Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: TR/kazy.mekml.1

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 19.04.2011, 16:58   #1
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



Hallo zusammen,

auch ich habe mir gestern den Trojaner TR/kazy.mekml.1 eingefangen. Habe dann auf Rat eines Bekannten Malwarebytes' Antmalware runtergeladen und erstmal einen Quick-Scan gemacht. Immerhin kann ich jetzt den Taskmanager wieder öffnen und ich habs auch schon hinbekommen, dass ich meine Dateien wieder sehe, allerdings sind sie alle halb transparent...
Habe mir schon andere Threads zu diesem Trojaner angeschaut und mir OTL runtegeladen und poste gleich die Logs... Und auch die Info von dem Quickscan. Ich bin allerdings nicht wirklich ein PC-Held und hoffe, dass ich mich hier nicht zu doof anstelle...
Ich bin wirklich für jede Hilfe dankbar!

Liebe Grüße,

Nina

Malware-Info:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6392

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

19.04.2011 05:49:53
mbam-log-2011-04-19 (05-49-53).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 167160
Laufzeit: 38 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 5
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
c:\documents and settings\all users\datos de programa\hvmejswqptwc.exe (Trojan.Agent) -> 2504 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hvmeJSwqpTWC (Trojan.Agent) -> Value: hvmeJSwqpTWC -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\documents and settings\all users\datos de programa\hvmejswqptwc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\martina reich\configuración local\Temp\jar_cache5018406662731739562.tmp (Trojan.Agent) -> Quarantined and deleted successfully.


Habe noch einen vollständigen Scan gemacht, das Ergebnis hier:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6392

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

19.04.2011 17:36:13
mbam-log-2011-04-19 (17-36-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 247669
Laufzeit: 2 Stunde(n), 47 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\system volume information\_restore{38c6ce1c-529c-4421-972f-4f24481c2f53}\RP1891\A0284361.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Noch eine Frage, ist es normal, dass OTL so lange braucht um die Log Files zu erstellen? Läuft bei mir jetzt schon über 40 Minuten...

Geändert von nina173 (19.04.2011 um 17:38 Uhr)

Alt 19.04.2011, 17:46   #2
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 19.04.2011 17:00:14 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Documents and Settings\Martina Reich\Mis documentos\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Alemania | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 152,00 Mb Available Physical Memory | 30,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 52,83 Gb Total Space | 4,05 Gb Free Space | 7,67% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: NINA | User Name: Martina Reich | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\Martina Reich\Mis documentos\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Archivos de programa\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Archivos de programa\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Archivos de programa\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Archivos de programa\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Archivos de programa\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Archivos de programa\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Archivos de programa\Archivos comunes\GtFlashSwitch\GtFlashSwitch.exe (OptionNV)
PRC - C:\WINDOWS\vsnpstd3.exe ()
PRC - C:\WINDOWS\tsnpstd3.exe ()
PRC - C:\Archivos de programa\Archivos comunes\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
PRC - C:\Archivos de programa\VeriSign\NAVI\naviclient.exe (VeriSign, Inc.)
PRC - C:\Archivos de programa\VeriSign\NAVI\naviagent.exe (VeriSign, Inc.)
PRC - C:\Archivos de programa\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
PRC - C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\WINDOWS\system32\TpKmpSvc.exe ()
PRC - C:\Archivos de programa\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe ()
PRC - C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\MDM.EXE (Microsoft Corporation)
PRC - C:\Archivos de programa\ThinkPad\ConnectUtilities\QCWLICON.EXE ()
PRC - C:\WINDOWS\system32\QCONSVC.EXE ()
PRC - C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
PRC - C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)
PRC - C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
PRC - C:\Archivos de programa\ThinkPad\Utilities\TP98TRAY.EXE (IBM Corp.)
PRC - C:\Archivos de programa\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe (IBM Corporation)
PRC - C:\WINDOWS\system32\rmctrl.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Documents and Settings\Martina Reich\Mis documentos\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (PLSRemoteSvc) --  File not found
SRV - (AntiVirService) -- C:\Archivos de programa\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Archivos de programa\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (GtFlashSwitch) -- C:\Archivos de programa\Archivos comunes\GtFlashSwitch\GtFlashSwitch.exe (OptionNV)
SRV - (LightScribeService) -- C:\Archivos de programa\Archivos comunes\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (Adobe LM Service) -- C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (navi) -- C:\Archivos de programa\VeriSign\NAVI\naviagent.exe (VeriSign, Inc.)
SRV - (ose) -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (TpKmpSVC) -- C:\WINDOWS\system32\TpKmpSvc.exe ()
SRV - (MDM) -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
SRV - (QCONSVC) -- C:\WINDOWS\system32\QCONSVC.EXE ()
SRV - (S24EventMonitor) -- C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) -- C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (FlashUSB) -- C:\WINDOWS\system32\drivers\FlashUsb.sys (Danish Wireless Design A/S)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Archivos de programa\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\WINDOWS\system32\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (GTMNDISIRPXP) -- C:\WINDOWS\system32\drivers\Gtm51Irp.sys (Option NV)
DRV - (GTUQBUS) -- C:\WINDOWS\system32\drivers\gtuqbus.sys (Option N.V.)
DRV - (GTPTSER) -- C:\WINDOWS\system32\drivers\gtptser.sys (Option N.V.)
DRV - (ACEDRV06) -- C:\WINDOWS\system32\drivers\ACEDRV06.sys (Protect Software GmbH)
DRV - (SSHDRV84) -- C:\WINDOWS\system32\drivers\SSHDRV84.sys ()
DRV - (SQTECH905C) -- C:\WINDOWS\system32\drivers\Capt905c.sys (Service & Quality Technology.)
DRV - (WPN111) -- C:\WINDOWS\system32\drivers\WPN111.sys (NETGEAR, Inc.)
DRV - (PID_0928) Labtec WebCam(PID_0928) -- C:\WINDOWS\system32\drivers\LV561AV.SYS (Labtec Inc.)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.)
DRV - (ltmodem5) -- C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (LMouKE) -- C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LHidPPKE) -- C:\WINDOWS\system32\drivers\LHidPPKE.Sys (Logitech, Inc.)
DRV - (LHidKe) -- C:\WINDOWS\system32\drivers\LHidKE.Sys (Logitech, Inc.)
DRV - (PalmUSBD) -- C:\WINDOWS\system32\drivers\PalmUSBD.sys (Palm, Inc.)
DRV - (DNINDIS5) -- C:\WINDOWS\system32\DNINDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (IBMTPCHK) -- C:\WINDOWS\system32\drivers\IBMBLDID.SYS ()
DRV - (w70n51) Controlador Intel(R) -- C:\WINDOWS\system32\drivers\w70n51.sys (Intel® Corporation)
DRV - (WLAN) -- C:\WINDOWS\system32\drivers\WLANNDS.sys (Red Inalámbrica Local)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (LMouFlt2) -- C:\WINDOWS\system32\drivers\lmouflt2.sys (Logitech, Inc.)
DRV - (LHidFlt2) -- C:\WINDOWS\system32\drivers\LHIDFLT2.SYS (Logitech, Inc.)
DRV - (Smapint) -- C:\WINDOWS\system32\drivers\SMAPINT.SYS (Microsoft Corporation)
DRV - (TPPWR) -- C:\WINDOWS\system32\drivers\TPPWR.SYS (IBM Corp.)
DRV - (TDSMAPI) -- C:\WINDOWS\system32\drivers\TDSMAPI.SYS ()
DRV - (TSMAPIP) -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS ()
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (MMRTKRNL) -- C:\WINDOWS\system32\drivers\mmrtkrnl.sys (ALCATech GmbH)
DRV - (S3SSavage) -- C:\WINDOWS\system32\drivers\s3ssavm.sys (S3 Graphics, Inc.)
DRV - (QV2KUX) -- C:\WINDOWS\system32\drivers\qv2kux.sys (Microsoft Corporation)
DRV - (TwoTrack) -- C:\WINDOWS\system32\drivers\TwoTrack.sys (IBM Corporation)
DRV - (MarxDev3) -- C:\WINDOWS\System32\drivers\MARXDEV3.SYS ()
DRV - (MarxDev2) -- C:\WINDOWS\System32\drivers\MARXDEV2.SYS ()
DRV - (MarxDev1) -- C:\WINDOWS\System32\drivers\MARXDEV1.SYS ()
DRV - (Aspi32) -- C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKLM\..\URLSearchHook: {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Archivos de programa\VeriSign\i-Nav\i-nav_4_2_1.dll (VeriSign, Inc.)
 
 
IE - HKU\.DEFAULT\..\URLSearchHook: {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Archivos de programa\VeriSign\i-Nav\i-nav_4_2_1.dll (VeriSign, Inc.)
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\URLSearchHook: {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Archivos de programa\VeriSign\i-Nav\i-nav_4_2_1.dll (VeriSign, Inc.)
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sh-spion.de/
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Archivos de programa\ICQToolbar\toolbaru.dll (IE Toolbar)
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\URLSearchHook: {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Archivos de programa\VeriSign\i-Nav\i-nav_4_2_1.dll (VeriSign, Inc.)
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Archivos de programa\Mozilla Firefox\components [2011.04.02 10:36:51 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Archivos de programa\Mozilla Firefox\plugins [2011.03.27 08:32:54 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Components: C:\Archivos de programa\Mozilla Thunderbird\components [2011.03.26 16:56:44 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Plugins: C:\Archivos de programa\Mozilla Thunderbird\plugins
 
