Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Windows Security Alert - wie bekomm ich den weg ?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 09.01.2011, 19:46   #1
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Böse

Windows Security Alert - wie bekomm ich den weg ?



Moin Leute,

ich hatte aufeinmal den "Windows Security Alert" auf meinem PC - keine Ahnung wie.
Ich habe schon herausgefunden das dies wohl ein Trojaner ist der sich als "Antivurs Scan" ausgibt.
Wie bekomm ich den weg ?

Ich habe hier schonmal einen Scan mit HiJack gemacht:
HiJackthis Logfile:
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:37:20, on 09.01.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programme\Application Updater\ApplicationUpdater.exe
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\windows\system32\svchost.exe
C:\Programme\Tunngle\TnglCtrl.exe
C:\Programme\refogkl\MPK.exe
C:\windows\Explorer.EXE
C:\windows\RTHDCPL.EXE
C:\windows\system32\RUNDLL32.EXE
C:\Programme\Razer\DeathAdder\razerhid.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\windows\system32\mmrtkrnl.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
C:\Programme\Search Settings\SearchSettings.exe
C:\windows\vsnpstd3.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
E:\iTunes\iTunesHelper.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
C:\Programme\Razer\DeathAdder\razerofa.exe
C:\Programme\DNA\btdna.exe
C:\Programme\Pando Networks\Media Booster\PMB.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\PC Connectivity Solution\ServiceLayer.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\lxcecoms.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
C:\Programme\Xfire\Xfire.exe
C:\Programme\iPod\bin\iPodService.exe
C:\windows\System32\svchost.exe
C:\windows\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\Name\LOKALE~1\Temp\Rar$EX00.000\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
R3 - URLSearchHook: TECHNO4EVER Toolbar - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll
R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll
R3 - URLSearchHook: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,C:\Programme\refogkl\MPK.exe
O1 - Hosts: 88.198.16.154 status.wow-europe.com
O1 - Hosts: 88.198.16.154 launcher.worldofwarcraft.com
O1 - Hosts: 88.198.16.154 eu.logon.worldofwarcraft.com
O1 - Hosts: 88.198.16.154 eu.version.worldofwarcraft.com
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: TECHNO4EVER Toolbar - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: TECHNO4EVER Toolbar - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programme\Styler\TB\StylerTB.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll
O3 - Toolbar: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [DeathAdder] C:\Programme\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Realtime Audio Engine] "mmrtkrnl.exe" /i
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [snpstd3] C:\windows\vsnpstd3.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Programme\DNA\btdna.exe"
O4 - HKCU\..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [iymoxksp] C:\DOKUME~1\Name\LOKALE~1\Temp\tknmgbxqg\cmfoeoklajb.exe
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI" TRANSFORMS="C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST" WISE_SETUP_EXE_PATH="c:\nvidia\displaydriver\190.62\international\PhysX_9.09.0814_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Save YouTube Video as MP3 - res://C:\Programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} (Perparer Class) - hxxp://www.fiaa.eu/OPLauncher.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Programme\Application Updater\ApplicationUpdater.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Programme\Tunngle\TnglCtrl.exe

--
End of file - 13821 bytes
         
--- --- ---

Alt 09.01.2011, 20:03   #2
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten
__________________

__________________

Alt 09.01.2011, 23:52   #3
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Oke, hier der OTL report:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 09.01.2011 23:57:40 - Run 1
OTL by OldTimer - Version 3.2.20.1     Folder = C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Programme
Drive C: | 49,81 Gb Total Space | 1,28 Gb Free Space | 2,58% Space Free | Partition Type: NTFS
Drive E: | 99,23 Gb Total Space | 6,86 Gb Free Space | 6,91% Space Free | Partition Type: NTFS
 
Computer Name: NAME-1 | User Name: Name | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.01.09 23:51:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads\OTL.exe
PRC - [2010.12.10 16:12:42 | 000,435,368 | ---- | M] (Avira GmbH) -- c:\Programme\Avira\AntiVir Desktop\avscan.exe
PRC - [2010.12.10 16:12:42 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.02 17:44:29 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.11.02 17:44:28 | 000,389,288 | ---- | M] (Avira GmbH) -- c:\Programme\Avira\AntiVir Desktop\avcenter.exe
PRC - [2010.11.02 17:44:28 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.09.21 19:37:40 | 000,932,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
PRC - [2010.09.14 12:47:24 | 000,716,024 | ---- | M] (Tunngle.net GmbH) -- C:\Programme\Tunngle\TnglCtrl.exe
PRC - [2010.08.25 14:28:58 | 002,937,528 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
PRC - [2010.07.09 20:04:34 | 003,493,776 | ---- | M] (Xfire Inc.) -- C:\Programme\Xfire\Xfire.exe
PRC - [2010.04.01 19:00:17 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.02.08 14:47:04 | 001,248,024 | ---- | M] () -- C:\Programme\refogkl\MPK.exe
PRC - [2010.01.19 20:59:15 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\DNA\btdna.exe
PRC - [2010.01.14 20:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2010.01.08 00:36:58 | 000,974,848 | ---- | M] (Spigot, Inc.) -- C:\Programme\Search Settings\SearchSettings.exe
PRC - [2010.01.07 23:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
PRC - [2009.11.23 21:40:22 | 000,070,144 | ---- | M] (AlcaTech) -- C:\WINDOWS\system32\mmrtkrnl.exe
PRC - [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.09.07 14:54:54 | 000,159,744 | ---- | M] () -- C:\Programme\Razer\DeathAdder\razerhid.exe
PRC - [2007.06.01 09:21:30 | 001,209,904 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007.06.01 09:21:30 | 000,271,920 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
PRC - [2007.06.01 09:21:08 | 000,153,136 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
PRC - [2007.05.07 14:35:14 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Programme\Razer\DeathAdder\razerofa.exe
PRC - [2007.01.19 11:49:04 | 000,049,152 | ---- | M] (Wireless Service) -- C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
PRC - [2006.11.08 13:27:54 | 000,222,208 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
PRC - [2006.11.06 14:21:10 | 000,210,432 | ---- | M] (Nokia.) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe
PRC - [2006.09.19 09:07:28 | 000,827,392 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe
PRC - [2005.07.06 11:14:12 | 000,471,040 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\lxcecoms.exe
PRC - [2004.06.16 06:03:04 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.01.09 23:51:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads\OTL.exe
MOD - [2010.07.09 20:04:44 | 000,970,640 | ---- | M] (Xfire Inc.) -- C:\Programme\Xfire\xfire_toucan_43094.dll
MOD - [2010.02.08 14:48:00 | 000,082,712 | ---- | M] () -- C:\Programme\refogkl\Mpk.dll
MOD - [2008.04.14 06:52:34 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wsock32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\windows\System32\hidserv.dll -- (HidServ)
SRV - [2010.12.10 16:12:42 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.02 17:44:29 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.09.14 12:47:24 | 000,716,024 | ---- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Programme\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2010.04.28 16:27:00 | 003,522,800 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\windows\System32\GameMon.des -- (npggsvc)
SRV - [2010.01.07 23:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2007.06.01 09:21:30 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.01.19 11:49:26 | 000,049,152 | ---- | M] (Wireless Service) [Auto | Stopped] -- C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService)
SRV - [2006.11.06 14:21:10 | 000,210,432 | ---- | M] (Nokia.) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2005.07.06 11:14:12 | 000,471,040 | ---- | M] (Lexmark International, Inc.) [On_Demand | Running] -- C:\windows\System32\lxcecoms.exe -- (lxce_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\PCAMPR5.SYS -- (PCAMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\drivers\EagleNT.sys -- (EagleNT)
DRV - [2010.12.21 16:21:46 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.23 17:25:26 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.11.29 12:02:31 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.09.16 07:02:40 | 000,027,136 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV - [2009.08.30 09:35:47 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2009.08.16 23:57:00 | 007,729,568 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2009.05.11 08:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.12.11 10:24:20 | 004,959,232 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.07.10 02:49:14 | 000,242,712 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RsFx0102.sys -- (RsFx0102)
DRV - [2008.04.13 21:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007.08.02 16:32:26 | 000,022,784 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dadder.sys -- (DAdderFltr)
DRV - [2007.05.12 14:49:54 | 000,380,928 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt61.sys -- (RT61)
DRV - [2007.03.27 18:19:36 | 010,252,544 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - [2007.01.26 01:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007.01.26 01:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmeject.sys -- (avmeject)
DRV - [2006.11.27 15:33:54 | 000,019,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006.11.27 15:33:50 | 000,058,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006.10.18 15:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2006.10.10 08:54:34 | 000,138,240 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (Nokia USB Phone Parent)
DRV - [2006.10.10 08:54:32 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (Nokia USB Port)
DRV - [2006.10.10 08:54:32 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (Nokia USB Modem)
DRV - [2006.10.10 08:54:32 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (Nokia USB Generic)
DRV - [2006.07.01 22:30:28 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2005.12.11 11:55:38 | 000,028,195 | ---- | M] (Alpha Networks Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\ANIO.sys -- (ANIO)
DRV - [2004.09.08 09:10:00 | 000,017,018 | R--- | M] (Intellon, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PLCNDIS5.SYS -- (PLCNDIS5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8074
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "techno4ever Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://home.sweetim.com"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.1.0014
FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:6.6.0.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.1.0.0
FF - prefs.js..extensions.enabledItems: {33b974a8-e892-4f5f-bd17-f7b0331843d5}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: dealio@mybrowserbar.com:4.0.2
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
FF - prefs.js..extensions.enabledItems: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.8.6.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "chrome://browser-region/locale/region.properties"
FF - prefs.js..browser.startup.homepage: "resource:/browserconfig.properties"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.01.08 01:30:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.13 15:44:47 | 000,000,000 | ---D | M]
 
