Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows blockiert, 50€ Zahlungsaufforderung (https://www.trojaner-board.de/108007-windows-blockiert-50-zahlungsaufforderung.html)

blimsch 12.01.2012 19:01
Windows blockiert, 50€ Zahlungsaufforderung
 
Hallo Community,

so wie's aussieht bin ich bei weitem nicht der einzige mit dem Problem...
Habe mir mehrere Threads mal durchgelesen und im abgesicherten Modus mit Netzwerktreibern zunächst Malwarebytes und den ESET laufen lassen.... der letztere hat dann auch noch ein paar Threats mehr entdeckt (Siehe logs)

Dann hab ich probiert wieder in den normalen Modus zu booten, jedoch kam nochmal die Zahlungsaufforderung, also hab ich wieder im abgesicherten Modus OTL laufen lassen und anschließend nochmal Malwarebytes (hat im Restore Folder eine Threat entdeckt, siehe log)...

hier mal die OTL logfile:

Code:
OTL logfile created on: 12.01.2012 17:56:26 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,75 Gb Available Physical Memory | 91,76% Memory free
4,85 Gb Paging File | 4,78 Gb Available in Paging File | 98,63% Paging File free
Paging file location(s): C:\pagefile.sys 2046 2046 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 12,10 Gb Total Space | 2,23 Gb Free Space | 18,40% Space Free | Partition Type: NTFS
Drive D: | 14,26 Gb Total Space | 8,82 Gb Free Space | 61,86% Space Free | Partition Type: NTFS
Drive E: | 29,29 Gb Total Space | 29,23 Gb Free Space | 99,78% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 7,92 Gb Free Space | 54,06% Space Free | Partition Type: NTFS
Drive H: | 26,60 Gb Total Space | 26,53 Gb Free Space | 99,76% Space Free | Partition Type: NTFS
 
Computer Name: BLIMSCHS-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.12 16:56:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\Downloads\OTL.exe
PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.03.16 23:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- D:\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.05 14:28:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Stopped] -- D:\Java\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011.06.12 10:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.10.08 16:15:18 | 001,541,360 | ---- | M] (Sophos Plc) [Auto | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2010.10.08 16:15:13 | 000,163,056 | ---- | M] (Sophos Plc) [Unknown | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2010.09.21 17:16:17 | 000,230,640 | ---- | M] (Sophos Plc) [Auto | Stopped] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2010.09.15 08:48:42 | 000,435,008 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- D:\TuneUp 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.08.26 13:43:20 | 001,051,968 | ---- | M] (TuneUp Software) [Auto | Stopped] -- D:\TuneUp 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010.08.26 13:40:24 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010.08.24 21:56:30 | 002,281,800 | ---- | M] (O&O Software GmbH) [Auto | Stopped] -- D:\OO Defrag 14\oodag.exe -- (OODefragAgent)
SRV - [2010.06.04 12:23:16 | 000,097,520 | ---- | M] (Sophos Plc) [Unknown | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () [Auto | Stopped] -- D:\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2007.04.03 15:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- D:\Cisco VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005.01.14 08:32:38 | 000,053,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\PAStiSvc.exe -- (STI Simulator)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.08.19 01:46:06 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tapoas.sys -- (tapoas)
DRV - [2011.07.01 10:46:40 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2010.10.08 16:14:59 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2010.10.08 16:14:59 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2010.09.15 08:09:50 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.02.24 13:41:50 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- D:\TuneUp 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.08.21 17:41:02 | 000,025,728 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\androidusb.sys -- (androidusb)
DRV - [2009.08.14 17:08:50 | 000,105,984 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbser.sys -- (qcusbser)
DRV - [2008.10.09 14:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV - [2008.05.23 09:38:25 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2008.04.13 23:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007.04.03 15:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007.01.31 12:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005.10.18 10:48:38 | 000,154,752 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PA707UCM.SYS -- (PAC7311)
DRV - [2005.01.26 07:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2003.08.06 09:43:04 | 000,159,744 | R--- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003.07.02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003.05.15 17:09:32 | 000,043,136 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2001.08.17 12:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Creative-SoundFont-Verwaltungstreiber (WDM)
DRV - [2001.08.17 12:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Creative-Schnittstellen-Verwaltungstreiber (WDM)
DRV - [2001.08.17 12:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001.08.17 12:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=12.0: D:\ChemDraw 12\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=12.0: D:\ChemDraw 12\ChemDraw\npcdp32.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: D:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\jqs@sun.com: D:\Java\lib\deploy\jqs\ff [2011.08.05 14:28:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: D:\Firefox\components [2011.12.22 08:08:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: D:\Firefox\plugins [2011.09.04 09:19:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: D:\Thunderbird\components [2011.09.01 20:58:07 | 000,000,000 | ---D | M]
 
[2012.01.12 16:47:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
 
O1 HOSTS File: ([2011.12.21 10:04:28 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Java\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Malwarebytes Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Ptipbmf] C:\WINDOWS\System32\ptipbmf.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284497531750 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284547224953 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9514F494-7C4D-4204-B56E-929252888553}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) -C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.14 21:35:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: aux - C:\WINDOWS\System32\ctwdm32.dll (Creative Technology Ltd.)
Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3fhg - C:\WINDOWS\System32\mp3fhg.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.12 17:10:32 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.01.12 16:51:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2012.01.12 16:51:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.01.12 16:51:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.01.12 16:51:35 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.12 16:49:57 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien
[2012.01.12 16:49:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads
[2012.01.12 16:49:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia
[2012.01.12 16:49:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe
[2012.01.12 16:47:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2012.01.12 16:47:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
[2012.01.12 16:47:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
[2012.01.11 22:48:33 | 000,000,000 | ---D | C] -- C:\Programme\D95A2
[2012.01.11 22:47:58 | 000,000,000 | ---D | C] -- C:\Programme\51BCB
[2012.01.11 22:47:23 | 000,000,000 | ---D | C] -- C:\Programme\LP
[2011.12.21 10:00:42 | 000,000,000 | ---D | C] -- C:\Programme\OpenVPN Technologies
[63 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[31 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.12 17:53:41 | 000,013,678 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.12 17:53:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.12 17:53:18 | 000,280,720 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2012.01.12 17:51:37 | 000,002,137 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2012.01.12 17:51:28 | 000,212,641 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.01.12 16:51:37 | 000,000,541 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[63 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[31 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.12 16:51:37 | 000,000,541 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2011.08.05 14:45:05 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2010.09.21 22:07:29 | 000,000,042 | ---- | C] () -- C:\WINDOWS\oodjobd.INI
[2010.09.18 09:06:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PAStiSvc.exe
[2010.09.15 10:04:05 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.09.15 10:04:04 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.09.15 10:04:03 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.09.15 10:04:03 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.09.15 10:04:02 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.09.15 08:16:27 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2010.09.15 08:16:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2010.09.15 08:05:44 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.09.15 06:56:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.09.14 22:20:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.09.14 22:19:52 | 000,220,040 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.09.14 21:37:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.09.14 21:32:57 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.02.18 13:44:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.02.18 13:44:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009.02.18 13:44:00 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.02.18 13:44:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2009.02.18 13:44:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.02.18 13:44:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009.02.18 13:44:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009.02.18 13:44:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008.04.14 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.04.14 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.04.14 13:00:00 | 000,485,648 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2008.04.14 13:00:00 | 000,463,704 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.04.14 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.04.14 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2008.04.14 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.04.14 13:00:00 | 000,095,772 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2008.04.14 13:00:00 | 000,078,762 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.04.14 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.04.14 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2008.04.14 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.04.14 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.04.14 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.04.14 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008.04.14 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007.04.03 15:18:26 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007.04.03 15:18:06 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
 
========== LOP Check ==========
 
[2012.01.12 16:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
[2011.08.04 17:36:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
[2010.09.15 12:12:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CambridgeSoft
[2011.08.15 13:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2010.09.15 08:09:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.09.15 08:16:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2011.06.11 16:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mestrelab Research S.L
[2011.03.03 17:49:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
[2011.03.03 17:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence
[2010.09.15 12:16:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Thomson.ResearchSoft.Installers
[2010.09.15 08:48:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.09.15 08:47:28 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.12 16:49:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe
[2012.01.12 16:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
[2012.01.12 16:49:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia
[2012.01.12 16:51:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2012.01.12 16:47:43 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft
[2012.01.12 16:47:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
[2011.08.04 17:36:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.09.14 23:19:03 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.09.14 23:19:03 | 001,089,536 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.09.14 23:19:03 | 000,458,752 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[63 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
<          >

< End of report >

Könntet ihr mir vielleicht weiterhelfen? :)


Vielen Dank schonmal!

cosinus 13.01.2012 19:40
Zitat:
F:\Downloads\stuff\kkrieger.exe (Malware.Packer)
Was bitte soll das sein und aus welcher Quelle stammt das?

blimsch 13.01.2012 20:19
Bei der Datei handelts sich um das 96k Game kkrieger... siehe theprodukkt.com

Hat vor n paar Jahren mal nen Entwicklerpreis gewonnen weils eben nur wenige kilobyte groß ist...
ich würde meine hand zwar nicht dafür ins Feuer legen, aber ich schätze nicht, dass das die Wurzel allen Übels ist. Die File hab ich bestimmt schon seit 5 Jahren...

cosinus 13.01.2012 20:22
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

blimsch 13.01.2012 20:28
hier die neue log:

Code:
OTL logfile created on: 13.01.2012 20:24:03 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,74 Gb Available Physical Memory | 91,46% Memory free
4,85 Gb Paging File | 4,78 Gb Available in Paging File | 98,65% Paging File free
Paging file location(s): C:\pagefile.sys 2046 2046 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 12,10 Gb Total Space | 2,16 Gb Free Space | 17,88% Space Free | Partition Type: NTFS
Drive D: | 14,26 Gb Total Space | 8,82 Gb Free Space | 61,86% Space Free | Partition Type: NTFS
Drive E: | 29,29 Gb Total Space | 29,23 Gb Free Space | 99,78% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 7,81 Gb Free Space | 53,31% Space Free | Partition Type: NTFS
Drive H: | 26,60 Gb Total Space | 26,53 Gb Free Space | 99,76% Space Free | Partition Type: NTFS
 
Computer Name: BLIMSCHS-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.12 16:56:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\Downloads\OTL.exe
PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.03.16 23:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- D:\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.05 14:28:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Stopped] -- D:\Java\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011.06.12 10:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.10.08 16:15:18 | 001,541,360 | ---- | M] (Sophos Plc) [Auto | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2010.10.08 16:15:13 | 000,163,056 | ---- | M] (Sophos Plc) [Unknown | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2010.09.21 17:16:17 | 000,230,640 | ---- | M] (Sophos Plc) [Auto | Stopped] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2010.09.15 08:48:42 | 000,435,008 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- D:\TuneUp 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.08.26 13:43:20 | 001,051,968 | ---- | M] (TuneUp Software) [Auto | Stopped] -- D:\TuneUp 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010.08.26 13:40:24 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010.08.24 21:56:30 | 002,281,800 | ---- | M] (O&O Software GmbH) [Auto | Stopped] -- D:\OO Defrag 14\oodag.exe -- (OODefragAgent)
SRV - [2010.06.04 12:23:16 | 000,097,520 | ---- | M] (Sophos Plc) [Unknown | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () [Auto | Stopped] -- D:\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2007.04.03 15:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- D:\Cisco VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005.01.14 08:32:38 | 000,053,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\PAStiSvc.exe -- (STI Simulator)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.08.19 01:46:06 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tapoas.sys -- (tapoas)
DRV - [2011.07.01 10:46:40 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2010.10.08 16:14:59 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2010.10.08 16:14:59 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2010.09.15 08:09:50 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.02.24 13:41:50 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- D:\TuneUp 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.08.21 17:41:02 | 000,025,728 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\androidusb.sys -- (androidusb)
DRV - [2009.08.14 17:08:50 | 000,105,984 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbser.sys -- (qcusbser)
DRV - [2008.10.09 14:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV - [2008.05.23 09:38:25 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2008.04.13 23:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007.04.03 15:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007.01.31 12:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005.10.18 10:48:38 | 000,154,752 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PA707UCM.SYS -- (PAC7311)
DRV - [2005.01.26 07:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2003.08.06 09:43:04 | 000,159,744 | R--- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003.07.02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003.05.15 17:09:32 | 000,043,136 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2001.08.17 12:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Creative-SoundFont-Verwaltungstreiber (WDM)
DRV - [2001.08.17 12:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Creative-Schnittstellen-Verwaltungstreiber (WDM)
DRV - [2001.08.17 12:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001.08.17 12:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=12.0: D:\ChemDraw 12\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=12.0: D:\ChemDraw 12\ChemDraw\npcdp32.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: D:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\jqs@sun.com: D:\Java\lib\deploy\jqs\ff [2011.08.05 14:28:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: D:\Firefox\components [2011.12.22 08:08:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: D:\Firefox\plugins [2011.09.04 09:19:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: D:\Thunderbird\components [2011.09.01 20:58:07 | 000,000,000 | ---D | M]
 