[2010.04.30 17:24:43 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Extensions
[2010.04.30 17:24:43 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.03.13 12:02:19 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions
[2010.03.13 12:02:17 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.03.13 12:02:13 | 000,000,000 | -H-D | M] (PinkHope) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{333b42b0-9c75-11db-b606-0800200c9a66}
[2010.03.13 12:02:13 | 000,000,000 | -H-D | M] (Aquatint Black Gloss) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2010.03.13 12:02:11 | 000,000,000 | -H-D | M] (IE Tab) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2010.03.13 12:02:07 | 000,000,000 | -H-D | M] (FoxClocks) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2010.03.13 12:02:07 | 000,000,000 | -H-D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010.03.13 12:02:07 | 000,000,000 | -H-D | M] (Pink Fox) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2010.03.13 12:02:19 | 000,000,000 | -H-D | M] (Flashbug) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\flashbug@coursevector.com
[2010.03.13 12:02:17 | 000,000,000 | -H-D | M] (NewTabURL) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\newtaburl@sogame.cat
[2010.03.13 12:02:13 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{333b42b0-9c75-11db-b606-0800200c9a66}\chrome\mozapps\extensions
[2010.03.13 12:02:13 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{333b42b0-9c75-11db-b606-0800200c9a66}\chrome\mozapps\extensions\CVS
[2011.04.18 19:32:38 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\nk4rinlt.Nino\extensions
[2010.07.10 23:32:42 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\nk4rinlt.Nino\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.09 11:39:28 | 000,000,000 | -H-D | M] (Adblock Plus) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\nk4rinlt.Nino\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.03.24 20:25:03 | 000,000,000 | -H-D | M] (FoxClocks) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\nk4rinlt.Nino\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2010.03.13 12:16:14 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\ugbbe8lq.Nina1\extensions
[2010.03.13 12:16:14 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\ugbbe8lq.Nina1\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.18 19:32:38 | 000,000,000 | -H-D | M] (No name found) -- C:\Archivos de programa\Mozilla Firefox\extensions
[2010.03.08 12:24:04 | 000,103,168 | -H-- | M] (Midasplayer Ltd) -- C:\Archivos de programa\Mozilla Firefox\plugins\npmidas.dll
[2011.03.27 08:32:37 | 000,001,392 | -H-- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.27 08:32:37 | 000,002,344 | -H-- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.27 08:32:38 | 000,006,805 | -H-- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.27 08:32:38 | 000,001,178 | -H-- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.27 08:32:38 | 000,001,105 | -H-- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2002.09.10 05:00:00 | 000,000,792 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Archivos de programa\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Archivos de programa\ICQToolbar\toolbaru.dll (IE Toolbar)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (i-Nav IDN Resolver) - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Archivos de programa\VeriSign\i-Nav\i-nav_4_2_1.dll (VeriSign, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (ICQ Toolbar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Archivos de programa\ICQToolbar\toolbaru.dll (IE Toolbar)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Archivos de programa\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found.
O3 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\Toolbar\ShellBrowser: (ICQ Toolbar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Archivos de programa\ICQToolbar\toolbaru.dll (IE Toolbar)
O3 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..\Toolbar\WebBrowser: (ICQ Toolbar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Archivos de programa\ICQToolbar\toolbaru.dll (IE Toolbar)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Archivos de programa\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [BMMGAG] C:\Archivos de programa\ThinkPad\Utilities\PWRMONIT.DLL (IBM Corp.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Archivos de programa\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Archivos de programa\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
O4 - HKLM..\Run: [QCWLICON] C:\Archivos de programa\ThinkPad\ConnectUtilities\QCWLICON.EXE ()
O4 - HKLM..\Run: [Realtime Audio Engine]  File not found
O4 - HKLM..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe ()
O4 - HKLM..\Run: [S3TRAY2] C:\WINDOWS\System32\S3Tray2.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe ()
O4 - HKLM..\Run: [Start RF Wireless Mouse]  File not found
O4 - HKLM..\Run: [SynTPLpr] C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [tgcmd]  File not found
O4 - HKLM..\Run: [TPHOTKEY] C:\Archivos de programa\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
O4 - HKLM..\Run: [TPKMAPHELPER] C:\Archivos de programa\ThinkPad\Utilities\TpKmapAp.exe (IBM Corp.)
O4 - HKLM..\Run: [TPTRAY] C:\Archivos de programa\ThinkPad\Utilities\TP98TRAY.EXE (IBM Corp.)
O4 - HKLM..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe ()
O4 - HKLM..\Run: [UC_SMB]  File not found
O4 - HKU\.DEFAULT..\Run: [MySpaceIM] C:\Archivos de programa\MySpace\IM\MySpaceIM.exe ()
O4 - HKU\S-1-5-18..\Run: [MySpaceIM] C:\Archivos de programa\MySpace\IM\MySpaceIM.exe ()
O4 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004..\Run: [ICQ] C:\Archivos de programa\ICQ7.4\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004..\Run: [LDM]  File not found
O4 - Startup: C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-BA7E-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Adobe Reader Speed Launch.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Archivos de programa\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Archivos de programa\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Ayuda de i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} -  File not found
O9 - Extra 'Tools' menuitem : Ayuda de i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} -  File not found
O9 - Extra 'Tools' menuitem : Opciones de i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Archivos de programa\VeriSign\i-Nav\i-nav_4_2_1.dll (VeriSign, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKU\S-1-5-21-3223205443-1629879421-2787705077-1004\..Trusted Domains:   ([]msn in Mi PC)
O16 - DPF: {08EC5265-BFFB-48C1-8B3B-B96B19921616} https://www.fotoprix.es/ReveladoOnline/SetupReveladoOnline.exe (ReveladoOnlineX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} hxxp://www.cult3d.com/download/cult.cab (Cult3D ActiveX Player)
O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} hxxp://download.akamaitools.com.edgesuite.net/dlmanager/live/code/IE_1070/DownloadManager.cab (DownloadManager Control)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} hxxp://software-dl.real.com/073fd2f710ba77344305/netzip/RdxIE601_es.cab (RdxIE Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Archivos de programa\Archivos comunes\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTServ: DllName - C:\Archivos de programa\Archivos comunes\Logitech\Bluetooth\lbtserv.dll - C:\Archivos de programa\Archivos comunes\Logitech\Bluetooth\LBTServ.dll (Logitech Inc.)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - CLSID or File not found.
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Martina Reich\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Martina Reich\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.05.18 02:48:29 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{528b6c12-e417-11dd-8c7c-00061bdf2c2e}\Shell - "" = AutoRun
O33 - MountPoints2\{528b6c12-e417-11dd-8c7c-00061bdf2c2e}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{749bf1e0-c07f-11d8-8450-00061bdf2c2e}\Shell\AutoRun\command - "" = F:\setupSNK.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Action Manager 32.lnk - C:\Archivos de programa\ScannerU\AM32.exe - ()
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^GlobeTrotter Connect.lnk - C:\Archivos de programa\Orange\GlobeTrotter Connect\GlobeTrotter Connect.exe - (Orange_ES)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Logitech Desktop Messenger Agent.lnk -  - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Logitech SetPoint.lnk - C:\Archivos de programa\Logitech\SetPoint\KEM.exe - (Logitech Inc.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^NETGEAR WPN111 Smart Wizard.lnk - C:\Archivos de programa\NETGEAR\WPN111\WPN111.exe - (NETGEAR)
MsConfig - StartUpFolder: C:^Documents and Settings^Martina Reich^Menú Inicio^Programas^Inicio^VolvicTrinkWecker.lnk -  - File not found
MsConfig - StartUpReg: Acrobat Assistant 7.0 - hkey= - key= - C:\Archivos de programa\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
MsConfig - StartUpReg: AVMWlanClient - hkey= - key= - C:\Archivos de programa\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
MsConfig - StartUpReg: ibmmessages - hkey= - key= - C:\Archivos de programa\IBM\Messages By IBM\ibmmessages.exe (IBM)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= -  File not found
MsConfig - StartUpReg: Logitech Hardware Abstraction Layer - hkey= - key= - C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
MsConfig - StartUpReg: Messenger (Yahoo!) - hkey= - key= - C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
MsConfig - StartUpReg: MsnMsgr - hkey= - key= -  File not found
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Archivos de programa\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: updateMgr - hkey= - key= - C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: WLANSTA.EXE - hkey= - key= -  File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm -  File not found
SafeBootNet: nm.sys -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Generación de gráficos vectoriales (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {2298d453-bcae-4519-bf33-1cbf3faf1524} - Q867801
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Enlace dinámico de datos HTML para Java
ActiveX: {377483c2-e4b4-4ee8-b577-9aed264c8735} - Q822925
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Paquete para exploración sin conexión
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Autoría avanzada
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Ayuda de Internet Explorer
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Clases Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Herramientas de instalación de Internet Explorer
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Mejoras en la exploración
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Acceso al sitio de MSN
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Enlace dinámico de datos HTML
ActiveX: {9B2C0871-098C-4102-109C-3F59DBD15935} - Internet Explorer
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Fuentes principales de Internet Explorer
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Programador de tareas
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - Ayuda de HTML
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {f5173cf0-1dfb-4978-8e50-a90169ee7ca9} - Q823353
ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Unable to start service SrService!
 