[2009.09.05 17:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Extensions
[2010.12.20 07:17:01 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions
[2009.09.05 21:44:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.02.13 16:46:00 | 000,000,000 | ---D | M] (techno4ever Toolbar) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{33b974a8-e892-4f5f-bd17-f7b0331843d5}
[2010.05.16 20:17:19 | 000,000,000 | ---D | M] (Html Validator) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
[2010.03.02 20:44:25 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.07.16 11:54:17 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.07.16 11:54:17 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.08.24 13:34:31 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2010.10.12 08:55:40 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2009.11.29 12:02:46 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\DTToolbar@toolbarnet.com
[2010.04.09 11:12:38 | 000,002,331 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\bigseekpro.xml
[2010.01.27 13:15:12 | 000,000,923 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\conduit.xml
[2009.11.29 12:02:42 | 000,002,055 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\daemon-search.xml
[2010.10.12 08:55:16 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\sweetim.xml
[2010.08.24 17:48:00 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.12.29 17:23:22 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.04.18 12:49:39 | 000,000,000 | ---D | M] (Dealio Toolbar Plugin) -- C:\PROGRAMME\DEALIO TOOLBAR\FF
[2009.09.29 12:57:54 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010.04.18 12:49:43 | 000,000,000 | ---D | M] (Search Settings Plugin) -- C:\PROGRAMME\SEARCH SETTINGS\FF
[2010.08.25 14:28:57 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Programme\Mozilla Firefox\plugins\npPandoWebInst.dll
[2010.04.01 17:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 17:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 17:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 17:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 17:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.01.09 13:56:42 | 000,372,092 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 88.198.16.154	status.wow-europe.com
O1 - Hosts: 88.198.16.154	launcher.worldofwarcraft.com
O1 - Hosts: 88.198.16.154	eu.logon.worldofwarcraft.com
O1 - Hosts: 88.198.16.154	eu.version.worldofwarcraft.com
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 12822 more lines...
O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (TECHNO4EVER Toolbar) - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (TECHNO4EVER Toolbar) - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (StylerToolBar) - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programme\Styler\TB\StylerTB.dll (StyleFantasist)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (TECHNO4EVER Toolbar) - {33B974A8-E892-4F5F-BD17-F7B0331843D5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\windows\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DeathAdder] C:\Programme\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LXCECATS] C:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
O4 - HKLM..\Run: [Realtime Audio Engine] C:\windows\System32\mmrtkrnl.exe (AlcaTech)
O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe ()
O4 - HKU\.DEFAULT..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-18..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [BitTorrent DNA] C:\Programme\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [iymoxksp] C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Temp\tknmgbxqg\cmfoeoklajb.exe ()
O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Name\Startmenü\Programme\Autostart\CurseClientStartup.ccip ()
O4 - Startup: C:\Dokumente und Einstellungen\Name\Startmenü\Programme\Autostart\Xfire.lnk = C:\Programme\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Programme\refogkl\MPK.exe) - C:\Programme\refogkl\MPK.exe ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Desktop-Hintergrund.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Desktop-Hintergrund.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.08.30 05:01:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - Unable to obtain root file information for disk E:\
O33 - MountPoints2\{13c81eba-006f-11df-9b5b-00241d6a8a52}\Shell\AutoRun\command - "" = F:\Get_Started_for_Win.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ - C:\windows\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpReg: D-Link AirPlus G DWL-G510 - hkey= - key= - C:\Programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe (D-Link)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: vsmon - Service
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - 
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\windows\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.vorbis - C:\windows\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\windows\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\windows\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XFR1 - C:\windows\System32\xfcodec.dll ()
Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902053519425536)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.01.09 19:53:36 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Name\Recent
[2010.12.18 21:35:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\softonic-de3
[2010.12.18 21:35:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\techno4ever
[2010.12.18 21:35:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\DVDVideoSoftTB
[2010.12.18 21:35:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Apple
[2010.12.18 16:48:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PhotoScape
[2010.12.18 16:48:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PhotoScape
[2010.12.18 16:48:38 | 000,000,000 | ---D | C] -- C:\Programme\PhotoScape
[2010.12.18 16:48:17 | 017,327,195 | ---- | C] (Mooii) -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScapeSetup_V3.5.exe
[2010.12.18 01:22:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\ICQ
[2010.12.16 22:18:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Desktop\Bewerbungsmappe
[2010.12.13 16:13:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Desktop\Virus ;)
[2010.12.13 15:45:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Apple Computer
[2010.12.13 15:45:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes
[2010.12.13 15:45:41 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\windows\System32\GEARAspi.dll
[2010.12.13 15:45:21 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.12.13 15:45:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.12.13 15:44:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime
[2010.12.13 15:44:32 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2010.12.13 15:44:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
[2010.12.13 15:44:13 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update
[2010.12.13 15:43:36 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2010.12.13 15:43:22 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Apple
[2010.12.13 15:43:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
[2010.12.11 22:13:23 | 000,431,616 | ---- | C] (Fatih Kodak) -- C:\Dokumente und Einstellungen\Name\Desktop\Bat_To_Exe_Converter.exe
[2007.09.21 18:42:42 | 000,019,008 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\Programme\markfun.a64
[2007.08.21 18:49:28 | 000,017,912 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Programme\markfun.w32
[2007.03.12 11:41:52 | 000,061,440 | ---- | C] ( ) -- C:\windows\System32\vsnpstd3.dll
[2005.11.23 12:55:32 | 000,053,248 | ---- | C] ( ) -- C:\windows\System32\csnpstd3.dll
[4 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.01.09 23:59:00 | 000,001,088 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.09 23:46:02 | 000,000,007 | ---- | M] () -- C:\windows\System32\ANIWZCSUSERNAME
[2011.01.09 23:45:57 | 000,249,324 | ---- | M] () -- C:\windows\System32\NvApps.xml
[2011.01.09 23:45:52 | 000,001,084 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 23:45:35 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2011.01.09 23:45:33 | 000,135,664 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2011.01.09 19:58:22 | 000,105,872 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\cc_20110109_195808.reg
[2011.01.09 19:22:16 | 000,000,000 | ---- | M] () -- C:\windows\System32\Access.dat
[2011.01.09 18:27:33 | 000,000,069 | ---- | M] () -- C:\windows\NeroDigital.ini
[2011.01.08 21:35:04 | 000,000,276 | ---- | M] () -- C:\windows\tasks\AppleSoftwareUpdate.job
[2011.01.08 16:05:04 | 000,002,206 | ---- | M] () -- C:\windows\System32\wpa.dbl
[2011.01.07 13:49:26 | 000,000,005 | ---- | M] () -- C:\windows\System32\ANIWZCSUSERNAME{BBAFD89B-C226-4E03-BF2F-86CA54489D29}
[2011.01.06 22:43:13 | 000,003,284 | ---- | M] () -- C:\windows\System32\ANIWZCS{BBAFD89B-C226-4E03-BF2F-86CA54489D29}
[2010.12.31 01:41:09 | 000,858,651 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Nordkurve-Bayern-Doppelhalter.JPG
[2010.12.31 01:28:06 | 000,195,146 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Unbenannt3.jpg
[2010.12.31 01:15:20 | 003,625,649 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Linkin Park - Numb Techno Remix.mp3
[2010.12.30 00:21:31 | 000,025,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\12.jpg
[2010.12.30 00:16:37 | 000,117,776 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_30122010_001627.png
[2010.12.28 01:41:36 | 011,214,976 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Dj NeXt - Hit Leta (Electro 2010).mp3
[2010.12.28 00:32:43 | 000,686,194 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\hot-girls-sexy-girls.jpg
[2010.12.26 23:52:11 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\klasse_1c tobias & marcel.jpg
[2010.12.26 23:51:23 | 000,008,879 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-4a65b476d5be0b9c.jpg
[2010.12.21 16:39:05 | 013,029,654 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\kalle.bmp
[2010.12.21 16:21:46 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys
[2010.12.20 19:59:47 | 001,620,426 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\svz2 xD.bmp
[2010.12.18 16:49:02 | 000,059,392 | -H-- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\photothumb.db
[2010.12.18 16:48:46 | 000,000,688 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScape.lnk
[2010.12.18 16:48:27 | 017,327,195 | ---- | M] (Mooii) -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScapeSetup_V3.5.exe
[2010.12.18 16:42:21 | 000,009,536 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-53a0fed14bd4aae2.jpg
[2010.12.15 22:08:25 | 000,107,625 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03411.jpg
[2010.12.15 22:08:08 | 000,049,027 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03387.JPG
[2010.12.15 22:07:55 | 000,040,017 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03003.JPG
[2010.12.15 22:03:11 | 000,543,190 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_15122010_220154.png
[2010.12.15 21:47:19 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\sirksfeld_4b_05_239.jpg
[2010.12.15 19:56:16 | 000,022,136 | -H-- | M] () -- C:\windows\System32\mlfcache.dat
[2010.12.15 18:56:55 | 007,378,437 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\01 My Life Would Suck Without You.m4a
[2010.12.15 18:42:32 | 002,972,426 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Ciara feat. Usher - Turn It Up.mp3
[2010.12.15 18:42:17 | 000,677,293 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\G35 konfigurieren.png
[2010.12.15 17:15:49 | 000,021,418 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Paladin Asoka.odt
[2010.12.14 17:05:30 | 000,396,288 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!2.ppt
[2010.12.13 21:00:41 | 000,001,787 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2010.12.13 20:57:41 | 003,173,941 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_13122010_202900.png
[2010.12.13 19:32:26 | 000,000,235 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\virus1.bat
[2010.12.13 18:45:30 | 000,420,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!.pps
[2010.12.13 16:18:22 | 000,022,309 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\TowerDefence.rar
[2010.12.13 16:00:05 | 001,537,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Bodem Brothers.jpg
[2010.12.13 15:45:43 | 000,001,362 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2010.12.13 15:44:38 | 000,001,594 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2010.12.12 21:37:42 | 000,001,697 | ---- | M] () -- C:\WarRock.ini
[2010.12.12 00:10:09 | 007,260,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kat DeLuna feat. Akon - Push Push.mp3
[2010.12.11 23:56:23 | 000,597,786 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0189.JPG
