WIN 32 Rootkit-gen [rtk] engine b meldungen

kPeXx_04 · 15.06.2010, 19:25

Hallo,

ich bekomme seit kurzem von meinem Virenprogramm (Gdata Anti Viren Kit)
WIN 32 Rootkit-gen [rtk] engine b meldungen.

Zudem bekomme ich Meldungen, dass verschiedene exe. Anwendungen Zugriff auf die Registrierung nehmen wollen und diese Ändern wollen.

Hier mein Logfile:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:56:58, on 15.06.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Application Updater\ApplicationUpdater.exe
C:\Programme\G DATA InternetSecurity\AVK\AVKService.exe
C:\Programme\G DATA InternetSecurity\AVK\AVKWCtl.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\ASUS\Power4 Gear\BatteryLife.exe
C:\Programme\Wireless Console 2\wcourier.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
C:\Programme\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\Programme\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programme\Asus\Asus ChkMail\ChkMail.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe
C:\Programme\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Programme\QIP 2010\qip.exe
C:\Programme\Mozilla Thunderbird\thunderbird.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\G DATA InternetSecurity\GUI\avkis.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.asus.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\pdfforge Toolbar\SearchSettings.dll
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Programme\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Wireless Console 2] C:\Programme\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Programme\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [AVKTray] "C:\Programme\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Programme\pdfforge Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EA Core] "C:\Programme\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [{D0697154-953C-428B-1F4C-572F004597AC}] "C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Wiocle\yweq.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: siszpe32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ASUS ChkMail.lnk = C:\Programme\Asus\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=hxxp://www.asus.com
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Programme\Application Updater\ApplicationUpdater.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Programme\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Programme\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 10305 bytes

cosinus · 16.06.2010, 16:07

Hallo und

bitte nen Vollscan mit Malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

kPeXx_04 · 16.06.2010, 20:02

Hallo,

hier noch eine Meldung:

Code:

ATTFilter

Virus: Backdoor.Win32.Bredolab.fee
Datei: siszpe32.exe
Verzeichnis: C:\Dokumente und Einstellungen\Stephan\Startmenü\Programme\Autostart
Prozess: svchost.exe

Code:

ATTFilter

Virus: Packed.Win32.Katusha.n
Datei: 9bd[1].exe
Verzeichnis: C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Temporary Internet Files\Content.IE5\URSRSLCH
Prozess: AcroRd32.exe

Hab vor kurzer Zeit ein Acrobat Reader Update durchgeführt,
liegt es evtl daran? Seidem kann ich auch keine .pdf Dateien mehr öffnen.

Noch welche während des Scans:

Code:

ATTFilter

Virus: Win32:MalOb-BK [Cryp]
Datei: yweq.exe
Verzeichnis: C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Wiocle
Prozess: mbam.exe

Code:

ATTFilter

Virus: Win32:DNSChanger-VJ [Trj]
Datei: svchost.exe.hdmp
Verzeichnis: C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Temp\WER63a4.dir00
Prozess: svchost.exe

Code:

ATTFilter

Virus: Exploit.JS.Pdfka.clp
Datei: plugin-Notes1.pdf
Verzeichnis: C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Temp\plugtmp
Prozess: mbam.exe

Code:

ATTFilter

Virus: Backdoor.Win32.Bredolab.fee
Datei: game[1].exe
Verzeichnis: C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Temporary Internet Files\Content.IE5\URSRSLCH
Prozess: mbam.exe

Code:

ATTFilter

Virus: Backdoor.Win32.Bredolab.fee
Datei: A0012795.exe
Verzeichnis: C:\System Volume Information\_restore{6B514D2F-BC8C-490B-B665-013B74F488AB}\RP119
Prozess: mbam.exe

Code:

ATTFilter

Virus: Win32:MalOb-BK [Cryp]
Datei: A0012797.exe
Verzeichnis: C:\System Volume Information\_restore{6B514D2F-BC8C-490B-B665-013B74F488AB}\RP119
Prozess: mbam.e

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4206

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

16.06.2010 20:34:35
mbam-log-2010-06-16 (20-34-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 211906
Laufzeit: 1 Stunde(n), 41 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.

HIer noch die Dateien die das Gdata Anti Viren Kit während des Scans in die Quarantäne geschoben hat:

cosinus · 16.06.2010, 20:13

Winzige Screenshots brauch ich nicht, ich wollte die OTL-Logs sehen.

kPeXx_04 · 16.06.2010, 20:15

[CODE]
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 16.06.2010 21:03:53 - Run 1
OTL by OldTimer - Version 3.2.6.0     Folder = C:\Dokumente und Einstellungen\Stephan\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 54,83 Gb Total Space | 5,32 Gb Free Space | 9,71% Space Free | Partition Type: FAT32
Drive D: | 36,46 Gb Total Space | 12,06 Gb Free Space | 33,09% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ASUS
Current User Name: Stephan
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Stephan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe (G DATA Software AG)
PRC - C:\Programme\G DATA InternetSecurity\AVKTray\AVKTray.exe (G DATA Software AG)
PRC - C:\Programme\G DATA InternetSecurity\AVK\avkservice.exe (G DATA Software AG)
PRC - C:\Programme\G DATA InternetSecurity\AVK\AVKWCtl.exe (G DATA Software AG)
PRC - C:\Programme\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.)
PRC - C:\WINDOWS\ATK0100\HControl.exe ()
PRC - C:\WINDOWS\ATK0100\ATKOSD.exe ()
PRC - C:\Programme\Wireless Console 2\wcourier.exe ()
PRC - C:\Programme\Asus\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe (TOSHIBA CORPORATION.)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.)
PRC - C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
PRC - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Asus\Asus ChkMail\ChkMail.exe (asus)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Stephan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Application Updater) -- C:\Programme\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SeaPort) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (AVKProxy) -- C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe (G DATA Software AG)
SRV - (AVKService) -- C:\Programme\G DATA InternetSecurity\AVK\avkservice.exe (G DATA Software AG)
SRV - (AVKWCtl) -- C:\Programme\G DATA InternetSecurity\AVK\AVKWCtl.exe (G DATA Software AG)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel(R) -- C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (truecrypt) -- C:\WINDOWS\system32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (GDTdiInterceptor) -- C:\WINDOWS\system32\drivers\GDTdiIcpt.sys (G DATA Software AG)
DRV - (GDMnIcpt) -- C:\WINDOWS\system32\drivers\MiniIcpt.sys (G DATA Software AG)
DRV - (HookCentre) -- C:\WINDOWS\system32\drivers\HookCentre.sys (G DATA Software AG)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w39n51) Intel(R) -- C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (Tosrfhid) -- C:\WINDOWS\system32\drivers\tosrfhid.sys (TOSHIBA Corporation.)
DRV - (tosporte) -- C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (Tosrfbd) -- C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (Tosrfusb) -- C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (TosRfSnd) Bluetooth Audio Device (WDM) -- C:\WINDOWS\system32\drivers\tosrfsnd.sys (TOSHIBA Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (Tosrfbnp) -- C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Tosrfcom) -- C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (risdptsk) -- C:\WINDOWS\system32\DRIVERS\risdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (toshidpt) -- C:\WINDOWS\system32\drivers\toshidpt.sys (TOSHIBA Corporation.)
DRV - (smserial) -- C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.)
DRV - (Cam5603D) -- C:\WINDOWS\system32\drivers\BisonCam.sys (Bison Electronics. Inc. )
DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ATKACPI.sys ()
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (tosrfnds) -- C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\pdfforge Toolbar\SearchSettings.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:1.1.2
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.4
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.01.22 23:04:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.01.22 23:04:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.04.18 13:49:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2010.06.05 22:26:46 | 000,000,000 | ---D | M]
 
