PC ist von Trojanern befallen, u.a. agent.fefk

Blümchen13 · 25.09.2010, 17:18

Hallo an alle Helfer

Ich habe ein Problem mit meinem PC, auf dem sich so wie´s aussieht gleich mehrere Trojaner eingenistet haben - anscheinend ist es beim Surfen im Netz passiert: 2 Tabs von Firefox waren geöffnet, u.a. Facebook, aber niemand hat am PC gearbeitet. Als dann die Arbeit fortgesetzt werden sollte, hat Avira bereits mehrere Viruswarnungen gesendet, beim Scan mit Malwarebytes wurden 9 Schädlinge gefunden...

Hier kommen die erforderlichen Protokolle - ich hoffe, jemand kann mir helfen uns sagen, was zu tun ist:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4681

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

24.09.2010 14:52:40
mbam-log-2010-09-24 (14-52-40).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 125932
Laufzeit: 4 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\OTGV1DNWQQ (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\YXE7DXCQ37 (Trojan.FakeAlert) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Documents and Settings\

\My Documents\downloads\packupdate107_231(2).exe (Rogue.Installer) -> No action taken.
C:\Documents and Settings\

\My Documents\downloads\packupdate107_231.exe (Rogue.Installer) -> No action taken.
C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> No action taken.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:59 on 24/09/2010 (

)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

Die Logfiles gmer, otl, extras folgen sogleich..

Vielen Dank!

Blümchen

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 24.09.2010 22:30:02 - Run 1
OTL by OldTimer - Version 3.2.14.1     Folder = C:\Documents and Settings\:)\Desktop\MFTools
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 34,87 Gb Free Space | 46,79% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: SCHWARZERNEUER
Current User Name: :)
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - [2010.09.24 12:08:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sabrina\Desktop\MFTools\OTL.exe
PRC - [2010.09.11 20:14:17 | 000,030,192 | ---- | M] (Google) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
PRC - [2010.04.22 23:13:58 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.11.06 12:52:16 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009.08.19 10:53:30 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2009.08.19 10:52:28 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2002.04.12 01:00:00 | 000,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001.12.13 01:01:00 | 000,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.09.24 12:08:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\:)\Desktop\MFTools\OTL.exe
MOD - [2008.04.14 02:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010.09.11 20:14:17 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-051210-111108)
SRV - [2010.04.22 23:13:58 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.03.07 20:10:25 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2002.04.12 01:00:00 | 000,057,344 | ---- | M] (brother Industries Ltd) [Auto | Running] -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\ds1410d.sys -- (DS1410D)
DRV - [2010.09.10 23:50:18 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.09.10 23:50:17 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.08.23 17:03:58 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2010.03.01 09:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.02.16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.11.06 09:36:36 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.24 19:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mcdbus.sys -- (mcdbus)
DRV - [2009.02.13 13:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.12.11 11:24:20 | 004,959,232 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.04.13 18:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007.04.16 17:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2006.11.27 17:33:54 | 000,019,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006.11.27 17:33:50 | 000,058,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006.11.24 15:47:50 | 000,040,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ET5Drv.sys -- (ET5Drv)
DRV - [2006.10.31 08:35:00 | 003,964,256 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2006.10.18 17:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005.07.28 08:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2004.10.15 13:50:20 | 000,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb)
DRV - [2001.06.21 21:39:02 | 000,073,728 | ---- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2001.06.21 21:39:02 | 000,020,032 | R--- | M] (Rainbow Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (Sntnlusb)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.09.24 14:56:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.09.24 14:56:01 | 000,000,000 | ---D | M]
 
[2009.11.22 20:31:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\*\Application Data\mozilla\Extensions
[2010.01.12 01:59:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\*\Application Data\mozilla\Firefox\Profiles\2uon28wj.default\extensions
[2009.11.22 20:30:48 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.09.24 14:55:53 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.09.24 14:55:53 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.09.24 14:55:53 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.09.24 14:55:53 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.09.24 14:55:53 | 000,000,801 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2007.07.27 14:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe ()
O4 - HKLM..\Run: [GEST]  File not found
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\sabrina\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe File not found
O4 - Startup: C:\Documents and Settings\sabrina\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\:)\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\:)\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.11.05 17:06:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: SSHNAS -  File not found
 