[2010.12.11 23:56:20 | 000,866,931 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0249.JPG
[2010.12.11 23:56:02 | 000,703,869 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0242.JPG
[2010.12.11 23:51:08 | 003,320,605 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_3977.JPG
[2010.12.11 21:25:11 | 000,001,500 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kalle.jpg.lnk
[4 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.01.09 19:58:13 | 000,105,872 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\cc_20110109_195808.reg
[2011.01.03 23:32:49 | 000,003,284 | ---- | C] () -- C:\windows\System32\ANIWZCS{BBAFD89B-C226-4E03-BF2F-86CA54489D29}
[2010.12.31 01:40:34 | 000,858,651 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Nordkurve-Bayern-Doppelhalter.JPG
[2010.12.31 01:27:57 | 000,195,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Unbenannt3.jpg
[2010.12.31 01:07:55 | 003,625,649 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Linkin Park - Numb Techno Remix.mp3
[2010.12.30 00:21:29 | 000,025,752 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\12.jpg
[2010.12.30 00:16:35 | 000,117,776 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_30122010_001627.png
[2010.12.28 01:32:22 | 011,214,976 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Dj NeXt - Hit Leta (Electro 2010).mp3
[2010.12.28 00:31:51 | 000,686,194 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\hot-girls-sexy-girls.jpg
[2010.12.26 23:51:22 | 000,008,879 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-4a65b476d5be0b9c.jpg
[2010.12.20 19:23:50 | 001,620,426 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\svz2 xD.bmp
[2010.12.20 19:23:39 | 013,029,654 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\kalle.bmp
[2010.12.18 16:49:02 | 000,059,392 | -H-- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\photothumb.db
[2010.12.18 16:48:46 | 000,000,688 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScape.lnk
[2010.12.18 16:42:21 | 000,009,536 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-53a0fed14bd4aae2.jpg
[2010.12.15 22:08:21 | 000,107,625 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03411.jpg
[2010.12.15 22:08:07 | 000,049,027 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03387.JPG
[2010.12.15 22:07:54 | 000,040,017 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03003.JPG
[2010.12.15 22:02:28 | 000,543,190 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_15122010_220154.png
[2010.12.15 21:47:48 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\klasse_1c tobias & marcel.jpg
[2010.12.15 21:47:19 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\sirksfeld_4b_05_239.jpg
[2010.12.15 19:56:16 | 000,022,136 | -H-- | C] () -- C:\windows\System32\mlfcache.dat
[2010.12.15 18:59:42 | 007,378,437 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\01 My Life Would Suck Without You.m4a
[2010.12.15 18:41:50 | 000,677,293 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\G35 konfigurieren.png
[2010.12.15 18:20:44 | 002,972,426 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Ciara feat. Usher - Turn It Up.mp3
[2010.12.15 17:15:48 | 000,021,418 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Paladin Asoka.odt
[2010.12.14 17:05:27 | 000,396,288 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!2.ppt
[2010.12.13 20:57:03 | 003,173,941 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_13122010_202900.png
[2010.12.13 19:26:21 | 000,000,884 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\towerdefence.jnlp
[2010.12.13 18:45:16 | 000,420,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!.pps
[2010.12.13 16:16:56 | 000,002,238 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\pzqst2.ico
[2010.12.13 16:11:31 | 000,022,309 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\TowerDefence.rar
[2010.12.13 15:45:43 | 000,001,362 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2010.12.13 15:44:38 | 000,001,594 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2010.12.13 15:44:18 | 000,000,276 | ---- | C] () -- C:\windows\tasks\AppleSoftwareUpdate.job
[2010.12.12 21:37:42 | 000,001,697 | ---- | C] () -- C:\WarRock.ini
[2010.12.11 23:57:53 | 007,260,752 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kat DeLuna feat. Akon - Push Push.mp3
[2010.12.11 23:53:38 | 000,597,786 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0189.JPG
[2010.12.11 23:52:39 | 000,703,869 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0242.JPG
[2010.12.11 23:52:33 | 000,866,931 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0249.JPG
[2010.12.11 23:48:56 | 003,320,605 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_3977.JPG
[2010.12.11 23:34:15 | 001,537,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Bodem Brothers.jpg
[2010.12.11 22:13:56 | 000,000,235 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\virus1.bat
[2010.12.11 21:24:18 | 000,001,500 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kalle.jpg.lnk
[2010.12.10 16:30:47 | 001,970,176 | ---- | C] () -- C:\windows\System32\d3dx9.dll
[2010.11.03 18:45:41 | 000,049,152 | ---- | C] () -- C:\windows\System32\JJAKEn.dll
[2010.09.08 19:11:05 | 000,000,035 | ---- | C] () -- C:\windows\System32\FIOALL.INI
[2010.07.09 20:04:40 | 000,041,872 | ---- | C] () -- C:\windows\System32\xfcodec.dll
[2010.05.16 17:06:44 | 000,000,326 | ---- | C] () -- C:\windows\ULEAD32.INI
[2010.04.18 12:49:24 | 000,290,816 | ---- | C] () -- C:\windows\System32\decdll.dll
[2010.04.17 00:08:10 | 000,115,160 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.04.16 19:53:51 | 000,027,648 | ---- | C] () -- C:\windows\System32\AVSredirect.dll
[2010.03.27 21:42:38 | 000,000,121 | ---- | C] () -- C:\windows\SMM_HCEditor.INI
[2010.03.25 21:19:25 | 001,108,482 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\NMM-MetaData.db
[2010.01.31 00:29:16 | 000,000,151 | ---- | C] () -- C:\windows\PhotoSnapViewer.INI
[2009.11.23 15:06:12 | 000,000,073 | ---- | C] () -- C:\windows\cdplayer.ini
[2009.11.23 15:06:05 | 000,001,074 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ss.ini
[2009.10.22 13:41:25 | 000,000,029 | ---- | C] () -- C:\windows\DEBUGSM.INI
[2009.10.22 13:38:27 | 000,000,072 | ---- | C] () -- C:\windows\System32\epDPE.ini
[2009.10.22 13:38:26 | 000,096,768 | ---- | C] () -- C:\windows\SlantAdj.dll
[2009.09.29 13:02:21 | 000,040,960 | ---- | C] () -- C:\windows\System32\lxcevs.dll
[2009.09.29 13:02:14 | 000,139,264 | ---- | C] () -- C:\windows\System32\lxcejswr.dll
[2009.09.29 13:02:13 | 000,102,400 | ---- | C] () -- C:\windows\System32\lxceinsr.dll
[2009.09.29 13:02:12 | 000,036,864 | ---- | C] () -- C:\windows\System32\lxcecur.dll
[2009.09.13 18:59:14 | 000,036,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.09.12 15:46:00 | 000,138,464 | ---- | C] () -- C:\windows\System32\drivers\PnkBstrK.sys
[2009.09.06 19:44:08 | 000,000,000 | ---- | C] () -- C:\windows\OpPrintServer.INI
[2009.09.05 21:41:50 | 000,000,069 | ---- | C] () -- C:\windows\NeroDigital.ini
[2009.09.05 21:26:52 | 000,691,696 | ---- | C] () -- C:\windows\System32\drivers\sptd.sys
[2009.08.30 08:30:26 | 000,003,972 | ---- | C] () -- C:\windows\System32\drivers\PciBus.sys
[2009.08.30 05:53:58 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI
[2009.08.29 23:29:18 | 000,000,400 | ---- | C] () -- C:\windows\ODBC.INI
[2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\windows\System32\physxcudart_20.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSwedish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSpanish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelPortugese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelKorean.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelJapanese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelGerman.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelFrench.dll
[2008.02.14 13:28:56 | 000,000,029 | ---- | C] () -- C:\Programme\version.ini
[2008.02.14 13:23:12 | 000,231,944 | ---- | C] () -- C:\Programme\gwflash.exe
[2007.08.21 18:49:36 | 000,125,504 | ---- | C] () -- C:\Programme\MarkFunDrv.dll
[2007.04.05 03:31:22 | 000,248,640 | ---- | C] () -- C:\Programme\update.exe
[2007.03.30 03:36:28 | 000,000,301 | ---- | C] () -- C:\Programme\update.ini
[2007.03.02 03:48:50 | 000,240,448 | ---- | C] () -- C:\Programme\gwf32.exe
[2006.11.23 22:47:50 | 000,207,680 | ---- | C] () -- C:\Programme\BIOS_Run.exe
[2006.11.23 22:40:30 | 000,060,224 | ---- | C] () -- C:\Programme\HUADRV.DLL
[2006.11.03 17:09:40 | 000,000,528 | ---- | C] () -- C:\Programme\CONFIG.INI
[2005.12.07 11:31:00 | 000,202,752 | R--- | C] () -- C:\windows\System32\CddbCdda.dll
[2005.04.27 18:40:26 | 000,006,800 | ---- | C] () -- C:\Programme\W95_HUA.vxd
[2004.02.27 16:36:18 | 000,015,498 | ---- | C] () -- C:\windows\snpstd3.ini
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.03.07 20:20:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\AccurateRip
[2009.09.05 17:27:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Adobe
[2009.09.06 10:16:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Ahead
[2009.12.13 14:03:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\AlcaTech
[2010.01.10 21:34:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\AntMe
[2010.12.13 15:47:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Apple Computer
[2010.04.15 19:31:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Avira
[2009.09.16 18:28:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\CD-LabelPrint
[2010.01.09 13:52:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\CheckPoint
[2009.11.29 12:06:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DAEMON Tools Lite
[2009.09.05 21:32:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DAEMON Tools Pro
[2010.04.18 12:49:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Dealio
[2010.05.23 22:40:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Desktopicon
[2010.07.07 12:03:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DivX
[2011.01.09 23:56:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DNA
[2010.07.16 11:54:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.08.31 19:31:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\FileZilla
[2010.04.18 12:49:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\FreeVideoConverter
[2010.07.31 19:51:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Google
[2010.10.10 01:00:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\gtk-2.0
[2010.01.06 14:51:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Help
[2010.12.18 12:26:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\ICQ
[2009.08.30 05:05:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Identities
[2009.08.30 05:08:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\InstallShield
[2010.02.21 06:26:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Macromedia
[2010.09.10 19:47:27 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft
[2009.09.05 17:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla
[2010.03.15 20:29:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\MrJobs
[2010.06.27 21:19:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\NCH Swift Sound
[2010.03.25 21:25:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Nokia
[2010.03.25 21:39:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Nokia Multimedia Player
[2009.09.29 13:26:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\OpenOffice.org
[2010.03.25 21:13:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PC Suite
[2010.12.18 16:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PhotoScape
[2010.04.18 12:49:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Search Settings
[2011.01.09 23:47:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Skype
[2011.01.09 16:01:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\skypePM
[2010.02.17 18:42:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Styler
[2009.09.29 12:57:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Sun
[2010.01.03 17:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\teamspeak2
[2010.02.08 17:00:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TeamViewer
[2009.10.02 21:02:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Teeworlds
[2010.05.31 14:59:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Toolbar4
[2010.06.20 18:10:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TS3Client
[2009.12.29 02:52:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TuneUp Software
[2010.12.29 02:45:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Tunngle
[2009.09.05 22:29:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Ubisoft
[2009.08.30 08:16:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\vlc
[2010.03.16 20:26:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Webocton - Scriptly
[2011.01.09 20:06:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Xfire
 