[2010.01.22 23:04:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Extensions
[2010.04.18 13:49:44 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.05.18 21:06:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2010.01.22 23:04:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\extensions
[2010.02.16 09:03:58 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\extensions\{156d36f6-b68b-11db-96eb-005056c00008}
[2010.06.13 20:58:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.05.02 00:28:36 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.05.02 00:28:40 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010.05.02 00:28:32 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.05.12 18:40:06 | 000,001,042 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\searchplugins\icqplugin.xml
[2010.04.12 18:47:16 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.14 17:24:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.05.14 17:23:48 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.04.04 18:28:14 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.04 18:28:14 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.04 18:28:14 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.04 18:28:14 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.04 18:28:14 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\pdfforge Toolbar\SearchSettings.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.EXE (ASYSTeK Computer INC.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVKTray] C:\Programme\G DATA InternetSecurity\AVKTray\AVKTray.exe (G DATA Software AG)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EOUApp] C:\Programme\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
O4 - HKLM..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Power_Gear] C:\Programme\ASUS\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [SearchSettings] C:\Programme\pdfforge Toolbar\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Wireless Console 2] C:\Programme\Wireless Console 2\wcourier.exe ()
O4 - HKCU..\Run: [{D0697154-953C-428B-1F4C-572F004597AC}] C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Wiocle\yweq.exe File not found
O4 - HKCU..\Run: [EA Core] C:\Programme\Electronic Arts\EADM\Core.exe File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ASUS ChkMail.lnk = C:\Programme\Asus\Asus ChkMail\ChkMail.exe (asus)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Bluetooth Manager.lnk = C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.220.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.01.22 21:36:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{8caed17c-62b0-11df-a0b0-0017313cf411}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found
O33 - MountPoints2\{9f4b206e-07a3-11df-a037-0013023ce676}\Shell - "" = AutoRun
O33 - MountPoints2\{9f4b206e-07a3-11df-a037-0013023ce676}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9f4b206e-07a3-11df-a037-0013023ce676}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.16 19:49:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia
[2010.06.16 19:49:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2010.06.16 19:36:32 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Stephan\Desktop\OTL.exe
[2010.06.16 18:51:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2010.06.16 18:51:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2010.06.16 18:49:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Malwarebytes
[2010.06.16 18:49:24 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.06.16 18:49:22 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.06.16 18:49:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.06.16 18:49:21 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.16 18:48:37 | 006,153,648 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Stephan\Desktop\mbam-setup.exe
[2010.06.15 22:11:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\G DATA
[2010.06.15 19:56:11 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.06.15 19:55:46 | 000,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\Stephan\Desktop\HJTInstall.exe
[2010.06.13 21:40:07 | 000,000,000 | ---D | C] -- C:\Programme\Free PDF to Word Doc Converter
[2010.06.13 20:58:21 | 000,000,000 | ---D | C] -- C:\Programme\ICQ6Toolbar
[2010.06.13 20:58:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010.06.13 20:57:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\ICQ
[2010.06.13 20:57:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\AOL
[2010.06.13 20:57:33 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.2
[2010.06.10 23:40:36 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.06.05 22:23:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
[2010.06.05 21:05:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Desktop\Scharf
[2010.05.18 21:07:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
[2010.05.18 21:06:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Eigene Dateien\TomTom
[2010.05.18 21:06:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\TomTom
[2010.05.18 21:06:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\TomTom
[2010.05.18 21:06:01 | 000,000,000 | ---D | C] -- C:\Programme\TomTom International B.V
[2010.05.18 21:05:45 | 000,000,000 | ---D | C] -- C:\Programme\TomTom HOME 2
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.16 21:09:28 | 000,772,096 | ---- | M] () -- C:\WINDOWS\System32\drivers\xtneuv.sys
[2010.06.16 20:58:42 | 000,041,156 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.06.16 20:58:34 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.06.16 20:58:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.06.16 20:58:26 | 2146,881,536 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.16 20:57:10 | 003,670,016 | -H-- | M] () -- C:\Dokumente und Einstellungen\Stephan\NTUSER.DAT
[2010.06.16 20:57:10 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Stephan\ntuser.ini
[2010.06.16 20:55:36 | 000,070,078 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Unbenannt.JPG
[2010.06.16 20:35:44 | 000,059,392 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.16 19:36:38 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Stephan\Desktop\OTL.exe
[2010.06.16 18:49:28 | 000,000,580 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.16 18:48:52 | 006,153,648 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Stephan\Desktop\mbam-setup.exe
[2010.06.15 19:56:14 | 000,001,602 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\HijackThis.lnk
[2010.06.15 19:55:46 | 000,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\Stephan\Desktop\HJTInstall.exe
[2010.06.15 19:12:50 | 000,000,140 | ---- | M] () -- C:\WINDOWS\System32\fjhdyfhsn.bat
[2010.06.15 19:12:48 | 000,000,016 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\qcopjv.dat
[2010.06.14 11:21:06 | 000,039,936 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Auswaertsspiele_Allesfahrer_Stephan.doc
[2010.06.14 11:18:36 | 000,000,573 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.06.14 11:18:36 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.06.14 11:18:36 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2010.06.13 21:40:52 | 004,295,769 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Eigene Dateien\Turnierpferdeeintragung.doc
[2010.06.13 21:40:34 | 000,254,194 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Eigene Dateien\Turnierpferdeeintragung.pdf
[2010.06.11 19:17:00 | 000,266,208 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.10 23:41:12 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.06.10 23:33:14 | 000,997,796 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.06.10 23:33:14 | 000,449,044 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.06.10 23:33:14 | 000,432,690 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.06.10 23:33:14 | 000,080,306 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.06.10 23:33:14 | 000,067,646 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.06.08 19:23:18 | 000,038,400 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Auswaertsspiele_Allesfahrer.doc
[2010.06.06 17:08:54 | 000,041,984 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\DFBPokal_R1.doc
[2010.06.06 00:20:46 | 000,055,121 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Foren-Übersicht.htm
[2010.06.05 10:20:18 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.27 20:57:28 | 000,013,809 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\comunio.xlsx
[2010.05.25 21:21:46 | 000,052,197 | ---- | M] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\album_page.un
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.06.16 20:55:35 | 000,070,078 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Unbenannt.JPG
[2010.06.16 18:49:27 | 000,000,580 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.15 19:56:13 | 000,001,602 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\HijackThis.lnk
[2010.06.15 19:12:42 | 000,000,016 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\qcopjv.dat
[2010.06.14 14:22:23 | 000,772,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\xtneuv.sys
[2010.06.14 14:17:36 | 000,000,140 | ---- | C] () -- C:\WINDOWS\System32\fjhdyfhsn.bat
[2010.06.13 21:40:50 | 004,295,769 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Eigene Dateien\Turnierpferdeeintragung.doc
[2010.06.13 21:40:33 | 000,254,194 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Eigene Dateien\Turnierpferdeeintragung.pdf
[2010.06.11 23:14:24 | 000,008,402 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\hs_err_pid3976.log
[2010.06.08 19:43:42 | 000,039,936 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Auswaertsspiele_Allesfahrer_Stephan.doc
[2010.06.08 19:23:18 | 000,038,400 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Auswaertsspiele_Allesfahrer.doc
[2010.06.06 17:03:23 | 000,041,984 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\DFBPokal_R1.doc
[2010.06.06 00:20:45 | 000,055,121 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\Foren-Übersicht.htm
[2010.05.25 21:21:44 | 000,052,197 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\album_page.un
[2010.05.18 23:17:01 | 000,013,809 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Desktop\comunio.xlsx
[2010.04.12 18:46:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2010.03.07 17:34:12 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.02.01 22:55:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
[2010.01.22 22:04:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010.01.22 22:00:51 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2010.01.22 21:40:05 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2010.01.22 21:18:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\System32\ABLKSR.INI
[2010.01.22 21:17:59 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2010.01.22 21:17:58 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2010.01.22 21:17:53 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2010.01.22 21:17:46 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2010.01.22 21:17:36 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2010.01.22 21:17:19 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll
[2010.01.22 21:17:19 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll
[2010.01.22 21:17:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll
[2010.01.22 21:17:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll
[2010.01.22 21:17:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll
[2010.01.22 21:17:17 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll
[2010.01.22 21:17:17 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll
[2010.01.22 21:17:17 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll
[2010.01.22 21:17:17 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll
[2010.01.22 21:17:02 | 000,015,190 | ---- | C] () -- C:\WINDOWS\M2000Twn.ini
[2010.01.22 21:16:28 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATKACPI.sys
[2005.09.02 14:44:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2005.07.22 21:30:20 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
[2004.09.07 16:34:59 | 000,007,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\MMIOPORT.SYS
[2004.09.07 16:34:59 | 000,002,538 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004.09.07 16:34:02 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004.07.20 17:04:02 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004.01.15 14:43:28 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
< End of report >