[2012.01.12 16:47:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
 
O1 HOSTS File: ([2011.12.21 10:04:28 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Java\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Malwarebytes Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Ptipbmf] C:\WINDOWS\System32\ptipbmf.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284497531750 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284547224953 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9514F494-7C4D-4204-B56E-929252888553}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) -C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.14 21:35:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: aux - C:\WINDOWS\System32\ctwdm32.dll (Creative Technology Ltd.)
Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3fhg - C:\WINDOWS\System32\mp3fhg.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.12 23:12:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\EndNote
[2012.01.12 23:12:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun
[2012.01.12 18:56:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\WinRAR
[2012.01.12 17:10:32 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.01.12 16:51:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2012.01.12 16:51:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.01.12 16:51:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.01.12 16:51:35 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.12 16:49:57 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien
[2012.01.12 16:49:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads
[2012.01.12 16:49:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia
[2012.01.12 16:49:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe
[2012.01.12 16:47:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2012.01.12 16:47:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
[2012.01.12 16:47:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
[2012.01.11 22:48:33 | 000,000,000 | ---D | C] -- C:\Programme\D95A2
[2012.01.11 22:47:58 | 000,000,000 | ---D | C] -- C:\Programme\51BCB
[2012.01.11 22:47:23 | 000,000,000 | ---D | C] -- C:\Programme\LP
[2011.12.21 10:00:42 | 000,000,000 | ---D | C] -- C:\Programme\OpenVPN Technologies
[63 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[31 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.13 19:46:32 | 000,013,678 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.13 19:45:51 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.13 19:45:46 | 000,283,272 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2012.01.12 23:12:07 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.01.12 17:51:37 | 000,002,137 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2012.01.12 17:51:28 | 000,212,641 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.01.12 16:51:37 | 000,000,541 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[63 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[31 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.12 20:25:19 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.01.12 16:51:37 | 000,000,541 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2011.08.05 14:45:05 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2010.09.21 22:07:29 | 000,000,042 | ---- | C] () -- C:\WINDOWS\oodjobd.INI
[2010.09.18 09:06:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PAStiSvc.exe
[2010.09.15 10:04:05 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.09.15 10:04:04 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.09.15 10:04:03 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.09.15 10:04:03 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.09.15 10:04:02 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.09.15 08:16:27 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2010.09.15 08:16:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2010.09.15 08:05:44 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.09.15 06:56:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.09.14 22:20:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.09.14 22:19:52 | 000,220,040 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.09.14 21:37:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.09.14 21:32:57 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.02.18 13:44:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.02.18 13:44:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009.02.18 13:44:00 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.02.18 13:44:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2009.02.18 13:44:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.02.18 13:44:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009.02.18 13:44:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009.02.18 13:44:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008.04.14 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.04.14 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.04.14 13:00:00 | 000,485,648 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2008.04.14 13:00:00 | 000,463,704 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.04.14 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.04.14 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2008.04.14 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.04.14 13:00:00 | 000,095,772 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2008.04.14 13:00:00 | 000,078,762 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.04.14 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.04.14 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2008.04.14 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.04.14 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.04.14 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.04.14 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008.04.14 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007.04.03 15:18:26 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007.04.03 15:18:06 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
 
========== LOP Check ==========
 
[2012.01.12 16:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
[2012.01.12 23:12:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\EndNote
[2011.08.04 17:36:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
[2010.09.15 12:12:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CambridgeSoft
[2011.08.15 13:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2010.09.15 08:09:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.09.15 08:16:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2011.06.11 16:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mestrelab Research S.L
[2011.03.03 17:49:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
[2011.03.03 17:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence
[2010.09.15 12:16:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Thomson.ResearchSoft.Installers
[2010.09.15 08:48:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.09.15 08:47:28 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.12 16:49:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe
[2012.01.12 16:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
[2012.01.12 23:12:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\EndNote
[2012.01.12 16:49:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia
[2012.01.12 16:51:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2012.01.12 20:43:40 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft
[2012.01.12 16:47:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
[2012.01.12 23:12:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun
[2011.08.04 17:36:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
[2012.01.12 18:56:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.09.14 23:19:03 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.09.14 23:19:03 | 001,089,536 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.09.14 23:19:03 | 000,458,752 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[63 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
<          >

< End of report >

cosinus 13.01.2012 23:14
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
[2012.01.11 22:48:33 | 000,000,000 | ---D | C] -- C:\Programme\D95A2
[2012.01.11 22:47:58 | 000,000,000 | ---D | C] -- C:\Programme\51BCB
[2012.01.11 22:47:23 | 000,000,000 | ---D | C] -- C:\Programme\LP
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

blimsch 14.01.2012 00:48
okay, auch das hab ich gemacht, hier die log:

Code:
All processes killed
========== OTL ==========
C:\Programme\D95A2 folder moved successfully.
C:\Programme\51BCB folder moved successfully.
C:\Programme\LP\1548 folder moved successfully.
C:\Programme\LP\1546 folder moved successfully.
C:\Programme\LP folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 124189 bytes
->Temporary Internet Files folder emptied: 50578 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 87897364 bytes
->Flash cache emptied: 1013 bytes
 
User: All Users
 
User: Blimsch
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352202 bytes
%systemroot%\System32 .tmp files removed: 46843466 bytes
%systemroot%\System32\dllcache .tmp files removed: 7672800 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3500452 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 142,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01142012_003846
Direkt nach dem Fix hat sich keine Log-Datei geöffnet, hab also mal die Logfile aus dem _OTL ordner nach dem Neustart gepostet.

soll ich den Ordner hier auch noch hochladen oder brauchst du nur die log?

cosinus 14.01.2012 13:58
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

blimsch 14.01.2012 14:30
Hier die Log vom TDSS Killer:

Code:
14:25:49.0937 1244        TDSS rootkit removing tool 2.7.1.0 Jan 13 2012 15:24:05
14:25:50.0125 1244        ============================================================
14:25:50.0125 1244        Current date / time: 2012/01/14 14:25:50.0125
14:25:50.0125 1244        SystemInfo:
14:25:50.0125 1244       
14:25:50.0125 1244        OS Version: 5.1.2600 ServicePack: 3.0
14:25:50.0125 1244        Product type: Workstation
14:25:50.0125 1244        ComputerName: BLIMSCHS-PC
14:25:50.0125 1244        UserName: Blimsch
14:25:50.0125 1244        Windows directory: C:\WINDOWS
14:25:50.0125 1244        System windows directory: C:\WINDOWS
14:25:50.0125 1244        Processor architecture: Intel x86
14:25:50.0125 1244        Number of processors: 1
14:25:50.0125 1244        Page size: 0x1000
14:25:50.0125 1244        Boot type: Normal boot
14:25:50.0125 1244        ============================================================
14:25:51.0671 1244        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000054
14:25:51.0671 1244        Drive \Device\Harddisk1\DR1 - Size: 0xDF99E6000, SectorSize: 0x200, Cylinders: 0x1C81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000054
14:25:51.0765 1244        Initialize success
14:26:47.0953 3604        ============================================================
14:26:47.0953 3604        Scan started
14:26:47.0953 3604        Mode: Manual; SigCheck; TDLFS;
14:26:47.0953 3604        ============================================================
14:26:48.0421 3604        Abiosdsk - ok
14:26:48.0453 3604        abp480n5 - ok
14:26:48.0500 3604        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:26:49.0468 3604        ACPI - ok
14:26:49.0546 3604        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
14:26:49.0765 3604        ACPIEC - ok
14:26:49.0796 3604        adpu160m - ok
14:26:49.0906 3604        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
14:26:50.0140 3604        aec - ok
14:26:50.0187 3604        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
14:26:50.0250 3604        AFD - ok
14:26:50.0281 3604        Aha154x - ok
14:26:50.0312 3604        aic78u2 - ok
14:26:50.0359 3604        aic78xx - ok
14:26:50.0421 3604        AliIde - ok
14:26:50.0453 3604        AmdK7          (3a0dafac778236559c14c7203fb550eb) C:\WINDOWS\system32\DRIVERS\amdk7.sys
14:26:50.0656 3604        AmdK7 - ok
14:26:50.0687 3604        amsint - ok
14:26:50.0734 3604        androidusb      (f71671248134ea39bfd10401ee5fd825) C:\WINDOWS\system32\Drivers\androidusb.sys
14:26:50.0812 3604        androidusb - ok
14:26:50.0859 3604        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
14:26:51.0078 3604        Arp1394 - ok
14:26:51.0125 3604        asc - ok
14:26:51.0156 3604        asc3350p - ok
14:26:51.0187 3604        asc3550 - ok
14:26:51.0281 3604        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:26:51.0515 3604        AsyncMac - ok
14:26:51.0546 3604        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
14:26:51.0765 3604        atapi - ok
14:26:51.0828 3604        Atdisk - ok
14:26:51.0875 3604        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:26:52.0109 3604        Atmarpc - ok
14:26:52.0156 3604        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
14:26:52.0359 3604        audstub - ok
14:26:52.0421 3604        bcm4sbxp        (068523d2cd260069b19ad68adea0d739) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
14:26:52.0468 3604        bcm4sbxp - ok
14:26:52.0515 3604        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
14:26:52.0750 3604        Beep - ok
14:26:52.0796 3604        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
14:26:53.0046 3604        cbidf2k - ok
14:26:53.0093 3604        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
14:26:53.0312 3604        CCDECODE - ok
14:26:53.0359 3604        cd20xrnt - ok
14:26:53.0406 3604        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
14:26:53.0640 3604        Cdaudio - ok
14:26:53.0671 3604        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
14:26:53.0921 3604        Cdfs - ok
14:26:53.0953 3604        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:26:54.0187 3604        Cdrom - ok
14:26:54.0203 3604        Changer - ok
14:26:54.0281 3604        CmdIde - ok
14:26:54.0359 3604        Cpqarray - ok
14:26:54.0406 3604        ctljystk        (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
14:26:54.0609 3604        ctljystk - ok
14:26:54.0656 3604        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\WINDOWS\system32\DRIVERS\CVirtA.sys
14:26:54.0718 3604        CVirtA - ok
14:26:54.0765 3604        CVPNDRVA        (1c2999966f0f36aa44eaecbee70cf770) C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
14:26:54.0906 3604        CVPNDRVA ( UnsignedFile.Multi.Generic ) - warning
14:26:54.0906 3604        CVPNDRVA - detected UnsignedFile.Multi.Generic (1)
14:26:54.0937 3604        dac2w2k - ok
14:26:54.0984 3604        dac960nt - ok
14:26:55.0046 3604        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
14:26:55.0281 3604        Disk - ok
14:26:55.0359 3604        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
14:26:55.0609 3604        dmboot - ok
14:26:55.0656 3604        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
14:26:55.0890 3604        dmio - ok
14:26:55.0937 3604        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
14:26:56.0140 3604        dmload - ok
14:26:56.0203 3604        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
14:26:56.0421 3604        DMusic - ok
14:26:56.0453 3604        DNE            (7b4fdfbe97c047175e613aa96f3de987) C:\WINDOWS\system32\DRIVERS\dne2000.sys
14:26:56.0515 3604        DNE - ok
14:26:56.0562 3604        dpti2o - ok
14:26:56.0593 3604        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
14:26:56.0828 3604        drmkaud - ok
14:26:56.0890 3604        emu10k          (01f83e1b5dce05f5cb7d99113ca9e890) C:\WINDOWS\system32\drivers\emu10k1m.sys
14:26:57.0093 3604        emu10k - ok
14:26:57.0140 3604        emu10k1        (7ffa171cce6a8bfc774862a578ba39a2) C:\WINDOWS\system32\drivers\ctlfacem.sys
14:26:57.0359 3604        emu10k1 - ok
14:26:57.0421 3604        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
14:26:57.0656 3604        Fastfat - ok
14:26:57.0703 3604        fasttx2k        (3acbc73531dedd69837fe73b1623d49c) C:\WINDOWS\system32\DRIVERS\fasttx2k.sys
14:26:57.0796 3604        fasttx2k - ok
14:26:57.0828 3604        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
14:26:58.0015 3604        Fdc - ok
14:26:58.0062 3604        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
14:26:58.0281 3604        Fips - ok
14:26:58.0312 3604        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
14:26:58.0500 3604        Flpydisk - ok
14:26:58.0546 3604        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
14:26:58.0765 3604        FltMgr - ok
14:26:58.0796 3604        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:26:59.0000 3604        Fs_Rec - ok
14:26:59.0046 3604        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:26:59.0250 3604        Ftdisk - ok
14:26:59.0281 3604        gameenum        (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
14:26:59.0500 3604        gameenum - ok
14:26:59.0546 3604        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:26:59.0718 3604        Gpc - ok
14:26:59.0796 3604        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:26:59.0968 3604        hidusb - ok
14:27:00.0031 3604        hpn - ok
14:27:00.0109 3604        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
14:27:00.0156 3604        HTTP - ok
14:27:00.0187 3604        i2omgmt - ok
14:27:00.0218 3604        i2omp - ok
14:27:00.0281 3604        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\drivers\i8042prt.sys
14:27:00.0484 3604        i8042prt - ok
14:27:00.0531 3604        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
14:27:00.0703 3604        Imapi - ok
14:27:00.0750 3604        ini910u - ok
14:27:00.0781 3604        IntelIde - ok
14:27:00.0843 3604        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
14:27:01.0031 3604        Ip6Fw - ok
14:27:01.0093 3604        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:27:01.0265 3604        IpFilterDriver - ok
14:27:01.0296 3604        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:27:01.0515 3604        IpInIp - ok
14:27:01.0546 3604        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:27:01.0718 3604        IpNat - ok
14:27:01.0750 3604        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:27:01.0953 3604        IPSec - ok
14:27:02.0000 3604        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
14:27:02.0078 3604        IRENUM - ok
14:27:02.0140 3604        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:27:02.0328 3604        isapnp - ok
14:27:02.0359 3604        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:27:02.0562 3604        Kbdclass - ok
14:27:02.0593 3604        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:27:02.0781 3604        kbdhid - ok
14:27:02.0828 3604        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
14:27:03.0000 3604        kmixer - ok
14:27:03.0046 3604        KMWDFILTER      (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\WINDOWS\system32\DRIVERS\KMWDFILTER.sys
14:27:03.0093 3604        KMWDFILTER - ok
14:27:03.0156 3604        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
14:27:03.0265 3604        KSecDD - ok
14:27:03.0312 3604        lbrtfdc - ok
14:27:03.0406 3604        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
14:27:03.0484 3604        MBAMProtector - ok
14:27:03.0546 3604        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
14:27:03.0750 3604        mnmdd - ok
14:27:03.0796 3604        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
14:27:03.0984 3604        Modem - ok
14:27:04.0031 3604        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:27:04.0203 3604        Mouclass - ok
14:27:04.0250 3604        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:27:04.0390 3604        mouhid - ok
14:27:04.0437 3604        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
14:27:04.0609 3604        MountMgr - ok
14:27:04.0656 3604        mraid35x - ok
14:27:04.0687 3604        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:27:04.0859 3604        MRxDAV - ok
14:27:04.0906 3604        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:27:05.0015 3604        MRxSmb - ok
14:27:05.0093 3604        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
14:27:05.0250 3604        Msfs - ok
14:27:05.0312 3604        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:27:05.0453 3604        MSKSSRV - ok
14:27:05.0531 3604        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:27:05.0671 3604        MSPCLOCK - ok
14:27:05.0687 3604        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
14:27:05.0859 3604        MSPQM - ok
14:27:05.0906 3604        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:27:06.0046 3604        mssmbios - ok
14:27:06.0078 3604        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
14:27:06.0250 3604        MSTEE - ok
14:27:06.0312 3604        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
14:27:06.0343 3604        Mup - ok
14:27:06.0390 3604        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
14:27:06.0546 3604        NABTSFEC - ok
14:27:06.0593 3604        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
14:27:06.0750 3604        NDIS - ok
14:27:06.0796 3604        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
14:27:06.0968 3604        NdisIP - ok
14:27:07.0015 3604        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:27:07.0078 3604        NdisTapi - ok
14:27:07.0109 3604        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:27:07.0265 3604        Ndisuio - ok
14:27:07.0312 3604        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:27:07.0453 3604        NdisWan - ok
14:27:07.0500 3604        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
14:27:07.0546 3604        NDProxy - ok
14:27:07.0578 3604        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
14:27:07.0734 3604        NetBIOS - ok
14:27:07.0765 3604        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
14:27:07.0937 3604        NetBT - ok
14:27:08.0031 3604        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
14:27:08.0187 3604        NIC1394 - ok
14:27:08.0234 3604        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
14:27:08.0406 3604        Npfs - ok
14:27:08.0484 3604        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
14:27:08.0703 3604        Ntfs - ok
14:27:08.0734 3604        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
14:27:08.0921 3604        Null - ok
14:27:09.0140 3604        nv              (0ae3a22dbe88dc219f8c0fdd30239e4f) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
14:27:09.0562 3604        nv - ok
14:27:09.0625 3604        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:27:09.0812 3604        NwlnkFlt - ok
14:27:09.0843 3604        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:27:10.0046 3604        NwlnkFwd - ok
14:27:10.0062 3604        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
14:27:10.0218 3604        ohci1394 - ok
14:27:10.0296 3604        PAC7311        (2085d5168fc0c56bb13304d180d244b6) C:\WINDOWS\system32\DRIVERS\PA707UCM.SYS
14:27:10.0468 3604        PAC7311 - ok
14:27:10.0531 3604        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
14:27:10.0671 3604        Parport - ok
14:27:10.0718 3604        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
14:27:10.0859 3604        PartMgr - ok
14:27:10.0906 3604        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
14:27:11.0062 3604        ParVdm - ok
14:27:11.0093 3604        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
14:27:11.0265 3604        PCI - ok
14:27:11.0296 3604        PCIDump - ok
14:27:11.0328 3604        PCIIde - ok
14:27:11.0375 3604        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
14:27:11.0546 3604        Pcmcia - ok
14:27:11.0593 3604        PDCOMP - ok
14:27:11.0625 3604        PDFRAME - ok
14:27:11.0656 3604        PDRELI - ok
14:27:11.0687 3604        PDRFRAME - ok
14:27:11.0734 3604        perc2 - ok
14:27:11.0781 3604        perc2hib - ok
14:27:11.0890 3604        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:27:12.0046 3604        PptpMiniport - ok
14:27:12.0078 3604        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
14:27:12.0250 3604        PSched - ok
14:27:12.0281 3604        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:27:12.0484 3604        Ptilink - ok
14:27:12.0531 3604        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
14:27:12.0609 3604        PxHelp20 - ok
14:27:12.0671 3604        qcusbser        (59b96dbe2acb872cc1c9f4c14dbb7690) C:\WINDOWS\system32\DRIVERS\qcusbser.sys
14:27:12.0859 3604        qcusbser - ok
14:27:12.0875 3604        ql1080 - ok
14:27:12.0921 3604        Ql10wnt - ok
14:27:12.0953 3604        ql12160 - ok
14:27:13.0000 3604        ql1240 - ok
14:27:13.0031 3604        ql1280 - ok
14:27:13.0078 3604        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:27:13.0234 3604        RasAcd - ok
14:27:13.0265 3604        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:27:13.0437 3604        Rasl2tp - ok
14:27:13.0468 3604        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:27:13.0640 3604        RasPppoe - ok
14:27:13.0687 3604        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
14:27:13.0828 3604        Raspti - ok
14:27:13.0875 3604        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:27:14.0031 3604        Rdbss - ok
14:27:14.0062 3604        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:27:14.0234 3604        RDPCDD - ok
14:27:14.0281 3604        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:27:14.0453 3604        rdpdr - ok
14:27:14.0500 3604        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
14:27:14.0546 3604        RDPWD - ok
14:27:14.0609 3604        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
14:27:14.0765 3604        redbook - ok
14:27:14.0859 3604        RT73 - ok
14:27:14.0921 3604        SAVOnAccessControl (d9df915972694b5274facc8d00492acd) C:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys
14:27:15.0000 3604        SAVOnAccessControl - ok
14:27:15.0046 3604        SAVOnAccessFilter (31b35cca652a3553fa4fb99ea79c35bf) C:\WINDOWS\system32\DRIVERS\savonaccessfilter.sys
14:27:15.0078 3604        SAVOnAccessFilter - ok
14:27:15.0156 3604        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:27:15.0250 3604        Secdrv - ok
14:27:15.0296 3604        serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
14:27:15.0453 3604        serenum - ok
14:27:15.0500 3604        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
14:27:15.0640 3604        Serial - ok
14:27:15.0750 3604        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
14:27:15.0921 3604        Sfloppy - ok
14:27:15.0968 3604        sfman          (0b1a5e9cacb5cdd54a2815107bd7c772) C:\WINDOWS\system32\drivers\sfmanm.sys
14:27:16.0234 3604        sfman - ok
14:27:16.0281 3604        Simbad - ok
14:27:16.0312 3604        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
14:27:16.0468 3604        SLIP - ok
14:27:16.0531 3604        SophosBootDriver (3bdf94e0827d13e44249a646f6c0eb7c) C:\WINDOWS\system32\DRIVERS\SophosBootDriver.sys
14:27:16.0593 3604        SophosBootDriver - ok
14:27:16.0625 3604        Sparrow - ok
14:27:16.0656 3604        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
14:27:16.0828 3604        splitter - ok
14:27:16.0890 3604        sptd            (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys
14:27:16.0890 3604        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
14:27:16.0906 3604        sptd ( LockedFile.Multi.Generic ) - warning
14:27:16.0906 3604        sptd - detected LockedFile.Multi.Generic (1)
14:27:16.0937 3604        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
14:27:17.0031 3604        sr - ok
14:27:17.0093 3604        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
14:27:17.0156 3604        Srv - ok
14:27:17.0218 3604        StarOpen        (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
14:27:17.0234 3604        StarOpen ( UnsignedFile.Multi.Generic ) - warning
14:27:17.0234 3604        StarOpen - detected UnsignedFile.Multi.Generic (1)
14:27:17.0281 3604        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
14:27:17.0437 3604        streamip - ok
14:27:17.0484 3604        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
14:27:17.0640 3604        swenum - ok
14:27:17.0671 3604        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
14:27:17.0843 3604        swmidi - ok
14:27:17.0875 3604        symc810 - ok
14:27:17.0906 3604        symc8xx - ok
14:27:17.0937 3604        sym_hi - ok
14:27:17.0984 3604        sym_u3 - ok
14:27:18.0015 3604        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
14:27:18.0171 3604        sysaudio - ok
14:27:18.0218 3604        tap0901        (98a1e6bc9f766b0b0a5bf00af847ef20) C:\WINDOWS\system32\DRIVERS\tap0901.sys
14:27:18.0234 3604        tap0901 ( UnsignedFile.Multi.Generic ) - warning
14:27:18.0234 3604        tap0901 - detected UnsignedFile.Multi.Generic (1)
14:27:18.0312 3604        tapoas          (827c8058c284ff0013e4462efe2591a3) C:\WINDOWS\system32\DRIVERS\tapoas.sys
14:27:18.0328 3604        tapoas ( UnsignedFile.Multi.Generic ) - warning
14:27:18.0328 3604        tapoas - detected UnsignedFile.Multi.Generic (1)
14:27:18.0375 3604        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:27:18.0468 3604        Tcpip - ok
14:27:18.0515 3604        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
14:27:18.0656 3604        TDPIPE - ok
14:27:18.0687 3604        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
14:27:18.0843 3604        TDTCP - ok
14:27:18.0875 3604        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
14:27:19.0031 3604        TermDD - ok
14:27:19.0109 3604        TosIde - ok
14:27:19.0187 3604        TuneUpUtilitiesDrv - ok
14:27:19.0218 3604        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
14:27:19.0375 3604        Udfs - ok
14:27:19.0406 3604        ultra - ok
14:27:19.0468 3604        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
14:27:19.0640 3604        Update - ok
14:27:19.0687 3604        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
14:27:19.0859 3604        usbaudio - ok
14:27:19.0875 3604        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:27:20.0046 3604        usbccgp - ok
14:27:20.0078 3604        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:27:20.0234 3604        usbehci - ok
14:27:20.0265 3604        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:27:20.0421 3604        usbhub - ok
14:27:20.0468 3604        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:27:20.0609 3604        USBSTOR - ok
14:27:20.0640 3604        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:27:20.0796 3604        usbuhci - ok
14:27:20.0843 3604        usb_rndisx      (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
14:27:20.0984 3604        usb_rndisx - ok
14:27:21.0015 3604        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
14:27:21.0171 3604        VgaSave - ok
14:27:21.0218 3604        viaagp1        (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
14:27:21.0250 3604        viaagp1 - ok
14:27:21.0281 3604        ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
14:27:21.0453 3604        ViaIde - ok
14:27:21.0484 3604        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
14:27:21.0640 3604        VolSnap - ok
14:27:21.0703 3604        vsdatant        (27b3dd12a19eec50220df15b64913dda) C:\WINDOWS\system32\vsdatant.sys
14:27:22.0015 3604        vsdatant - ok
14:27:22.0078 3604        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:27:22.0234 3604        Wanarp - ok
14:27:22.0281 3604        Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
14:27:22.0359 3604        Wdf01000 - ok
14:27:22.0390 3604        WDICA - ok
14:27:22.0437 3604        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
14:27:22.0593 3604        wdmaud - ok
14:27:22.0796 3604        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
14:27:22.0937 3604        WSTCODEC - ok
14:27:23.0000 3604        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:27:23.0046 3604        WudfPf - ok
14:27:23.0093 3604        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:27:23.0140 3604        WudfRd - ok
14:27:23.0250 3604        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
14:27:23.0515 3604        \Device\Harddisk0\DR0 - ok
14:27:23.0531 3604        MBR (0x1B8)    (587f1bf40479d66675a13b610e5e7f9e) \Device\Harddisk1\DR1
14:27:23.0656 3604        \Device\Harddisk1\DR1 - ok
14:27:23.0687 3604        Boot (0x1200)  (324f4450a0dc71c583488d2ed8e55688) \Device\Harddisk0\DR0\Partition0
14:27:23.0687 3604        \Device\Harddisk0\DR0\Partition0 - ok
14:27:23.0703 3604        Boot (0x1200)  (13a1db200670938a173c36d71c435d22) \Device\Harddisk1\DR1\Partition0
14:27:23.0703 3604        \Device\Harddisk1\DR1\Partition0 - ok
14:27:23.0703 3604        ============================================================
14:27:23.0703 3604        Scan finished
14:27:23.0703 3604        ============================================================
14:27:23.0843 3792        Detected object count: 5
14:27:23.0843 3792        Actual detected object count: 5
14:28:03.0484 3792        CVPNDRVA ( UnsignedFile.Multi.Generic ) - skipped by user
14:28:03.0484 3792        CVPNDRVA ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:28:03.0484 3792        sptd ( LockedFile.Multi.Generic ) - skipped by user
14:28:03.0484 3792        sptd ( LockedFile.Multi.Generic ) - User select action: Skip
14:28:03.0500 3792        StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
14:28:03.0500 3792        StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:28:03.0500 3792        tap0901 ( UnsignedFile.Multi.Generic ) - skipped by user
14:28:03.0500 3792        tap0901 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:28:03.0500 3792        tapoas ( UnsignedFile.Multi.Generic ) - skipped by user
14:28:03.0500 3792        tapoas ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 14.01.2012 16:08
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

blimsch 14.01.2012 16:18
kleines Problem:

kurz nachdem ich die TDSS Log gepostet hatte kam schon wieder dasselbe popup mit der Zahlungsaufforderung... ich könnte echt kotzen...
Bin daraufhin im Safeboot nicht als Admin sondern als User eingeloggt und hab zuerst Malwarebytes (vorher wieder aktualisiert) und dann ESET rüberlaufen lassen und wurde natürlich auch prompt fündig...
Anscheinend hatte der Admin keinen Zugriff auf die Userdaten... wieso das so ist, kann ich aber nicht sagen, hab mich selbst gewundert...