< %APPDATA%\*.exe /s >
[2009.04.09 12:47:36 | 000,089,088 | ---- | M] (AD ON Multimedia Advertising GmbH) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Desktopicon\eBayShortcuts.exe
[2009.08.29 23:15:14 | 001,961,720 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2010.02.22 22:19:40 | 001,923,880 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2010.03.15 20:27:50 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe
[2010.03.15 20:27:50 | 000,000,766 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe
[2010.02.17 18:45:03 | 000,015,086 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe
[2010.02.17 18:45:03 | 000,015,086 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_7b12541d.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 23:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\agp440.sys
[2008.04.13 23:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 23:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\atapi.sys
[2008.04.13 23:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 21:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004.08.03 21:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 06:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\eventlog.dll
[2008.04.14 06:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.03 23:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004.08.03 23:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\explorer.exe
[2010.04.09 10:58:19 | 000,004,608 | ---- | M] () MD5=562CC71724C20DC9AFF1C935492A26F0 -- C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Xenocode\ApplianceCaches\GameCamV2.exe_v7AC6EAFE\Native\STUBEXE\@WINDIR@\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 06:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\netlogon.dll
[2008.04.14 06:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.03 23:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: NVATA.SYS  >
[2006.10.18 15:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) MD5=EF9941593B2E9B436F64A87DDB570D1A -- C:\WINDOWS\system32\drivers\nvata.sys
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 06:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\scecli.dll
[2008.04.14 06:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.03 23:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004.08.03 23:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008.04.14 06:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\user32.dll
[2008.04.14 06:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\userinit.exe
[2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.03 23:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.03 23:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\winlogon.exe
[2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2001.08.18 11:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001.08.18 11:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2009.11.29 12:02:31 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2009.08.30 06:52:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009.08.30 06:52:06 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009.08.30 06:52:05 | 000,425,984 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.04.14 06:52:10 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
[2009.03.08 03:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009.03.08 03:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[2001.08.18 11:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\eventcls.dll
[2010.02.25 07:14:59 | 000,184,320 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll
[1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ]