========== Files/Folders - Created Within 30 Days ==========
 
File not found -- C:\Documents and Settings\Martina Reich\Escritorio\Dr Alban .
[2011.04.18 21:48:30 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Martina Reich\Recent
[2011.04.18 21:43:53 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Martina Reich\Datos de programa\Malwarebytes
[2011.04.18 21:43:22 | 000,038,224 | -H-- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.04.18 21:43:22 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Malwarebytes' Anti-Malware
[2011.04.18 21:43:17 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes
[2011.04.18 21:43:12 | 000,020,952 | -H-- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.04.18 21:43:10 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\Malwarebytes' Anti-Malware
[2011.04.18 21:41:59 | 007,734,208 | -H-- | C] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\Martina Reich\Escritorio\mbam-setup-1.50.1.1100.exe
[2011.04.15 07:52:47 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Martina Reich\Mis documentos\prüf
[2011.03.31 12:54:25 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\ICQ7.4
[2011.03.31 12:52:38 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\ICQ7.4
[2011.03.27 09:34:03 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Martina Reich\Datos de programa\WinRAR
[2011.03.27 09:17:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\JDownloader
[2011.03.27 09:16:00 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\JDownloader
[2008.09.11 15:49:01 | 000,147,456 | -H-- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll
[2008.09.11 15:49:01 | 000,061,440 | -H-- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll
[2008.09.11 15:49:01 | 000,053,248 | -H-- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll
[2008.09.11 15:49:01 | 000,053,248 | -H-- | C] ( ) -- C:\WINDOWS\csnpstd3.dll
[2008.03.06 20:17:39 | 005,828,544 | -H-- | C] (Mozilla) -- C:\Archivos de programa\Firefox Setup 2.0.0.12.exe
[2005.05.22 23:33:39 | 021,904,216 | -H-- | C] (Apple Computer, Inc.                                        ) -- C:\Archivos de programa\iTunesSetup.exe
[2005.04.28 14:30:47 | 000,724,960 | -H-- | C] (RealVNC Ltd.                                                ) -- C:\Archivos de programa\vnc-4_1_1-x86_win32.exe
[42 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[17 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\Documents and Settings\Martina Reich\*.tmp files -> C:\Documents and Settings\Martina Reich\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
File not found -- C:\Documents and Settings\Martina Reich\Escritorio\Dr Alban .
[2011.04.19 17:15:06 | 000,001,088 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.19 06:10:43 | 000,002,278 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.19 06:10:02 | 000,001,084 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.19 06:09:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.19 06:07:52 | 000,000,211 | RHS- | M] () -- C:\BOOT.INI
[2011.04.18 21:43:24 | 000,000,844 | -H-- | M] () -- C:\Documents and Settings\All Users\Escritorio\Malwarebytes' Anti-Malware.lnk
[2011.04.18 21:42:13 | 007,734,208 | -H-- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\Martina Reich\Escritorio\mbam-setup-1.50.1.1100.exe
[2011.04.16 14:11:04 | 000,329,888 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.16 12:32:05 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.16 12:09:23 | 000,498,798 | -H-- | M] () -- C:\WINDOWS\System32\perfh00A.dat
[2011.04.16 12:09:23 | 000,435,594 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.16 12:09:23 | 000,086,880 | -H-- | M] () -- C:\WINDOWS\System32\perfc00A.dat
[2011.04.16 12:09:23 | 000,068,490 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.04.06 20:22:02 | 000,028,132 | -H-- | M] () -- C:\Documents and Settings\Martina Reich\Escritorio\jacke.JPG
[2011.03.31 12:54:26 | 000,001,561 | -H-- | M] () -- C:\Documents and Settings\All Users\Escritorio\ICQ7.4.lnk
[2011.03.27 09:17:13 | 000,000,815 | -H-- | M] () -- C:\Documents and Settings\All Users\Escritorio\JDownloader.lnk
[2011.03.23 12:34:51 | 000,040,960 | -H-- | M] () -- C:\Documents and Settings\Martina Reich\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[42 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[17 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\Documents and Settings\Martina Reich\*.tmp files -> C:\Documents and Settings\Martina Reich\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.19 06:07:53 | 000,002,363 | -H-- | C] () -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Adobe Acrobat Speed Launcher.lnk
[2011.04.19 06:07:52 | 000,001,803 | -H-- | C] () -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Adobe Reader Speed Launch.lnk
[2011.04.18 21:43:24 | 000,000,844 | -H-- | C] () -- C:\Documents and Settings\All Users\Escritorio\Malwarebytes' Anti-Malware.lnk
[2011.04.06 20:22:01 | 000,028,132 | -H-- | C] () -- C:\Documents and Settings\Martina Reich\Escritorio\jacke.JPG
[2011.03.31 12:54:26 | 000,001,561 | -H-- | C] () -- C:\Documents and Settings\All Users\Escritorio\ICQ7.4.lnk
[2011.03.27 09:17:13 | 000,000,815 | -H-- | C] () -- C:\Documents and Settings\All Users\Escritorio\JDownloader.lnk
[2010.12.28 05:14:53 | 000,032,608 | -H-- | C] () -- C:\WINDOWS\king-uninstall.exe
[2010.05.10 21:55:08 | 000,000,020 | -H-- | C] () -- C:\WINDOWS\eplan.ini
[2010.03.13 13:48:39 | 000,053,248 | -H-- | C] () -- C:\WINDOWS\System32\CommonDL.dll
[2010.03.13 13:48:39 | 000,002,412 | -H-- | C] () -- C:\WINDOWS\System32\lgAxconfig.ini
[2009.08.03 15:07:42 | 000,403,816 | -H-- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009.08.03 15:07:42 | 000,230,768 | -H-- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009.05.03 14:15:18 | 000,051,280 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008.10.27 11:41:15 | 000,192,512 | RH-- | C] () -- C:\WINDOWS\System32\AegisI5.exe
[2008.10.27 11:41:15 | 000,149,392 | -H-- | C] () -- C:\WINDOWS\System32\drivers\ar5523.bin
[2008.10.27 11:41:14 | 000,651,264 | -H-- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2008.10.27 11:41:14 | 000,147,456 | -H-- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2008.09.11 15:49:08 | 000,827,392 | -H-- | C] () -- C:\WINDOWS\vsnpstd3.exe
[2008.09.11 15:49:08 | 000,262,144 | -H-- | C] () -- C:\WINDOWS\tsnpstd3.exe
[2008.09.11 15:49:07 | 000,015,498 | -H-- | C] () -- C:\WINDOWS\snpstd3.ini
[2008.06.24 20:34:54 | 000,006,812 | RH-- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2008.06.24 20:23:29 | 000,053,248 | RH-- | C] () -- C:\WINDOWS\System32\InstMed.exe
[2008.06.11 16:26:16 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008.05.22 16:31:28 | 000,000,613 | -H-- | C] () -- C:\WINDOWS\if40le.ini
[2008.05.22 16:31:12 | 000,000,114 | -H-- | C] () -- C:\WINDOWS\SCNDRVU.INI
[2008.05.22 16:29:39 | 000,002,997 | -H-- | C] () -- C:\WINDOWS\If42le.ini
[2008.05.22 16:29:38 | 000,000,241 | -H-- | C] () -- C:\WINDOWS\PEXPLORE.INI
[2008.05.22 16:29:21 | 000,011,776 | -H-- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2008.05.22 16:28:52 | 000,000,403 | -H-- | C] () -- C:\WINDOWS\umxaddin.ini
[2008.03.31 15:36:01 | 000,036,864 | -H-- | C] () -- C:\WINDOWS\System32\ctrldll.dll
[2008.03.31 15:36:01 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\System32\rmctrl.exe
[2008.03.11 11:41:00 | 000,000,305 | -H-- | C] () -- C:\Documents and Settings\All Users\Datos de programa\addr_file.html
[2008.03.06 20:27:09 | 000,001,317 | -H-- | C] () -- C:\WINDOWS\mozver.dat
[2008.03.06 20:19:16 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2006.11.25 20:31:44 | 000,111,932 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2006.11.25 20:31:44 | 000,000,097 | -H-- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2006.11.25 20:31:43 | 000,031,053 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2006.11.25 20:31:43 | 000,027,417 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2006.11.25 20:31:43 | 000,026,154 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2006.11.25 20:31:43 | 000,024,903 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2006.11.25 20:31:43 | 000,021,390 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2006.11.25 20:31:43 | 000,020,148 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2006.11.25 20:31:43 | 000,011,811 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2006.11.25 20:31:43 | 000,004,943 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2006.11.25 20:31:43 | 000,001,146 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2006.11.25 20:31:43 | 000,001,139 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2006.11.25 20:31:43 | 000,001,139 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2006.11.25 20:31:43 | 000,001,136 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2006.11.25 20:31:43 | 000,001,129 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2006.11.25 20:31:43 | 000,001,129 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2006.11.25 20:31:43 | 000,001,120 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2006.11.25 20:31:43 | 000,001,107 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2006.11.25 20:31:43 | 000,001,104 | -H-- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2006.11.25 20:26:16 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\CDE DX4000DEFGIPS.ini
[2006.09.06 16:08:02 | 000,819,200 | RH-- | C] () -- C:\WINDOWS\KochRun.exe
[2006.09.06 16:08:02 | 000,001,062 | RH-- | C] () -- C:\WINDOWS\KochRun.ini
[2006.09.06 16:00:47 | 000,000,068 | -H-- | C] () -- C:\WINDOWS\odbc_merge.INI
[2006.09.06 15:49:45 | 000,016,387 | -H-- | C] () -- C:\WINDOWS\German.ini
[2006.06.09 09:00:20 | 000,076,800 | -H-- | C] () -- C:\WINDOWS\System32\drivers\SSHDRV84.sys
[2006.06.09 08:59:37 | 000,495,616 | -H-- | C] () -- C:\WINDOWS\System32\Tx32.dll
[2006.06.09 08:59:37 | 000,000,260 | -H-- | C] () -- C:\WINDOWS\System32\IC32.INI
[2006.05.02 08:57:18 | 000,000,360 | -H-- | C] () -- C:\WINDOWS\System32\drivers\wnmsav.dat
[2006.03.20 13:26:36 | 000,323,584 | -H-- | C] () -- C:\WINDOWS\System32\ZSHP2600.EXE
[2006.03.07 22:36:18 | 000,000,058 | -H-- | C] () -- C:\WINDOWS\System32\Favorites.ini
[2006.01.26 13:23:14 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\Wininit.ini
[2006.01.10 09:59:48 | 000,139,331 | -H-- | C] () -- C:\WINDOWS\System32\AVS.dll
[2006.01.10 09:59:48 | 000,061,440 | -H-- | C] () -- C:\WINDOWS\System32\AVSReub.exe
[2006.01.10 09:59:48 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\System32\AVSTabla.dll
[2005.12.12 02:50:01 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\homeDVD-Fotos4_dlx.INI
[2005.06.01 04:46:30 | 011,210,752 | -H-- | C] () -- C:\WINDOWS\System32\ZHHP_RES.DLL
[2005.06.01 04:46:30 | 000,749,568 | -H-- | C] () -- C:\WINDOWS\System32\AGISSI.DLL
[2005.06.01 04:46:30 | 000,241,664 | -H-- | C] () -- C:\WINDOWS\System32\ZHHP2600.EXE
[2005.06.01 04:46:30 | 000,114,688 | -H-- | C] () -- C:\WINDOWS\System32\VSHP2600.DLL
[2005.03.16 11:51:17 | 000,008,864 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MARXDEV3.SYS
[2005.03.16 11:51:17 | 000,008,864 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MARXDEV2.SYS
[2005.03.16 11:51:17 | 000,008,864 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MARXDEV1.SYS
[2005.03.16 11:51:16 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2005.02.16 20:58:28 | 000,001,890 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005.02.16 20:58:28 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\0100CDE72B.sys
[2005.02.02 13:42:40 | 000,000,112 | -H-- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2004.10.25 14:19:42 | 000,000,017 | -H-- | C] () -- C:\WINDOWS\Missing.ini
[2004.09.20 10:06:28 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.09 23:10:36 | 000,046,128 | -H-- | C] () -- C:\WINDOWS\System32\DLLPRF32.DAT
[2004.08.07 15:09:35 | 000,000,284 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini
[2004.08.05 12:53:12 | 000,040,960 | -H-- | C] () -- C:\Documents and Settings\Martina Reich\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004.08.03 22:15:22 | 000,000,116 | -H-- | C] () -- C:\WINDOWS\homeDVD-Fotos2.INI
[2004.08.03 22:10:25 | 000,019,968 | -H-- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2004.08.03 22:07:03 | 000,000,182 | -H-- | C] () -- C:\WINDOWS\magix.ini
[2004.08.03 22:06:58 | 000,001,010 | -H-- | C] () -- C:\WINDOWS\mgxoschk.ini
[2004.07.26 18:38:11 | 000,006,550 | -H-- | C] () -- C:\WINDOWS\jautoexp.dat
[2004.07.05 12:45:19 | 000,000,031 | -H-- | C] () -- C:\WINDOWS\warhead.ini
[2004.06.18 11:40:57 | 000,000,035 | -H-- | C] () -- C:\WINDOWS\A5W.INI
[2004.06.18 11:39:55 | 000,000,191 | -H-- | C] () -- C:\WINDOWS\PowerReg.dat
[2004.06.08 18:39:32 | 000,000,612 | -H-- | C] () -- C:\WINDOWS\lexstat.ini
[2004.06.07 20:30:18 | 006,609,800 | -H-- | C] () -- C:\Archivos de programa\psa2se_esp.exe
[2004.06.04 04:26:55 | 000,000,379 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2004.03.19 15:24:20 | 000,002,954 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004.03.19 15:03:40 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2004.03.19 15:02:40 | 000,001,112 | -H-- | C] () -- C:\WINDOWS\System32\PX.INI
[2004.03.19 14:56:50 | 000,000,225 | -H-- | C] () -- C:\WINDOWS\Welcome.ini
[2004.03.19 14:49:47 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\System32\TpKmpSvc.exe
[2004.03.19 14:49:23 | 000,007,168 | -H-- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2004.03.19 14:48:54 | 000,184,320 | -H-- | C] () -- C:\WINDOWS\TPBATHLP.EXE
[2004.03.19 14:48:44 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\QCONSVC.EXE
[2004.03.19 14:48:44 | 000,002,295 | -H-- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.SYS
[2004.03.19 14:48:00 | 000,102,400 | -H-- | C] () -- C:\WINDOWS\_tpiu000.exe
[2003.04.11 14:14:14 | 000,005,827 | -H-- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.11.15 01:14:28 | 000,143,360 | -H-- | C] () -- C:\WINDOWS\System32\AIBMRUNL.dll
[2002.10.02 12:06:04 | 000,000,834 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2002.10.02 11:55:17 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2002.10.02 11:45:31 | 000,021,900 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002.10.02 11:38:52 | 000,004,207 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002.10.02 11:37:59 | 000,329,888 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002.01.21 14:48:12 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\desktopset.exe
[2001.08.23 07:26:08 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2001.08.23 07:24:30 | 000,004,524 | -H-- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[1999.01.27 13:39:06 | 000,065,024 | -H-- | C] () -- C:\WINDOWS\System32\indounin.dll
[1999.01.26 23:00:00 | 000,114,816 | -H-- | C] () -- C:\WINDOWS\System32\MSMT4232.DLL
[1997.06.13 07:56:08 | 000,056,832 | -H-- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[1980.01.01 00:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[1980.01.01 00:00:00 | 000,498,798 | -H-- | C] () -- C:\WINDOWS\System32\perfh00A.dat
[1980.01.01 00:00:00 | 000,435,594 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[1980.01.01 00:00:00 | 000,317,534 | -H-- | C] () -- C:\WINDOWS\System32\perfi00A.dat
[1980.01.01 00:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[1980.01.01 00:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[1980.01.01 00:00:00 | 000,159,744 | -H-- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[1980.01.01 00:00:00 | 000,086,880 | -H-- | C] () -- C:\WINDOWS\System32\perfc00A.dat
[1980.01.01 00:00:00 | 000,077,824 | -H-- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[1980.01.01 00:00:00 | 000,068,490 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[1980.01.01 00:00:00 | 000,057,344 | -H-- | C] () -- C:\WINDOWS\System32\ibmpmsvc.exe
[1980.01.01 00:00:00 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\tpinspm.dll
[1980.01.01 00:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[1980.01.01 00:00:00 | 000,036,284 | -H-- | C] () -- C:\WINDOWS\System32\perfd00A.dat
[1980.01.01 00:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[1980.01.01 00:00:00 | 000,016,384 | -H-- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[1980.01.01 00:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[1980.01.01 00:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
 