Hab die Logfiles im Anhang drin und hier ist jetzt noch ne OTL log, die ich eben erstellt habe mit den Custom Scan Parametern von oben im Post...

Code:
OTL logfile created on: 14.01.2012 15:51:14 - Run 3
OTL by OldTimer - Version 3.2.31.0    Folder = F:\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 85,00% Memory free
4,85 Gb Paging File | 4,64 Gb Available in Paging File | 95,87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 2046 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 12,10 Gb Total Space | 2,26 Gb Free Space | 18,63% Space Free | Partition Type: NTFS
Drive D: | 14,26 Gb Total Space | 8,82 Gb Free Space | 61,86% Space Free | Partition Type: NTFS
Drive E: | 29,29 Gb Total Space | 29,23 Gb Free Space | 99,78% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 7,80 Gb Free Space | 53,27% Space Free | Partition Type: NTFS
Drive H: | 26,60 Gb Total Space | 26,53 Gb Free Space | 99,76% Space Free | Partition Type: NTFS
 
Computer Name: BLIMSCHS-PC | User Name: Blimsch | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.14 15:01:13 | 000,190,464 | ---- | M] () -- C:\Programme\D95A2\lvvm.exe
PRC - [2012.01.12 16:56:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\Downloads\OTL.exe
PRC - [2012.01.11 22:48:04 | 000,175,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe
PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.14 15:01:13 | 000,190,464 | ---- | M] () -- C:\Programme\D95A2\lvvm.exe
MOD - [2012.01.11 22:48:04 | 000,175,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe
MOD - [2011.03.16 23:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010.03.15 10:28:22 | 000,141,824 | ---- | M] () -- D:\WinRAR\RarExt.dll
MOD - [2009.06.21 23:26:00 | 000,305,664 | ---- | M] () -- D:\TeraCopy\TeraCopyExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- D:\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.05 14:28:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Stopped] -- D:\Java\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011.06.12 10:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.10.08 16:15:18 | 001,541,360 | ---- | M] (Sophos Plc) [Auto | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2010.10.08 16:15:13 | 000,163,056 | ---- | M] (Sophos Plc) [Unknown | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2010.09.21 17:16:17 | 000,230,640 | ---- | M] (Sophos Plc) [Auto | Stopped] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2010.09.15 08:48:42 | 000,435,008 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- D:\TuneUp 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.08.26 13:43:20 | 001,051,968 | ---- | M] (TuneUp Software) [Auto | Stopped] -- D:\TuneUp 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010.08.26 13:40:24 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010.08.24 21:56:30 | 002,281,800 | ---- | M] (O&O Software GmbH) [Auto | Stopped] -- D:\OO Defrag 14\oodag.exe -- (OODefragAgent)
SRV - [2010.06.04 12:23:16 | 000,097,520 | ---- | M] (Sophos Plc) [Unknown | Stopped] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () [Auto | Stopped] -- D:\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2007.04.03 15:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- D:\Cisco VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005.01.14 08:32:38 | 000,053,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\PAStiSvc.exe -- (STI Simulator)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.08.19 01:46:06 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tapoas.sys -- (tapoas)
DRV - [2011.07.01 10:46:40 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2010.10.08 16:14:59 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2010.10.08 16:14:59 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2010.09.15 08:09:50 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.02.24 13:41:50 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- D:\TuneUp 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.08.21 17:41:02 | 000,025,728 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\androidusb.sys -- (androidusb)
DRV - [2009.08.14 17:08:50 | 000,105,984 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qcusbser.sys -- (qcusbser)
DRV - [2008.10.09 14:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV - [2008.05.23 09:38:25 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2008.04.13 23:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007.04.03 15:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007.01.31 12:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005.10.18 10:48:38 | 000,154,752 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PA707UCM.SYS -- (PAC7311)
DRV - [2005.01.26 07:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2003.08.06 09:43:04 | 000,159,744 | R--- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003.07.02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003.05.15 17:09:32 | 000,043,136 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2001.08.17 12:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Creative-SoundFont-Verwaltungstreiber (WDM)
DRV - [2001.08.17 12:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Creative-Schnittstellen-Verwaltungstreiber (WDM)
DRV - [2001.08.17 12:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001.08.17 12:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:59030
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {770d4d1a-a959-4353-95af-0e7a483bb4a0}:1.0.5
FF - prefs.js..extensions.enabledItems: DOISearch@shox.net:1.0
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search? ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=12.0: D:\ChemDraw 12\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=12.0: D:\ChemDraw 12\ChemDraw\npcdp32.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: D:\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\jqs@sun.com: D:\Java\lib\deploy\jqs\ff [2011.08.05 14:28:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: D:\Firefox\components [2011.12.22 08:08:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: D:\Firefox\plugins [2011.09.04 09:19:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: D:\Thunderbird\components [2011.09.01 20:58:07 | 000,000,000 | ---D | M]
 
[2010.09.15 07:00:52 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Extensions
[2010.09.15 07:00:52 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.09 11:26:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\extensions
[2010.09.15 13:39:12 | 000,000,000 | ---D | M] (Mozilla Handle/DOI Protocol Handler) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\extensions\{770d4d1a-a959-4353-95af-0e7a483bb4a0}
[2012.01.09 11:26:45 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.09.15 13:39:11 | 000,000,000 | ---D | M] (DOI Search) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\extensions\DOISearch@shox.net
[2011.03.18 10:59:54 | 000,000,000 | ---D | M] (Personas) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\extensions\personas@christopher.beard
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BLIMSCH\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\1TT8LB1U.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
 
O1 HOSTS File: ([2012.01.14 00:38:55 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Java\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Malwarebytes Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Ptipbmf] C:\WINDOWS\System32\ptipbmf.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] D:\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Dokumente und Einstellungen\Blimsch\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Blimsch\Startmenü\Programme\Autostart\Multidesk Desktop Manager.lnk = D:\Multidesk\MultiDesk.exe (smartcoder.net software development)
F3 - HKCU WinNT: Load - (C:\Programme\D95A2\lvvm.exe) -C:\Programme\D95A2\lvvm.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284497531750 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284547224953 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9514F494-7C4D-4204-B56E-929252888553}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) -C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe) -C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.14 21:35:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: aux - C:\WINDOWS\System32\ctwdm32.dll (Creative Technology Ltd.)
Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3fhg - C:\WINDOWS\System32\mp3fhg.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.14 14:31:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Malwarebytes
[2012.01.14 14:22:03 | 000,000,000 | ---D | C] -- C:\Programme\D95A2
[2012.01.14 14:21:53 | 000,000,000 | ---D | C] -- C:\Programme\LP
[2012.01.12 17:10:32 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.01.12 16:51:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.01.12 16:51:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.01.12 16:51:35 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.11 22:47:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9
[2012.01.11 22:47:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51
[2011.12.21 10:00:42 | 000,000,000 | ---D | C] -- C:\Programme\OpenVPN Technologies
[2011.12.18 08:24:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\gtk-2.0
[2011.12.18 08:18:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\webkit
[2011.12.18 08:18:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\midori
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.14 15:08:49 | 000,013,678 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.14 15:08:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.14 15:08:26 | 000,296,032 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2012.01.14 14:23:47 | 000,002,137 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2012.01.14 14:23:44 | 000,212,641 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.01.14 00:38:55 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2012.01.12 23:12:07 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.01.12 16:51:37 | 000,000,541 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2011.12.21 17:53:00 | 000,023,040 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.18 08:27:22 | 000,000,218 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\recently-used.xbel
[2011.12.17 21:20:51 | 000,001,038 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Startmenü\Programme\Autostart\Dropbox.lnk
[2011.12.17 21:20:51 | 000,001,038 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Desktop\Dropbox.lnk
 
========== Files Created - No Company Name ==========
 
[2012.01.12 20:25:19 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.01.12 16:51:37 | 000,000,541 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2011.12.18 08:27:22 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\recently-used.xbel
[2011.11.01 11:25:06 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\$_hpcst$.hpc
[2011.08.06 09:17:50 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2011.08.05 14:45:05 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2010.09.21 22:07:29 | 000,000,042 | ---- | C] () -- C:\WINDOWS\oodjobd.INI
[2010.09.18 09:06:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PAStiSvc.exe
[2010.09.17 12:38:07 | 000,023,040 | ---- | C] () -- C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.15 10:04:05 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.09.15 10:04:04 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.09.15 10:04:03 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.09.15 10:04:03 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.09.15 10:04:02 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.09.15 08:16:27 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2010.09.15 08:16:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2010.09.15 08:05:44 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.09.15 06:56:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.09.14 22:20:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.09.14 22:19:52 | 000,220,040 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.09.14 21:37:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.09.14 21:32:57 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.02.18 13:44:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.02.18 13:44:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009.02.18 13:44:00 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.02.18 13:44:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2009.02.18 13:44:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.02.18 13:44:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009.02.18 13:44:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009.02.18 13:44:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008.04.14 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.04.14 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.04.14 13:00:00 | 000,485,648 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2008.04.14 13:00:00 | 000,463,704 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.04.14 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.04.14 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2008.04.14 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.04.14 13:00:00 | 000,095,772 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2008.04.14 13:00:00 | 000,078,762 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.04.14 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.04.14 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2008.04.14 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.04.14 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.04.14 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.04.14 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008.04.14 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007.04.03 15:18:26 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007.04.03 15:18:06 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
 
========== LOP Check ==========
 
[2010.09.15 12:12:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CambridgeSoft
[2011.08.15 13:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2010.09.15 08:09:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.09.15 08:16:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2011.06.11 16:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mestrelab Research S.L
[2011.03.03 17:49:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
[2011.03.03 17:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence
[2010.09.15 12:16:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Thomson.ResearchSoft.Installers
[2010.09.15 08:48:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.09.15 08:47:28 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2012.01.11 22:47:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9
[2012.01.11 22:47:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51
[2011.02.25 22:23:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\benibela
[2011.05.06 19:24:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\bsnes
[2011.08.15 13:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Canneverbe Limited
[2010.09.15 10:26:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\DAEMON Tools Lite
[2012.01.14 14:23:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox
[2011.03.29 10:34:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\EndNote
[2010.09.15 06:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Foxit Software
[2011.09.07 10:31:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\gtk-2.0
[2010.09.15 08:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\ImgBurn
[2011.02.17 11:17:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\LibreOffice
[2011.06.11 16:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mestrelab Research S.L
[2010.10.15 18:11:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mp3tag
[2010.09.21 23:23:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\OpenOffice.org
[2011.09.01 15:15:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TeamViewer
[2012.01.11 22:34:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TeraCopy
[2010.09.15 07:00:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Thunderbird
[2010.09.15 10:19:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Trillian
[2010.09.14 21:42:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TrueCrypt
[2010.09.15 08:48:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TuneUp Software
[2011.11.05 14:50:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\uTorrent
[2011.08.05 14:49:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\xm1
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.11 22:47:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9
[2012.01.11 22:47:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51
[2010.09.15 12:59:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Adobe
[2011.02.25 22:23:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\benibela
[2011.05.06 19:24:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\bsnes
[2011.08.15 13:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Canneverbe Limited
[2010.09.15 10:26:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\DAEMON Tools Lite
[2012.01.14 14:23:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox
[2011.03.29 10:34:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\EndNote
[2010.09.15 06:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Foxit Software
[2011.09.07 10:31:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\gtk-2.0
[2010.09.14 21:39:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Identities
[2010.09.15 08:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\ImgBurn
[2011.02.17 11:17:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\LibreOffice
[2010.09.15 12:59:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Macromedia
[2012.01.14 14:31:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Malwarebytes
[2010.09.15 10:09:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Media Player Classic
[2011.06.11 16:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mestrelab Research S.L
[2011.11.01 11:28:38 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Microsoft
[2011.02.25 22:56:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\MiKTeX
[2010.09.15 06:56:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mozilla
[2010.10.15 18:11:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Mp3tag
[2010.09.21 23:23:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\OpenOffice.org
[2011.11.13 23:50:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Skype
[2010.09.15 08:17:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Sun
[2011.09.01 15:15:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TeamViewer
[2012.01.11 22:34:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TeraCopy
[2010.09.15 07:00:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Thunderbird
[2010.09.15 10:19:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Trillian
[2010.09.14 21:42:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TrueCrypt
[2010.09.15 08:48:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\TuneUp Software
[2011.11.05 14:50:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\uTorrent
[2010.09.15 10:18:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Winamp
[2010.09.15 07:39:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\WinRAR
[2011.08.05 14:49:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\xm1
 