< End of report >
         
--- --- ---





Und hier den Extras report:OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 09.01.2011 23:57:40 - Run 1
OTL by OldTimer - Version 3.2.20.1     Folder = C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Programme
Drive C: | 49,81 Gb Total Space | 1,28 Gb Free Space | 2,58% Space Free | Partition Type: NTFS
Drive E: | 99,23 Gb Total Space | 6,86 Gb Free Space | 6,91% Space Free | Partition Type: NTFS
 
Computer Name: NAME-1 | User Name: Name | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56764:TCP" = 56764:TCP:*:Enabled:Pando Media Booster
"56764:UDP" = 56764:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"56764:TCP" = 56764:TCP:*:Enabled:Pando Media Booster
"56764:UDP" = 56764:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"58759:TCP" = 58759:TCP:*:Enabled:Pando Media Booster
"58759:UDP" = 58759:UDP:*:Enabled:Pando Media Booster
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\GIGABYTE\@BIOS\gwflash.exe" = C:\Programme\GIGABYTE\@BIOS\gwflash.exe:*:Enabled:gwflash -- ()
"C:\Programme\GIGABYTE\@BIOS\update.exe" = C:\Programme\GIGABYTE\@BIOS\update.exe:*:Enabled:update -- ()
"C:\Programme\gwflash.exe" = C:\Programme\gwflash.exe:*:Enabled:gwflash -- ()
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\Xfire\Xfire.exe" = C:\Programme\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)
"C:\Programme\Valve\hl.exe" = C:\Programme\Valve\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Programme\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe" = C:\Programme\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:*:Enabled:Tom Clancy's H.A.W.X -- ()
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Dokumente und Einstellungen\Name\Eigene Dateien\Games\teeworlds-0.5.1-win32\teeworlds_srv.exe" = C:\Dokumente und Einstellungen\Name\Eigene Dateien\Games\teeworlds-0.5.1-win32\teeworlds_srv.exe:*:Enabled:teeworlds_srv -- ()
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"E:\prototypef.exe" = E:\prototypef.exe:*:Enabled:Prototype(TM) -- File not found
"C:\Programme\TmNationsForever\TmForever.exe" = C:\Programme\TmNationsForever\TmForever.exe:*:Enabled:TmForever -- ()
"E:\Age of Empires\Empires.exe" = E:\Age of Empires\Empires.exe:*:Enabled:Age of Empires -- (Microsoft Corporation)
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"E:\cod\Call of Duty - World at War\Call of Duty - World at War\CoDWaWmp.exe" = E:\cod\Call of Duty - World at War\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty(R): World at War Multiplayer -- (Activision Blizzard, Inc.)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Messenger\update\sweetimsetup.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Messenger\update\sweetimsetup.exe:*:Enabled:SweetIM Installer -- File not found
"E:\1234\Warcraft 3 & Frozen Throne\Warcraft III.exe" = E:\1234\Warcraft 3 & Frozen Throne\Warcraft III.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"E:\Empire Earth\Empire Earth.exe" = E:\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth -- ()
"C:\Programme\Tunngle\tnglctrl.exe" = C:\Programme\Tunngle\tnglctrl.exe:*:Enabled:Tunngle Service -- (Tunngle.net GmbH)
"C:\Programme\Tunngle\tunngle.exe" = C:\Programme\Tunngle\tunngle.exe:*:Enabled:Tunngle Client -- (Tunngle.net GmbH)
"E:\iTunes\iTunes.exe" = E:\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"E:\1234\Call of Duty 4 - Modern Warfare\iw3mp.exe" = E:\1234\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:iw3mp -- ()
"C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Apps\2.0\Z6NKCKRW.P12\9ZKH9C2D.JMP\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\CurseClient.exe" = C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Apps\2.0\Z6NKCKRW.P12\9ZKH9C2D.JMP\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\CurseClient.exe:*:Enabled:Curse Client 4.0 -- (Curse)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B128562-681D-4FFA-BEBF-A825985B2CB9}" = AirPlus G DWL-G510
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.4 - Deutsch
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F93D2591-8201-4692-BD8D-67A0BFAC9C14}" = SweetIM Toolbar for Internet Explorer 3.9
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"DivX Setup.divx.com" = DivX-Setup
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"FL Studio 8" = FL Studio 8
"Google Chrome" = Google Chrome
"IL Download Manager" = IL Download Manager
"MSNINST" = MSN
"Neffy" = Neffy 1,3,29,0
"PhotoScape" = PhotoScape
"PoiZone" = PoiZone
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Toxic Biohazard" = Toxic Biohazard
"Tunngle beta_is1" = Tunngle beta
"WavePad" = WavePad Sound Editor
"WinGimp-2.0_is1" = GIMP 2.6.10
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"BitTorrent DNA" = DNA
"CreepSmash.com" = CreepSmash.com
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 09.01.2011 13:30:35 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6000
 
Error - 09.01.2011 13:30:37 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 09.01.2011 13:30:37 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7953
 
Error - 09.01.2011 13:30:37 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7953
 
Error - 09.01.2011 14:17:38 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 09.01.2011 14:18:07 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 09.01.2011 14:18:36 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 09.01.2011 14:19:43 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 09.01.2011 14:53:18 | Computer Name = NAME-1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung ClearProg.exe, Version 1.6.0.1, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 09.01.2011 18:53:59 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
 
[ System Events ]
Error - 28.12.2010 23:08:26 | Computer Name = NAME-1 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 29.12.2010 08:46:46 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 29.12.2010 08:46:46 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 29.12.2010 08:46:46 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 29.12.2010 08:55:27 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 29.12.2010 08:55:27 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 29.12.2010 08:55:39 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 29.12.2010 08:55:39 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 31.12.2010 10:49:54 | Computer Name = NAME-1 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 31.12.2010 11:24:59 | Computer Name = NAME-1 | Source = Dhcp | ID = 1001
Description = Diesem Computer konnte keine Netzwerkadresse durch den DHCP-Server
 für die  Netzwerkkarte mit der Netzwerkadresse 00240113E872 zugeteilt werden. Der
 folgende Fehler  ist aufgetreten:   %%121.  Es wird weiterhin im Hintergrund versucht,
 eine Adresse vom  Netzwerkadressserver (DHCP) zugeteilt zu bekommen.
 
 
< End of report >
         
--- --- ---
__________________

Geändert von Xtremx3 (10.01.2011 um 00:09 Uhr)

Alt 10.01.2011, 14:02   #4
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



bitte füge in meinem script deinen benutzernamen ein, sonst klappts nicht :-)



• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
:Files
C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Temp\tknmgbxqg
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
öffne den internet explorer, extras, internet optionen, dort verbindung, lanverbindung.
lösche den eintrag bei proxy server. wähle dann, keinen proxy verwenden. übernehmen, ok.

öffne den arbeitsplatz, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 10.01.2011, 14:51   #5
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Oke, ich habs hochgeladen.

Ähm, ich verwende Mozilla Firefox nicht den Internet Explorer. Ich hab den zwar installiert aber da kommt immer eine Fehlermeldung mit Problem Senden & Problem nicht senden. Deswegen benutze ich den nie...

Aber hier das Textdokument:

All processes killed
========== OTL ==========
========== FILES ==========
C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Temp\tknmgbxqg folder moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: LocalService

User: Name
->Flash cache emptied: 17598137 bytes

User: NetworkService

Total Flash Files Cleaned = 17,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 116131 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 1064168 bytes
->Temporary Internet Files folder emptied: 580565 bytes

User: Name
->Temp folder emptied: 37828134 bytes
->Temporary Internet Files folder emptied: 2180557 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 111232126 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 2132184 bytes
->Temporary Internet Files folder emptied: 667424 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 151,00 mb


OTL by OldTimer - Version 3.2.20.1 log created on 01102011_144443

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Alt 10.01.2011, 15:20   #6
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



dann öffne mal den arbeitsplatz, systemsteuerung, internet optionen, lanverbindung und dann mit den proxy einstellungen so verfahren wie beschrieben bitte.
__________________
--> Windows Security Alert - wie bekomm ich den weg ?

Alt 10.01.2011, 15:36   #7
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Oke, hab ich gemacht.

Alt 10.01.2011, 15:39   #8
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



sehr gut.

download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 10.01.2011, 23:18   #9
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Oke, hab ich auch gemacht : )

Hier der Log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5495

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.01.2011 23:17:12
mbam-log-2011-01-10 (23-17-12).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 344766
Laufzeit: 6 Stunde(n), 43 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 2
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 16
Infizierte Registrierungswerte: 17
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 19
Infizierte Dateien: 333

Infizierte Speicherprozesse:
c:\programme\application updater\applicationupdater.exe (PUP.Dealio) -> 676 -> Unloaded process successfully.
c:\programme\search settings\searchsettings.exe (PUP.Dealio) -> 2104 -> Unloaded process successfully.