========== LOP Check ==========
 
[2008.03.07 00:33:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\BufferZone
[2004.06.08 18:44:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\BVRP Software
[2009.12.28 20:59:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\CanonBJ
[2004.03.19 14:57:40 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\ibm
[2010.03.13 13:48:57 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\LGMOBILEAX
[2004.07.20 13:40:55 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\MSScanAppDataDir
[2010.06.15 21:06:13 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\TechSmith
[2010.05.01 11:13:26 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\TuneUp Software
[2006.11.25 20:35:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\UDL
[2010.05.01 11:09:27 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Datos de programa\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2009.12.23 10:30:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Amazon
[2009.04.05 09:50:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Ashampoo
[2008.03.19 15:15:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\DeepBurner
[2007.01.05 02:08:31 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\EPSON
[2008.03.11 17:48:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\GMX
[2004.07.15 12:52:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\IBM
[2011.04.19 16:28:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\ICQ
[2008.02.08 00:02:48 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\ICQ Toolbar
[2004.06.08 22:10:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Leadertech
[2009.12.23 11:06:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\LG Electronics
[2009.01.20 13:09:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\LGSync
[2006.01.16 00:24:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\MAGIX
[2008.11.05 16:06:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\OpenOffice.org
[2009.10.28 10:21:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\phonostar-Player
[2007.01.08 22:48:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\sueddeutsche.de Bildschirmschoner
[2010.04.30 17:24:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Thunderbird
[2010.05.01 11:14:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\TuneUp Software
[2007.11.08 10:13:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\webex
[2008.02.14 19:39:28 | 000,000,554 | -H-- | M] () -- C:\WINDOWS\Tasks\BMMTask.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2010.08.09 10:58:16 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.09.29 21:32:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Adobe
[2008.07.06 18:52:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\AdobeUM
[2009.12.23 10:30:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Amazon
[2005.05.22 23:36:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Apple Computer
[2009.04.05 09:50:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Ashampoo
[2005.02.16 20:58:55 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Corel
[2008.03.19 15:15:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\DeepBurner
[2005.02.16 20:11:40 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Download Manager
[2010.05.14 18:55:13 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\dvdcss
[2007.01.05 02:08:31 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\EPSON
[2008.03.11 17:48:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\GMX
[2008.03.21 19:16:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Google
[2004.06.30 11:33:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Help
[2004.07.15 12:52:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\IBM
[2011.04.19 16:28:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\ICQ
[2008.02.08 00:02:48 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\ICQ Toolbar
[2002.10.02 11:57:26 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Identities
[2008.02.07 23:50:28 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\InstallShield
[2004.06.08 22:10:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Leadertech
[2009.12.23 11:06:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\LG Electronics
[2009.01.20 13:09:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\LGSync
[2004.06.21 17:46:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Logitech
[2004.07.30 11:38:04 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Macromedia
[2006.01.16 00:24:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\MAGIX
[2011.04.18 21:43:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Malwarebytes
[2008.10.20 17:55:17 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Microsoft
[2008.08.27 20:49:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla
[2009.08.09 09:19:27 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\MSN6
[2007.07.27 19:49:06 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\MySpace
[2008.11.05 16:06:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\OpenOffice.org
[2009.10.28 10:21:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\phonostar-Player
[2005.02.17 20:24:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Real
[2006.06.10 17:46:48 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Roxio
[2011.04.07 19:17:18 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Skype
[2011.04.07 16:00:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\skypePM
[2006.09.09 22:33:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Sony Corporation
[2007.02.04 02:26:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\SopCast
[2007.01.08 22:48:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\sueddeutsche.de Bildschirmschoner
[2008.03.06 23:21:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Sun
[2004.06.04 04:30:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Symantec
[2010.04.30 17:24:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Thunderbird
[2010.05.01 11:14:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\TuneUp Software
[2010.09.20 22:12:55 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\vlc
[2007.11.08 10:13:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\webex
[2011.03.27 09:34:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\WinRAR
[2010.01.28 19:06:02 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Martina Reich\Datos de programa\Yahoo!
 
< %APPDATA%\*.exe /s >
[2008.04.11 15:08:00 | 021,277,080 | -H-- | M] (                            ) -- C:\Documents and Settings\Martina Reich\Datos de programa\Adobe\Acrobat\7.0\Updater\AdbeRdr709_en_US.exe
[2011.04.17 09:04:01 | 000,053,632 | -H-- | M] (Adobe Systems Inc.) -- C:\Documents and Settings\Martina Reich\Datos de programa\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.11.09 23:00:39 | 000,007,358 | RH-- | M] () -- C:\Documents and Settings\Martina Reich\Datos de programa\Microsoft\Installer\{5C79D312-F68F-4B04-8A4F-E28A0AE1ECBB}\_24c89c8.exe
[2010.11.09 23:00:39 | 000,007,358 | RH-- | M] () -- C:\Documents and Settings\Martina Reich\Datos de programa\Microsoft\Installer\{5C79D312-F68F-4B04-8A4F-E28A0AE1ECBB}\_39fe3610.exe
[2010.02.19 20:31:44 | 000,029,344 | -H-- | M] (NOS Microsystems Ltd.) -- C:\Documents and Settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\50aazo9u.Nina\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
[2009.02.16 22:45:09 | 007,049,336 | -H-- | M] (MySpace Inc.) -- C:\Documents and Settings\Martina Reich\Datos de programa\MySpace\IM\Install\MSIMClientSetup.1.0.789.0-static-de-A.exe
[2007.02.04 02:25:54 | 000,260,944 | -H-- | M] (www.sopcast.com) -- C:\Documents and Settings\Martina Reich\Datos de programa\SopCast\adv\SopAdver.exe
 
< %SYSTEMDRIVE%\*.exe >
[2005.11.29 14:51:59 | 000,731,116 | -H-- | M] (                                                            ) -- C:\SudokuJESSetup3.3.exe
[2001.05.24 13:59:30 | 000,162,304 | -H-- | M] () -- C:\UNWISE.EXE
 