 
Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: SENTINEL - C:\WINDOWS\System32\SNTI386.DLL (Rainbow Technologies, Inc.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.09.24 12:16:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.09.24 12:15:11 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010.09.24 12:08:43 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2010.09.24 12:05:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Desktop\MFTools
[2010.09.22 00:19:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.09.12 11:18:20 | 000,000,000 | --SD | C] -- C:\Documents and Settings\*\UserData
[2010.09.12 00:41:43 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\*\Recent
[2010.09.11 23:38:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Local Settings\Application Data\Help
[2010.09.11 23:38:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Application Data\Help
[2010.09.11 23:34:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Application Data\Avira
[2010.09.11 00:14:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2010.09.10 23:49:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages
[2010.09.10 23:24:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Net
[2010.09.10 23:24:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Application Data\DAEMON Tools Net
[2010.09.01 18:54:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010.09.01 13:57:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Local Settings\Application Data\Temp
[2010.09.01 13:52:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010.08.28 16:16:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Application Data\Apple Computer
[2010.08.28 16:10:40 | 002,047,052 | ---- | C] (Macromedia, Inc.) -- C:\Documents and Settings\:)\Desktop\ufo-joe.exe
[2010.08.28 16:10:29 | 000,792,738 | ---- | C] (3rd Eye Solutions                                                                                                                                                                                                        ) -- C:\Documents and Settings\sabrina\Desktop\monkey-lander.exe
[2010.08.27 22:35:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Application Data\WinRAR
[2010.08.27 22:35:05 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010.08.27 21:45:41 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.08.27 21:45:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010.08.27 21:45:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010.08.27 21:45:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Local Settings\Application Data\Apple
[2010.08.27 21:45:09 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010.08.27 21:45:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple
[2010.08.27 21:44:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Local Settings\Application Data\Apple Computer
[2010.08.24 21:37:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\My Documents\Levi datei
[2010.08.23 17:12:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\Local Settings\Application Data\Autodesk
[2010.08.23 17:11:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\*\My Documents\maya
[2010.08.23 17:04:25 | 000,685,056 | ---- | C] (Aladdin Knowledge Systems Ltd.) -- C:\WINDOWS\System32\drivers\hardlock.sys
[2010.08.23 17:04:25 | 000,073,728 | ---- | C] (Rainbow Technologies, Inc.) -- C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2010.08.23 17:04:25 | 000,049,664 | ---- | C] (Rainbow Technologies, Inc.) -- C:\WINDOWS\System32\SNTI386.DLL
[2010.08.23 17:04:25 | 000,018,432 | ---- | C] (Rainbow Technologies, Inc.) -- C:\WINDOWS\System32\RNBOVDD.DLL
[2010.08.23 17:04:22 | 000,020,032 | R--- | C] (Rainbow Technologies Inc.) -- C:\WINDOWS\System32\drivers\SNTNLUSB.SYS
[2010.08.23 17:04:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RNBOSENT
[2010.08.23 17:04:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\:)\WINDOWS
[2010.08.23 17:03:58 | 000,047,616 | ---- | C] (Aladdin Knowledge Systems) -- C:\WINDOWS\System32\drivers\Haspnt.sys
[2010.08.23 17:03:58 | 000,006,656 | ---- | C] (Aladdin Knowledge Systems.) -- C:\WINDOWS\System32\haspvdd.dll
[2010.08.23 17:01:35 | 000,000,000 | ---D | C] -- C:\Program Files\Autodesk
[2010.08.23 17:01:35 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Alias Shared
[2010.08.23 16:59:06 | 000,000,000 | ---D | C] -- C:\FLEXLM
 