--- --- ---

kPeXx_04 · 16.06.2010, 20:18

[CODE]
OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 16.06.2010 21:03:53 - Run 1
OTL by OldTimer - Version 3.2.6.0     Folder = C:\Dokumente und Einstellungen\Stephan\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 54,83 Gb Total Space | 5,32 Gb Free Space | 9,71% Space Free | Partition Type: FAT32
Drive D: | 36,46 Gb Total Space | 12,06 Gb Free Space | 33,09% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ASUS
Current User Name: Stephan
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\QIP\qip.exe" = D:\QIP\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\Electronic Arts\Command & Conquer 4 Beta\Data\rts-final.exe" = C:\Programme\Electronic Arts\Command & Conquer 4 Beta\Data\rts-final.exe:*:Enabled:Command & Conquer™ 4 Beta -- File not found
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\Java\JRE6\BIN\javaw.exe" = C:\Programme\Java\JRE6\BIN\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
"C:\WINDOWS\EXPLORER.EXE" = C:\WINDOWS\EXPLORER.EXE:*:Disabled:Windows Explorer -- (Microsoft Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{17E2F183-BAC4-4D01-BD7A-59F781E17EFA}" = REALTEK PCIE NIC Driver
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4462AD13-F2AA-4CBD-9F95-293C38EED870}" = Power4 Gear
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = BisonCam, NB Pro
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5791B7D3-8B34-4218-9750-6A8E45D0AD32}" = pdfforge Toolbar v1.1.2
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B502B428-3386-40A9-98DB-079AAB72E64F}" = mEoU
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5FA15A8-5849-4595-AFAD-C414A31A7516}" = G DATA InternetSecurity
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{E89B484C-B913-49A0-959B-89E836001658}" = GEAR 32bit Driver Installer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F439D7AF-03F3-4F8E-AEC4-571BFE977C61}" = iTunes
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Asus ChkMail" = Asus ChkMail
"Asus_A_Series_ScreenSaver" = Asus_A_Series_ScreenSaver
"bwin Poker_is1" = bwin Poker
"CopyTrans Suite" = Nur Deinstallierung der CopyTrans Suite möglich.
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free Studio_is1" = Free Studio version 4.3
"FUSSBALL MANAGER 10" = FUSSBALL MANAGER 10
"HControl" = ATK0100 ACPI UTILITY
"HijackThis" = HijackThis 2.0.2
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel(R) PROSet/Wireless Software
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TomTom HOME" = TomTom HOME 2.7.3.1894
"TrueCrypt" = TrueCrypt
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"WIC" = Windows Imaging Component
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP 2010" = QIP 2010 10.4.23.3289
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.02.2010 14:27:13 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3667, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.02.2010 04:34:24 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 6.0.2900.2180, fehlgeschlagenes
 Modul user32.dll, Version 5.1.2600.2180, Fehleradresse 0x00027f4f.
 
