Trojaner eingefangen

OTL logfile created on: 22.04.2011 19:04:01 - Run 2
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\ADAMSKI\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
5,00 Gb Paging File | 3,00 Gb Available in Paging File | 65,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 465,75 Gb Total Space | 343,14 Gb Free Space | 73,67% Space Free | Partition Type: NTFS
 
Computer Name: VIPER4 | User Name: ADAMSKI | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\ADAMSKI\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme-Internet\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\runservice.exe ()
PRC - C:\Programme-Utilities\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme-Utilities\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme-Utilities\PTBSync\PTBSync.exe (ElmüSoft)
PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme-Internet\NetLimiter 2 Pro\NLClient.exe (Locktime Software)
PRC - C:\Programme-Internet\NetLimiter 2 Pro\nlsvc.exe (Locktime Software)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\ADAMSKI\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation)
MOD - C:\Programme\QMacro\MSSCRIPT.OCX (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AMService) --  File not found
SRV - (SSHNAS) -- C:\WINDOWS\system32\sshnas21.dll (videosoft)
SRV - (AVGIDSAgent) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Programme\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (LicCtrlService) -- C:\WINDOWS\runservice.exe ()
SRV - (TuneUp.Defrag) -- C:\Programme-Utilities\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme-Utilities\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (npggsvc) -- C:\WINDOWS\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (nlsvc) -- C:\Programme-Internet\NetLimiter 2 Pro\nlsvc.exe (Locktime Software)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (TuneUpUtilitiesDrv) -- C:\Programme-Utilities\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (PortTalk) -- C:\WINDOWS\system32\drivers\ptbtalk.sys (Beyond Logic hxxp://www.beyondlogic.org)
DRV - (FWLANUSB) -- C:\WINDOWS\system32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (nltdi) -- C:\WINDOWS\system32\drivers\nltdi.sys (Locktime Software)
DRV - (CamthWDM) -- C:\WINDOWS\system32\drivers\CamthWDM.sys (YewSoft)
DRV - (PDNMp50) -- C:\WINDOWS\system32\drivers\PDNMp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PDNSp50) -- C:\WINDOWS\system32\drivers\PDNSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_0928) Logitech QuickCam Express(PID_0928) -- C:\WINDOWS\system32\drivers\LV561AV.SYS (Logitech Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.live.com/sphome.aspx
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Disable Script Debugger Default = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,DisableScriptDebuggerIE Default = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:61980
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.studentenwerk-bonn.de/index.php?option=com_jobline&Itemid=121"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.14.2
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {05f6a7ea-896b-11da-8bde-f66bad1e3fff}:3.5.20090705
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.5
FF - prefs.js..extensions.enabledItems: refspoof@mozdev.org:0.9.5
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 61980
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Web Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Winload Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.studentenwerk-bonn.de/index.php?option=com_jobline&Itemid=121"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Programme\AVG\AVG10\Firefox4\ [2011.03.30 13:31:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Programme-Internet\Mozilla Firefox\components [2011.03.26 13:47:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Programme-Internet\Mozilla Firefox\plugins [2011.03.24 10:02:47 | 000,000,000 | ---D | M]
 
[2010.03.16 20:30:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Extensions
[2010.03.16 20:30:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.04.21 20:28:22 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions
[2009.07.22 12:26:17 | 000,000,000 | ---D | M] (Locator) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}
[2010.10.15 16:23:51 | 000,000,000 | ---D | M] (Flashblock) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2011.01.03 22:41:55 | 000,000,000 | ---D | M] (ArchiveFacebook) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA6}
[2011.03.03 09:26:43 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010.07.31 18:26:40 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.15 10:25:19 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.03.11 21:58:09 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2011.03.11 21:58:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010.04.20 16:11:16 | 000,000,000 | ---D | M] (Torbutton) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2009.09.10 22:27:54 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011.04.15 10:25:18 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.12.25 11:53:25 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2011.01.17 13:49:19 | 000,000,000 | ---D | M] (refspoof) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\refspoof@mozdev.org
[2011.03.11 21:58:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\extensions\{dc572301-7619-498c-a57d-39143191b318}\modules\extensions
[2010.07.31 18:26:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\xmn6n9gq.default\extensions
[2010.07.31 18:26:40 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\xmn6n9gq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.05.25 13:02:34 | 000,000,000 | ---D | M] (WINLOAD-Gutschein-Alarm) -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\xmn6n9gq.default\extensions\sparweltgutscheinewl@sparwelt.de
[2010.03.24 16:13:02 | 000,000,917 | ---- | M] () -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\searchplugins\conduit.xml
[2009.06.17 09:15:16 | 000,001,632 | ---- | M] () -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\searchplugins\live-search.xml
[2010.12.25 11:52:46 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Mozilla\Firefox\Profiles\kdu4yl47.default\searchplugins\sweetim.xml
[2011.03.30 13:31:17 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAMME\AVG\AVG10\FIREFOX4
[2009.06.17 10:41:57 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009.06.17 09:35:01 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAMME-INTERNET\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.06.17 10:42:02 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAMME-INTERNET\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
 