 
< MD5 for: AGP440.SYS  >
[2004.09.23 10:38:03 | 022,285,982 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.12.18 11:32:09 | 023,895,938 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.09.23 10:38:03 | 022,285,982 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008.12.18 11:32:09 | 023,895,938 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 08:07:41 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2002.09.10 05:00:00 | 010,180,710 | -H-- | M] () .cab file -- C:\I386\sp1.cab:atapi.sys
[2002.09.10 05:00:00 | 010,180,710 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004.09.23 10:38:03 | 022,285,982 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.12.18 11:32:09 | 023,895,938 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.09.23 10:38:03 | 022,285,982 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008.12.18 11:32:09 | 023,895,938 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 07:59:42 | 000,095,360 | -H-- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:18:21 | 000,056,320 | -H-- | M] (Microsoft Corporation) MD5=2744C713F0217BD8FFD13E2EF731371C -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:18:21 | 000,056,320 | -H-- | M] (Microsoft Corporation) MD5=2744C713F0217BD8FFD13E2EF731371C -- C:\WINDOWS\system32\eventlog.dll
[2004.08.20 00:42:07 | 000,055,808 | -H-- | M] (Microsoft Corporation) MD5=5696DF4EF09C375CE42FB2DDE1E68AB7 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.04.14 04:18:57 | 001,036,288 | -H-- | M] (Microsoft Corporation) MD5=7522F548A84ABAD8FA516DE5AB3931EF -- C:\WINDOWS\explorer.exe
[2008.04.14 04:18:57 | 001,036,288 | -H-- | M] (Microsoft Corporation) MD5=7522F548A84ABAD8FA516DE5AB3931EF -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004.08.20 00:42:46 | 001,034,752 | -H-- | M] (Microsoft Corporation) MD5=89C8DD146CEAF482D82822766437D93F -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:10:53 | 001,035,776 | -H-- | M] (Microsoft Corporation) MD5=DBB6B75CC6CB2CF8EC0BAFCA08AED6BE -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 15:22:28 | 001,035,776 | -H-- | M] (Microsoft Corporation) MD5=F8DDB22B6EFC5E630D65E241074C2404 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2004.08.20 00:42:18 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=7FD182B1B80117C353983565D60B1CAF -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 04:18:28 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=CD2BBB52DFAAB666B812A51B1E96F2A0 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:18:28 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=CD2BBB52DFAAB666B812A51B1E96F2A0 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:18:35 | 000,185,856 | -H-- | M] (Microsoft Corporation) MD5=B6BE3C96CD33336A551DB3F2299A8E69 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:18:35 | 000,185,856 | -H-- | M] (Microsoft Corporation) MD5=B6BE3C96CD33336A551DB3F2299A8E69 -- C:\WINDOWS\system32\scecli.dll
[2004.08.20 00:42:22 | 000,184,832 | -H-- | M] (Microsoft Corporation) MD5=C6347748F2E9F310EA1E1915482ABFEF -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.03.08 17:50:25 | 000,579,072 | -H-- | M] (Microsoft Corporation) MD5=237FB93C6B4330D8EE7D2448CF71C5ED -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2005.03.02 20:20:22 | 000,578,048 | -H-- | M] (Microsoft Corporation) MD5=37CE819E8ECB3517B9981A886876EF72 -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.20 00:42:27 | 000,578,048 | -H-- | M] (Microsoft Corporation) MD5=5D5C9CC377A70D036816E7EA55F3CA73 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2002.11.22 12:31:18 | 000,529,920 | -H-- | M] (Microsoft Corporation) MD5=85049DCB2C2FD979B895EB0EF944EA9B -- C:\WINDOWS\$NtUninstallKB824141$\user32.dll
[2008.04.14 04:18:45 | 000,579,584 | -H-- | M] (Microsoft Corporation) MD5=DA8898129E0075C7DE4DEE457514A73C -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:18:45 | 000,579,584 | -H-- | M] (Microsoft Corporation) MD5=DA8898129E0075C7DE4DEE457514A73C -- C:\WINDOWS\system32\user32.dll
[2005.03.02 20:10:34 | 000,578,048 | -H-- | M] (Microsoft Corporation) MD5=DDA46F3DBCF32727E93976B09FBB0E83 -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 17:36:30 | 000,578,560 | -H-- | M] (Microsoft Corporation) MD5=FED9881C07A301271F52B51389A028C9 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2004.08.20 00:43:13 | 000,025,088 | -H-- | M] (Microsoft Corporation) MD5=7B30B4D55B4562C733A5DDF6D6F72B3F -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008.04.14 04:19:14 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=F5B8745B9A90EAF17E30C0574E049AA3 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:19:14 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=F5B8745B9A90EAF17E30C0574E049AA3 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 04:19:15 | 000,510,976 | -H-- | M] (Microsoft Corporation) MD5=213C80D912880BBF04453D09FFCCB28C -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:19:15 | 000,510,976 | -H-- | M] (Microsoft Corporation) MD5=213C80D912880BBF04453D09FFCCB28C -- C:\WINDOWS\system32\winlogon.exe
[2004.08.20 00:43:15 | 000,505,344 | -H-- | M] (Microsoft Corporation) MD5=FCB59D25D628B4D3181DC816D14679DD -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2002.09.10 05:00:00 | 000,012,032 | -H-- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2002.10.02 11:37:30 | 000,094,208 | -H-- | M] () -- C:\WINDOWS\system32\config\default.sav
[2002.10.02 11:37:30 | 000,634,880 | -H-- | M] () -- C:\WINDOWS\system32\config\software.sav
[2002.10.02 11:37:30 | 000,430,080 | -H-- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[42 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
         
--- --- ---
__________________


Alt 19.04.2011, 17:49   #3
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 19.04.2011 17:00:14 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Documents and Settings\Martina Reich\Mis documentos\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Alemania | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 152,00 Mb Available Physical Memory | 30,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 52,83 Gb Total Space | 4,05 Gb Free Space | 7,67% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: NINA | User Name: Martina Reich | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Archivos de programa\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
.scr [@ = scrfile] -- "%1" /S %*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Archivos de programa\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Archivos de programa\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S %*
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Archivos de programa\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Archivos de programa\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"FirewallOverride" = 0
"AntiVirusOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
"DisableMonitoring" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
"DisableMonitoring" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"5900:TCP" = 5900:TCP:*:Enabled:acceso antonio martin
"80:TCP" = 80:TCP:*:Enabled:internet
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" = C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"C:\Archivos de programa\Windows Live\Messenger\livecall.exe" = C:\Archivos de programa\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)
"C:\Archivos de programa\ICQ7.4\ICQ.exe" = C:\Archivos de programa\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4 -- (ICQ, LLC.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe" = C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Archivos de programa\GMX\GMX SMS-Manager\SMSMngr.exe" = C:\Archivos de programa\GMX\GMX SMS-Manager\SMSMngr.exe:*:Enabled:GMX SMS-Manager -- (1&1 Internet AG)
"C:\Archivos de programa\MySpace\IM\MySpaceIM.exe" = C:\Archivos de programa\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM -- ()
"C:\Archivos de programa\ICQ7.4\ICQ.exe" = C:\Archivos de programa\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4 -- (ICQ, LLC.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{065D5505-3821-4C2E-BB6C-FE66A7E7CB4F}" = USB Flash Port Driver
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3600_series" = Canon iP3600 series Printer Driver
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1E34AB5C-B893-4EE9-82F3-F195978D009D}" = IBM Access Support - Local Content Pack
"{2111B23F-7FDA-4A41-8309-E5A1663CA296}" = Programa de utilidad de personalización del teclado de IBM ThinkPad
"{22B71A00-4DED-11D4-A5E5-0004AC564F43}" = IBM Access Connections
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{236022CE-C413-474F-98FF-4E9FE19D54E1}" = Logitech Media Desktop
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{31C2FBAC-67CF-4093-8F36-15A146613747}" = IBM Update Connector
"{350C9C0A-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37C39957-B0B3-40DC-8BA4-2363241159ED}" = LightScribe  1.4.44.1
"{3B7B3B4A-AF8C-4671-A92E-3E7E9ABCB22B}" = IBM Rapid Restore PC Setup
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HydraVision
"{5265664F-6128-405C-9225-9782A85954FD}" = Plustek USB Scanner
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.75 
"{582E9125-32B6-4CBA-AB48-3E33CE3DB389}" = NETGEAR RangeMax(TM) Wireless USB 2.0 Adapter WPN111
"{5C47C8B6-77FF-4FC7-A388-66FCF9CFC24C}" = Snagit 9.1.3
"{5C79D312-F68F-4B04-8A4F-E28A0AE1ECBB}" = CrissCross 8.40
"{5C8C8D88-A35C-4CF1-99F3-76256195C2B1}" = Red Inalámbrica Local 802.11b WLAN para Windows
"{5EAF9A83-3B91-45BF-8F2D-990BBEBDC9AB}" = Intel(R) Sebring API 
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6CE96A14-61E2-48CC-837E-22710A953ADE}" = IBM Themes
"{7109B88E-46F0-EEC2-BFAC-81440CFDAE52}" = Volvic Trink-Wecker
"{710C0BB2-FE39-484E-BB23-C9B96835A14A}" = Access IBM Message Center
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{82512BC9-BD5D-4C50-BE4D-B98E7DF78687}" = Asistente de IBM ThinkPad UltraNav
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8745DEAB-1126-42F5-9585-C66D5497B47B}" = EMEA Wallpaper
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90300C0A-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{91CA0C0A-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-0000-7EC8-7489-000000000703}" = Adobe Acrobat 7.0.2 and Reader 7.0.2 Update
"{AC76BA86-1033-F400-BA7E-000000000002}" = Adobe Acrobat 7.0 Standard - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5599ECB-DA72-43EE-8A30-2C80396FF8BB}" = Access IBM
"{B90450DF-E781-46FD-B1F1-0C86DA40E443}" = PIF DESIGNER
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem Driver
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF44C7A5-5705-41E4-BE84-A9A42977AB05}" = alm
"{D974EE78-6760-4F8B-A93E-E17FFB8EDDAC}" = GlobeTrotter Connect
"{D9EDF47B-533C-468E-A6CD-0A29045A01E5}" = Aplicación Verificación Firma e-Factura
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{ECD03DA7-5952-406A-8156-5F0C93618D1F}" = USB PC Camera Plus
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Paquete de controladores de Windows - Infineon Technologies (FlashUSB) USB  (04/16/2009 1.0.0.6)
"Access IBM Tools" = Access IBM Tools
"Adobe Acrobat 7.0 Standard - English, Français, Deutsch" = Adobe Acrobat 7.0 Standard - English, Français, Deutsch
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"Ashampoo ClipFinder HD_is1" = Ashampoo ClipFinder HD 2.01
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon iP3600 series Benutzerregistrierung" = Canon iP3600 series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"de.volvic.air.drinkreminder.92830DA63F1B23B0F9D267537DCF78B72BB95C17.1" = Volvic Trink-Wecker
"EasyEject Utility" = Programa de utilidad EasyEject de IBM ThinkPad
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ESDX4000_4050_CX3900" = ESDX4000_4050_CX3900
"GMX SMS-Manager" = GMX SMS-Manager
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"i-nav" = VeriSign i-Nav and Components
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"Intellisync Lite Connected Organizers V4.0" = Intellisync Lite
"JDownloader" = JDownloader
"king.com" = king.com (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Mozilla Thunderbird (3.1.9)" = Mozilla Thunderbird (3.1.9)
"MySpaceIM" = MySpaceIM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Picasa 3" = Picasa 3
"Power Features" = Características Maximizador de batería y Gestión de energía
"Power Management Driver" = IBM ThinkPad Power Management Driver
"Presentation Director" = Director de presentaciones de IBM ThinkPad
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"QcDrv" = Labtec® Camera-Treiber
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer
"SnagIt7" = SnagIt 7
"SopCast" = SopCast 1.1.1
"sueddeutsche.de-Screensaver ScreenSaver" = sueddeutsche.de-Screensaver ScreenSaver
"SynTPDeinstKey" = IBM ThinkPad UltraNav Driver
"ThinkPad Configuration" = Configuración de IBM ThinkPad
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"ThinkPadSoftwareInstaller" = Instalador de software de ThinkPad
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR Archivierer
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XMedia Recode" = XMedia Recode 2.0.5.6
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"XTTB00001.XTTB00001Toolbar" = ICQ Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 28.02.2011 14:36:56 | Computer Name = NINA | Source = Application Error | ID = 1000
Description = Aplicación con errores: plugin-container.exe, versión: 1.9.2.3989,
 módulo con error: ntdll.dll, versión 5.1.2600.6055, dirección de error 0x0000100b.
 
