Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   HijackThis logfile auswerten (https://www.trojaner-board.de/88445-hijackthis-logfile-auswerten.html)

Raphael7436 20.07.2010 20:05
HijackThis logfile auswerten
 
Ich möchte meinen PC verkaufen deswegen wäre es schön wenn ihr den mal ebend schnell ausweten könntet:

HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:02:13, on 20.07.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\mmrtkrnl.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Raphael\AppData\Local\ljnmjpm.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Users\Raphael\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2319825
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
R3 - URLSearchHook: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - (no file)
O2 - BHO: Loader Class - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - I:\LeopardXP\FindeXer.dll (file missing)
O3 - Toolbar: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
O3 - Toolbar: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Realtime Audio Engine] "mmrtkrnl.exe" /i
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ljnmjpm] "c:\users\raphael\appdata\local\ljnmjpm.exe" ljnmjpm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Crawler Screensaver - {CDAFD956-97BE-443D-8EF7-F4F094EB5766} - C:\Program Files\Crawler\SSaver\CSSaver.exe (file missing)
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\Program Files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Steam Client Service - Unknown owner - C:\Program Files\Common Files\Steam\SteamService.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 6919 bytes
--- --- ---

nochdigger 20.07.2010 21:25
Hallo

da sich anscheinend Malware auf dem System befindet, das System zudem sehr ungepflegt wirkt und du es verkaufen möchtest, kurz und schmerzlos ->
Neuinstallation

MFG

Raphael7436 21.07.2010 07:34
kann ich die Neuinstallation nicht auch irgendwie umgehen??

nochdigger 21.07.2010 18:17
Hallo

Zitat:
kann ich die Neuinstallation nicht auch irgendwie umgehen?
klar kannst du, ist doch deine Entscheidung:rolleyes:
Wenn du aber sicher gehen möchtest, dann verkaufst du den Rechner nur frisch formatiert;)

MFG

Raphael7436 21.07.2010 20:29
Wie kann ich Malware löschen und den pc wieder auffraümen??
neuinstallation geht nähmlich net,da keine recovery cd vorhanden oder treiber.

nochdigger 21.07.2010 21:17
Hallo

Zitat:
neuinstallation geht nähmlich net,da keine recovery cd vorhanden oder treiber.
Wenn der Windowskey vorhanden ist, sollte auch die installation von CD gelingen und Treiber lassen sich i.d.R. auch aus dem Netz besorgen:rolleyes:.

Schauen wir mal, arbeite bitte diese Anleitung ab.
Lass vom Ccleaner auch die Registry bereinigen bis nix mehr gefunden wird, RSIT können wir bitte weglassen.
Poste alle anderen Logs hierher, dann sehen wir weiter.

MFG

Raphael7436 22.07.2010 12:08
Malwarebytes Anti-Malware funktioniert nicht.
2 Fehler:- MBAM_ERROR_EXPANDING_VARIABLES(0,9)
- MBAM_ERROR_MISSING_FILE(3,0, mbamswissarmy.sys)
Das System kann den Angegebenen Pfard nicht finden

Was soll ich machen????

nochdigger 22.07.2010 16:25
Hallo

erstmal OTL ausführen und Logs hierher posten.

Zitat:
Malwarebytes Anti-Malware funktioniert nicht.
Versuch dann mal diese Anleitung abzuarbeiten

MFG

Raphael7436 22.07.2010 17:11
Was ist OTL??

nochdigger 22.07.2010 20:34
Hallo

Zitat:
Was ist OTL??
lies doch einfach nochmal die Anleitung 1 Punkt C:teufel2:

Raphael7436 22.07.2010 20:46
Habe aber kein Windows 7 oder eine 64-Bit Version.

nochdigger 23.07.2010 15:30
Hallo

:kaffee:ich bitte dich ja nicht umsonst...
Führe einen Scan mit OTL aus, egal wie das BS heißt