< %APPDATA%\*.exe /s >
[2012.01.11 22:48:04 | 000,175,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe
[2012.01.11 22:47:48 | 000,175,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51\ADF15.exe
[2011.12.05 20:17:44 | 024,242,056 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe
[2011.12.05 20:18:12 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Uninstall.exe
[2011.08.06 09:26:47 | 000,003,584 | R--- | M] () -- C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.09.14 23:19:03 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.09.14 23:19:03 | 001,089,536 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.09.14 23:19:03 | 000,458,752 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
tut mir leid, dass ich nicht gleich als user eingeloggt war :(

cosinus 14.01.2012 16:21
Mach bitte mit CF weiter wenn der nomale Modus funktioniert, ansonsten den abgesicherten Modus mit Netzwerk auch für CF bentuzen

blimsch 14.01.2012 16:22
alles klar, dann mach ich jetzt CF

blimsch 14.01.2012 16:40
hier die log:

Code:
ComboFix 12-01-13.05 - Blimsch 14.01.2012  16:26:21.1.1 - x86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3072.2621 [GMT 1:00]
ausgeführt von:: F:\ComboFix.exe
AV: Sophos Anti-Virus *Disabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\602D9
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\602D9\95A2.02D
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\8CC51
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\8CC51\1BCB.CC5
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\8CC51\ADF15.exe
c:\programme\Internet Explorer\SET333.tmp
c:\programme\Internet Explorer\SET338.tmp
c:\programme\LP
c:\programme\LP\1546\018.exe
c:\programme\LP\1546\6019.tmp
c:\programme\LP\1546\C053.tmp
c:\programme\LP\1546\C054.exe
c:\programme\LP\1546\C054.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-14 bis 2012-01-14  ))))))))))))))))))))))))))))))
.
.
2012-01-14 13:31 . 2012-01-14 13:31        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Malwarebytes
2012-01-14 13:22 . 2012-01-14 14:01        --------        d-----w-        c:\programme\D95A2
2012-01-12 22:12 . 2012-01-12 22:12        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\EndNote
2012-01-12 16:10 . 2012-01-12 16:10        --------        d-----w-        c:\programme\ESET
2012-01-12 15:51 . 2012-01-12 15:51        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2012-01-12 15:51 . 2012-01-12 15:51        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-12 15:51 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-12 15:49 . 2012-01-12 15:49        --------        d-----r-        c:\dokumente und einstellungen\Administrator\Eigene Dateien
2012-01-12 15:47 . 2012-01-12 15:47        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Mozilla
2012-01-12 15:47 . 2012-01-12 15:47        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
2012-01-11 18:13 . 2007-05-12 08:23        224016        ----a-w-        c:\windows\system32\tabctl32.ocx
2012-01-11 18:13 . 2007-05-12 08:23        198656        ----a-w-        c:\windows\system32\comdlg32.ocx
2011-12-21 09:00 . 2011-12-21 09:00        --------        d-----w-        c:\programme\OpenVPN Technologies
2011-12-18 07:24 . 2011-12-18 07:24        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\gtk-2.0
2011-12-18 07:18 . 2011-12-18 07:40        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\midori
2011-12-18 07:18 . 2011-12-18 07:18        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\webkit
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-17 05:44 . 2011-08-06 06:13        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\daemon tools lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 118784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"nwiz"="nwiz.exe" [2009-02-18 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"Sophos AutoUpdate Monitor"="c:\programme\Sophos\AutoUpdate\almon.exe" [2010-09-21 439536]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Malwarebytes' Anti-Malware"="d:\malwarebytes anti-malware\mbamgui.exe" [2011-12-24 460872]
.
c:\dokumente und einstellungen\Blimsch\Startmenü\Programme\Autostart\
Dropbox.lnk - c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2011-12-5 24242056]
Multidesk Desktop Manager.lnk - d:\multidesk\MultiDesk.exe [2004-4-15 625664]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
VPN Client.lnk - c:\windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico [2010-9-15 6144]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Trillian\\trillian.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\TuneUp 2010\\Integrator.exe"=
"f:\\Downloads\\utorrent.exe"=
"d:\\Skype\\Phone\\Skype.exe"=
"d:\\Winamp\\winamp.exe"=
"d:\\ChemDraw 12\\ChemDraw\\ChemDraw.exe"=
"c:\\Dokumente und Einstellungen\\Blimsch\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
"d:\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Dokumente und Einstellungen\\Blimsch\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"d:\\Trillian\\plugins\\skypekit.exe"=
.
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.09.2010 08:09 691696]
S1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [14.09.2010 21:57 153344]
S1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [14.09.2010 21:57 24064]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 12:16 130384]
S2 MBAMService;MBAMService;d:\malwarebytes anti-malware\mbamservice.exe [12.01.2012 16:51 652872]
S2 OODefragAgent;O&O Defrag Agent;d:\oo defrag 14\oodag.exe [24.08.2010 21:56 2281800]
S2 SAVAdminService;Sophos Anti-Virus Statusreporter;c:\programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe [08.10.2010 16:15 163056]
S2 SAVService;Sophos Anti-Virus;c:\programme\Sophos\Sophos Anti-Virus\SavService.exe [04.06.2010 12:23 97520]
S2 swi_service;Sophos Web Intelligence Service;c:\programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [08.10.2010 16:15 1541360]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;d:\tuneup 2010\TuneUpUtilitiesService32.exe [26.08.2010 13:43 1051968]
S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [23.11.2011 19:38 25728]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12.01.2012 16:51 20464]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;d:\microsoft office\Office14\GROOVE.EXE [12.06.2011 10:15 31125880]
S3 osppsvc;Office Software Protection Platform;c:\programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09.01.2010 21:37 4640000]
S3 PAC7311;VGA SoC PC-Camera;c:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 10:48 154752]
S3 qcusbser;ACER Android USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [23.11.2011 19:38 105984]
S3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\drivers\tapoas.sys [19.08.2011 01:46 26112]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;d:\tuneup 2010\TuneUpUtilitiesDriver32.sys [24.02.2010 13:41 10064]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 12:16 753504]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [14.09.2010 21:57 14976]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft E&xcel exportieren - d:\micros~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - d:\micros~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search? ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-018.exe - c:\programme\LP\1546\018.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-14 16:32
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="045D393BE5BDA378B712095C9CCFAFDD8948D36A05349DDD548A272FF7C6B41EC0886F5CE2AB2D753CB5290B4B54AD0EFE3119905CD542E4260115198307F80A54A7DE1AA17EFB436C75911844CECAEBD63C95ADFA1E763157CA3573310EFA1976372CAD9DE79BDF717BDB4E432C5A184965FDC1FCDAF52A524DF3151AA27E98DE2B1EE1164E7A9C73E8CA0EC80F950A9096AB63420AE18B0163E268A341B029CCEA9E140ACA6E9F24D1C0CC954E980D6CB29ABCEF5E4166D5D939EB6F9C9D3E0151BD39FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794C038D530D6EB3452BA7FD869164D6794CFD21FD1DAD85CAFD901B59B1244FC843C322B5756B29C062D485792393C1A32D653CE3C7EEFB9F1F7BCF0E7C161788411B78D6BAE8CFDC7A00498C6C67891C1F609E7593638A60610348B6CBB39F7638330AC0CA0DDB16504E67E30BB682B23EC5DC7B18B3AB1E45ECC6C18DA5E630D73A096AB766719DE763564E5F31AE18C377130218CEE8C976425DD2A7B55C38081C3BE107DDA36C9D9E385514E8ED1461A96475747C48EBB688C8DB7801C4A4F94857D5189E2B14CD61D01342FBBBAAD9E579458D21EAF0471878FAA4FA149A3D58A8DDE711B5824D7C05D9E7D090435916C86FB45CF8FB74DCF58BED046B6B635A48E7A8F9198A10CE00278A5D3B46081476FEC3E25ED308FD0C28472632DD8E36082B942CC082966433B7B96ED7AC9C38A82AB5CDBB25C092B8E6127C2EC6CD7F85305ECC3DC311FE23938C49BA51DEF8DDB8C44A567BCD6B45C8E6425D8E8CBE14B1DF4E17349B0EE1110A6162B1E62DCF5B69F28386953F3B41823BBF6DABCBF9A90C6084C8ED9C8BABB390AA4203BB635269AFD798CA1A600DD612E72DFED6BD2474F898BB61E8813427B994E0D5E8FDB2AE5B520E3263D8C1720179B2CE472EB7A02AFF709C477DA0671D88962F40E96E6B651C542095C8E4A6607E207EC18C1B656B5FDE3D89434B822515A31690FF0544445A88C395B9B553DFEDF4B1250946045CAAD35A891A96099FEEA1F6D225C3E4C7D2ABE67C82DE8B1774EE7A8C406AA4F143B0449D5285967540864F388AEC41056D0E68762238855DA0EE046549EA0F4A97DE590FB7D501FB621CE363CA05AD2A2C5A55420BE10BE881FCD440FC9A0BE96F18799D1E0C8D87C4D402F6750485DA8D83349A7A6A887532B59C1BA575B36DCB6AA435B689A307543ADA06ABE29FCA279592957E5D5CC82FA439F5178566A6D90A2B24D92EF44E161A08DD7D16D033E3E75F8BEE9EAB0D0FE5E858047ECED3368584C13BE4738752835BEF752D7429CE27A01220711D8ECC991DBA8BDCA5789C747BD4AB07335DABB9DBFC6EE8215D4C2EECD7BF0C4"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(2912)
c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
c:\progra~1\GEMEIN~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
d:\cisco vpn client\cvpnd.exe
d:\java\bin\jqs.exe
c:\windows\system32\RUNDLL32.EXE
d:\cdburnerxp\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\devldr32.exe
c:\programme\Sophos\AutoUpdate\ALsvc.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wscntfy.exe
d:\tuneup 2010\TuneUpUtilitiesApp32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-14  16:33:59 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-14 15:33
.
Vor Suchlauf: 2.340.687.872 Bytes frei
Nach Suchlauf: 2.388.123.648 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - CF551B534F775D74E2B3E3A26E89E10D

cosinus 14.01.2012 17:21
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Folder::
c:\programme\D95A2
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

blimsch 14.01.2012 17:52
habe das Script ausgeführt, hier die log:

Code:
ComboFix 12-01-13.05 - Blimsch 14.01.2012  17:38:05.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3072.2491 [GMT 1:00]
ausgeführt von:: F:\ComboFix.exe
Benutzte Befehlsschalter :: F:\CFScript.txt
AV: Sophos Anti-Virus *Disabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programme\D95A2
c:\programme\D95A2\lvvm.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-14 bis 2012-01-14  ))))))))))))))))))))))))))))))
.
.
2012-01-14 16:34 . 2012-01-14 16:34        --------        d--h--w-        c:\windows\PIF
2012-01-14 16:16 . 2012-01-14 16:16        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\Sophos
2012-01-14 13:31 . 2012-01-14 13:31        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Malwarebytes
2012-01-12 22:12 . 2012-01-12 22:12        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\EndNote
2012-01-12 16:10 . 2012-01-12 16:10        --------        d-----w-        c:\programme\ESET
2012-01-12 15:51 . 2012-01-12 15:51        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2012-01-12 15:51 . 2012-01-12 15:51        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-12 15:51 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-12 15:49 . 2012-01-12 15:49        --------        d-----r-        c:\dokumente und einstellungen\Administrator\Eigene Dateien
2012-01-12 15:47 . 2012-01-12 15:47        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Mozilla
2012-01-12 15:47 . 2012-01-12 15:47        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Canneverbe Limited
2012-01-11 18:13 . 2007-05-12 08:23        224016        ----a-w-        c:\windows\system32\tabctl32.ocx
2012-01-11 18:13 . 2007-05-12 08:23        198656        ----a-w-        c:\windows\system32\comdlg32.ocx
2011-12-21 09:00 . 2011-12-21 09:00        --------        d-----w-        c:\programme\OpenVPN Technologies
2011-12-18 07:24 . 2011-12-18 07:24        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\gtk-2.0
2011-12-18 07:18 . 2011-12-18 07:40        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\midori
2011-12-18 07:18 . 2011-12-18 07:18        --------        d-----w-        c:\dokumente und einstellungen\Blimsch\Lokale Einstellungen\Anwendungsdaten\webkit
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-17 05:44 . 2011-08-06 06:13        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\daemon tools lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 118784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"nwiz"="nwiz.exe" [2009-02-18 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"Sophos AutoUpdate Monitor"="c:\programme\Sophos\AutoUpdate\almon.exe" [2010-09-21 439536]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Malwarebytes' Anti-Malware"="d:\malwarebytes anti-malware\mbamgui.exe" [2011-12-24 460872]
.
c:\dokumente und einstellungen\Blimsch\Startmenü\Programme\Autostart\
Dropbox.lnk - c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2011-12-5 24242056]
Multidesk Desktop Manager.lnk - d:\multidesk\MultiDesk.exe [2004-4-15 625664]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
VPN Client.lnk - c:\windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico [2010-9-15 6144]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Trillian\\trillian.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\TuneUp 2010\\Integrator.exe"=
"f:\\Downloads\\utorrent.exe"=
"d:\\Skype\\Phone\\Skype.exe"=
"d:\\Winamp\\winamp.exe"=
"d:\\ChemDraw 12\\ChemDraw\\ChemDraw.exe"=
"c:\\Dokumente und Einstellungen\\Blimsch\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
"d:\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Dokumente und Einstellungen\\Blimsch\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"d:\\Trillian\\plugins\\skypekit.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.09.2010 08:09 691696]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [14.09.2010 21:57 153344]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [14.09.2010 21:57 24064]
R2 MBAMService;MBAMService;d:\malwarebytes anti-malware\mbamservice.exe [12.01.2012 16:51 652872]
R2 OODefragAgent;O&O Defrag Agent;d:\oo defrag 14\oodag.exe [24.08.2010 21:56 2281800]
R2 SAVAdminService;Sophos Anti-Virus Statusreporter;c:\programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe [08.10.2010 16:15 163056]
R2 SAVService;Sophos Anti-Virus;c:\programme\Sophos\Sophos Anti-Virus\SavService.exe [04.06.2010 12:23 97520]
R2 swi_service;Sophos Web Intelligence Service;c:\programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [08.10.2010 16:15 1541360]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;d:\tuneup 2010\TuneUpUtilitiesService32.exe [26.08.2010 13:43 1051968]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12.01.2012 16:51 20464]
R3 PAC7311;VGA SoC PC-Camera;c:\windows\system32\drivers\PA707UCM.SYS [18.10.2005 10:48 154752]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;d:\tuneup 2010\TuneUpUtilitiesDriver32.sys [24.02.2010 13:41 10064]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 12:16 130384]
S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [23.11.2011 19:38 25728]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;d:\microsoft office\Office14\GROOVE.EXE [12.06.2011 10:15 31125880]
S3 osppsvc;Office Software Protection Platform;c:\programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09.01.2010 21:37 4640000]
S3 qcusbser;ACER Android USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [23.11.2011 19:38 105984]
S3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\drivers\tapoas.sys [19.08.2011 01:46 26112]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 12:16 753504]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [14.09.2010 21:57 14976]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft E&xcel exportieren - d:\micros~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - d:\micros~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\dokumente und einstellungen\Blimsch\Anwendungsdaten\Mozilla\Firefox\Profiles\1tt8lb1u.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search? ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-14 17:41
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="045D393BE5BDA378B712095C9CCFAFDD8948D36A05349DDD548A272FF7C6B41EC0886F5CE2AB2D753CB5290B4B54AD0EFE3119905CD542E4260115198307F80A54A7DE1AA17EFB436C75911844CECAEBD63C95ADFA1E763157CA3573310EFA1976372CAD9DE79BDF717BDB4E432C5A184965FDC1FCDAF52A524DF3151AA27E98DE2B1EE1164E7A9C73E8CA0EC80F950A9096AB63420AE18B0163E268A341B029CCEA9E140ACA6E9F24D1C0CC954E980D6CB29ABCEF5E4166D5D939EB6F9C9D3E0151BD39FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794C038D530D6EB3452BA7FD869164D6794CFD21FD1DAD85CAFD901B59B1244FC843C322B5756B29C062D485792393C1A32D653CE3C7EEFB9F1F7BCF0E7C161788411B78D6BAE8CFDC7A00498C6C67891C1F609E7593638A60610348B6CBB39F7638330AC0CA0DDB16504E67E30BB682B23EC5DC7B18B3AB1E45ECC6C18DA5E630D73A096AB766719DE763564E5F31AE18C377130218CEE8C976425DD2A7B55C38081C3BE107DDA36C9D9E385514E8ED1461A96475747C48EBB688C8DB7801C4A4F94857D5189E2B14CD61D01342FBBBAAD9E579458D21EAF0471878FAA4FA149A3D58A8DDE711B5824D7C05D9E7D090435916C86FB45CF8FB74DCF58BED046B6B635A48E7A8F9198A10CE00278A5D3B46081476FEC3E25ED308FD0C28472632DD8E36082B942CC082966433B7B96ED7AC9C38A82AB5CDBB25C092B8E6127C2EC6CD7F85305ECC3DC311FE23938C49BA51DEF8DDB8C44A567BCD6B45C8E6425D8E8CBE14B1DF4E17349B0EE1110A6162B1E62DCF5B69F28386953F3B41823BBF6DABCBF9A90C6084C8ED9C8BABB390AA4203BB635269AFD798CA1A600DD612E72DFED6BD2474F898BB61E8813427B994E0D5E8FDB2AE5B520E3263D8C1720179B2CE472EB7A02AFF709C477DA0671D88962F40E96E6B651C542095C8E4A6607E207EC18C1B656B5FDE3D89434B822515A31690FF0544445A88C395B9B553DFEDF4B1250946045CAAD35A891A96099FEEA1F6D225C3E4C7D2ABE67C82DE8B1774EE7A8C406AA4F143B0449D5285967540864F388AEC41056D0E68762238855DA0EE046549EA0F4A97DE590FB7D501FB621CE363CA05AD2A2C5A55420BE10BE881FCD440FC9A0BE96F18799D1E0C8D87C4D402F6750485DA8D83349A7A6A887532B59C1BA575B36DCB6AA435B689A307543ADA06ABE29FCA279592957E5D5CC82FA439F5178566A6D90A2B24D92EF44E161A08DD7D16D033E3E75F8BEE9EAB0D0FE5E858047ECED3368584C13BE4738752835BEF752D7429CE27A01220711D8ECC991DBA8BDCA5789C747BD4AB07335DABB9DBFC6EE8215D4C2EECD7BF0C4"
.
Zeit der Fertigstellung: 2012-01-14  17:43:08
ComboFix-quarantined-files.txt  2012-01-14 16:43
ComboFix2.txt  2012-01-14 15:34
.
Vor Suchlauf: 2.273.042.432 Bytes frei
Nach Suchlauf: 2.276.261.888 Bytes frei
.
- - End Of File - - 3C264582E7AFF8C0458A6AE336717114

cosinus 14.01.2012 20:02
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

blimsch 14.01.2012 21:09
soooo... hat etwas gedauert, aber jetzt ist auch aswMBR durch... hier die logs:

gmer:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-14 20:36:54
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 WDC_WD3200AAKB-00UAA0 rev.00.02C01
Running: m066g9fe.exe; Driver: C:\DOKUME~1\Blimsch\LOKALE~1\Temp\kwlyikoc.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)        ZwCreateKey [0xB6FB83BA]
SSDT            \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)        ZwCreateThread [0xB6FB88A4]
SSDT            \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)        ZwDeleteKey [0xB6FB8510]
SSDT            spjx.sys                                                                                                            ZwEnumerateKey [0xF74FCDA4]
SSDT            spjx.sys                                                                                                            ZwEnumerateValueKey [0xF74FD132]
SSDT            spjx.sys                                                                                                            ZwOpenKey [0xF74E40C0]
SSDT            spjx.sys                                                                                                            ZwQueryKey [0xF74FD20A]
SSDT            spjx.sys                                                                                                            ZwQueryValueKey [0xF74FD08A]
SSDT            \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)        ZwSetSystemInformation [0xB6FB8BCE]
SSDT            \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)        ZwSetValueKey [0xB6FB8576]

INT 0x62        ?                                                                                                                  8A19EBF8
INT 0x82        ?                                                                                                                  8A19EBF8
INT 0xB4        ?                                                                                                                  88EE3BF8
INT 0xB4        ?                                                                                                                  88EE3BF8
INT 0xB4        ?                                                                                                                  88EE3BF8
INT 0xB4        ?                                                                                                                  88EE3BF8
INT 0xB4        ?                                                                                                                  88EE3BF8

---- Kernel code sections - GMER 1.0.15 ----

.text          ntoskrnl.exe!_abnormal_termination + 120                                                                            804E278C 1 Byte  [A4]
?              spjx.sys                                                                                                            Das System kann die angegebene Datei nicht finden. !
.text          C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                            section is writeable [0xB9333360, 0x35483F, 0xE8000020]
.text          USBPORT.SYS!DllUnload                                                                                              B92868AC 5 Bytes  JMP 88EE31D8
.text          ac9qecqq.SYS                                                                                                        B91EF386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text          ac9qecqq.SYS                                                                                                        B91EF3AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text          ac9qecqq.SYS                                                                                                        B91EF3C4 3 Bytes  [00, 80, 02]
.text          ac9qecqq.SYS                                                                                                        B91EF3C9 1 Byte  [30]
.text          ac9qecqq.SYS                                                                                                        B91EF3C9 11 Bytes  [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text          ...                                                                                                               

---- User code sections - GMER 1.0.15 ----

.text          D:\OO Defrag 14\oodag.exe[444] kernel32.dll!SetUnhandledExceptionFilter                                            7C84495D 5 Bytes  JMP 00402FB0 D:\OO Defrag 14\oodag.exe (O&O Defrag Agent (Win32)/O&O Software GmbH)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                  8A1A12D8
IAT            pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                [F750FDDC] spjx.sys
IAT            pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                  [F750FE30] spjx.sys
IAT            atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                  [F74E5042] spjx.sys
IAT            atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                          [F74E513E] spjx.sys
IAT            atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                [F74E50C0] spjx.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                        [F74E5800] spjx.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                [F74E56D6] spjx.sys
IAT            \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                88EE32D8
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlInitUnicodeString]                                        8800001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!swprintf]                                                    001CBA86
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeSetEvent]                                                  C61AEB00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoCreateSymbolicLink]                                        001C8986
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoGetConfigurationInformation]                              86C61200
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoDeleteSymbolicLink]                                        00001C8B
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmFreeMappingAddress]                                        96868801
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoFreeErrorLogEntry]                                        8800001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoDisconnectInterrupt]                                      001CB286
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmUnmapIoSpace]                                              88968B00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ObReferenceObjectByPointer]                                  8900001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IofCompleteRequest]                                          001CA496
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlCompareUnicodeString]                                    C6168B00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IofCallDriver]                                              001CC186
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmAllocateMappingAddress]                                    428A0A00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry]                                    C286880C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoConnectInterrupt]                                          8B00001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoDetachDevice]                                              24A48DFA
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeWaitForSingleObject]                                      00000000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeInitializeEvent]                                          4B8BDF8B
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeCancelTimer]                                              8D3F0304
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString]                                CB033043
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlInitAnsiString]                                          0673C13B
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest]                              C13B0003
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoQueueWorkItem]                                            8366FA72
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmMapIoSpace]                                                75000E7B
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations]                                0B7D80E3
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoReportDetectedDevice]                                      307B8D00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoReportResourceForDetection]                                00AA840F
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize]                                83660000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!NlsMbCodePageTag]                                            6A000E7A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!PoRequestPowerIrp]                                          C6647400
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue]                                    001CC386
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection]                            4F8B0200
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!sprintf]                                                    968D5140
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache]                                00001C98
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ObfDereferenceObject]                                        22F6E852
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference]                                478B0000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoInvalidateDeviceState]                                    50016A40
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ZwClose]                                                    1CB48E8D
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ObReferenceObjectByHandle]                                  E8510000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ZwCreateDirectoryObject]                                    000022E4
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest]                                6A18538B
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!PoStartNextPowerIrp]                                        868D5200
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoCreateDevice]                                              00001CA0
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlCopyUnicodeString]                                        22D2E850
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension]                            4B8B0000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlQueryRegistryValues]                                      51016A18
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ZwOpenKey]                                                  1CBC968D
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlFreeUnicodeString]                                        E8520000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoStartTimer]                                                000022C0
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeInitializeTimer]                                          8A05478A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoInitializeTimer]                                          001CC38E
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeInitializeDpc]                                            30C48300
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeInitializeSpinLock]                                        1CC58688
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoInitializeIrp]                                            80E90000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ZwCreateKey]                                                C6000000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString]                              001CC386
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString]                                  438B0100
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ZwSetValueKey]                                              8E8D5018
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeInsertQueueDpc]                                            00001C98
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel]                                2292E851
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoStartPacket]                                              538B0000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel]                              52016A18
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest]                              1CB4868D
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoFreeMdl]                                                  E8500000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmUnlockPages]                                              00002280
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoWriteErrorLogEntry]                                        8A05478A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue]                                    001CC38E
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping]                        18C48300
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmUnmapReservedMapping]                                      1CC58688
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeSynchronizeExecution]                                      43EB0000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoStartNextPacket]                                          320C538A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeBugCheckEx]                                                88F93BC0
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeRemoveDeviceQueue]                                        001CC396
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeSetTimer]                                                  F6317300
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!_allmul]                                                    74070647
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmProbeAndLockPages]                                        75C0841A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!_except_handler3]                                            05578A0B
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!PoSetPowerState]                                            968801B0
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey]                                    00001CC5
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlWriteRegistryValue]                                      57B60F66
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlDeleteRegistryValue]                                      533B6604
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!_aulldiv]                                                    03087408
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!strstr]                                                      72F93B3F
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!_strupr]                                                    8A09EBDA
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeQuerySystemTime]                                          86880547
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoWMIRegistrationControl]                                    00001CC5
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!KeTickCount]                                                88084B8A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                001CC68E
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoDeleteDevice]                                              40578B00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ExAllocatePoolWithTag]                                      8D52006A
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoAllocateWorkItem]                                          001CC886
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoAllocateIrp]                                              11E85000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoAllocateMdl]                                              8B000022
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool]                                  001CC08E
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmLockPagableDataSection]                                    C4968B00
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoGetDriverObjectExtension]                                  8900001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmUnlockPagableImageSection]                                001CCC8E
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!ExFreePoolWithTag]                                          D0968900
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoFreeIrp]                                                  8B00001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!IoFreeWorkItem]                                              016A4047
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!InitSafeBootMode]                                            D4C68150
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!RtlCompareMemory]                                            5600001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!PoCallDriver]                                                0021E7E8
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!memmove]                                                    18C48300
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[ntoskrnl.exe!MmHighestUserAddress]                                        5D5B5E5F
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!KfAcquireSpinLock]                                                18C4830E
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!READ_PORT_UCHAR]                                                  1C959E88
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!KeGetCurrentIrql]                                                9E880000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!KfRaiseIrql]                                                      00001CB1
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!KfLowerIrql]                                                      0E798366
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!HalGetInterruptVector]                                            74AAB000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!HalTranslateBusAddress]                                          8986C636
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!KeStallExecutionProcessor]                                        1A00001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!KfReleaseSpinLock]                                                1C8B86C6
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                          C6020000
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!READ_PORT_USHORT]                                                001C9686
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                        86C60200
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                00001CB2
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[WMILIB.SYS!WmiSystemControl]                                              8800001C
IAT            \SystemRoot\System32\Drivers\ac9qecqq.SYS[WMILIB.SYS!WmiCompleteRequest]                                            001CB99E