Error - 20.03.2011 10:49:17 | Computer Name = NINA | Source = WmiAdapter | ID = 4099
Description = Error al abrir el servicio.
 
Error - 29.03.2011 09:29:17 | Computer Name = NINA | Source = Application Hang | ID = 1002
Description = Aplicación que no responde: AcroRd32.exe, versión 7.0.8.218, módulo
 que no responde hungapp, versión 0.0.0.0, dirección que no responde 0x00000000.
 
Error - 02.04.2011 03:00:17 | Computer Name = NINA | Source = Application Hang | ID = 1002
Description = Aplicación que no responde: iexplore.exe, versión 6.0.2900.5512, módulo
 que no responde hungapp, versión 0.0.0.0, dirección que no responde 0x00000000.
 
Error - 03.04.2011 02:51:23 | Computer Name = NINA | Source = Application Error | ID = 1000
Description = Aplicación con errores: update.exe, versión: 9.0.0.54, módulo con 
error: msvcr90.dll, versión 9.0.30729.1, dirección de error 0x000371e2.
 
Error - 09.04.2011 08:43:48 | Computer Name = NINA | Source = Application Hang | ID = 1002
Description = Aplicación que no responde: AcroRd32.exe, versión 7.0.8.218, módulo
 que no responde hungapp, versión 0.0.0.0, dirección que no responde 0x00000000.
 
Error - 16.04.2011 04:37:55 | Computer Name = NINA | Source = Application Hang | ID = 1002
Description = Aplicación que no responde: thunderbird.exe, versión 1.9.2.4079, módulo
 que no responde hungapp, versión 0.0.0.0, dirección que no responde 0x00000000.
 
Error - 17.04.2011 03:05:43 | Computer Name = NINA | Source = MsiInstaller | ID = 11704
Description = Product: Adobe AIR -- Error 1704. An installation for Microsoft Office
 Small Business Edition 2003 is currently suspended.  You must undo the changes 
made by that installation to continue.  Do you want to undo those changes?
 
Error - 18.04.2011 15:00:14 | Computer Name = NINA | Source = Application Hang | ID = 1002
Description = Aplicación que no responde: VolvicTrinkWecker.exe, versión 0.0.0.0,
 módulo que no responde hungapp, versión 0.0.0.0, dirección que no responde 0x00000000.
 
Error - 18.04.2011 15:00:14 | Computer Name = NINA | Source = Application Hang | ID = 1002
Description = Aplicación que no responde: VolvicTrinkWecker.exe, versión 0.0.0.0,
 módulo que no responde hungapp, versión 0.0.0.0, dirección que no responde 0x00000000.
 
[ System Events ]
Error - 17.04.2011 23:50:45 | Computer Name = NINA | Source = Service Control Manager | ID = 7011
Description = Intervalo de espera (30000 ms.) para la respuesta de transacción del
 servicio Netman.
 
Error - 18.04.2011 13:19:07 | Computer Name = NINA | Source = Service Control Manager | ID = 7011
Description = Intervalo de espera (30000 ms.) para la respuesta de transacción del
 servicio GtFlashSwitch.
 
Error - 18.04.2011 13:20:00 | Computer Name = NINA | Source = Service Control Manager | ID = 7011
Description = Intervalo de espera (30000 ms.) para la respuesta de transacción del
 servicio stisvc.
 
Error - 18.04.2011 23:53:36 | Computer Name = NINA | Source = SRService | ID = 104
Description = Error en el proceso de inicialización de Restaurar sistema.
 
Error - 18.04.2011 23:53:57 | Computer Name = NINA | Source = Service Control Manager | ID = 7023
Description = El servicio Servicio de restauración de sistema terminó con el error:
   %%5
 
Error - 19.04.2011 00:10:03 | Computer Name = NINA | Source = SRService | ID = 104
Description = Error en el proceso de inicialización de Restaurar sistema.
 
Error - 19.04.2011 00:10:07 | Computer Name = NINA | Source = Service Control Manager | ID = 7023
Description = El servicio Servicio de restauración de sistema terminó con el error:
   %%5
 
Error - 19.04.2011 10:13:58 | Computer Name = NINA | Source = Service Control Manager | ID = 7011
Description = Intervalo de espera (30000 ms.) para la respuesta de transacción del
 servicio Netman.
 
Error - 19.04.2011 11:05:55 | Computer Name = NINA | Source = SRService | ID = 104
Description = Error en el proceso de inicialización de Restaurar sistema.
 
Error - 19.04.2011 11:05:57 | Computer Name = NINA | Source = Service Control Manager | ID = 7023
Description = El servicio Servicio de restauración de sistema terminó con el error:
   %%5
 
 
< End of report >
         
--- --- ---
__________________

Alt 19.04.2011, 17:53   #4
markusg
/// Malware-holic
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 19.04.2011, 18:03   #5
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



Oha, na mal gucken, ob ich das schaffe...
Bis später dann und


Alt 19.04.2011, 18:57   #6
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



So, geschafft!