MFG

Raphael7436 23.07.2010 16:05
Logfile 1:
OTL Logfile:
Code:
OTL logfile created on: 23.07.2010 17:00:14 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\Raphael\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 445,66 Gb Total Space | 304,92 Gb Free Space | 68,42% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 17,56 Gb Free Space | 87,86% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: RAPHAEL-PC
Current User Name: Raphael
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Raphael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Raphael\AppData\Local\ljnmjpm.exe ()
PRC - C:\Program Files\iTunes\iTunes.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Safari\Safari.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe (Apple Inc.)
PRC - C:\Windows\System32\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\ielowutil.exe (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Windows\System32\mmrtkrnl.exe (AlcaTech)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Raphael\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe File not found
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe File not found
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Boonty Games) -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (BOONTY)
SRV - (Stereo Service) -- C:\Windows\System32\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (AntiVirScheduler) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeActiveFileMonitor5.0) -- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (AVFSFilter) -- C:\Windows\System32\DRIVERS\avfsfilter.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (MMRTKRNL) -- C:\Windows\system32\drivers\mmrtkrnl.sys (AlcaTech)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ahcix86s) -- C:\Windows\system32\DRIVERS\ahcix86s.sys (AMD Technologies Inc.)
DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (amdide) -- C:\Windows\system32\DRIVERS\amdide.sys (Advanced Micro Devices)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files\AutocompletePro\support@predictad.com File not found
 