Hosts file not found
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [PTBSync] C:\Programme-Utilities\PTBSync\PTBSync.exe (ElmüSoft)
O4 - HKCU..\Run: [D1T2EUR7FZ]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = FF 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\ADAMSKI\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\ADAMSKI\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.17 09:08:38 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{baa29fa0-0e80-11e0-9056-00040ec477d8}\Shell\Auto\command - "" = wscript "moz.vbs"
O33 - MountPoints2\{baa29fa0-0e80-11e0-9056-00040ec477d8}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{baa29fa0-0e80-11e0-9056-00040ec477d8}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "moz.vbs"
O33 - MountPoints2\{f1562888-41ed-11e0-90c1-00040ec477d8}\Shell - "" = AutoRun
O33 - MountPoints2\{f1562888-41ed-11e0-90c1-00040ec477d8}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f1562888-41ed-11e0-90c1-00040ec477d8}\Shell\AutoRun\command - "" = F:\Password.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.22 18:46:07 | 000,791,393 | ---- | C] (Lars Hederer                                                ) -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\Erunt-setup.exe
[2011.04.22 18:46:07 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\OTL.exe
[2011.04.22 18:46:07 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\TFC.exe
[2011.04.22 18:33:27 | 000,173,056 | ---- | C] (videosoft) -- C:\WINDOWS\System32\sshnas21.dll
[2011.04.22 12:48:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia
[2011.04.21 13:22:06 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ADAMSKI\Recent
[2011.04.21 11:56:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Malwarebytes
[2011.04.21 11:55:56 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.04.21 11:55:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.04.21 11:55:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.04.21 11:55:52 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.04.21 11:44:28 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2011.04.20 21:40:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Identities
[2011.04.20 21:40:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2011.04.20 18:50:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2011.04.20 18:50:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2011.04.01 19:10:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\Keddo
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.22 18:59:00 | 000,000,418 | ---- | M] () -- C:\WINDOWS\tasks\ul_pt_gen.job
[2011.04.22 18:54:00 | 000,000,250 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011.04.22 18:48:42 | 000,000,815 | ---- | M] () -- C:\Dokumente und Einstellungen\ADAMSKI\Eigene Dateien\PTBSync-AutoExport-Adamski.ini
[2011.04.22 18:48:19 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2011.04.22 18:48:19 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011.04.22 18:48:13 | 000,001,361 | -HS- | M] () -- C:\WINDOWS\System32\mmf.sys
[2011.04.22 18:48:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.22 18:46:19 | 000,301,568 | ---- | M] () -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\g2m3e4r.exe
[2011.04.22 18:46:17 | 000,791,393 | ---- | M] (Lars Hederer                                                ) -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\Erunt-setup.exe
[2011.04.22 18:46:11 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\OTL.exe
[2011.04.22 18:46:11 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\TFC.exe
[2011.04.22 18:33:27 | 000,173,056 | ---- | M] (videosoft) -- C:\WINDOWS\System32\sshnas21.dll
[2011.04.22 11:29:27 | 113,104,343 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011.04.21 11:55:56 | 000,000,810 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.21 11:44:29 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2011.04.18 18:56:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.17 19:09:58 | 000,025,103 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011.04.04 06:32:44 | 000,003,298 | ---- | M] () -- C:\WINDOWS\System32\StyleVista.png
[2011.04.04 06:32:44 | 000,003,137 | ---- | M] () -- C:\WINDOWS\System32\StyleVistaDown.png
 