Infizierte Speichermodule:
c:\programme\search settings\searchsettingsres409.dll (PUP.Dealio) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SearchSettings.BHO.1 (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SearchSettings.BHO (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\qni8hj710fdl (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Dealio (PUP.Dealio) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Refog Software (Refog.Keylogger) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\APPLICATION UPDATER\APPLICATIONUPDATER.EXE (PUP.Dealio) -> Value: APPLICATIONUPDATER.EXE -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\SEARCHSETTINGS.EXE (PUP.Dealio) -> Value: SEARCHSETTINGS.EXE -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchSettings (PUP.Dealio) -> Value: SearchSettings -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\SEARCHSETTINGSRES409.DLL (PUP.Dealio) -> Value: SEARCHSETTINGSRES409.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Value: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\SEARCHSETTINGS.DLL (PUP.Dealio) -> Value: SEARCHSETTINGS.DLL -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Value: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\COMPONENTS\DEALIOTOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: DEALIOTOOLBARFF.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\FF\COMPONENTS\SEARCHSETTINGSFF.DLL (PUP.Dealio) -> Value: SEARCHSETTINGSFF.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\SEARCHSETTINGS@SPIGOT.COM (PUP.Dealio) -> Value: SEARCHSETTINGS@SPIGOT.COM -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\DEALIO@MYBROWSERBAR.COM (PUP.Dealio) -> Value: DEALIO@MYBROWSERBAR.COM -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\iymoxksp (Trojan.FakeAlert.Gen) -> Value: iymoxksp -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\CHROME.MANIFEST (PUP.Dealio) -> Value: CHROME.MANIFEST -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\INSTALL.RDF (PUP.Dealio) -> Value: INSTALL.RDF -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\CHROME\LOCALE\EN-US\WIDGITOOLBARPLUGIN.PROPERTIES (PUP.Dealio) -> Value: WIDGITOOLBARPLUGIN.PROPERTIES -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Refog.Keylogger) -> Bad: (c:\windows\system32\userinit.exe,C:\Programme\refogkl\MPK.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\2 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\CPDA (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\CPDM (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar (PUP.Dealio) -> Delete on reboot.
c:\programme\dealio toolbar\FF (PUP.Dealio) -> Delete on reboot.
c:\programme\dealio toolbar\FF\chrome (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\locale (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\locale\EN-US (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\components (PUP.Dealio) -> Delete on reboot.
c:\programme\dealio toolbar\IE (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\IE\4.0.2 (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res (PUP.Dealio) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio (PUP.Dealio) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\res (PUP.Dealio) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\temp (PUP.Dealio) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\programme\application updater\applicationupdater.exe (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\search settings\searchsettings.exe (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\search settings\searchsettingsres409.dll (PUP.Dealio) -> Delete on reboot.
c:\programme\dealio toolbar\IE\4.0.2\dealiotoolbarie.dll (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\search settings\searchsettings.dll (PUP.Dealio) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\anwendungsdaten\desktopicon\ebayshortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\Desktop\Virus \towerdefence.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\eigene dateien\dvdvideosoft\downloads\account hacker 1.3.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\widgihelper.exe (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\components\dealiotoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot.
c:\programme\search settings\FF\components\searchsettingsff.dll (PUP.Dealio) -> Delete on reboot.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240037.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240038.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240040.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240048.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240050.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240059.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240060.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240061.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\01102011_144443\c_dokumente und einstellungen\Name\lokale einstellungen\Temp\tknmgbxqg\cmfoeoklajb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programme\mozilla firefox\extensions\searchsettings@spigot.com (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\mozilla firefox\extensions\dealio@mybrowserbar.com (PUP.Dealio) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\winsvncs.txt (Malware.Trace) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\refog free keylogger.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40463_9251980208 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6054426273 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6064181019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6070328009 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6070391204 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6070420139 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654241782 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654579977 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654712037 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654853009 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6655015856 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6655176736 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656475232 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656605440 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656697685 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656724769 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656751968 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656779051 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656802546 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656907407 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40465_9599229514 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40467_7066974074 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40467_8949918518 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40467_8950327315 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6765342824 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817314005 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817565394 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817681134 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817876505 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_7600414120 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_7609740278 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_8128855556 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9681360301 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9682899306 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9683646181 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9683776389 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684071181 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684306250 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684432870 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684528704 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6117379167 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6254909838 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255000347 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255027431 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255058218 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255083449 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255108796 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255291435 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6546070139 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_9422799074 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_9423095602 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_9935020602 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_0831237269 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_0831324074 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_0831542940 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_6973600232 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_7399323611 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0538279398 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0669806134 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0670028472 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0670489699 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0670974306 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0995576505 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996128009 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996196759 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996307060 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996513310 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_1007014931 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_1008756481 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_1009494329 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_5742390046 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9028680093 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9028826620 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9029115972 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9029956944 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9030085301 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0244026620 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0347303588 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0347421065 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0347808102 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0926906019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0927405208 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1197081134 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1198209606 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1198858796 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199133681 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199274769 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199392361 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199511690 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199665394 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1200253125 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1200801042 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1201410532 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1201493750 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1325307407 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1325479167 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1325884259 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1326012732 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1326175463 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1326363542 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1327112269 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6564203472 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6564400579 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6564574190 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6565069792 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6624001736 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6624515278 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6625000000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6629501157 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6629613310 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6633751042 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6634324306 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6634532292 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6634982639 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6635261111 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6635722222 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6635970023 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636101968 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636364236 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636545139 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636722338 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636879630 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637058681 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637228704 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637561458 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637868866 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6638250463 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6658685880 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40477_7367616088 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40481_4763550694 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40482_6390116782 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40483_6119267130 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40487_6231315046 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40494_8202963542 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7524929398 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7578441435 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7580953356 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7581481481 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7582199421 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7582515856 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7582747338 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339049769 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339301157 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339621296 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339785880 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9340015509 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9340557986 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9341749769 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9342762500 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9343880208 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9343963310 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9344091782 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9344200231 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40510_6517321296 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7246994329 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7274600231 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7274954745 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7275159144 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7434935532 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931524884 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931633333 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931740046 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931980556 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_8050768519 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6219231019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6219471528 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6219896528 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6220046644 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6220294329 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6220838657 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6221097338 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6221337847 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6495609028 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6499963773 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6500802893 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6500981944 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6501123032 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6501524421 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6516048148 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6587290162 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6587516204 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6603797685 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_6521840625 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_7610479861 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8251090394 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8486045949 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8909031366 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910027778 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910190509 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910335185 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910461806 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_9936960995 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40518_6821659722 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40518_6822101042 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40523_7593153819 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40523_7594088773 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40523_7833531019 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40524_8432819676 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8515666551 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8527204398 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8528985764 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8532116204 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8533005903 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8533696759 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8537953819 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8552020023 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8552358218 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8556839468 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40531_0077803704 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40539_6500694444 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40539_6502685532 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40539_6503061690 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679835764 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679882755 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679900810 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679918981 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679958681 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679976852 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6685286458 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40543_0597965394 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40543_0599739583 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40549_8920549306 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40550_6630224537 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40550_6631221065 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7096175926 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7170985532 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7207157060 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7207511458 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\2\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\2\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\CPDM\cpfm.bin (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome.manifest (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\install.rdf (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\chevron.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\chevron.xul (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\login.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\login.xul (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\parser.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\rsstickerwidget.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\searchbox.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\searchbox.xul (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgichevron.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgicomm.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgihandling.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgilisteners.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgitoolbarplugin.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgitoolbarplugin.xul (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\content\widgiui.js (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\locale\EN-US\searchbox.dtd (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\locale\EN-US\yahoo-search.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\apple.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\barnes.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\bestbuy.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\dealio_logo.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\dealio_logo_hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\icon_settings.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\macys.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\newegg.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\overstock.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search-button-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search-button.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search-chevron-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search-chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\searchbox.css (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search_amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search_dealio.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search_ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\search_yahoo.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\separator.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\target.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\walmart.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\chrome\skin\widgitoolbarplugin.css (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\components\config.ini (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\components\ifbhohelperwidgitoolbar.xpt (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\FF\components\ifbhowidgitoolbar.xpt (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\IE\4.0.2\config.ini (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\apple.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\barnes.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\bestbuy.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\dealio_logo.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\dealio_logo_hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\icon_settings.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\macys.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\newegg.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\overstock.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search-button-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search-button.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search-chevron-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search-chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search_amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search_dealio.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search_ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\search_yahoo.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\target.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\walmart.gif (PUP.Dealio) -> Quarantined and deleted successfully.
c:\programme\dealio toolbar\Res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml (PUP.Dealio) -> Quarantined and deleted successfully.

Alt 11.01.2011, 14:48   #10
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 11.01.2011, 16:31   #11
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Oke. Hier ist es:

Combofix Logfile:
Code:
ATTFilter
ComboFix 11-01-10.07 - Name 11.01.2011  15:33:53.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2047.1203 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Name\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
 * Neuer Wiederherstellungspunkt wurde erstellt

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\Name\Anwendungsdaten\Desktopicon
c:\dokumente und einstellungen\Name\Anwendungsdaten\Desktopicon\config.ini
c:\programme\Search Settings
c:\programme\Search Settings\FF\chrome.manifest
c:\programme\Search Settings\FF\chrome\content\plugin.js
c:\programme\Search Settings\FF\chrome\content\plugin.xul
c:\programme\Search Settings\FF\chrome\content\protection.js
c:\programme\Search Settings\FF\chrome\content\utils.js
c:\programme\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
c:\programme\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
c:\programme\Search Settings\FF\components\IFBHOSearch.xpt
c:\programme\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
c:\programme\Search Settings\FF\components\IFHelperPreferences.xpt
c:\programme\Search Settings\FF\install.rdf
c:\programme\update.exe
E:\autorun.inf
E:\install.exe

.
(((((((((((((((((((((((   Dateien erstellt von 2010-12-11 bis 2011-01-11  ))))))))))))))))))))))))))))))
.