Combofix Logfile:
Code:
ATTFilter
ComboFix 11-04-19.01 - Martina Reich 19.04.2011  18:22:38.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.3082.18.511.322 [GMT 2:00]
ausgeführt von:: c:\documents and settings\Martina Reich\Escritorio\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\archivos de programa\Internet Explorer\SET44.tmp
c:\archivos de programa\Internet Explorer\SET45.tmp
c:\archivos de programa\Internet Explorer\SET47.tmp
c:\documents and settings\Administrador\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Martina Reich\WINDOWS
c:\windows\Downloaded Program Files\RdXIe.dll
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\drivers\lmpscv.sys
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_okewdl
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-03-19 bis 2011-04-19  ))))))))))))))))))))))))))))))
.
.
2011-04-18 19:43 . 2011-04-18 19:43	--------	d--h--w-	c:\documents and settings\Martina Reich\Datos de programa\Malwarebytes
2011-04-18 19:43 . 2010-12-20 16:09	38224	---ha-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-18 19:43 . 2011-04-18 19:43	--------	d--h--w-	c:\documents and settings\All Users\Datos de programa\Malwarebytes
2011-04-18 19:43 . 2010-12-20 16:08	20952	---ha-w-	c:\windows\system32\drivers\mbam.sys
2011-04-18 19:43 . 2011-04-18 19:43	--------	d--h--w-	c:\archivos de programa\Malwarebytes' Anti-Malware
2011-03-31 10:52 . 2011-03-31 10:56	--------	d--h--w-	c:\archivos de programa\ICQ7.4
2011-03-27 07:16 . 2011-03-27 07:21	--------	d--h--w-	c:\archivos de programa\JDownloader
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 05:33 . 2004-06-07 12:19	692736	---ha-w-	c:\windows\system32\inetcomm.dll
2011-03-04 08:43 . 2002-02-26 12:58	434176	---ha-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:53 . 1979-12-31 22:00	1858048	---ha-w-	c:\windows\system32\win32k.sys
2011-02-17 13:51 . 2004-08-19 22:42	81920	---ha-w-	c:\windows\system32\ieencode.dll
2011-02-17 13:51 . 2004-02-06 16:08	669696	---ha-w-	c:\windows\system32\wininet.dll
2011-02-17 13:51 . 1979-12-31 22:00	61952	---ha-w-	c:\windows\system32\tdc.ocx
2011-02-17 13:50 . 2004-08-19 22:23	371200	---ha-w-	c:\windows\system32\html.iec
2011-02-17 13:18 . 1979-12-31 22:00	455936	---ha-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 1979-12-31 22:00	357888	---ha-w-	c:\windows\system32\drivers\srv.sys
2011-02-17 12:54 . 2008-05-05 05:25	5632	---ha-w-	c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 1979-12-31 22:00	290432	---ha-w-	c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 1979-12-31 22:00	270848	---ha-w-	c:\windows\system32\sbe.dll
2011-02-09 13:53 . 1979-12-31 22:00	186880	---ha-w-	c:\windows\system32\encdec.dll
2011-02-08 13:33 . 1979-12-31 22:00	978944	---ha-w-	c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 1979-12-31 22:00	974848	---ha-w-	c:\windows\system32\mfc42u.dll
2011-02-02 07:58 . 2002-10-02 09:44	2067456	---ha-w-	c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2002-10-02 09:44	677888	---ha-w-	c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 1979-12-31 22:00	441344	---ha-w-	c:\windows\system32\shimgvw.dll
2008-03-06 18:18 . 2008-03-06 18:17	5828544	-c-ha-w-	c:\archivos de programa\Firefox Setup 2.0.0.12.exe
2005-05-22 21:34 . 2005-05-22 21:33	21904216	-c-ha-w-	c:\archivos de programa\iTunesSetup.exe
2005-04-28 12:31 . 2005-04-28 12:30	724960	-c-ha-w-	c:\archivos de programa\vnc-4_1_1-x86_win32.exe
2004-06-07 18:32 . 2004-06-07 18:30	6609800	-c-ha-w-	c:\archivos de programa\psa2se_esp.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\archivos de programa\ICQ7.4\ICQ.exe" [2011-03-31 119608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S3TRAY2"="S3Tray2.exe" [2001-10-11 69632]
"SynTPLpr"="c:\archivos de programa\Synaptics\SynTP\SynTPLpr.exe" [2003-07-31 110592]
"SynTPEnh"="c:\archivos de programa\Synaptics\SynTP\SynTPEnh.exe" [2003-07-31 512000]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"TPHOTKEY"="c:\archiv~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2003-08-07 94208]
"QCWLICON"="c:\archivos de programa\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2003-03-27 53248]
"TPTRAY"="c:\archiv~1\ThinkPad\UTILIT~1\TP98TRAY.EXE" [2002-10-31 49152]
"TPKMAPHELPER"="c:\archivos de programa\ThinkPad\Utilities\TpKmapAp.exe" [2003-08-08 897024]
"EZEJMNAP"="c:\archiv~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2002-11-01 204800]
"AGRSMMSG"="AGRSMMSG.exe" [2002-10-18 87751]
"ATIPTA"="c:\archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-29 315392]
"BMMGAG"="c:\archiv~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2002-10-31 64000]
"RemoteControl"="c:\windows\system32\rmctrl.exe" [2001-11-09 32768]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-12-14 221184]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2006-07-07 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"avgnt"="c:\archivos de programa\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\archivos de programa\QuickTime\qttask.exe" [2005-05-22 98304]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 19968]
"CanonSolutionMenu"="c:\archivos de programa\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488]
"CanonMyPrinter"="c:\archivos de programa\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"MySpaceIM"="c:\archivos de programa\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
.
c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-F400-BA7E-000000000002}\SC_Acrobat.exe [2005-2-17 25214]
Adobe Reader Speed Launch.lnk - c:\archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Taskman"=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTServ]
2003-10-08 23:02	1064960	---ha-w-	c:\archivos de programa\Archivos comunes\Logitech\Bluetooth\LBTServ.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Action Manager 32.lnk]
path=c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\Action Manager 32.lnk
backup=c:\windows\pss\Action Manager 32.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^GlobeTrotter Connect.lnk]
path=c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\GlobeTrotter Connect.lnk
backup=c:\windows\pss\GlobeTrotter Connect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Logitech Desktop Messenger Agent.lnk]
path=c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\Logitech Desktop Messenger Agent.lnk
backup=c:\windows\pss\Logitech Desktop Messenger Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^NETGEAR WPN111 Smart Wizard.lnk]
path=c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\NETGEAR WPN111 Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WPN111 Smart Wizard.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Martina Reich^Menú Inicio^Programas^Inicio^VolvicTrinkWecker.lnk]
path=c:\documents and settings\Martina Reich\Menú Inicio\Programas\Inicio\VolvicTrinkWecker.lnk
backup=c:\windows\pss\VolvicTrinkWecker.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WLANSTA.EXE]
WLANSTA.EXE START [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2004-12-14 01:12	483328	---ha-w-	c:\archivos de programa\Adobe\Acrobat 7.0\Distillr\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMWlanClient]
2007-02-02 16:26	283136	---ha-w-	c:\archivos de programa\avmwlanstick\FRITZWLANMini.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ibmmessages]
2003-01-07 12:52	495616	---ha-w-	c:\archivos de programa\IBM\Messages By IBM\ibmmessages.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
2003-09-19 11:17	25088	---ha-w-	c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 14:39	5244216	---ha-w-	c:\archiv~1\Yahoo!\MESSEN~1\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-28 22:58	149280	---ha-w-	c:\archivos de programa\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-05-29 07:25	68856	---ha-w-	c:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
2006-03-30 14:45	313472	---ha-r-	c:\archivos de programa\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Archivos de programa\\GMX\\GMX SMS-Manager\\SMSMngr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Archivos de programa\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
"c:\\Archivos de programa\\ICQ7.4\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"5900:TCP"= 5900:TCP:acceso antonio martin
.
R1 SSHDRV84;SSHDRV84;c:\windows\system32\drivers\SSHDRV84.sys [09.06.2006 09:00 76800]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [19.03.2004 14:48 12288]
R2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [06.09.2006 15:50 99840]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\archivos de programa\Avira\AntiVir Desktop\sched.exe [28.10.2009 11:24 108289]
R2 GtFlashSwitch;GtFlashSwitch;c:\archivos de programa\Archivos comunes\GtFlashSwitch\GtFlashSwitch.exe [09.02.2007 14:48 176128]
R2 MarxDev1;MarxDev1;c:\windows\system32\drivers\MARXDEV1.SYS [16.03.2005 11:51 8864]
R2 MarxDev2;MarxDev2;c:\windows\system32\drivers\MARXDEV2.SYS [16.03.2005 11:51 8864]
R2 MarxDev3;MarxDev3;c:\windows\system32\drivers\MARXDEV3.SYS [16.03.2005 11:51 8864]
R2 navi;VeriSign Updater;c:\archivos de programa\VeriSign\NAVI\naviagent.exe uimode=agentupdate --> c:\archivos de programa\VeriSign\NAVI\naviagent.exe uimode=agentupdate [?]
S2 gupdate;Servicio Google Update (gupdate);c:\archivos de programa\Google\Update\GoogleUpdate.exe [13.03.2010 11:43 135664]
S3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\DRIVERS\COMFiltr.sys --> c:\windows\system32\DRIVERS\COMFiltr.sys [?]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [27.10.2008 11:41 17149]
S3 FlashUSB;FlashUSB;c:\windows\system32\drivers\FlashUsb.sys [13.03.2010 13:51 16896]
S3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\drivers\Gtm51Irp.sys [15.01.2007 18:48 122240]
S3 GTUQBUS;GT UQ BUS;c:\windows\system32\drivers\gtuqbus.sys [15.01.2007 18:48 36992]
S3 LHidPPKE;Logitech SetPoint HID Function Driver;c:\windows\system32\drivers\LHidPPKE.Sys [21.06.2004 17:04 22536]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
S3 vvftav;vvftav;c:\windows\system32\drivers\vvftav.sys --> c:\windows\system32\drivers\vvftav.sys [?]
S3 WLAN;Red Inalámbrica Local 802.11b WLAN Driver;c:\windows\system32\drivers\WLANNDS.sys [16.06.2004 11:28 613888]
S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [27.10.2008 11:41 362944]
S3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\Drivers\ZS211.sys --> c:\windows\system32\Drivers\ZS211.sys [?]
.
Inhalt des "geplante Tasks" Ordners
.
2008-02-14 c:\windows\Tasks\BMMTask.job
- c:\archiv~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2004-03-19 23:31]
.
2011-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-03-13 09:43]
.
2011-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-03-13 09:43]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.sh-spion.de/
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\archivos de programa\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\archivos de programa\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\archivos de programa\ICQ7.4\ICQ.exe
TCP: {7D80E3F2-655F-4EDE-AD5C-4575C55A019C} = 194.179.1.100,194.179.1.101
TCP: {A1E2710B-D314-4BF8-A14D-196137DBF65A} = 69.50.184.84,195.225.176.37
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {08EC5265-BFFB-48C1-8B3B-B96B19921616} - hxxps://www.fotoprix.es/ReveladoOnline/SetupReveladoOnline.exe
DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} - hxxp://download.akamaitools.com.edgesuite.net/dlmanager/live/code/IE_1070/DownloadManager.cab
FF - ProfilePath - c:\documents and settings\Martina Reich\Datos de programa\Mozilla\Firefox\Profiles\nk4rinlt.Nino\
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\archivos de programa\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\archivos de programa\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: FoxClocks: {d37dc5d0-431d-44e5-8c91-49419370caa1} - %profile%\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-LDM - c:\archivos de programa\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
HKLM-Run-UC_SMB - (no file)
HKLM-Run-tgcmd - (no file)
HKLM-Run-Start RF Wireless Mouse - c:\archivos de programa\RF Wireless Mouse\cm20.exe
HKLM-Run-Realtime Audio Engine - mmrtkrnl.exe
MSConfigStartUp-iTunesHelper - c:\archivos de programa\iTunes\iTunesHelper.exe
MSConfigStartUp-MsnMsgr - c:\archivos de programa\Windows Live\Messenger\MsnMsgr.Exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-04-19 18:34
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\System\CurrentControlSet]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\USER\LocalSystem]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"A0C0AC1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(876)
c:\archivos de programa\Archivos comunes\Logitech\Bluetooth\lbtserv.dll
c:\archivos de programa\Archivos comunes\Logitech\Bluetooth\lbtinte.dll
.
- - - - - - - > 'explorer.exe'(2084)
c:\archiv~1\ThinkPad\UTILIT~1\pwrmonit.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\windows\System32\S24EvMon.exe
c:\archivos de programa\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\Ati2evxx.exe
c:\archivos de programa\Java\jre6\bin\jqs.exe
c:\archivos de programa\Archivos comunes\LightScribe\LSSrvc.exe
c:\archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
c:\archivos de programa\VeriSign\NAVI\naviagent.exe
c:\windows\System32\QCONSVC.EXE
c:\windows\System32\RegSrvc.exe
c:\windows\system32\TpKmpSVC.exe
c:\windows\system32\wscntfy.exe
c:\archiv~1\VeriSign\NAVI\NAVICL~1.EXE
c:\windows\System32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
c:\archivos de programa\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\archivos de programa\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\windows\AGRSMMSG.exe
c:\windows\system32\RunDll32.exe
c:\windows\Logi_MwX.Exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-04-19  18:44:23 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-04-19 16:44
.
Vor Suchlauf: 4.240.474.112 bytes libres
Nach Suchlauf: 4.585.967.616 bytes libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 53D17E9474F07BA199543C8DA85DB045
         
--- --- ---

Alt 19.04.2011, 19:04   #7
markusg
/// Malware-holic
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



klicke mal mit rechts auf die transparenten dateien, eigenschaften, haken bei versteckt raus, übernehmen. passt das so?
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 19.04.2011, 19:10   #8
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



Es scheint wieder alles normal zu sein!
Gehe ich richtig in der Annahme, dass jetzt nix Besorgniserregendes mehr auf meinem Laptop ist? Hatte gelesen, dass der Trojaner Passwörter ausspioniert, kann ich zB mein Online-Banking jetzt wieder nutzen?

Auf jeden Fall ein großes DANKESCHÖN für die Hilfe!

Alt 19.04.2011, 19:24   #9
markusg
/// Malware-holic
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



du hast eine rogue auf dem system gehabt, diese zeigt dir gefälschte warnungen aller art.
wir prüfen mal noch weiter.
lade den CCleaner slim:
Piriform - Builds
falls der CCleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 19.04.2011, 19:47   #10
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



Das fand ich nicht so einfach... Aber ich hab mal mein bestes versucht! Und eine Frage habe ich noch, kann man hier irgendwo draus lesen, warum ich seit Monaten keinen Rechtsklick auf Dateien machen kann, weil dann der Explorer abstürzt?