========== Files Created - No Company Name ==========
 
[2011.04.22 18:46:07 | 000,301,568 | ---- | C] () -- C:\Dokumente und Einstellungen\ADAMSKI\Desktop\g2m3e4r.exe
[2011.04.22 18:33:40 | 000,000,290 | -H-- | C] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2011.04.22 18:33:35 | 000,000,290 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011.04.22 18:33:30 | 000,000,250 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011.04.21 11:55:56 | 000,000,810 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.21 11:44:29 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2011.02.13 14:51:02 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\0E06.6E1
[2011.02.12 16:13:55 | 000,000,050 | ---- | C] () -- C:\WINDOWS\MegaManager.INI
[2010.05.25 13:20:07 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2010.03.19 19:35:36 | 000,001,361 | -HS- | C] () -- C:\WINDOWS\System32\mmf.sys
[2010.03.19 19:35:34 | 000,048,640 | ---- | C] () -- C:\WINDOWS\mmfs.dll
[2010.03.19 19:35:34 | 000,016,384 | ---- | C] () -- C:\WINDOWS\runservice.exe
[2010.03.01 16:10:57 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\PnkBstrK.sys
[2009.12.12 10:49:09 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\nrzfzr.dll
[2009.12.02 21:09:05 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\qmdisp.dll
[2009.12.01 21:03:48 | 000,000,245 | ---- | C] () -- C:\WINDOWS\PROFED32.INI
[2009.11.28 22:56:39 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009.11.28 22:56:38 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.11.28 20:21:09 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2009.11.28 20:21:08 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009.09.28 14:45:49 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\bqqs.dll
[2009.09.28 14:45:46 | 000,066,048 | ---- | C] () -- C:\WINDOWS\QMDispatch.dll
[2009.09.28 14:29:29 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009.06.22 14:31:11 | 000,000,296 | ---- | C] () -- C:\WINDOWS\game.ini
[2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2009.06.18 10:48:46 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\InstMed.exe
[2009.06.18 10:48:42 | 000,009,255 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009.06.17 11:04:11 | 000,260,248 | ---- | C] () -- C:\WINDOWS\System32\QMO.dll
[2009.06.17 11:04:11 | 000,092,312 | ---- | C] () -- C:\WINDOWS\System32\QMOCameraDll.dll
[2009.06.17 10:54:27 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.06.17 10:45:52 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009.06.17 10:22:49 | 000,226,304 | ---- | C] () -- C:\Dokumente und Einstellungen\ADAMSKI\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.06.17 10:02:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2009.06.17 09:59:23 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.06.17 09:56:29 | 000,122,928 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.06.17 09:55:20 | 000,065,800 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2009.06.17 09:55:12 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2009.06.17 09:49:54 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2009.06.17 09:31:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.06.17 09:23:19 | 000,097,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin
[2009.06.17 09:10:55 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.06.17 09:05:53 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.05.16 03:54:01 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2009.05.16 03:54:01 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2009.04.23 20:04:54 | 000,198,341 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2009.02.18 18:55:21 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2009.02.03 21:52:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2008.04.14 07:06:26 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2007.11.26 21:56:28 | 000,151,415 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2006.12.31 06:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006.01.08 14:53:24 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\hash2.dll
[2001.08.23 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001.08.23 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001.08.23 13:00:00 | 000,448,800 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2001.08.23 13:00:00 | 000,432,492 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001.08.23 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001.08.23 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001.08.23 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001.08.23 13:00:00 | 000,080,302 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2001.08.23 13:00:00 | 000,067,448 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001.08.23 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001.08.23 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001.08.23 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001.08.23 13:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001.08.23 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[1997.06.14 13:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
 
========== LOP Check ==========
 
[2010.11.19 06:20:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\AVG10
[2010.06.04 15:53:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2009.06.22 14:23:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\DAEMON Tools Lite
[2010.07.31 18:26:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.11.23 17:26:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\ICQ
[2010.12.20 23:44:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Imaxel
[2010.10.07 17:08:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Lingo4u
[2010.02.24 19:35:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Locktime
[2009.09.02 14:16:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Orbit
[2010.04.11 12:48:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\runic games
[2011.04.04 06:43:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\translateclient
[2009.12.28 15:55:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\TS3Client
[2010.12.21 13:00:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\TSNotifier
[2009.06.17 09:44:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\TuneUp Software
[2010.09.09 15:53:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\W
[2010.07.17 16:12:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\wargaming.net
[2010.07.27 23:52:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\Xilisoft
[2009.11.30 10:55:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ADAMSKI\Anwendungsdaten\XProfanFree
[2011.02.13 14:53:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG10
[2010.11.18 19:19:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg9
[2010.11.19 06:12:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2009.06.22 14:22:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.12.18 18:53:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Core
[2010.12.18 18:53:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2010.02.24 19:32:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Locktime
[2010.11.18 19:16:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData
[2009.06.17 11:41:31 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PTBSync
[2010.06.23 13:30:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2009.06.17 10:34:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM
[2010.03.06 14:43:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2009.06.17 11:03:03 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2010.03.06 14:41:27 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2011.04.22 18:59:00 | 000,000,418 | ---- | M] () -- C:\WINDOWS\Tasks\ul_pt_gen.job
[2011.04.22 18:48:19 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011.04.22 18:54:00 | 000,000,250 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011.04.22 18:48:19 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 22.04.2011 19:04:01 - Run 2
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\ADAMSKI\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
5,00 Gb Paging File | 3,00 Gb Available in Paging File | 65,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 465,75 Gb Total Space | 343,14 Gb Free Space | 73,67% Space Free | Partition Type: NTFS
 