2011-01-11 14:25 . 2011-01-11 14:25	--------	d-----w-	c:\dokumente und einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Babylon
2011-01-11 14:25 . 2010-10-17 14:12	142336	----a-w-	c:\programme\Mozilla Firefox\BabyFox.dll
2011-01-11 14:25 . 2011-01-11 14:25	--------	d-----w-	c:\programme\Babylon
2011-01-11 14:25 . 2011-01-11 14:35	--------	d-----w-	c:\dokumente und einstellungen\Name\Anwendungsdaten\Babylon
2011-01-11 14:25 . 2011-01-11 14:34	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Babylon
2011-01-10 15:21 . 2011-01-10 15:21	--------	d-----w-	c:\dokumente und einstellungen\Name\Anwendungsdaten\Malwarebytes
2011-01-10 15:21 . 2010-12-20 17:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-10 15:20 . 2011-01-10 15:20	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-01-10 15:20 . 2011-01-10 15:21	--------	d-----w-	c:\programme\Malwarebytes' Anti-Malware
2011-01-10 15:20 . 2010-12-20 17:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-01-10 13:44 . 2011-01-10 13:49	--------	d-----w-	C:\_OTL
2010-12-18 20:35 . 2010-12-18 20:35	--------	d-----w-	c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\softonic-de3
2010-12-18 20:35 . 2010-12-18 20:35	--------	d-sh--w-	c:\dokumente und einstellungen\NetworkService\IETldCache
2010-12-18 20:35 . 2010-12-18 20:35	--------	d-----w-	c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\techno4ever
2010-12-18 20:35 . 2010-12-18 20:35	--------	d-----w-	c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\DVDVideoSoftTB
2010-12-18 20:35 . 2010-12-18 20:35	--------	d-----w-	c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Apple
2010-12-18 15:48 . 2010-12-18 15:48	--------	d-----w-	c:\dokumente und einstellungen\Name\Anwendungsdaten\PhotoScape
2010-12-18 15:48 . 2010-12-18 15:48	--------	d-----w-	c:\programme\PhotoScape
2010-12-13 14:45 . 2010-12-13 14:47	--------	d-----w-	c:\dokumente und einstellungen\Name\Anwendungsdaten\Apple Computer
2010-12-13 14:45 . 2009-05-18 12:17	26600	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2010-12-13 14:45 . 2008-04-17 11:12	107368	----a-w-	c:\windows\system32\GEARAspi.dll
2010-12-13 14:45 . 2010-12-13 14:45	--------	d-----w-	c:\programme\iPod
2010-12-13 14:45 . 2010-12-13 14:45	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-12-13 14:43 . 2010-12-13 14:43	--------	d-----w-	c:\programme\Bonjour
2010-12-13 14:43 . 2010-12-13 14:45	--------	d-----w-	c:\programme\Gemeinsame Dateien\Apple
2010-12-13 14:43 . 2010-12-13 14:43	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 15:21 . 2010-01-21 19:13	135096	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-11-28 15:18 . 2009-09-12 14:46	138464	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2010-11-28 15:17 . 2009-09-12 14:45	111928	----a-w-	c:\windows\system32\PnkBstrB.exe
2010-11-23 16:25 . 2009-08-29 22:15	61960	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2008-02-14 12:23 . 2008-02-14 12:23	231944	----a-w-	c:\programme\gwflash.exe
2007-09-21 17:42 . 2007-09-21 17:42	19008	----a-w-	c:\programme\markfun.a64
2007-08-21 17:49 . 2007-08-21 17:49	125504	----a-w-	c:\programme\MarkFunDrv.dll
2007-08-21 17:49 . 2007-08-21 17:49	17912	----a-w-	c:\programme\markfun.w32
2007-03-02 02:48 . 2007-03-02 02:48	240448	----a-w-	c:\programme\gwf32.exe
2006-11-23 21:47 . 2006-11-23 21:47	207680	----a-w-	c:\programme\BIOS_Run.exe
2006-11-23 21:40 . 2006-11-23 21:40	60224	----a-w-	c:\programme\HUADRV.DLL
2005-04-27 17:40 . 2005-04-27 17:40	6800	----a-w-	c:\programme\W95_HUA.vxd
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2010-06-13 138552]
"{33b974a8-e892-4f5f-bd17-f7b0331843d5}"= "c:\programme\techno4ever\tbtec1.dll" [2010-06-24 2515552]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\programme\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_CLASSES_ROOT\clsid\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]
2010-06-24 13:34	2515552	----a-w-	c:\programme\techno4ever\tbtec1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 09:08	2393184	----a-w-	c:\programme\DVDVideoSoftTB\tbDVDV.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-06-03 17:24	2736736	----a-w-	c:\programme\softonic-de3\tbsoft.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2010-06-13 16:25	1438520	----a-r-	c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-06-13 1438520]
"{33b974a8-e892-4f5f-bd17-f7b0331843d5}"= "c:\programme\techno4ever\tbtec1.dll" [2010-06-24 2515552]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\programme\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CLASSES_ROOT\clsid\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-06-13 1438520]
"{33B974A8-E892-4F5F-BD17-F7B0331843D5}"= "c:\programme\techno4ever\tbtec1.dll" [2010-06-24 2515552]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\programme\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CLASSES_ROOT\clsid\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"BitTorrent DNA"="c:\programme\DNA\btdna.exe" [2010-01-19 323392]
"Pando Media Booster"="c:\programme\Pando Networks\Media Booster\PMB.exe" [2010-08-25 2937528]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2010-12-03 14944136]
"msnmsgr"="c:\programme\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]
"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-09-29 148888]
"Realtime Audio Engine"="mmrtkrnl.exe" [2009-11-23 70144]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]
"PCSuiteTrayApplication"="c:\programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 222208]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"ANIWZCS2Service"="c:\programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="e:\itunes\iTunesHelper.exe" [2010-11-17 421160]
"DeathAdder"="c:\programme\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"BabylonToolbar"="c:\programme\BabylonToolbar\BabylonToolbar\1.4.19.5\BabylonToolbarsrv.exe" [2010-11-07 286720]
"Babylon Client"="c:\programme\Babylon\Babylon-Pro\Babylon.exe" [2010-10-17 3825080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"PcSync"="c:\programme\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

c:\dokumente und einstellungen\Name\Startmen\Programme\Autostart\
CurseClientStartup.ccip [2010-11-14 0]
Xfire.lnk - c:\programme\Xfire\Xfire.exe [2010-7-9 3493776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G DWL-G510]
2007-10-24 13:30	1552384	----a-w-	c:\programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50	1144104	----a-w-	c:\programme\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44	3883840	----a-w-	c:\programme\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\GIGABYTE\\@BIOS\\gwflash.exe"=
"c:\\Programme\\GIGABYTE\\@BIOS\\update.exe"=
"c:\\Programme\\gwflash.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Xfire\\Xfire.exe"=
"c:\\Programme\\Valve\\hl.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Dokumente und Einstellungen\\Name\\Eigene Dateien\\Games\\teeworlds-0.5.1-win32\\teeworlds_srv.exe"=
"c:\\Programme\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Programme\\TmNationsForever\\TmForever.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\Age of Empires\\Empires.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"e:\\cod\\Call of Duty - World at War\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Programme\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"e:\\1234\\Warcraft 3 & Frozen Throne\\Warcraft III.exe"=
"e:\\Empire Earth\\Empire Earth.exe"=
"c:\\Programme\\Tunngle\\tnglctrl.exe"=
"c:\\Programme\\Tunngle\\tunngle.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"e:\\iTunes\\iTunes.exe"=
"e:\\1234\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Dokumente und Einstellungen\\Name\\Lokale Einstellungen\\Apps\\2.0\\Z6NKCKRW.P12\\9ZKH9C2D.JMP\\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\\CurseClient.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56764:TCP"= 56764:TCP:Pando Media Booster
"56764:UDP"= 56764:UDP:Pando Media Booster
"58759:TCP"= 58759:TCP:Pando Media Booster
"58759:UDP"= 58759:UDP:Pando Media Booster

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [21.01.2010 20:13 135336]
R2 TunngleService;TunngleService;c:\programme\Tunngle\TnglCtrl.exe [12.09.2009 20:02 716024]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [09.09.2009 15:50 22784]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [12.09.2009 20:02 27136]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [08.02.2010 16:52 135664]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [05.02.2010 19:27 4352]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [05.02.2010 19:26 265088]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [08.09.2004 09:10 17018]
S4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\programme\Microsoft SQL Server\100\Shared\sqladhlp.exe [11.07.2008 01:27 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [10.07.2008 02:49 242712]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [05.09.2009 21:26 691696]
S4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11.07.2008 01:27 369688]
.
Inhalt des "geplante Tasks" Ordners

2011-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]

2011-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-08 15:52]

2011-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-08 15:52]

2010-07-02 c:\windows\Tasks\wavepadShakeIcon.job
- c:\programme\NCH Swift Sound\WavePad\wavepad.exe [2010-06-27 20:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.babylon.com/home?AF=16511
mStart Page = hxxp://home.sweetim.com
uInternet Settings,ProxyOverride = <local>
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Save YouTube Video as MP3 - c:\programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Translate this web page with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} - hxxp://www.fiaa.eu/OPLauncher.cab
FF - ProfilePath - c:\dokumente und einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://home.sweetim.com
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: techno4ever Toolbar: {33b974a8-e892-4f5f-bd17-f7b0331843d5} - %profile%\extensions\{33b974a8-e892-4f5f-bd17-f7b0331843d5}
FF - Ext: Html Validator: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} - %profile%\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
FF - Ext: iMacros for Firefox: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} - %profile%\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: softonic-de3 Toolbar: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - %profile%\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
FF - Ext: Elf 1 Community Toolbar: {22e03916-85c5-44b0-8dc9-1830c11238d9} - %profile%\extensions\{22e03916-85c5-44b0-8dc9-1830c11238d9}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-01-11 15:37
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Zeit der Fertigstellung: 2011-01-11  15:39:22
ComboFix-quarantined-files.txt  2011-01-11 14:39

Vor Suchlauf: 1.211.969.536 Bytes frei
Nach Suchlauf: 1.245.741.056 Bytes frei

- - End Of File - - AEF5B1D1BB97A9F034466DD49FA7148E
         
--- --- ---

Alt 11.01.2011, 17:35   #12
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



lade den CCleaner slim:
Piriform - Builds
falls der CCleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 11.01.2011, 21:50   #13
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Hier die Liste:

Adobe Flash Player 10 Plugin Adobe Systems Incorporated 10.1.102.64 ->Notwendig
Adobe Reader 8.2.4 - Deutsch Adobe Systems Incorporated 8.2.4 ->Notwendig
AirPlus G DWL-G510 D-Link ->Unbekannt
ANIO Service ->Unbekannt
ANIWZCS2 Service ->Unbekannt
Apple Application Support Apple Inc. 1.4.1 ->Unnötig
Apple Mobile Device Support Apple Inc. 3.3.0.69 ->Unnötig
Apple Software Update Apple Inc. 2.1.2.120 ->Unnötig
Babylon Babylon -> Unnötig
Babylon toolbar -> Unnötig
Bonjour Apple Inc. 2.0.4.0 -> Unnötig
Canon PhotoRecord -> Notwendig
Cheat Engine 5.6.1 Dark Byte -> Unnötig
CreepSmash.com 2010 CreepSmash.com GNU General Public License Version 3 -> Notwendig
Curse Client Curse 4.0.1.104 -> Notwendig
Dealio Toolbar v4.0.2 ->Unnötig
DivX-Setup DivX, Inc. 1.0.2.22 ->Unnötig
DNA BitTorrent Inc. 2.2.4 (16502) ->Unbekannt
DVDVideoSoftTB Toolbar ->Unnötig
FL Studio 8 Image-Line bvba ->Unnötig
GIMP 2.6.10 The GIMP Team 2.6.10 ->Notwendig
Google Chrome Google Inc. 8.0.552.224 ->Notwendig
Google Earth Google 5.2.1.1588 ->Notwendig
IL Download Manager Image-Line bvba ->Unnötig
iTunes Apple Inc. 10.1.0.56 ->Notwendig
Java(TM) 6 Update 13 ->Notwendig
Malwarebytes' Anti-Malware Malwarebytes Corporation ->Notwendig
Microsoft .NET Framework 2.0 Service Pack 2 ------
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU |
Microsoft .NET Framework 3.0 Service Pack 2 |
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU |
Microsoft .NET Framework 3.5 Language Pack SP1 - deu |
Microsoft .NET Framework 3.5 SP1 |
Microsoft Application Error Reporting |
Microsoft Choice Guard |
Microsoft Office XP Professional mit FrontPage |
Microsoft Silverlight Microsoft Corporation 3.0.50106.0 |------ Unbekannt(, aber ich denke mal das die Notwendig sind)
Microsoft SQL Server 2008 Common Files |
Microsoft SQL Server 2008 Database Engine Services |
Microsoft SQL Server 2008 Database Engine Shared |
Microsoft SQL Server 2008 Management Objects |
Microsoft SQL Server 2008 Native Client |
Microsoft SQL Server 2008 RsFx Driver |
Microsoft SQL Server 2008 Setup Support Files (English) |
Microsoft SQL Server 2008-Browser |
Microsoft SQL Server Compact 3.5 SP1 (Deutsch) |
Microsoft SQL Server Compact 3.5 SP1 Design Tools (Deutsch) |
Microsoft SQL Server VSS Writer ------
Microsoft Visual C# 2008 Express Edition with SP1 - DEU ->Unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 ->Unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 ->Unnötig
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - deu ->Unnötig
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32 -> Unnötig
MSN ->Unnötig
MSVCRT ->Unbekannt
MSXML 4.0 SP2 (KB954430) ->Unbekannt
MSXML 4.0 SP2 (KB973688) ->Unbekannt
MSXML 6.0 Parser (KB933579) ->Unbekannt
Neffy 1,3,29,0 CDNetworks 1,3,29,0 -> Unbekannt
Nero 7 Essentials ->Notwendig
neroxml ->Unbekannt
Nokia Connectivity Cable Driver ->Unnötig
Nokia PC Suite -> Unnötig
NVIDIA PhysX ->Unbekannt
OpenOffice.org 3.1 ->Notwendig
Pando Media Booster Pando Networks Inc. 2.3.3.6 ->Unbekannt
PC Connectivity Solution ->Unbekannt
Phase 5 HTML-Editor ->Notwendig
PhotoScape ->Notwendig
PoiZone Image-Line bvba ->Unbekannt
Prototype(TM) ->Notwendig
QuickTime Apple Inc. 7.68.75.0 -> Unbekannt
Search Settings v1.2.3 ->Unbekannt
Segoe UI ->Unbekannt
Skype Toolbars Skype Technologies S.A. 5.0.4137 ->Unnötig
Skype™ 5.0 Skype Technologies S.A. 5.0.156 ->Notwendig
softonic-de3 Toolbar softonic-de3 5.7.1.1 ->Unnötig
Sql Server Customer Experience Improvement Program ->Unbekannt
SQL Server System CLR Types ->Unbekannt
Styler ->Unnötig
SweetIM Toolbar for Internet Explorer 3.9 SweetIM Technologies Ltd. 3.9.0009 ->Unnötig
TeamSpeak 3 Client TeamSpeak Systems GmbH ->Notwendig
Toxic Biohazard Image-Line bvba ->Unbekannt
Tunngle beta Tunngle.net GmbH ->Notwendig
WavePad Sound Editor NCH Software ->Notwendig
WebFldrs XP ->Unbekannt
Windows Live Anmelde-Assistent ->Unnötig
Windows Live Call ->Unnötig
Windows Live Communications Platform ->Unnötig
Windows Live Essentials ->Unnötig
Windows Live Messenger ->Unnötig
Windows Live-Uploadtool ->Unnötig
Windows Media Player Firefox Plugin ->Notwendig

Alt 12.01.2011, 14:22   #14
markusg
/// Malware-holic
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Adobe Reader 8
ersetzen:
Adobe - Adobe Reader herunterladen - Alle Versionen

bitte den mcafee security scan nicht mit instalieren.
öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus.
so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden.
unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken.
unter update, auf instalieren stellen.
klicke übernehmen /ok

deinstaliere:
Babylon beide
Bonjour
Cheat Engine
Dealio Toolbar
DivX
DNA
DVDVideoSoftTB Toolbar ->
FL Studio
IL Download Manager
Microsoft Silverlight
Microsoft SQL Server falls nich verwendet, alle weg.
Microsoft Windows SDK for Visual Studio
Microsoft Windows SDK for Visual Studio 2008 SP1
MSN
Nokia beide
PC Connectivity Solution
Search Settings
Skype Toolbars
softonic
Sql Server beide
Styler
SweetIM Toolbar
windows live, alle
bereinige dann dateien + registry mit dem ccleaner
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 12.01.2011, 16:19   #15
Xtremx3
 
Windows Security Alert - wie bekomm ich den weg ? - Standard

Windows Security Alert - wie bekomm ich den weg ?



Hab ich gemacht : )

Antwort

Themen zu Windows Security Alert - wie bekomm ich den weg ?
ahnung, alert, antivurs, aufeinmal, canon, hkus\s-1-5-18, leute, msiexec, pando media booster, plug-in, scan, security, security alert, spigot, troja, trojaner, windows, windows security, windows security alert



Ähnliche Themen: Windows Security Alert - wie bekomm ich den weg ?


  1. Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 10.03.2012 (9)
  2. AntiVirus Software Alert / Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 15.01.2011 (19)
  3. Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 08.01.2011 (1)
  4. Meldung Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 17.09.2010 (26)
  5. Windows Security Alert / AV Security Suite / Antivirus Software Alert / gefakter AV lähmt PC
    Plagegeister aller Art und deren Bekämpfung - 09.09.2010 (3)
  6. Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (11)
  7. Windows security alert!
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (4)
  8. Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 26.08.2010 (1)
  9. selbe problem mit Windows Security Alert - Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 15.08.2010 (3)
  10. Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 26.07.2010 (21)
  11. Windows Security Alert / AV Security Suite / Antivirus Software Alert// Ohne Internet
    Plagegeister aller Art und deren Bekämpfung - 21.07.2010 (1)
  12. Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 28.05.2010 (7)
  13. system alert, windows security alert und fremde antiviren programme
    Plagegeister aller Art und deren Bekämpfung - 01.01.2010 (51)
  14. Windows Security Alert
    Log-Analyse und Auswertung - 07.10.2008 (10)
  15. Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 14.09.2008 (3)
  16. Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 29.12.2007 (1)
  17. Windows security alert??
    Plagegeister aller Art und deren Bekämpfung - 14.10.2007 (13)

Zum Thema Windows Security Alert - wie bekomm ich den weg ? - Moin Leute, ich hatte aufeinmal den "Windows Security Alert" auf meinem PC - keine Ahnung wie. Ich habe schon herausgefunden das dies wohl ein Trojaner ist der sich als "Antivurs - Windows Security Alert - wie bekomm ich den weg ?...
Archiv
Du betrachtest: Windows Security Alert - wie bekomm ich den weg ? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.