[2010.05.17 19:37:55 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\mozilla\Firefox\extensions
[2010.05.17 19:37:56 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Users\Raphael\AppData\Roaming\mozilla\Firefox\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
[2010.06.27 14:28:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Raphael\AppData\Roaming\mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found.
O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} - No CLSID value found.
O2 - BHO: (Loader Class) - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - I:\LeopardXP\FindeXer.dll File not found
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\System32\mmrtkrnl.exe (AlcaTech)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ljnmjpm] c:\users\raphael\appdata\local\ljnmjpm.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SetVisualStyle = C:\Windows\Resources\Themes\LeopardXP\LeopardXP.msstyles File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Crawler Screensaver - {CDAFD956-97BE-443D-8EF7-F4F094EB5766} - C:\Program Files\Crawler\SSaver\CSSaver.exe File not found
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Raphael\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Raphael\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{758231ab-87fd-11dd-ba34-0015af726fcd}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found
O33 - MountPoints2\{a6dad563-a500-11dd-a77d-0015af726fcd}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found
O33 - MountPoints2\{d4721310-5fea-11de-bafe-001d92b5b81b}\Shell\AutoRun\command - "" = I:\avira.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.23 16:54:28 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Raphael\Desktop\OTL.exe
[2010.07.22 12:59:08 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.07.22 12:59:06 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.07.22 12:59:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.07.22 12:59:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.07.22 12:03:00 | 000,000,000 | ---D | C] -- C:\Users\Raphael\Documents\Updater5
[2010.07.21 20:06:32 | 001,826,816 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SkyTel.exe
[2010.07.21 20:06:32 | 001,773,568 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll
[2010.07.21 20:06:32 | 001,196,032 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlUpd.exe
[2010.07.21 20:06:32 | 000,532,480 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RTSndMgr.cpl
[2010.07.21 20:06:32 | 000,339,968 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll
[2010.07.21 20:06:32 | 000,185,776 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll
[2010.07.21 20:06:32 | 000,167,936 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll
[2010.07.21 20:06:32 | 000,135,168 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll
[2010.07.21 20:06:31 | 002,098,904 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\drivers\RTKVHDA.sys
[2010.07.21 20:06:31 | 000,694,272 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkPgExt.dll
[2010.07.21 20:06:30 | 006,111,232 | ---- | C] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
[2010.07.21 20:06:30 | 001,929,216 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll
[2010.07.21 20:06:30 | 000,285,216 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkApoApi.dll
[2010.07.21 20:06:30 | 000,155,648 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll
[2010.07.21 20:06:30 | 000,126,976 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll
[2010.07.21 20:06:29 | 000,140,288 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\FMAPO.dll
[2010.07.21 20:06:28 | 000,520,192 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2010.07.21 08:50:06 | 000,000,000 | ---D | C] -- C:\ProgramData\clp
[2010.07.21 08:49:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Common Toolkit Suite
[2010.07.21 08:49:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Common Toolkit Suite
[2010.07.21 08:48:39 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Roaming\Fighters
[2010.07.21 08:48:38 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Local\PackageAware
[2010.07.20 14:34:28 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.07.20 12:13:28 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Roaming\TeamViewer
[2010.07.12 19:59:42 | 000,000,000 | ---D | C] -- C:\Users\Raphael\Documents\ICQ
[2010.07.06 16:56:53 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\System32\GEARAspi.dll
[2010.07.06 16:56:15 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.07.06 16:56:09 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.07.06 16:55:24 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010.07.04 12:59:45 | 000,000,000 | ---D | C] -- C:\Sierra
[2010.07.04 11:29:16 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Roaming\Audio Recorder for Free
[2010.06.29 21:06:17 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2010.06.29 15:32:08 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.06.28 14:22:13 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Local\MigWiz
[2010.06.27 20:56:22 | 001,414,440 | ---- | C] (Nero AG) -- C:\Windows\System32\ShellManager310E2D762.dll
[2010.06.26 19:36:46 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.06.26 14:14:56 | 000,000,000 | ---D | C] -- C:\Users\Raphael\AppData\Local\Stardock
[2010.06.26 13:01:05 | 000,000,000 | ---D | C] -- C:\Windows\BricoPacks
[2010.06.25 14:17:31 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2010.06.25 14:17:31 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2010.06.25 14:17:31 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2010.06.24 13:21:33 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2010.06.24 13:21:33 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.23 17:01:34 | 000,001,544 | ---- | M] () -- C:\Users\Raphael\AppData\Local\ljnmjpm_navps.dat
[2010.07.23 17:01:07 | 000,003,403 | ---- | M] () -- C:\Users\Raphael\AppData\Local\ljnmjpm.dat
[2010.07.23 17:00:54 | 004,194,304 | -HS- | M] () -- C:\Users\Raphael\NTUSER.DAT
[2010.07.23 17:00:00 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D762C80B-0833-4074-98C0-D5E095D75440}.job
[2010.07.23 16:54:39 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Raphael\Desktop\OTL.exe
[2010.07.23 16:52:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.23 16:51:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.07.23 14:44:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.07.23 14:41:43 | 000,002,058 | ---- | M] () -- C:\Users\Raphael\AppData\Roaming\wklnhst.dat
[2010.07.23 14:21:48 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.07.23 14:21:48 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.07.23 12:27:33 | 001,568,228 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.07.23 12:27:33 | 000,674,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.07.23 12:27:33 | 000,634,202 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.07.23 12:27:33 | 000,146,028 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.07.23 12:27:33 | 000,119,766 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.07.23 12:27:06 | 000,000,092 | ---- | M] () -- C:\Users\Raphael\AppData\Local\gysuyww.bat
[2010.07.23 12:24:08 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010.07.23 12:21:48 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.07.23 12:12:18 | 000,524,288 | -HS- | M] () -- C:\Users\Raphael\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010.07.23 12:12:18 | 000,065,536 | -HS- | M] () -- C:\Users\Raphael\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.07.23 10:50:11 | 001,836,077 | -H-- | M] () -- C:\Users\Raphael\AppData\Local\IconCache.db
[2010.07.22 18:07:12 | 000,248,324 | ---- | M] () -- C:\Users\Raphael\AppData\Local\ljnmjpm_nav.dat
[2010.07.22 12:59:11 | 000,000,800 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.21 21:16:08 | 000,000,000 | -H-- | M] () -- C:\Users\Raphael\Documents\Default.rdp
[2010.07.21 20:06:34 | 000,319,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\DIFxAPI.dll
[2010.07.20 15:07:51 | 000,007,592 | ---- | M] () -- C:\Users\Raphael\AppData\Local\d3d9caps.dat
[2010.07.20 14:34:58 | 000,001,696 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.07.20 13:00:02 | 000,001,659 | ---- | M] () -- C:\Users\Raphael\Desktop\Command Prompt.lnk
[2010.07.20 10:38:13 | 000,009,728 | ---- | M] () -- C:\Users\Raphael\Documents\COD Server.wps
[2010.07.18 17:50:37 | 000,516,096 | ---- | M] () -- C:\Users\Raphael\AppData\Local\ljnmjpm.exe
[2010.07.12 17:30:32 | 000,021,840 | ---- | M] () -- C:\Windows\System32\SIntfNT.dll
[2010.07.12 17:30:32 | 000,017,212 | ---- | M] () -- C:\Windows\System32\SIntf32.dll
[2010.07.12 17:30:32 | 000,012,067 | ---- | M] () -- C:\Windows\System32\SIntf16.dll
[2010.07.06 16:56:55 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.07.04 13:01:55 | 000,001,597 | ---- | M] () -- C:\Users\Public\Desktop\Empire Earth.lnk
[2010.07.04 12:59:45 | 000,000,218 | ---- | M] () -- C:\Windows\SIERRA.INI
[2010.06.27 14:20:54 | 000,001,854 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2010.06.26 14:11:32 | 000,008,379 | ---- | M] () -- C:\Windows\BricoPackFoldersDelete.cmd
[2010.06.26 14:11:28 | 000,118,071 | ---- | M] () -- C:\Windows\BricoPackUninst.cmd
[2010.06.26 13:48:43 | 003,936,310 | ---- | M] () -- C:\Windows\BricoPack Wallpaper.bmp
 