========== Files - Modified Within 90 Days ==========
 
[2010.09.24 22:26:51 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.09.24 22:26:31 | 000,081,496 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.09.24 22:26:30 | 000,000,000 | ---- | M] () -- C:\WINDOWS\TempFile
[2010.09.24 22:26:29 | 000,001,092 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.09.24 22:26:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.09.24 22:26:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.09.24 14:57:52 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\*\defogger_reenable
[2010.09.24 14:57:00 | 000,001,096 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.09.24 14:53:36 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\*\NTUSER.DAT
[2010.09.24 14:53:36 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\*\ntuser.ini
[2010.09.24 12:15:11 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\:)\Desktop\NTREGOPT.lnk
[2010.09.24 12:15:11 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\*\Desktop\ERUNT.lnk
[2010.09.24 12:08:02 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\*\Desktop\Gmer.zip
[2010.09.24 12:08:02 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\*\Desktop\defogger.exe
[2010.09.22 00:31:39 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.15 11:35:25 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.09.11 23:58:08 | 000,038,400 | ---- | M] () -- C:\Documents and Settings\*\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.10 23:50:18 | 000,279,712 | ---- | M] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010.09.10 23:50:17 | 000,025,888 | ---- | M] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010.09.10 23:49:48 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010.08.25 10:50:53 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010.08.24 21:17:19 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010.08.23 17:03:58 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) -- C:\WINDOWS\System32\drivers\Haspnt.sys
[2010.08.23 17:03:58 | 000,006,656 | ---- | M] (Aladdin Knowledge Systems.) -- C:\WINDOWS\System32\haspvdd.dll
[2010.08.23 17:03:58 | 000,002,620 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010.08.23 17:03:58 | 000,000,383 | ---- | M] () -- C:\WINDOWS\System32\haspdos.sys
[2010.08.23 17:03:51 | 000,001,772 | ---- | M] () -- C:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\Autodesk Maya 8.5.lnk
[2010.08.23 17:03:51 | 000,001,754 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Autodesk Maya 8.5.lnk
[2010.08.23 17:01:34 | 000,007,157 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\services
[2010.08.23 10:54:43 | 001,426,616 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.02 01:18:40 | 000,079,391 | ---- | M] () -- C:\Documents and Settings\:)\Desktop\Beratung älterer Menschen.docx
[2010.08.02 00:10:27 | 000,709,032 | ---- | M] () -- C:\Documents and Settings\:)\Desktop\HA Kommunikation mit Demenzpatienten.docx
 
========== Files Created - No Company Name ==========
 
[2010.09.24 15:00:20 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\*\Desktop\gmer.exe
[2010.09.24 14:57:52 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\*\defogger_reenable
[2010.09.24 12:15:11 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\*\Desktop\NTREGOPT.lnk
[2010.09.24 12:15:11 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\*\Desktop\ERUNT.lnk
[2010.09.24 12:06:00 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\*\Desktop\defogger.exe
[2010.09.24 12:05:58 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\*\Desktop\Gmer.zip
[2010.09.15 11:34:05 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010.09.10 23:50:18 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010.09.10 23:50:17 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010.09.01 13:52:32 | 000,001,096 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.09.01 13:52:31 | 000,001,092 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.24 21:17:19 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010.08.23 17:04:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TempFile
[2010.08.23 17:04:14 | 000,009,949 | ---- | C] () -- C:\WINDOWS\System32\SENTINEL.HLP
[2010.08.23 17:03:58 | 000,002,577 | ---- | C] () -- C:\WINDOWS\System32\config.hsp
[2010.08.23 17:03:58 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2010.08.23 17:03:51 | 000,001,772 | ---- | C] () -- C:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\Autodesk Maya 8.5.lnk
[2010.08.23 17:03:51 | 000,001,754 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Autodesk Maya 8.5.lnk
[2010.08.02 01:23:34 | 000,079,391 | ---- | C] () -- C:\Documents and Settings\*\Desktop\Beratung älterer Menschen.docx
[2010.08.02 00:36:11 | 000,709,032 | ---- | C] () -- C:\Documents and Settings\*\Desktop\HA Kommunikation mit Demenzpatienten.docx
[2010.03.07 21:02:21 | 000,038,400 | ---- | C] () -- C:\Documents and Settings\*\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.22 21:04:09 | 000,000,462 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009.11.22 21:04:09 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2009.11.22 21:04:09 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2006.10.31 08:35:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006.10.31 08:35:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006.10.31 08:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006.10.31 08:35:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006.10.31 08:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006.10.31 08:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006.10.31 08:35:00 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
 
========== LOP Check ==========
 
[2010.09.10 23:25:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Net
[2010.09.10 23:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\:)\Application Data\DAEMON Tools Net
[2009.11.22 21:10:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\:)\Application Data\gtk-2.0
[2010.01.21 23:12:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\:)\Application Data\OpenOffice.org
[2010.01.12 02:09:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\:)\Application Data\SoftGrid Client
[2010.01.12 02:01:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\:)\Application Data\TP
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2009.11.05 17:06:34 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009.11.06 09:09:12 | 000,000,223 | RHS- | M] () -- C:\boot.ini
[2009.11.05 17:06:34 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009.11.06 09:10:21 | 000,000,206 | ---- | M] () -- C:\csb.log
[2009.11.05 17:06:34 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009.11.05 17:06:34 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2007.07.27 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010.01.03 20:28:02 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010.09.24 22:26:24 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2009.11.06 09:10:21 | 000,001,530 | ---- | M] () -- C:\RHDSetup.log
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2009.11.05 17:06:13 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004.02.09 01:00:00 | 000,026,285 | ---- | M] (Brother Industries ,Ltd ) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\brmfpp1.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2009.11.05 23:20:46 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009.11.05 23:20:46 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009.11.05 23:20:46 | 000,880,640 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 02:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 02:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2008.04.14 02:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
 
