 09:04	772096	----a-w-	c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2009-09-24 13:41	434176	----a-w-	c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-04-01 691696]
R2 Netmannetprofm;Netzwerkverbindungen Netmannetprofm;c:\windows\system32\amxreadt.exe [2009-07-14 93184]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-11-03 13224]
R3 PAC207;Eye 110;c:\windows\system32\DRIVERS\PFC027.SYS [2009-06-25 618112]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2009-03-25 86824]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 15016]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 114728]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 106208]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 26024]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2009-03-25 104744]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2009-03-25 109864]
S2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [2010-05-07 99840]
S2 AntiVirSchedulerService;Avira AntiVir Planer;d:\avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe [2007-10-16 81920]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-09-27 240232]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2009-12-17 185640]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe [2007-10-16 2711552]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]

.
.
------- Zusätzlicher Suchlauf -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uStart Page = hxxp://start.icq.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to Mp3 Converter - c:\users\Toto\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft &Excel exportieren - d:\micros~1\OFFICE11\EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\users\Toto\AppData\Roaming\Mozilla\Firefox\Profiles\gp1pb4bm.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.2&q=
FF - component: c:\users\Toto\AppData\Roaming\Mozilla\Firefox\Profiles\gp1pb4bm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\users\Toto\AppData\Roaming\Mozilla\Firefox\Profiles\gp1pb4bm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: d:\divx\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: d:\divx\DivX Web Player\npdivx32.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin2.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin3.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin4.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin5.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin6.dll
FF - plugin: d:\quicktime\Plugins\npqtplugin7.dll

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-Performance Center - c:\program files\Ascentive\Performance Center\ApcMain.exe
HKCU-Run-Windows Firewall Manager - c:\users\Public\winscdvn.exe
MSConfigStartUp-BitTorrent DNA - c:\program files\DNA\btdna.exe
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
AddRemove-Update Service - c:\users\Toto\Desktop\Update Service\uninst.exe


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-625753107-3092379029-2642143614-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A1B10129-8906-D335-F388-32348D56CA30}*]
"haocciiamoklgepo"=hex:6a,61,61,69,67,64,6a,61,6e,6e,6e,67,62,67,67,67,6c,6a,
   6b,6e,00,fc
"iaakajpgencdfhkdao"=hex:63,61,67,69,64,70,00,00
"iaedabdoaebgokpmae"=hex:6a,61,67,69,61,61,6c,68,6a,61,67,68,6e,6c,69,6e,6e,65,
   62,6d,00,fc
"dbgiomkjgpbaopmlingakdbhkhmjnbkjbjagokdg"=hex:68,61,6a,65,63,67,6d,6c,6e,70,
   6c,64,6d,62,62,70,00,00
"jbgiomkjgpbaopmlingaheikjkffkloahmhalpcbkcgmlammjenp"=hex:68,61,6a,65,63,67,
   6d,6c,6e,70,6c,64,6d,62,62,70,00,00
"dbgiomkjgpbaopmlingafdeihanbcnppdefplago"=hex:62,61,6f,69,00,00

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-06-10  18:45:12
ComboFix-quarantined-files.txt  2010-06-10 16:45

Vor Suchlauf: 2.700.922.880 Bytes frei
Nach Suchlauf: 2.551.681.024 Bytes frei

- - End Of File - - FCC97AAEA74DF6BEAFD264F01AA06619
         
--- --- ---

Antwort

Themen zu ICq Virus, wie findest du das foto
0x00000001, 4d36e972-e325-11ce-bfc1-08002be10318, ask.com, avgntflt.sys, bekannte, c:\windows\system32\rundll32.exe, cdburnerxp, components, corp./icp, excel.exe, extras.txt, firefox 3.6.3, firefox.exe, fontcache, foto, icq, icq virus, langs, link, local\temp, location, media center, monitor.exe, nvlddmkm.sys, nvstor.sys, oldtimer, otl.exe, otl.txt, picasa, programdata, sched.exe, search the web, searchplugins, skype.exe, sptd.sys, taskhost.exe, virus, webcheck



Ähnliche Themen: ICq Virus, wie findest du das foto


  1. Foto.exe - Virus?
    Plagegeister aller Art und deren Bekämpfung - 05.12.2011 (11)
  2. msn foto facebook exe virus
    Log-Analyse und Auswertung - 06.01.2011 (7)
  3. Icq virus / wie findest du das bild... usw
    Plagegeister aller Art und deren Bekämpfung - 09.11.2010 (16)
  4. MSN Foto-Virus
    Plagegeister aller Art und deren Bekämpfung - 22.08.2010 (3)
  5. MSN/ICQ Virus (Hey, wie findest du das Foto?)
    Plagegeister aller Art und deren Bekämpfung - 18.07.2010 (7)
  6. schau dir mal das foto an icq virus?
    Plagegeister aller Art und deren Bekämpfung - 12.07.2010 (1)
  7. msn facebook foto virus
    Plagegeister aller Art und deren Bekämpfung - 01.07.2010 (1)
  8. ICQ spamt: "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 22.06.2010 (27)
  9. wie findest du das foto :D 2
    Plagegeister aller Art und deren Bekämpfung - 21.06.2010 (13)
  10. Chatfenster öffnen sich von allein; Wie findest du das Foto :D?
    Plagegeister aller Art und deren Bekämpfung - 21.06.2010 (12)
  11. ICQ-Virus, wie findest du das foto
    Plagegeister aller Art und deren Bekämpfung - 15.06.2010 (1)
  12. Der ICQ & MSN Virus: 'Wie findest du das Foto?'
    Plagegeister aller Art und deren Bekämpfung - 13.06.2010 (11)
  13. Und immer wieder der ICQ & MSN Virus. 'Wie findest du das Foto?'
    Plagegeister aller Art und deren Bekämpfung - 11.06.2010 (1)
  14. ICQ Virus: "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 10.06.2010 (3)
  15. Und wieder der ICQ & MSN Virus. 'Wie findest du das Foto?'
    Plagegeister aller Art und deren Bekämpfung - 10.06.2010 (9)
  16. ICQ: "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 02.06.2010 (0)
  17. ICQ spamt alle Kontakte zu... "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 01.06.2010 (4)

Zum Thema ICq Virus, wie findest du das foto - wie findest du das foto NICHT KLICKEN: hxxp://www.images.photobucket.mylexa.com/show_images.php?id=3&image=IMG0737830249202010.JPG den link hatte ich von nem bekannten aus der buddylist, und seit dem hab ich das ding und es verteil in meiner - ICq Virus, wie findest du das foto...
Archiv
Du betrachtest: ICq Virus, wie findest du das foto auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.