Error - 04.04.2010 21:17:03 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3743, fehlgeschlagenes
 Modul npswf32.dll, Version 10.0.45.2, Fehleradresse 0x00242eea.
 
Error - 27.04.2010 14:19:06 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3743, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 14.05.2010 16:33:08 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3743, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.05.2010 11:44:45 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WinRAR.exe, Version 3.91.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.05.2010 11:44:45 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WinRAR.exe, Version 3.91.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.05.2010 11:44:45 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WinRAR.exe, Version 3.91.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.05.2010 11:44:45 | Computer Name = ASUS | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WinRAR.exe, Version 3.91.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 18.05.2010 15:06:07 | Computer Name = ASUS | Source = TomTomHOMEService | ID = 10000
Description = 
 
[ System Events ]
Error - 13.06.2010 14:53:03 | Computer Name = ASUS | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 13.06.2010 16:22:41 | Computer Name = ASUS | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 14.06.2010 08:22:25 | Computer Name = ASUS | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Microsoft Kernel-Echounterdrückung" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%31
 
Error - 15.06.2010 13:11:23 | Computer Name = ASUS | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst NVSvc.
 
Error - 16.06.2010 12:37:18 | Computer Name = ASUS | Source = Ftdisk | ID = 262189
Description = Das System konnte den Treiber für das Speicherabbild nicht laden.
 
Error - 16.06.2010 12:37:18 | Computer Name = ASUS | Source = Ftdisk | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher
 abbilden zu können.
 
Error - 16.06.2010 14:25:41 | Computer Name = ASUS | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 16.06.2010 14:58:56 | Computer Name = ASUS | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume2" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
Error - 16.06.2010 14:58:56 | Computer Name = ASUS | Source = Ftdisk | ID = 262189
Description = Das System konnte den Treiber für das Speicherabbild nicht laden.
 
Error - 16.06.2010 14:58:56 | Computer Name = ASUS | Source = Ftdisk | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher
 abbilden zu können.
 
 
< End of report >

--- --- ---

cosinus · 16.06.2010, 20:51

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [{D0697154-953C-428B-1F4C-572F004597AC}] C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\Wiocle\yweq.exe File not found
[2010.06.15 19:12:42 | 000,000,016 | ---- | C] () -- C:\Dokumente und Einstellungen\Stephan\Anwendungsdaten\qcopjv.dat
[2010.06.14 14:22:23 | 000,772,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\xtneuv.sys
[2010.06.14 14:17:36 | 000,000,140 | ---- | C] () -- C:\WINDOWS\System32\fjhdyfhsn.bat
:Commands
[purity]
[resethosts]
[emptytemp]

Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

kPeXx_04 · 16.06.2010, 21:37

Code:

ATTFilter

->Temp folder emptied: 100564883 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 75 bytes
 
User: All Users
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 172320 bytes
->Flash cache emptied: 1053 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 98706 bytes
->Flash cache emptied: 405 bytes
 
User: Stephan
->Temp folder emptied: 26566224 bytes
->Temporary Internet Files folder emptied: 80273004 bytes
->Java cache emptied: 21836939 bytes
->FireFox cache emptied: 36270186 bytes
->Flash cache emptied: 34277 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 39222509 bytes
RecycleBin emptied: 61621080 bytes
 
Total Files Cleaned = 350,00 mb
 
 
OTL by OldTimer - Version 3.2.6.0 log created on 06162010_223100

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus · 17.06.2010, 08:32

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

kPeXx_04 · 17.06.2010, 14:23

OSAM Logfile:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 15:21:33 on 17.06.2010

OS: Windows XP Home Edition Service Pack 2 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.3