Computer Name: VIPER4 | User Name: ADAMSKI | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme-Internet\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme-Internet\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme-Internet\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme-Internet\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme-Player\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme-Player\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme-Player\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme-Player\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme-Player\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\DOKUME~1\ADAMSKI\LOKALE~1\Temp\nswF2.tmp\srchost.exe" = C:\DOKUME~1\ADAMSKI\LOKALE~1\Temp\nswF2.tmp\srchost.exe:*:Enabled:@xpsp2res.dll,-22019
"C:\Programme\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe" = C:\Programme\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher -- (Ubisoft)
"C:\games\Steam\Steam.exe" = C:\games\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\games\Steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe" = C:\games\Steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe:*:Enabled:Call of Duty: Modern Warfare 2 - Multiplayer -- ()
"C:\Programme-Internet\uTorrentPortable\App\utorrent\utorrent.exe" = C:\Programme-Internet\uTorrentPortable\App\utorrent\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Programme\AVG\AVG10\avgmfapx.exe" = C:\Programme\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG-Installationsprogramm -- (AVG Technologies CZ, s.r.o.)
"C:\games\Need for Speed(TM) Hot Pursuit\Launcher.exe" = C:\games\Need for Speed(TM) Hot Pursuit\Launcher.exe:*:Enabled:Need for Speed(TM) Hot Pursuit
"C:\games\Crysis 2 Demo\bin32\Crysis2Launcher.exe" = C:\games\Crysis 2 Demo\bin32\Crysis2Launcher.exe:*:Enabled:Crysis® 2 Demo
"C:\Programme\AVG\AVG10\avgdiagex.exe" = C:\Programme\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnose 2011 -- (AVG Technologies CZ, s.r.o.)
"C:\Programme\AVG\AVG10\avgnsx.exe" = C:\Programme\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Programme\AVG\AVG10\avgemcx.exe" = C:\Programme\AVG\AVG10\avgemcx.exe:*:Enabled:Personal eMail-Scanner -- (AVG Technologies CZ, s.r.o.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{179F3115-969C-454C-B524-464A026FD202}" = NavyFIELD Europa (DE)
"{1D301950-EA2F-4882-9AA0-49467756842A}" = SweetIM for Messenger 3.3
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks closed beta v.0.4.5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 14
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5943B7F7-678B-477E-9AEE-6E4C6962322B}" = Sparwelt.de Gutschein Alarm
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6734459C-512F-4DAD-93ED-BC07A88F0A5B}" = inSSIDer
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BB86C70-E1EF-7457-46DC-0093B5269458}" = ATI Catalyst Install Manager
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B3AEF776-7FFF-4C50-A402-9119E3849EE0}" = AVG 2011
"{BF67F764-95B6-4360-BB57-B2E5AA6C814B}" = SweetIM Toolbar for Internet Explorer 4.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam-Software
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0EFC907-B36F-416F-BB38-D4C44E99AF59}" = TS Notifier
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ATI Display Driver" = ATI Display Driver
"AVG" = AVG 2011
"AVMWLANCLI" = AVM FRITZ!WLAN
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"Foxit PDF Editor" = Foxit PDF Editor
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"NetLimiter 2 Pro" = NetLimiter 2 Pro (remove only)
"PFPortChecker" = PFPortChecker 1.0.32
"PTBSync" = PTBSync (Atomuhr Synchronisation & Terminkalender)
"QcDrv" = Logitech® Camera-Treiber
"Quick Macro_is1" = Quick Macro v6.20
"Shutdown4U" = Shutdown4U
"SopCast" = SopCast 3.2.9
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamSpeakOverlay" = TeamSpeak Overlay BETA 2 (#63)
"Translate Client" = Client for Google Translate
"TuneUp Utilities" = TuneUp Utilities
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"WebcamMax" = WebcamMax
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
"Xilisoft Video Converter Ultimate" = Xilisoft Video Converter Ultimate 6
"xp-AntiSpy" = xp-AntiSpy 3.97-3
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Xvid_is1" = Xvid 1.2.2 final uninstall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"RadioSure" = RadioSure
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.11.2010 13:48:33 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x07499290.
 