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              8A20A1F8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              savonaccessfilter.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    88EE21F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                          8A20C1F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                            8A20C1F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                8A20C1F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                              8A20C1F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    88EE21F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    88EE21F8
Device          \Driver\usbehci \Device\USBPDO-3                                                                                    88FA41F8
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                              8A19F1F8
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                              8A19F1F8
Device          \Driver\Cdrom \Device\CdRom0                                                                                        88FA11F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4                                                                        [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c                                                                        [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18                                                                        [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20                                                                        [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                              8A19F1F8
Device          \Driver\Cdrom \Device\CdRom1                                                                                        88FA11F8
Device          \Driver\Ftdisk \Device\HarddiskVolume4                                                                              8A19F1F8
Device          \Driver\Cdrom \Device\CdRom2                                                                                        88FA11F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{9514F494-7C4D-4204-B56E-929252888553}                                            8871A1F8
Device          \Driver\Ftdisk \Device\HarddiskVolume6                                                                              8A19F1F8
Device          \Driver\Ftdisk \Device\HarddiskVolume7                                                                              8A19F1F8
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                            8871A1F8
Device          \Driver\PCI_PNP9266 \Device\0000004a                                                                                spjx.sys
Device          \Driver\PCI_PNP9266 \Device\0000004a                                                                                spjx.sys
Device          \Driver\Ftdisk \Device\HarddiskVolume8                                                                              8A19F1F8
Device          \Driver\Ftdisk \Device\HarddiskVolume9                                                                              8A19F1F8
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                    8871A1F8
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    88EE21F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    88EE21F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                  886FF1F8
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    88EE21F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                        886FF1F8
Device          \Driver\usbehci \Device\USBFDO-3                                                                                    88FA41F8
Device          \Driver\sptd \Device\2153918016                                                                                    spjx.sys
Device          \Driver\Ftdisk \Device\FtControl                                                                                    8A19F1F8
Device          \Driver\ac9qecqq \Device\Scsi\ac9qecqq1Port3Path0Target0Lun0                                                        88CF9500
Device          \Driver\fasttx2k \Device\Scsi\fasttx2k1Port2Path0Target4Lun0                                                        8A20B1F8
Device          \Driver\fasttx2k \Device\Scsi\fasttx2k1                                                                            8A20B1F8
Device          \Driver\ac9qecqq \Device\Scsi\ac9qecqq1                                                                            88CF9500
Device          \FileSystem\Cdfs \Cdfs                                                                                              88D4D500

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                D:\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0x00 0x00 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xE1 0x07 0xA8 0x31 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0x84 0xF8 0xC1 0xFC ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0xDE 0x62 0x7C 0x01 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    D:\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x00 0x00 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x0A 0x87 0xB2 0x79 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0x84 0xF8 0xC1 0xFC ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0xDE 0x62 0x7C 0x01 ...
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                             
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL                              045D393BE5BDA378B712095C9CCFAFDD8948D36A05349DDD548A272FF7C6B41EC0886F5CE2AB2D753CB5290B4B54AD0EFE3119905CD542E4260115198307F80A54A7DE1AA17EFB436C75911844CECAEBD63C95ADFA1E763157CA3573310EFA1976372CAD9DE79BDF717BDB4E432C5A184965FDC1FCDAF52A524DF3151AA27E98DE2B1EE1164E7A9C73E8CA0EC80F950A9096AB63420AE18B0163E268A341B029CCEA9E140ACA6E9F24D1C0CC954E980D6CB29ABCEF5E4166D5D939EB6F9C9D3E0151BD39FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794C038D530D6EB3452BA7FD869164D6794CFD21FD1DAD85CAFD901B59B1244FC843C322B5756B29C062D485792393C1A32D653CE3C7EEFB9F1F7BCF0E7C161788411B78D6BAE8CFDC7A00498C6C67891C1F609E7593638A60610348B6CBB39F7638330AC0CA0DDB16504E67E30BB682B23EC5DC7B18B3AB1E45ECC6C18DA5E630D73A096AB766719DE763564E5F31AE18C377130218CEE8C976425DD2A7B55C38081C3BE107DDA36C9D9E385514E8ED1461A96475747C48EBB688C8DB7801C4A4F94857D5189E2B14CD61D01342FBBBAAD9E579458D21EAF0471878FAA4FA149A3D58A8DDE711B5824D7C05D9E7D090435916C86FB45CF8FB74DCF58B

---- EOF - GMER 1.0.15 ----

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:43:16 on 14.01.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\OODBS.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ac9qecqq" (ac9qecqq) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ac9qecqq.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"catchme" (catchme) - ? - C:\DOKUME~1\Blimsch\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
"doqsumar" (doqsumar) - ? - C:\WINDOWS\System32\drivers\yfexxuec.sys  (File found, but it contains no detailed information)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"kwlyikoc" (kwlyikoc) - ? - C:\DOKUME~1\Blimsch\LOKALE~1\Temp\kwlyikoc.sys  (Hidden registry entry, rootkit activity | File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"MSI US54EX Wireless Adapter" (RT73) - ? - C:\WINDOWS\System32\DRIVERS\rt73.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"TAP-Win32 Adapter OAS" (tapoas) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tapoas.sys
"TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - D:\TrueCrypt\truecrypt.sys
"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - D:\TuneUp 2010\TuneUpUtilitiesDriver32.sys
"vsdatant" (vsdatant) - "Zone Labs LLC" - C:\WINDOWS\system32\vsdatant.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{A3A1D8A1-006D-4B93-BA27-6F6B4C9C4F1D} "ContextMenuHandler Class" - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SavShellExt.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7} "TeraCopy" - ? - D:\TeraCopy\TeraCopy.dll  (File found, but it contains no detailed information)
{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7} "TeraCopy" - ? - D:\TeraCopy\TeraCopyExt.dll  (File found, but it contains no detailed information)
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - D:\TuneUp 2010\DseShExt-x86.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - D:\TuneUp 2010\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - D:\Java\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - D:\Java\lib\deploy\jqs\ie\jqs_plugin.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\URLREDIR.DLL
{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} "Sophos Web Content Scanner" - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"VPN Client.lnk" - "Cisco Systems, Inc." - D:\Cisco VPN Client\vpngui.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Blimsch\Startmenü\Programme\Autostart\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
"Multidesk Desktop Manager.lnk" - "smartcoder.net software development" - D:\Multidesk\MultiDesk.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "D:\DAEMON Tools Lite\DTLite.exe" -autorun
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "D:\Malwarebytes Anti-Malware\mbamgui.exe" /starttray
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"Sophos AutoUpdate Monitor" - "Sophos Plc" - C:\Programme\Sophos\AutoUpdate\almon.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - D:\Cisco VPN Client\cvpnd.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - D:\Java\bin\jqs.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - D:\Malwarebytes Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - D:\Microsoft Office\Office14\GROOVE.EXE
"NMSAccess" (NMSAccess) - ? - D:\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"O&O Defrag Agent" (OODefragAgent) - "O&O Software GmbH" - D:\OO Defrag 14\oodag.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Sophos Anti-Virus" (SAVService) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
"Sophos Anti-Virus Statusreporter" (SAVAdminService) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
"Sophos AutoUpdate Service" (Sophos AutoUpdate Service) - "Sophos Plc" - C:\Programme\Sophos\AutoUpdate\ALsvc.exe
"Sophos Web Intelligence Service" (swi_service) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
"STI Simulator" (STI Simulator) - ? - C:\WINDOWS\System32\PAStiSvc.exe  (File signed by Microsoft | File found, but it contains no detailed information)
"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - D:\TuneUp 2010\TuneUpDefragService.exe
"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - D:\TuneUp 2010\TuneUpUtilitiesService32.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
aswMBR:
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-14 20:43:48
-----------------------------
20:43:48.109    OS Version: Windows 5.1.2600 Service Pack 3
20:43:48.109    Number of processors: 1 586 0xA00
20:43:48.109    ComputerName: BLIMSCHS-PC  UserName: Blimsch
20:43:48.406    Initialize success
20:47:03.734    AVAST engine defs: 12011401
20:47:43.656    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
20:47:43.656    Disk 0 Vendor: WDC_WD3200AAKB-00UAA0 00.02C01 Size: 305245MB BusType: 3
20:47:43.656    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
20:47:43.656    Disk 1 Vendor: WDC_WD600AB-00BVA0 21.01H21 Size: 57241MB BusType: 3
20:47:43.687    Disk 0 MBR read successfully
20:47:43.687    Disk 0 MBR scan
20:47:43.718    Disk 0 Windows XP default MBR code
20:47:43.718    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        12393 MB offset 63
20:47:43.718    Disk 0 Partition - 00    0F Extended LBA            292848 MB offset 25382700
20:47:43.734    Disk 0 Partition - 00    05    Extended            14605 MB offset 25382762
20:47:43.734    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        14605 MB offset 25382763
20:47:43.750    Disk 0 Partition - 00    05    Extended            29996 MB offset 55295792
20:47:43.750    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        29996 MB offset 55295793
20:47:44.265    Disk 0 Partition - 00    05    Extended            14998 MB offset 146641320
20:47:44.265    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS        14998 MB offset 116728353
20:47:44.281    Disk 0 Partition - 00    05    Extended            233248 MB offset 238790160
20:47:44.296    Disk 0 Partition 5 00    07    HPFS/NTFS            233248 MB offset 147444633
20:47:44.312    Disk 0 scanning sectors +625137345
20:47:44.390    Disk 0 scanning C:\WINDOWS\system32\drivers
20:47:53.281    Service scanning
20:47:53.593    Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
20:47:54.140    Modules scanning
20:48:06.078    Disk 0 trace - called modules:
20:48:06.093    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spjx.sys >>UNKNOWN [0x8a1bf938]<<
20:48:06.093    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a108ab8]
20:48:06.093    3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\00000067[0x8a17bf18]
20:48:06.093    5 ACPI.sys[f74a2620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a110d98]
20:48:06.234    AVAST engine scan C:\WINDOWS
20:48:10.937    AVAST engine scan C:\WINDOWS\system32
20:52:23.703    AVAST engine scan C:\WINDOWS\system32\drivers
20:52:53.375    AVAST engine scan C:\Dokumente und Einstellungen\Blimsch
21:01:22.859    AVAST engine scan C:\Dokumente und Einstellungen\All Users
21:04:42.656    Scan finished successfully
21:05:55.484    Disk 0 MBR has been saved successfully to "F:\MBR.dat"
21:05:55.484    The log file has been saved successfully to "F:\aswMBR.txt"

cosinus 14.01.2012 21:18
Zitat:
"doqsumar" (doqsumar) - ? - C:\WINDOWS\System32\drivers\yfexxuec.sys (File found, but it contains no detailed information)
Bitte mit OSAM deaktivieren und löschen. Danach Windows rebooten und ein neues Log mit OSAM machen

blimsch 14.01.2012 21:33
hier die log nach dem reboot:



OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:31:47 on 14.01.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\OODBS.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ar64brxg" (ar64brxg) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ar64brxg.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"catchme" (catchme) - ? - C:\DOKUME~1\Blimsch\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"MSI US54EX Wireless Adapter" (RT73) - ? - C:\WINDOWS\System32\DRIVERS\rt73.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"TAP-Win32 Adapter OAS" (tapoas) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tapoas.sys
"TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys
"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - D:\TuneUp 2010\TuneUpUtilitiesDriver32.sys
"vsdatant" (vsdatant) - "Zone Labs LLC" - C:\WINDOWS\system32\vsdatant.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
(Disabled) "doqsumar" (doqsumar) - ? - C:\WINDOWS\System32\drivers\yfexxuec.sys  (File found, but it contains no detailed information)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{A3A1D8A1-006D-4B93-BA27-6F6B4C9C4F1D} "ContextMenuHandler Class" - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SavShellExt.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7} "TeraCopy" - ? - D:\TeraCopy\TeraCopy.dll  (File found, but it contains no detailed information)
{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7} "TeraCopy" - ? - D:\TeraCopy\TeraCopyExt.dll  (File found, but it contains no detailed information)
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - D:\TuneUp 2010\DseShExt-x86.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - D:\TuneUp 2010\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - D:\Java\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - D:\Java\lib\deploy\jqs\ie\jqs_plugin.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\URLREDIR.DLL
{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} "Sophos Web Content Scanner" - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"VPN Client.lnk" - "Cisco Systems, Inc." - D:\Cisco VPN Client\vpngui.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Blimsch\Startmenü\Programme\Autostart\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
"Multidesk Desktop Manager.lnk" - "smartcoder.net software development" - D:\Multidesk\MultiDesk.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "D:\DAEMON Tools Lite\DTLite.exe" -autorun
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "D:\Malwarebytes Anti-Malware\mbamgui.exe" /starttray
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"Sophos AutoUpdate Monitor" - "Sophos Plc" - C:\Programme\Sophos\AutoUpdate\almon.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - D:\Cisco VPN Client\cvpnd.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - D:\Java\bin\jqs.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - D:\Malwarebytes Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - D:\Microsoft Office\Office14\GROOVE.EXE
"NMSAccess" (NMSAccess) - ? - D:\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"O&O Defrag Agent" (OODefragAgent) - "O&O Software GmbH" - D:\OO Defrag 14\oodag.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Sophos Anti-Virus" (SAVService) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
"Sophos Anti-Virus Statusreporter" (SAVAdminService) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
"Sophos AutoUpdate Service" (Sophos AutoUpdate Service) - "Sophos Plc" - C:\Programme\Sophos\AutoUpdate\ALsvc.exe
"Sophos Web Intelligence Service" (swi_service) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
"STI Simulator" (STI Simulator) - ? - C:\WINDOWS\System32\PAStiSvc.exe  (File signed by Microsoft | File found, but it contains no detailed information)
"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - D:\TuneUp 2010\TuneUpDefragService.exe
"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - D:\TuneUp 2010\TuneUpUtilitiesService32.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 15.01.2012 17:29
Zitat:
(Disabled) "doqsumar" (doqsumar) - ? - C:\WINDOWS\System32\drivers\yfexxuec.sys (File found, but it contains no detailed information)
Du hast den nur deaktiviert, er sollte aber gelöscht werden

blimsch 15.01.2012 17:45
das ist mir dann auch aufgefallen, deswegen hab ich mit osam nochmal gescannt und dann gelöscht...