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"JAVACPL.CPL" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\JAVACPL.CPL
"LocalCOM.cpl" - "東芝公司" - C:\WINDOWS\system32\LocalCOM.cpl
"NVTUICPL.CPL" - "NVIDIA Corporation" - C:\WINDOWS\system32\NVTUICPL.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AEGIS Protocol (IEEE 802.1x) v3.4.9.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys
"akgkly20" (akgkly20) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\akgkly20.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Bluetooth Audio Device (WDM) from TOSHIBA" (TosRfSnd) - "TOSHIBA Corporation" - C:\WINDOWS\System32\drivers\TosRfSnd.sys
"Bluetooth Personal Area Network from TOSHIBA" (tosrfnds) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\tosrfnds.sys
"Bluetooth Port Driver from Toshiba" (tosporte) - "TOSHIBA Corporation" - C:\WINDOWS\System32\DRIVERS\tosporte.sys
"Bluetooth RFBNEP from TOSHIBA" (Tosrfbnp) - "TOSHIBA Corporation" - C:\WINDOWS\System32\Drivers\tosrfbnp.sys
"Bluetooth RFBUS from TOSHIBA" (Tosrfbd) - "TOSHIBA CORPORATION" - C:\WINDOWS\System32\Drivers\tosrfbd.sys
"Bluetooth RFCOMM from TOSHIBA" (Tosrfcom) - "TOSHIBA Corporation" - C:\WINDOWS\System32\Drivers\tosrfcom.sys
"Bluetooth RFHID from TOSHIBA" (Tosrfhid) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\Tosrfhid.sys
"Bluetooth USB Controller" (Tosrfusb) - "TOSHIBA CORPORATION" - C:\WINDOWS\System32\Drivers\tosrfusb.sys
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"GDMnIcpt" (GDMnIcpt) - "G DATA Software AG" - C:\WINDOWS\system32\drivers\MiniIcpt.sys
"GDTdiInterceptor" (GDTdiInterceptor) - ? - C:\WINDOWS\system32\drivers\GDTdiIcpt.sys
"HookCentre" (HookCentre) - "G DATA Software AG" - C:\WINDOWS\system32\drivers\HookCentre.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"pxtdrpoc" (pxtdrpoc) - ? - C:\DOKUME~1\Stephan\LOKALE~1\Temp\pxtdrpoc.sys  (Hidden registry entry, rootkit activity | File not found)
"Secdrv" (Secdrv) - ? - C:\WINDOWS\System32\DRIVERS\secdrv.sys  (File signed by Microsoft | File found, but it contains no detailed information)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"TOSHIBA Bluetooth HID port driver" (toshidpt) - "TOSHIBA Corporation." - C:\WINDOWS\System32\drivers\Toshidpt.sys
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\WINDOWS\System32\drivers\truecrypt.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"WLAN-Transport" (s24trans) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\s24trans.sys
"xtneuv" (xtneuv) - ? - C:\WINDOWS\system32\drivers\xtneuv.sys  (Hidden registry entry, rootkit activity | File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - c:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B} "Bluetooth-Informationsaustausch" - "東芝" - C:\WINDOWS\system32\TosBtExt.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\OLKFSTUB.DLL
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Programme\Windows Live\Toolbar\wltcore.dll
<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" - "Spigot, Inc." - C:\Programme\pdfforge Toolbar\SearchSettings.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
"ICQ7.2" - "ICQ, LLC." - C:\Programme\ICQ7.2\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Programme\Windows Live\Toolbar\wltcore.dll
{B922D405-6D13-4A2B-AE89-08A030DA4402} "pdfforge Toolbar" - "Spigot, Inc." - C:\Programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - c:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{B922D405-6D13-4A2B-AE89-08A030DA4402} "pdfforge Toolbar" - "Spigot, Inc." - C:\Programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Programme\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" - "Spigot, Inc." - C:\Programme\pdfforge Toolbar\SearchSettings.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"Adobe Reader Speed Launch.lnk" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe  (Shortcut exists | File exists)
"ASUS ChkMail.lnk" - "asus" - C:\Programme\Asus\Asus ChkMail\ChkMail.exe  (Shortcut exists | File exists)
"Bluetooth Manager.lnk" - ? - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\DESKTOP.INI
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"DESKTOP.INI" - ? - C:\Dokumente und Einstellungen\Stephan\Startmenü\Programme\Autostart\DESKTOP.INI
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"EA Core" - ? - "C:\Programme\Electronic Arts\EADM\Core.exe" -silent  (File not found)
"msnmsgr" - "Microsoft Corporation" - "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"ABLKSR" - "ASYSTeK Computer INC." - C:\WINDOWS\ABLKSR\ABLKSR.exe
"AVKTray" - "G DATA Software AG" - "C:\Programme\G DATA InternetSecurity\AVKTray\AVKTray.exe"
"DivXUpdate" - ? - "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"EOUApp" - "Intel Corporation" - "C:\Programme\Intel\Wireless\Bin\EOUWiz.exe"
"GrooveMonitor" - "Microsoft Corporation" - "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
"IntelWireless" - "Intel Corporation" - "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
"IntelZeroConfig" - "Intel Corporation" - "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"Power_Gear" - "ASUSTeK Computer Inc." - C:\Programme\ASUS\Power4 Gear\BatteryLife.exe 1
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime
"SearchSettings" - "Spigot, Inc." - C:\Programme\pdfforge Toolbar\SearchSettings.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"Wireless Console 2" - ? - C:\Programme\Wireless Console 2\wcourier.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll
"Toshiba Bluetooth Monitor" - "Toshiba America Business Solutions, Inc." - C:\WINDOWS\system32\tbtmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Application Updater" (Application Updater) - "Spigot, Inc." - C:\Programme\Application Updater\ApplicationUpdater.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"AVK Service" (AVKService) - "G DATA Software AG" - C:\Programme\G DATA InternetSecurity\AVK\AVKService.exe
"AVK Wächter" (AVKWCtl) - "G DATA Software AG" - C:\Programme\G DATA InternetSecurity\AVK\AVKWCtl.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"G DATA AntiVirus Proxy" (AVKProxy) - "G DATA Software AG" - C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"TomTomHOMEService" (TomTomHOMEService) - "TomTom" - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

[CODE]
GMER Logfile:
GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-06-17 15:10:49
Windows 5.1.2600 Service Pack 2
Running: 3zt6iq9z.exe; Driver: C:\DOKUME~1\Stephan\LOKALE~1\Temp\pxtdrpoc.sys


---- System - GMER 1.0.15 ----

SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwClose [0xA72493AA]                                                                                                                        <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwCreateKey [0xA724A078]                                                                                                                    <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwDeleteKey [0xA724A19C]                                                                                                                    <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwDeleteValueKey [0xA724A1BE]                                                                                                               <-- ROOTKIT !!!
SSDT            spen.sys                                                                                                            ZwEnumerateKey [0xB9ECDDA4]                                                                                                                 <-- ROOTKIT !!!
SSDT            spen.sys                                                                                                            ZwEnumerateValueKey [0xB9ECE132]                                                                                                            <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwOpenKey [0xA724A100]                                                                                                                      <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwOpenProcess [0xA72492D0]                                                                                                                  <-- ROOTKIT !!!
SSDT            spen.sys                                                                                                            ZwQueryKey [0xB9ECE20A]                                                                                                                     <-- ROOTKIT !!!
SSDT            spen.sys                                                                                                            ZwQueryValueKey [0xB9ECE08A]                                                                                                                <-- ROOTKIT !!!
SSDT            \??\C:\WINDOWS\system32\drivers\HookCentre.sys (Security Hook/G DATA Software AG)                                   ZwSetValueKey [0xA724A16E]                                                                                                                  <-- ROOTKIT !!!

INT 0x62        ?                                                                                                                   89E55BF8
INT 0x73        ?                                                                                                                   89B4BBF8
INT 0x84        ?                                                                                                                   89B4BBF8
INT 0x94        ?                                                                                                                   89B4BBF8

---- Kernel code sections - GMER 1.0.15 ----

?               spen.sys                                                                                                            Das System kann die angegebene Datei nicht finden. !
?               xtneuv.sys                                                                                                          Ein an das System angeschlossenes Gerät funktioniert nicht. !
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                            section is writeable [0xB8BFC360, 0x213A6D, 0xE8000020]
.text           USBPORT.SYS!DllUnload                                                                                               B8A4762C 5 Bytes  JMP 89B4B1D8 
.text           akgkly20.SYS                                                                                                        B89A4386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text           akgkly20.SYS                                                                                                        B89A43AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text           akgkly20.SYS                                                                                                        B89A43C4 3 Bytes  [00, 80, 02]
.text           akgkly20.SYS                                                                                                        B89A43C9 1 Byte  [30]
.text           akgkly20.SYS                                                                                                        B89A43C9 11 Bytes  [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text           ...                                                                                                                 