Access IBM Tools IBM Corporation 4.0 notwendig
Adobe Acrobat 7.0 Standard - English, Français, Deutsch Adobe Systems 7.0.0 notwendig
Adobe Acrobat 7.0.2 and Reader 7.0.2 Update Adobe Systems 7.0.3 notwendig
Adobe AIR Adobe Systems Incorporated 2.6.0.19140 notwendig
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 10.2.152.32 notwendig
Adobe Reader 7.0.9 Adobe Systems Incorporated 7.0.9 notwendig
Adobe Shockwave Player 11 Adobe Systems, Inc. 11 notwendig
Agere Systems AC'97 Modem unbekannt
Aplicación Verificación Firma e-Factura unbekannt
Ashampoo ClipFinder HD 2.01 ashampoo GmbH & Co. KG 2.0.1 unnötig
ATI Control Panel unbekannt
ATI Display Driver unbekannt
ATI HydraVision unbekannt
Avira AntiVir Personal - Free Antivirus Avira GmbH notwendig
Canon iP3600 series Benutzerregistrierung notwendig
Canon iP3600 series Printer Driver notwendig
Canon Utilities Easy-PhotoPrint EX notwendig
Canon Utilities My Printer notwendig
Canon Utilities Solution Menu notwendig
CCleaner Piriform 3.05 notwendig
Compatibility Pack für 2007 Office System Microsoft Corporation 12.0.6514.5001 notwendig
CrissCross 8.40 8.4.0.0 unnötig
ESDX4000_4050_CX3900 unbekannt
GlobeTrotter Connect Option NV 2.1.0.420 unnötig
GMX SMS-Manager notwendig
Google Toolbar for Internet Explorer Google Inc. 6.6.1409.1944 unnötig
IBM Themes IBM 1.00.0000 notwendig
IBM ThinkPad Power Management Driver 1.25.01 notwendig
IBM ThinkPad UltraNav Driver 7.5.17.5 notwendig
ICQ7.4 ICQ 7.4 notwendig
Infineon USB driver 1.0.0.6 Infineon unbekannt
Intel(R) PRO Network Adapters and Drivers unbekannt
Intel(R) Sebring API Intel 1.02.0000 unbekannt
Intellisync Lite unbekannt
Java(TM) 6 Update 17 Sun Microsystems, Inc. 6.0.170 notwendig
JDownloader AppWork UG (haftungsbeschränkt) unnötig
king.com (remove only) Midasplayer Ltd (king.com) unnötig
Labtec® Camera-Treiber unnötig
LG USB Modem Driver LG Electronics 4.9.7 unnötig
Logitech Media Desktop 1.02 unnötig
Logitech MouseWare 9.75 unnötig
Logitech SetPoint 1.02 unnötig
Malwarebytes' Anti-Malware Malwarebytes Corporation notwendig
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU Microsoft Corporation 2.1.21022 vermutlich notwendig
Microsoft .NET Framework 2.0 Service Pack 2 Microsoft Corporation 2.2.30729 vermutlich notwendig
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU Microsoft Corporation 3.1.21022 vermutlich notwendig
Microsoft .NET Framework 3.0 Service Pack 2 Microsoft Corporation 3.2.30729 vermutlich notwendig
Microsoft .NET Framework 3.5 Language Pack - DEU Microsoft Corporation vermutlich notwendig
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation vermutlich notwendig
Microsoft Data Access Components KB870669 Microsoft Corporation vermutlich notwendig
Microsoft Internationalized Domain Names Mitigation APIs Microsoft Corporation vermutlich notwendig
Microsoft National Language Support Downlevel APIs Microsoft Corporation vermutlich notwendig
Microsoft Office Small Business Edition 2003 Microsoft Corporation 11.0.8173.0 notwendig
Microsoft Office XP Media Content Microsoft Corporation 10.0.2619.0 notwendig
Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Corporation vermutlich notwendig
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 8.0.59193 vermutlich notwendig
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 9.0.30729.4148 vermutlich notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 9.0.30729 vermutlich notwendig
Mozilla Firefox (3.6.16) Mozilla 3.6.16 (de) notwendig
Mozilla Thunderbird (3.1.9) Mozilla 3.1.9 (de) notwendig
MSXML 4.0 SP2 (KB927978) Microsoft Corporation 4.20.9841.0 unbekannt
MSXML 4.0 SP2 (KB936181) Microsoft Corporation 4.20.9848.0 unbekannt
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 4.20.9876.0 unbekannt
MySpaceIM MySpace.com 1.0.789.0 unnötig
NETGEAR RangeMax(TM) Wireless USB 2.0 Adapter WPN111 unnötig
Paquete de controladores de Windows - Infineon Technologies (FlashUSB) USB (04/16/2009 1.0.0.6) Infineon Technologies 04/16/2009 1.0.0.6
Picasa 3 Google, Inc. 3.1 unbekannt
PIF DESIGNER unbekannt
Plustek USB Scanner notwendig
PowerDVD unnötig
QuickTime notwendig
RealPlayer RealNetworks notwendig
Red Inalámbrica Local 802.11b WLAN para Windows notwendig
Skype™ 5.1 Skype Technologies S.A. 5.1.112 notwendig
SnagIt 7 TechSmith Corporation 7.2 notwendig
Snagit 9.1.3 TechSmith Corporation 9.1.3.16 notwendig
SopCast 1.1.1 1.1.1 unbekannt
sueddeutsche.de-Screensaver ScreenSaver unnötig
ThinkPad FullScreen Magnifier 1.10 vermutlich notwendig
Uninstall 1.0.0.1 unbekannt
USB Flash Port Driver Infineon Technologies 1.00.0000 vermutlich notwendig
USB PC Camera Plus Sonix 5.17.0.000 unbekannt
VeriSign i-Nav and Components VeriSign, Inc. 4.2.2 unbekannt
VLC media player 1.0.5 VideoLAN Team 1.0.5 notwendig
Volvic Trink-Wecker Danone Waters Deutschland GmbH 1.0 unnötig
Windows Media Format 11 runtime vermutlich notwendig
Windows Media Player 11 notwendig
Windows Media Player Firefox Plugin Microsoft Corp 1.0.0.8 notwendig
Windows XP Service Pack 3 Microsoft Corporation 20080414.031514 vermutlich notwendig
WinRAR Archivierer notwendig
XMedia Recode 2.0.5.6 Sebastian Dörfler 2.0.5.6 unnötig
Yahoo! Messenger Yahoo! Inc. notwendig

Alt 19.04.2011, 19:54   #11
markusg
/// Malware-holic
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



na wenn du seit monaten probleme mit dem pc hst, sollten wir mal drüber reden den neu zu machen und dann richtig abzusichern. das wäre dann vllt mal ganz günstig
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 19.04.2011, 19:57   #12
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



Die Frage ist ob sich das überhaupt lohnt bei der alten Kiste... Vielleicht sollte ich lieber mal darüber nachdenken mir einen Neuen zu kaufen. ;-)
Meinst Du, dass jetzt erstmal bezüglich des Trojaners wieder alles in Ordnung ist?

Alt 19.04.2011, 20:13   #13
markusg
/// Malware-holic
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



naja wenn man neu aufsetzt kommt bei den meisten systemen wieder ein wenig schwung rein, da man sie vom müll der jahre befreit.
avira
http://www.trojaner-board.de/54192-a...tellungen.html
avira 10 so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
bitte auch unter verwaltung, planer, scan auftrag, darauf achten, das dieser über lokale laufwerke läuft! sonst werden die einstellungen nicht gültig.
den update auftrag auf 1x pro tag einstellen.
und "nachhohlen falls zeit überschritten" auswählen
klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 19.04.2011, 21:16   #14
nina173
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



Vielen lieben Dank für die Hilfe, Spende ist unterwegs! Finde ich echt toll, dass man hier so professionelle Hilfe bekommt!

Alt 19.04.2011, 21:26   #15
markusg
/// Malware-holic
 
TR/kazy.mekml.1 - Standard

TR/kazy.mekml.1



danke und kein problem, aber wie willst du nun weiter machen?
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu TR/kazy.mekml.1
adware.zango, andere, anti-malware, bösartige, cache, dateien, disabletaskmgr, explorer, hallo zusammen, jar_cache, log files, malwarebytes, microsoft, minute, process, service, software, system, taskmanager, temp, threads, toolbar, trojan.agent, trojaner, version, wirklich, zusammen, öffnen



Ähnliche Themen: TR/kazy.mekml.1


  1. TR/Kazy.mekml.1 ; 'TR/FakeSysdef.A.621 ; 'TR/Kazy.22847'..
    Log-Analyse und Auswertung - 15.05.2011 (33)
  2. TR/Kazy.mekml.1 - was tun?
    Plagegeister aller Art und deren Bekämpfung - 12.05.2011 (5)
  3. TR/Kazy.mekml.1
    Log-Analyse und Auswertung - 06.05.2011 (1)
  4. Tr/kazy.mekml.1
    Log-Analyse und Auswertung - 03.05.2011 (13)
  5. TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 02.05.2011 (2)
  6. TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 01.05.2011 (37)
  7. TR/Kazy.mekml.1 - OTL Fix?
    Log-Analyse und Auswertung - 01.05.2011 (17)
  8. TR/Kazy.mekml.1 ... SOS
    Plagegeister aller Art und deren Bekämpfung - 30.04.2011 (34)
  9. TR/kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 29.04.2011 (10)
  10. TR/kazy.mekml.1
    Mülltonne - 26.04.2011 (0)
  11. TR/Kazy.mekml.1
    Log-Analyse und Auswertung - 26.04.2011 (1)
  12. Osterei: TR/Kazy.mekml.1 und TR/Kazy.20364
    Log-Analyse und Auswertung - 25.04.2011 (1)
  13. tr/kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 23.04.2011 (9)
  14. kazy.mekml.1
    Log-Analyse und Auswertung - 23.04.2011 (3)
  15. TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 22.04.2011 (6)
  16. TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 22.04.2011 (11)
  17. TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 19.04.2011 (4)

Zum Thema TR/kazy.mekml.1 - Hallo zusammen, auch ich habe mir gestern den Trojaner TR/kazy.mekml.1 eingefangen. Habe dann auf Rat eines Bekannten Malwarebytes' Antmalware runtergeladen und erstmal einen Quick-Scan gemacht. Immerhin kann ich jetzt den - TR/kazy.mekml.1...
Archiv
Du betrachtest: TR/kazy.mekml.1 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.