 
< MD5 for: EXPLORER.EXE  >
[2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008.04.14 02:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.07.27 14:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
 
< MD5 for: WINLOGON.EXE  >
[2007.07.27 14:00:00 | 000,506,880 | ---- | M] (Microsoft Corporation) MD5=051A52001D625F316CE81A539BD25192 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 02:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 02:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-15 09:35:29
< End of report >

--- --- ---

Code:

ATTFilter

 
Computer Name: SCHWARZERNEUER
Current User Name: *
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Autodesk\Maya8.5\bin\maya.exe" = C:\Program Files\Autodesk\Maya8.5\bin\maya.exe:*:Enabled:Maya -- (Autodesk)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1ADE23D7-7A1E-4AEC-BA5D-EB8A01BED943}" = DeepBurner v1.8.0.224
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE1008C-11A1-4F4F-8DB7-27573924DE78}" = DMIView B7.0108.01
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A1E0E88A-F5E9-4414-A0D7-31940E965EC5}" = Maya 8.5
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"EasyTune5" = EasyTune5
"ERUNT_is1" = ERUNT 1.1j
"Google Desktop" = Google Desktop
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.5.13)" = Mozilla Firefox (3.5.13)
"NVIDIA Drivers" = NVIDIA Drivers
"Rainbow Sentinel Driver" = Sentinel System Driver
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinRAR archiver" = WinRAR archiver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 31.08.2010 03:03:54 | Computer Name = SCHWARZERNEUER | Source = ESENT | ID = 490
Description = svchost (1100) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 08.09.2010 14:10:59 | Computer Name = SCHWARZERNEUER | Source = ESENT | ID = 490
Description = svchost (1100) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 11.09.2010 18:36:02 | Computer Name = SCHWARZERNEUER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung sch.exe, Version 1.2.7.0, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x02c8024f.
 
Error - 12.09.2010 13:07:37 | Computer Name = SCHWARZERNEUER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://w*w.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
in der signierten Datei. .
 
Error - 12.09.2010 13:07:37 | Computer Name = SCHWARZERNEUER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://w*w.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
in der signierten Datei. .
 
Error - 12.09.2010 18:35:58 | Computer Name = SCHWARZERNEUER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung sch.exe, Version 1.2.7.0, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x02c8024f.
 
Error - 14.09.2010 15:22:11 | Computer Name = SCHWARZERNEUER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung sch.exe, Version 1.2.7.0, fehlgeschlagenes
Modul kernel32.dll, Version 5.1.2600.5781, Fehleradresse 0x0001326e.
 
Error - 15.09.2010 05:11:29 | Computer Name = SCHWARZERNEUER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung sch.exe, Version 1.2.7.0, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x02c8024f.
 
Error - 15.09.2010 05:58:04 | Computer Name = SCHWARZERNEUER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung sch.exe, Version 1.2.7.0, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x02c8024f.
 
Error - 24.09.2010 06:06:59 | Computer Name = SCHWARZERNEUER | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung Load.exe, Version 3.3.6.1, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ System Events ]
Error - 24.09.2010 06:11:16 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7034
Description = Dienst "BrSplService" wurde unerwartet beendet. Dies ist bereits 1
Mal passiert.
 
Error - 24.09.2010 06:11:17 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7034
Description = Dienst "##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" wurde
unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error - 24.09.2010 06:11:17 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
 
Error - 24.09.2010 06:13:06 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 24.09.2010 06:13:06 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126
 
Error - 24.09.2010 08:54:28 | Computer Name = SCHWARZERNEUER | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
 
Error - 24.09.2010 08:54:34 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 24.09.2010 09:06:27 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 24.09.2010 09:09:44 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 24.09.2010 16:26:31 | Computer Name = SCHWARZERNEUER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
 
< End of report >

Das Logfile von GMER ist so groß, dass es weder in dieses Nachrichtenfenster passt noch als Anhang gepostet werden kann - was mache ich jetzt am besten?

PC ist von Trojanern befallen, u.a. agent.fefk

Plagegeister aller Art und deren Bekämpfung: PC ist von Trojanern befallen, u.a. agent.fefk

PC ist von Trojanern befallen, u.a. agent.fefk

Ähnliche Themen: PC ist von Trojanern befallen, u.a. agent.fefk