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\System32\svchost.exe[1496] ntdll.dll!NtProtectVirtualMemory                                              7C91D6EE 5 Bytes  JMP 0082000A 
.text           C:\WINDOWS\System32\svchost.exe[1496] ntdll.dll!NtWriteVirtualMemory                                                7C91DFAE 5 Bytes  JMP 0083000A 
.text           C:\WINDOWS\System32\svchost.exe[1496] ntdll.dll!KiUserExceptionDispatcher                                           7C91E47C 5 Bytes  JMP 0081000C 
.text           C:\WINDOWS\System32\svchost.exe[1496] ole32.dll!CoCreateInstance                                                    774F6009 5 Bytes  JMP 0097000A 
.text           C:\WINDOWS\system32\wuauclt.exe[1948] ntdll.dll!NtProtectVirtualMemory                                              7C91D6EE 5 Bytes  JMP 00AB000A 
.text           C:\WINDOWS\system32\wuauclt.exe[1948] ntdll.dll!NtWriteVirtualMemory                                                7C91DFAE 5 Bytes  JMP 00AC000A 
.text           C:\WINDOWS\system32\wuauclt.exe[1948] ntdll.dll!KiUserExceptionDispatcher                                           7C91E47C 5 Bytes  JMP 003D000C 
.text           C:\WINDOWS\Explorer.EXE[2004] ntdll.dll!NtProtectVirtualMemory                                                      7C91D6EE 5 Bytes  JMP 00A0000A 
.text           C:\WINDOWS\Explorer.EXE[2004] ntdll.dll!NtWriteVirtualMemory                                                        7C91DFAE 5 Bytes  JMP 00AE000A 
.text           C:\WINDOWS\Explorer.EXE[2004] ntdll.dll!KiUserExceptionDispatcher                                                   7C91E47C 5 Bytes  JMP 009F000C 

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                  [B9EB6042] spen.sys
IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                          [B9EB613E] spen.sys
IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                 [B9EB60C0] spen.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                         [B9EB6800] spen.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                 [B9EB66D6] spen.sys
IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                  [B9EC5B90] spen.sys
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!KfAcquireSpinLock]                                                0C8D1C46
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!READ_PORT_UCHAR]                                                  B48B8932
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!KeGetCurrentIrql]                                                 89000001
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!KfRaiseIrql]                                                      0001C083
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!KfLowerIrql]                                                      24468B00
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!HalGetInterruptVector]                                            89820C8D
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!HalTranslateBusAddress]                                           D18BF84D
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!KeStallExecutionProcessor]                                        860F1639
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!KfReleaseSpinLock]                                                000000BD
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                          020CB389
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!READ_PORT_USHORT]                                                 83660000
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                         7400067E
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                 89D60320
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[WMILIB.SYS!WmiSystemControl]                                              8D168B00
IAT             \SystemRoot\System32\Drivers\akgkly20.SYS[WMILIB.SYS!WmiCompleteRequest]                                            F0003284

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              897DD500
Device          \FileSystem\Fastfat \FatCdrom                                                                                       89DA4EC0
Device          \FileSystem\Fastfat \FatCdrom                                                                                       89E541F8
Device          \Driver\Tcpip \Device\Ip                                                                                            GDTdiIcpt.sys (G DATA Software AG)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                             SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                             SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    89A611F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    89A611F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    89A611F8
Device          \Driver\usbehci \Device\USBPDO-3                                                                                    89A3C500
Device          \Driver\usbuhci \Device\USBPDO-4                                                                                    89A611F8
Device          \Driver\Tcpip \Device\Tcp                                                                                           GDTdiIcpt.sys (G DATA Software AG)
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                              89DE61F8
Device          \Driver\sptd \Device\1036620336                                                                                     spen.sys
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                              89DE61F8
Device          \Driver\Cdrom \Device\CdRom0                                                                                        899F0500
Device          \Driver\NetBT \Device\NetBT_Tcpip_{681E16B2-473F-4AC3-B291-8681050F16E5}                                            897D63A0
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                              89DE61F8
Device          \Driver\Cdrom \Device\CdRom1                                                                                        899F0500
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  89E551F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c                                                                         89E551F8
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                             897D63A0
Device          \Driver\PCI_PNP4086 \Device\0000004b                                                                                spen.sys
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                    897D63A0
Device          \Driver\Tcpip \Device\Udp                                                                                           GDTdiIcpt.sys (G DATA Software AG)
Device          \Driver\Tcpip \Device\RawIp                                                                                         GDTdiIcpt.sys (G DATA Software AG)
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    89A611F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    89A611F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                   896D3500
Device          \Driver\Tcpip \Device\IPMULTICAST                                                                                   GDTdiIcpt.sys (G DATA Software AG)
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    89A611F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                         896D3500
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    89A611F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                                    89A3C500
Device          \Driver\Ftdisk \Device\FtControl                                                                                    89DE61F8
Device          \Driver\akgkly20 \Device\Scsi\akgkly201                                                                             899CB1F8
Device          \Driver\akgkly20 \Device\Scsi\akgkly201Port1Path0Target0Lun0                                                        899CB1F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{BFC57E7C-8E96-4588-94FA-E58CC74F5039}                                            897D63A0
Device          \FileSystem\Fastfat \Fat                                                                                            89DA4EC0
Device          \FileSystem\Fastfat \Fat                                                                                            89E541F8

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device          \FileSystem\Cdfs \Cdfs                                                                                              897B6500
Device           -> \Driver\atapi \Device\Harddisk0\DR0                                                                             89CCFEC5

---- Services - GMER 1.0.15 ----

Service          (*** hidden *** )                                                                                                  [BOOT] xtneuv                                                                                                                               <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x55 0x2F 0x28 0x3C ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x5B 0x28 0x73 0xFC ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x87 0x18 0x5A 0x31 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\xtneuv@Type                                                                  1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\xtneuv@Start                                                                 0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\xtneuv@ErrorControl                                                          0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\xtneuv@Group                                                                 Boot Bus Extender
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x55 0x2F 0x28 0x3C ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x5B 0x28 0x73 0xFC ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x87 0x18 0x5A 0x31 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\xtneuv@Type                                                                      1
Reg             HKLM\SYSTEM\ControlSet003\Services\xtneuv@Start                                                                     0
Reg             HKLM\SYSTEM\ControlSet003\Services\xtneuv@ErrorControl                                                              0
Reg             HKLM\SYSTEM\ControlSet003\Services\xtneuv@Group                                                                     Boot Bus Extender

---- Files - GMER 1.0.15 ----

File            C:\WINDOWS\system32\drivers\atapi.sys                                                                               suspicious modification

---- EOF - GMER 1.0.15 ----

--- --- ---

--- --- ---

cosinus · 17.06.2010, 14:30

Bitte mal den Avenger anwenden:

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:

3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

Code:

ATTFilter

registry keys to delete:
HKLM\SYSTEM\ControlSet003\Services\xtneuv

files to delete:
C:\WINDOWS\System32\drivers\xtneuv.sys

drivers to delete:
xtneuv.sys
xtneuv

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net hochladen und hier verlinken

kPeXx_04 · 17.06.2010, 14:56

Code:

ATTFilter

Logfile of The Avenger Version 2.0, (c) by Swandog46
hxxp://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Registry key "HKLM\SYSTEM\ControlSet003\Services\xtneuv" deleted successfully.
File "C:\WINDOWS\System32\drivers\xtneuv.sys" deleted successfully.