sorry, hatte gestern beim editieren wohl die falsche log kopiert...
hier jetzt die richtige:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:04:29 on 14.01.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\OODBS.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ax5qrh51" (ax5qrh51) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ax5qrh51.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"catchme" (catchme) - ? - C:\DOKUME~1\Blimsch\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"MSI US54EX Wireless Adapter" (RT73) - ? - C:\WINDOWS\System32\DRIVERS\rt73.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"TAP-Win32 Adapter OAS" (tapoas) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tapoas.sys
"TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys
"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - D:\TuneUp 2010\TuneUpUtilitiesDriver32.sys
"vsdatant" (vsdatant) - "Zone Labs LLC" - C:\WINDOWS\system32\vsdatant.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{A3A1D8A1-006D-4B93-BA27-6F6B4C9C4F1D} "ContextMenuHandler Class" - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SavShellExt.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - "The Document Foundation" - D:\LibreOffice\Basis\program\shlxthdl\shlxthdl.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7} "TeraCopy" - ? - D:\TeraCopy\TeraCopy.dll  (File found, but it contains no detailed information)
{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7} "TeraCopy" - ? - D:\TeraCopy\TeraCopyExt.dll  (File found, but it contains no detailed information)
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - D:\TuneUp 2010\DseShExt-x86.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - D:\TuneUp 2010\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - D:\Java\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - D:\MICROS~1\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - D:\Java\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - D:\Java\lib\deploy\jqs\ie\jqs_plugin.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - D:\MICROS~1\Office14\URLREDIR.DLL
{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} "Sophos Web Content Scanner" - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"VPN Client.lnk" - "Cisco Systems, Inc." - D:\Cisco VPN Client\vpngui.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Blimsch\Startmenü\Programme\Autostart\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
"Multidesk Desktop Manager.lnk" - "smartcoder.net software development" - D:\Multidesk\MultiDesk.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "D:\DAEMON Tools Lite\DTLite.exe" -autorun
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "D:\Malwarebytes Anti-Malware\mbamgui.exe" /starttray
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"Sophos AutoUpdate Monitor" - "Sophos Plc" - C:\Programme\Sophos\AutoUpdate\almon.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - D:\Cisco VPN Client\cvpnd.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - D:\Java\bin\jqs.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - D:\Malwarebytes Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - D:\Microsoft Office\Office14\GROOVE.EXE
"NMSAccess" (NMSAccess) - ? - D:\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"O&O Defrag Agent" (OODefragAgent) - "O&O Software GmbH" - D:\OO Defrag 14\oodag.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Sophos Anti-Virus" (SAVService) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
"Sophos Anti-Virus Statusreporter" (SAVAdminService) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
"Sophos AutoUpdate Service" (Sophos AutoUpdate Service) - "Sophos Plc" - C:\Programme\Sophos\AutoUpdate\ALsvc.exe
"Sophos Web Intelligence Service" (swi_service) - "Sophos Plc" - C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
"STI Simulator" (STI Simulator) - ? - C:\WINDOWS\System32\PAStiSvc.exe  (File signed by Microsoft | File found, but it contains no detailed information)
"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - D:\TuneUp 2010\TuneUpDefragService.exe
"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - D:\TuneUp 2010\TuneUpUtilitiesService32.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 15.01.2012 18:40
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


blimsch 15.01.2012 20:35
gesagt, getan, hier die drei logs:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=28380ab7aa5b5b4d94e3ba2064ab7067
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-12 04:46:22
# local_time=2012-01-12 05:46:22 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 3727 3727 0 0
# compatibility_mode=8449 16775126 50 96 78200 139643793 62941 0
# scanned=117359
# found=5
# cleaned=0
# scan_time=2025
C:\Programme\51BCB\lvvm.exe        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Programme\D95A2\lvvm.exe        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Programme\LP\1546\2.tmp        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Programme\LP\1548\018.exe        Win32/Cycbot.AK trojan (unable to clean)        00000000000000000000000000000000        I
C:\Programme\LP\1548\25.tmp        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=28380ab7aa5b5b4d94e3ba2064ab7067
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-14 02:00:21
# local_time=2012-01-14 03:00:21 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 168176 168176 0 0
# compatibility_mode=8449 16775142 50 96 242649 139808242 0 0
# scanned=11480
# found=0
# cleaned=0
# scan_time=418
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=28380ab7aa5b5b4d94e3ba2064ab7067
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-14 02:46:37
# local_time=2012-01-14 03:46:37 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 169159 169159 0 0
# compatibility_mode=8449 16775142 50 96 243632 139809225 0 0
# scanned=124354
# found=12
# cleaned=0
# scan_time=2211
C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51\ADF15.exe        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Temp\1D.tmp        Win32/Cycbot.AK trojan (unable to clean)        00000000000000000000000000000000        I
C:\Dokumente und Einstellungen\Blimsch\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SX1LKAL2\3[1].exe        Win32/Cycbot.AK trojan (unable to clean)        00000000000000000000000000000000        I
C:\Programme\D95A2\lvvm.exe        a variant of Win32/Kryptik.YXP trojan (unable to clean)        00000000000000000000000000000000        I
F:\_OTL.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I
F:\_OTL\MovedFiles\01142012_003846\C_Programme\51BCB\lvvm.exe        Win32/Cycbot.AK trojan (unable to clean)        00000000000000000000000000000000        I
F:\_OTL\MovedFiles\01142012_003846\C_Programme\D95A2\lvvm.exe        Win32/Cycbot.AK trojan (unable to clean)        00000000000000000000000000000000        I
F:\_OTL\MovedFiles\01142012_003846\C_Programme\LP\1546\2.tmp        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
F:\_OTL\MovedFiles\01142012_003846\C_Programme\LP\1548\018.exe        Win32/Cycbot.AK trojan (unable to clean)        00000000000000000000000000000000        I
F:\_OTL\MovedFiles\01142012_003846\C_Programme\LP\1548\25.tmp        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
${Memory}        multiple threats        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=28380ab7aa5b5b4d94e3ba2064ab7067
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-14 06:17:47
# local_time=2012-01-14 07:17:47 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 181810 181810 0 0
# compatibility_mode=8449 16775126 50 96 11016 139821876 0 0
# scanned=125207
# found=11
# cleaned=11
# scan_time=2227
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe.vir        a variant of Win32/Kryptik.YVH trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51\ADF15.exe.vir        a variant of Win32/Kryptik.YVH trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Programme\D95A2\lvvm.exe.vir        a variant of Win32/Kryptik.YXP trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Programme\LP\1546\018.exe.vir        a variant of Win32/Kryptik.YXP trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Programme\LP\1546\C054.exe.vir        a variant of Win32/Kryptik.YYD trojan (deleted - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{914A42D0-607F-4F2E-954B-308F5E5AA82C}\RP131\A0065620.sys        a variant of Win32/Rootkit.Agent.NVG trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{914A42D0-607F-4F2E-954B-308F5E5AA82C}\RP131\A0066623.exe        a variant of Win32/Kryptik.YVH trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{914A42D0-607F-4F2E-954B-308F5E5AA82C}\RP131\A0067639.exe        Win32/Cycbot.AK trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{914A42D0-607F-4F2E-954B-308F5E5AA82C}\RP131\A0067640.exe        Win32/Cycbot.AK trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{914A42D0-607F-4F2E-954B-308F5E5AA82C}\RP131\A0067641.exe        Win32/Cycbot.AK trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{914A42D0-607F-4F2E-954B-308F5E5AA82C}\RP132\A0068990.exe        a variant of Win32/Kryptik.YXP trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=28380ab7aa5b5b4d94e3ba2064ab7067
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-15 11:41:02
# local_time=2012-01-15 12:41:02 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 244313 244313 0 0
# compatibility_mode=8449 16775141 50 96 13284 139884379 0 0
# scanned=121700
# found=5
# cleaned=5
# scan_time=2318
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe.vir        a variant of Win32/Kryptik.YVH trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51\ADF15.exe.vir        a variant of Win32/Kryptik.YVH trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Programme\D95A2\lvvm.exe.vir        a variant of Win32/Kryptik.YXP trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Programme\LP\1546\018.exe.vir        a variant of Win32/Kryptik.YXP trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\Qoobox\Quarantine\C\Programme\LP\1546\C054.exe.vir        a variant of Win32/Kryptik.YYD trojan (deleted - quarantined)        00000000000000000000000000000000        C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=28380ab7aa5b5b4d94e3ba2064ab7067
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-15 06:24:44
# local_time=2012-01-15 07:24:44 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 268536 268536 0 0
# compatibility_mode=8449 16775141 50 96 7143 139908602 0 0
# scanned=121738
# found=5
# cleaned=0
# scan_time=2316
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\602D9\ADF15.exe.vir        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\Blimsch\Anwendungsdaten\8CC51\ADF15.exe.vir        a variant of Win32/Kryptik.YVH trojan (unable to clean)        00000000000000000000000000000000        I
C:\Qoobox\Quarantine\C\Programme\D95A2\lvvm.exe.vir        a variant of Win32/Kryptik.YXP trojan (unable to clean)        00000000000000000000000000000000        I
C:\Qoobox\Quarantine\C\Programme\LP\1546\018.exe.vir        a variant of Win32/Kryptik.YXP trojan (unable to clean)        00000000000000000000000000000000        I
C:\Qoobox\Quarantine\C\Programme\LP\1546\C054.exe.vir        a variant of Win32/Kryptik.YYD trojan (unable to clean)        00000000000000000000000000000000        I
mbam:
Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.15.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Blimsch :: BLIMSCHS-PC [Administrator]

Schutz: Deaktiviert

15.01.2012 19:36:44
mbam-log-2012-01-15 (19-36-44).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 199647
Laufzeit: 7 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
SUPERAntiSpyware:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/15/2012 at 08:29 PM

Application Version : 5.0.1142

Core Rules Database Version : 8134
Trace Rules Database Version: 5946

Scan type      : Complete Scan
Total Scan Time : 00:38:54

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 478
Memory threats detected  : 0
Registry items scanned    : 36744
Registry threats detected : 0
File items scanned        : 166979
File threats detected    : 67

Adware.Tracking Cookie
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@ad.yieldmanager[2].txt [ /ad.yieldmanager ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@advertising[2].txt [ /advertising ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@anrtx.tacoda[1].txt [ /anrtx.tacoda ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@ar.atwola[1].txt [ /ar.atwola ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@at.atwola[1].txt [ /at.atwola ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@atwola[1].txt [ /atwola ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\blimsch@tacoda.at.atwola[1].txt [ /tacoda.at.atwola ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\7N90UPEC.txt [ /doubleclick.net ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\EU2KPEA9.txt [ /atdmt.com ]
        C:\Dokumente und Einstellungen\Blimsch\Cookies\G9PLN8Z5.txt [ /c.atdmt.com ]
        .doubleclick.net [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\DOKUMENTE UND EINSTELLUNGEN\ADMINISTRATOR\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NE26I5RT.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Kazy[EX]
        C:\QOOBOX\QUARANTINE\C\DOKUMENTE UND EINSTELLUNGEN\BLIMSCH\ANWENDUNGSDATEN\602D9\ADF15.EXE.VIR
        C:\QOOBOX\QUARANTINE\C\DOKUMENTE UND EINSTELLUNGEN\BLIMSCH\ANWENDUNGSDATEN\8CC51\ADF15.EXE.VIR
        C:\QOOBOX\QUARANTINE\C\PROGRAMME\D95A2\LVVM.EXE.VIR

Trojan.Agent/Gen-Cycbot
        C:\QOOBOX\QUARANTINE\C\PROGRAMME\LP\1546\018.EXE.VIR

cosinus 16.01.2012 12:57
Das ist ok. In C:\Qoobox bzw. C:\_OTL (Q-Ordner von CF und OTL) sind die Schädlinge isoliert und gut aufgehoben.
Der Rest ist nur Cookies, weg damit. Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Rechner soweit wieder im Lot?

blimsch 16.01.2012 14:25
ja, soweit ist alles wieder normal.
Das mit den Malware funden dachte ich mir selbst schon.

Die Quarantänedateien können dann ja wohl weg, oder?


Vielen Dank nochmal :)

cosinus 16.01.2012 15:28
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:28 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20