Error - 12.11.2010 13:26:47 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung ts3client_win32.exe, Version 1.0.0.0, fehlgeschlagenes
 Modul fmodex.dll, Version 0.4.31.2, Fehleradresse 0x000790f2.
 
Error - 12.11.2010 14:38:12 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x06619290.
 
Error - 13.11.2010 18:32:29 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x06549290.
 
Error - 18.11.2010 11:58:53 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul divxdech264.ax, Version 9.0.1.21, Fehleradresse 0x00039297.
 
Error - 18.11.2010 12:17:27 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul DivXDec.ax, Version 7.1.1.14, Fehleradresse 0x00129290.
 
Error - 18.11.2010 12:17:40 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung drwtsn32.exe, Version 5.1.2600.0, fehlgeschlagenes
 Modul dbghelp.dll, Version 5.1.2600.5512, Fehleradresse 0x0001295d.
 
Error - 18.11.2010 12:49:07 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x06319290.
 
Error - 18.11.2010 14:34:00 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x06459290.
 
Error - 23.11.2010 17:59:58 | Computer Name = VIPER4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x05c19290.
 
[ System Events ]
Error - 21.04.2011 08:04:53 | Computer Name = VIPER4 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "wuauserv"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {E60687F7-01A1-40AA-86AC-DB1CBF673334}
 
Error - 21.04.2011 08:07:03 | Computer Name = VIPER4 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "wuauserv"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {E60687F7-01A1-40AA-86AC-DB1CBF673334}
 
Error - 22.04.2011 09:10:58 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "AMService" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 22.04.2011 13:40:52 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "AMService" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 22.04.2011 13:46:40 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 22.04.2011 13:46:40 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "AVM WLAN Connection Service" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 22.04.2011 13:46:40 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "LicCtrl Service" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 22.04.2011 13:46:40 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "TuneUp Utilities Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 22.04.2011 13:46:40 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 22.04.2011 13:46:40 | Computer Name = VIPER4 | Source = Service Control Manager | ID = 7034
Description = Dienst "Einfache TCP/IP-Dienste" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
 
< End of report >
         

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6420

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

22.04.2011 19:52:44
mbam-log-2011-04-22 (19-52-44).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 142304
Laufzeit: 1 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
c:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
         

"Infektion";"Trojaner: SHeur3.BVYB";"c:\WINDOWS\msxpfsvs.dll";"Nicht verfügbar";"22.04.2011, 18:34:00"
"Malware";"Unbekannt";"C:\WINDOWS\SYSTEM32\SSHNAS21.DLL";"Nicht verfügbar";"22.04.2011, 19:41:33"
"Malware";"Unbekannt";"C:\WINDOWS\LKOFAA.EXE";"Nicht verfügbar";"22.04.2011, 18:39:14"
"Malware";"Unbekannt";"C:\DOKUMENTE UND EINSTELLUNGEN\ADAMSKI\LOKALE EINSTELLUNGEN\TEMP\85.TMP";"Nicht verfügbar";"13.02.2011, 14:51:11"
"Malware";"Unbekannt";"C:\DOKUMENTE UND EINSTELLUNGEN\ADAMSKI\LOKALE EINSTELLUNGEN\TEMP\LQW.EXE";"Nicht verfügbar";"22.04.2011, 18:39:45"
"Malware";"Win32/Spyeye.H";"C:\DOKUMENTE UND EINSTELLUNGEN\ADAMSKI\LOKALE EINSTELLUNGEN\TEMP\71.TMP";"Nicht verfügbar";"13.12.2010, 16:03:21"
"Malware";"Win32/Injector.gen!BB";"C:\DOKUMENTE UND EINSTELLUNGEN\ADAMSKI\LOKALE EINSTELLUNGEN\TEMP\0.8237797287237774.EXE";"Nicht verfügbar";"10.02.2011, 12:52:19"