Error:  registry key "\Registry\Machine\System\CurrentControlSet\Services\xtneuv.sys" not found!
Deletion of driver "xtneuv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist

Driver "xtneuv" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

hxxp://www.file-upload.net/download-2605288/backup.zip.html

hxxp://www.file-upload.net/download-2605288/backup.zip.html

cosinus · 17.06.2010, 15:43

Ok. Weiter gehts mit CF:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

kPeXx_04 · 17.06.2010, 19:41

[CODE]
Combofix Logfile:

Code:

ATTFilter

ComboFix 10-06-16.04 - Stephan 17.06.2010  20:10:31.2.2 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.49.1031.18.2047.1293 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Stephan\Desktop\cofi.exe
AV: G DATA InternetSecurity 2008 *On-access scanning disabled* (Updated) {71310606-6F3B-49F2-9A81-8315AA75FBB3}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programme\pdfforge Toolbar\SearchSettings.dll
c:\windows\system32\win.com

Infizierte Kopie von c:\windows\system32\drivers\compbatt.sys wurde gefunden und desinfiziert 
Kopie von - Kitty had a snack :p wurde wiederhergestellt 
.
(((((((((((((((((((((((   Dateien erstellt von 2010-05-17 bis 2010-06-17  ))))))))))))))))))))))))))))))
.

2010-06-17 17:14 . 2010-06-17 17:14	--------	d-----w-	c:\programme\CCleaner
2010-06-16 20:31 . 2010-06-16 20:31	--------	d-----w-	C:\_OTL
2010-06-16 17:48 . 2010-06-16 17:48	--------	d-s---w-	c:\dokumente und einstellungen\LocalService\UserData
2010-06-16 16:49 . 2010-06-16 16:49	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Malwarebytes
2010-06-16 16:49 . 2010-04-29 10:19	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-16 16:49 . 2010-06-16 16:49	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-06-16 16:49 . 2010-04-29 10:19	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-06-16 16:49 . 2010-06-16 16:49	--------	d-----w-	c:\programme\Malwarebytes' Anti-Malware
2010-06-15 20:11 . 2010-06-15 20:11	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\G DATA
2010-06-15 17:56 . 2010-06-15 17:56	--------	d-s---w-	c:\dokumente und einstellungen\NetworkService\UserData
2010-06-15 17:56 . 2010-06-15 17:56	--------	d-----w-	c:\programme\Trend Micro
2010-06-13 19:40 . 2010-06-13 19:40	--------	d-----w-	c:\programme\Free PDF to Word Doc Converter
2010-06-13 18:58 . 2010-06-13 18:58	--------	d-----w-	c:\programme\ICQ6Toolbar
2010-06-13 18:58 . 2010-06-13 18:58	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\ICQ
2010-06-13 18:57 . 2010-06-13 18:57	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\ICQ
2010-06-13 18:57 . 2010-06-13 18:57	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\AOL
2010-06-13 18:57 . 2010-06-13 18:57	--------	d-----w-	c:\programme\ICQ7.2
2010-06-05 20:27 . 2010-06-05 20:27	57344	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-06-05 20:25 . 2010-06-05 20:25	54128	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Converter\Uninstaller.exe
2010-06-05 20:25 . 2010-06-05 20:25	54644	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\TranscodeEngine\Uninstaller.exe
2010-06-05 20:25 . 2010-06-05 20:25	57409	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ControlPanel\Uninstaller.exe
2010-06-05 20:25 . 2010-06-05 20:25	54101	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MPEG2Plugin\Uninstaller.exe
2010-06-05 20:25 . 2010-06-05 20:25	52963	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-06-05 20:25 . 2010-06-05 20:25	54073	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Qt4.5\Uninstaller.exe
2010-06-05 20:25 . 2010-06-05 20:25	56969	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ASPEncoder\Uninstaller.exe
2010-06-05 20:23 . 2010-06-05 20:23	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX
2010-05-22 18:14 . 2010-05-22 18:14	503808	----a-w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78b1bd88-n\msvcp71.dll
2010-05-22 18:14 . 2010-05-22 18:14	499712	----a-w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78b1bd88-n\jmc.dll
2010-05-22 18:14 . 2010-05-22 18:14	348160	----a-w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78b1bd88-n\msvcr71.dll
2010-05-22 18:14 . 2010-05-22 18:14	61440	----a-w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7942be8d-n\decora-sse.dll
2010-05-22 18:14 . 2010-05-22 18:14	12800	----a-w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7942be8d-n\decora-d3d.dll
2010-05-18 19:07 . 2010-05-18 19:07	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\TomTom
2010-05-18 19:06 . 2010-05-18 19:06	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\TomTom
2010-05-18 19:06 . 2010-05-18 19:06	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\TomTom
2010-05-18 19:06 . 2010-05-18 19:06	--------	d-----w-	c:\programme\TomTom International B.V
2010-05-18 19:05 . 2010-05-18 19:05	--------	d-----w-	c:\programme\TomTom HOME 2

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-14 12:17 . 2010-06-14 12:17	12	----a-w-	c:\windows\system32\config\systemprofile\Anwendungsdaten\qcopjv.dat
2010-06-10 21:33 . 2004-09-07 14:34	80306	----a-w-	c:\windows\system32\perfc007.dat
2010-06-10 21:33 . 2004-09-07 14:34	449044	----a-w-	c:\windows\system32\perfh007.dat
2010-05-14 15:24 . 2010-05-14 15:24	--------	d-----w-	c:\programme\Gemeinsame Dateien\Java
2010-05-14 15:23 . 2010-05-14 15:24	411368	----a-w-	c:\windows\system32\deployJava1.dll
2010-05-14 15:23 . 2010-05-14 15:23	--------	d-----w-	c:\programme\Java
2010-05-02 08:24 . 2004-09-07 14:34	1851008	----a-w-	c:\windows\system32\win32k.sys
2010-04-27 19:46 . 2010-04-27 19:46	55608	---ha-w-	c:\windows\system32\mlfcache.dat
2010-04-27 18:40 . 2010-01-22 22:07	45648	----a-w-	c:\windows\system32\drivers\PxHelp20.sys
2010-04-27 18:40 . 2010-01-22 22:07	133616	------w-	c:\windows\system32\pxafs.dll
2010-04-27 18:40 . 2010-01-22 22:07	126448	------w-	c:\windows\system32\pxinsi64.exe
2010-04-27 18:40 . 2010-01-22 22:07	123888	------w-	c:\windows\system32\pxcpyi64.exe
2010-04-22 14:21 . 2010-04-22 14:21	--------	d-----w-	c:\programme\JDownloader
2010-04-20 05:46 . 2004-09-07 14:33	285696	----a-w-	c:\windows\system32\atmfd.dll
2010-04-19 18:29 . 2010-04-19 18:29	--------	d-----w-	c:\dokumente und einstellungen\Stephan\Anwendungsdaten\QIP
2010-04-19 18:29 . 2010-04-19 18:29	--------	d-----w-	c:\programme\QIP 2010
2010-04-16 15:35 . 2004-09-07 14:34	667648	----a-w-	c:\windows\system32\wininet.dll
2010-04-16 15:35 . 2004-09-07 14:33	81920	----a-w-	c:\windows\system32\ieencode.dll
2010-03-20 11:33 . 2010-01-22 20:37	68464	----a-w-	c:\dokumente und einstellungen\Stephan\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2010-01-08 01:17	700416	----a-w-	c:\programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\programme\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll" [2010-01-08 700416]

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\programme\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2005-11-10 102400]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-21 7335936]
"nwiz"="nwiz.exe" [2005-11-21 1519616]
"SMSERIAL"="sm56hlpr.exe" [2005-05-26 544768]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-06 14850560]
"Power_Gear"="c:\programme\ASUS\Power4 Gear\BatteryLife.exe" [2005-10-05 86016]
"Wireless Console 2"="c:\programme\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2005-10-20 761945]
"ABLKSR"="c:\windows\ABLKSR\ABLKSR.exe" [2006-01-02 61440]
"IntelZeroConfig"="c:\programme\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\programme\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"EOUApp"="c:\programme\Intel\Wireless\Bin\EOUWiz.exe" [2005-12-28 569413]
"AVKTray"="c:\programme\G DATA InternetSecurity\AVKTray\AVKTray.exe" [2008-02-11 603720]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-11-10 417792]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SearchSettings"="c:\programme\pdfforge Toolbar\SearchSettings.exe" [2010-01-07 974848]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040]
"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Reader Speed Launch.lnk - c:\programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
ASUS ChkMail.lnk - c:\programme\Asus\Asus ChkMail\ChkMail.exe [2010-1-22 32768]
Bluetooth Manager.lnk - c:\programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-6-16 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 10:57	369200	----a-w-	c:\programme\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2010-06-13 18:57	133368	----a-w-	c:\programme\ICQ7.2\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 17:16	141608	----a-w-	c:\programme\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-03 23:11	1667584	------w-	c:\programme\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31	247144	----a-w-	c:\programme\TomTom HOME 2\TomTomHOMERunner.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\QIP\\qip.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\sft-loader_2009_final\\leecher.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Java\\JRE6\\BIN\\javaw.exe"=
"c:\\Programme\\ICQ7.2\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\aolload.exe"=

R2 Application Updater;Application Updater;c:\programme\Application Updater\ApplicationUpdater.exe [08.01.2010 00:51 380928]
R2 AVKProxy;G DATA AntiVirus Proxy;c:\programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe [22.01.2010 22:34 718408]
R2 AVKService;AVK Service;c:\programme\G DATA InternetSecurity\AVK\avkservice.exe [22.01.2010 22:31 427592]
R2 AVKWCtl;AVK Wächter;c:\programme\G DATA InternetSecurity\AVK\AVKWCtl.exe [22.01.2010 22:32 1127816]
R2 GDTdiInterceptor;GDTdiInterceptor;c:\windows\system32\drivers\GDTdiIcpt.sys [22.01.2010 22:34 41928]
R2 TomTomHOMEService;TomTomHOMEService;c:\programme\TomTom HOME 2\TomTomHOMEService.exe [13.11.2009 13:31 92008]
R3 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [22.01.2010 22:34 46536]
R3 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [22.01.2010 22:34 32200]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07.03.2010 17:34 691696]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uInternet Connection Wizard,ShellNext = hxxp://www.asus.com/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - c:\programme\ICQ7.2\ICQ.exe
FF - ProfilePath - c:\dokumente und einstellungen\Stephan\Anwendungsdaten\Mozilla\Firefox\Profiles\2gbx22y5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF - component: c:\programme\pdfforge Toolbar\FF\components\pdfforgeToolbarFF.dll
FF - component: c:\programme\pdfforge Toolbar\SSFF\components\SearchSettingsFF.dll
FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-17 20:18
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3019629587-2398666316-2811247245-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:13,a2,1f,54,11,10,98,84,fd,cf,23,19,94,ad,14,3d,ca,96,c0,d6,a2,2a,cc,
   37,a8,1d,03,1c,cd,c4,05,79,4b,5a,8d,d6,34,b5,2b,35,d9,51,12,69,dc,55,fc,d8,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d
.
Zeit der Fertigstellung: 2010-06-17  20:20:09
ComboFix-quarantined-files.txt  2010-06-17 18:20

Vor Suchlauf: 6.132.563.968 Bytes frei
Nach Suchlauf: 6.260.948.992 Bytes frei

- - End Of File - - E3019BE1F4034AC47465B05CFB899F12

--- --- ---

cosinus · 18.06.2010, 10:34

Ok, CF hat noch was weggehauen

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

16.06.2010, 20:13	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	WIN 32 Rootkit-gen [rtk] engine b meldungen Winzige Screenshots brauch ich nicht, ich wollte die OTL-Logs sehen. __________________ Logfiles bitte immer in CODE-Tags posten

17.06.2010, 08:32	#9
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	WIN 32 Rootkit-gen [rtk] engine b meldungen Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus __________________ Logfiles bitte immer in CODE-Tags posten

18.06.2010, 10:34	#15
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	WIN 32 Rootkit-gen [rtk] engine b meldungen Ok, CF hat noch was weggehauen Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

WIN 32 Rootkit-gen [rtk] engine b meldungen

Log-Analyse und Auswertung: WIN 32 Rootkit-gen [rtk] engine b meldungen