========== Files Created - No Company Name ==========
 
[2010.07.22 12:59:11 | 000,000,800 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.21 21:16:08 | 000,000,000 | -H-- | C] () -- C:\Users\Raphael\Documents\Default.rdp
[2010.07.20 14:34:58 | 000,001,696 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.07.20 13:00:02 | 000,001,659 | ---- | C] () -- C:\Users\Raphael\Desktop\Command Prompt.lnk
[2010.07.19 20:37:59 | 000,009,728 | ---- | C] () -- C:\Users\Raphael\Documents\COD Server.wps
[2010.07.18 17:50:38 | 000,248,324 | ---- | C] () -- C:\Users\Raphael\AppData\Local\ljnmjpm_nav.dat
[2010.07.18 17:50:38 | 000,003,403 | ---- | C] () -- C:\Users\Raphael\AppData\Local\ljnmjpm.dat
[2010.07.18 17:50:38 | 000,001,492 | ---- | C] () -- C:\Users\Raphael\AppData\Local\ljnmjpm_navps.dat
[2010.07.18 17:50:37 | 000,516,096 | ---- | C] () -- C:\Users\Raphael\AppData\Local\ljnmjpm.exe
[2010.07.06 16:56:55 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.07.04 13:22:12 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2010.07.04 13:22:12 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2010.07.04 13:22:12 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2010.07.04 13:01:55 | 000,001,597 | ---- | C] () -- C:\Users\Public\Desktop\Empire Earth.lnk
[2010.06.27 20:56:22 | 000,774,144 | ---- | C] () -- C:\Windows\System32\NEROINSTAEC43759.DB
[2010.06.27 14:20:54 | 000,001,854 | ---- | C] () -- C:\Users\Public\Desktop\Safari.lnk
[2010.06.26 14:11:31 | 000,118,071 | ---- | C] () -- C:\Windows\BricoPackUninst.cmd
[2010.06.26 13:48:43 | 003,936,310 | ---- | C] () -- C:\Windows\BricoPack Wallpaper.bmp
[2010.06.26 13:44:18 | 000,008,379 | ---- | C] () -- C:\Windows\BricoPackFoldersDelete.cmd
[2010.05.11 20:32:38 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.04.27 13:43:11 | 000,204,857 | ---- | C] () -- C:\Windows\System32\InstallHelp.dll
[2010.04.21 16:18:36 | 000,000,211 | ---- | C] () -- C:\Windows\Muma2000.INI
[2010.04.21 16:16:49 | 000,000,094 | ---- | C] () -- C:\Windows\MAGIX.ini
[2010.04.07 17:25:44 | 000,000,048 | ---- | C] () -- C:\Windows\WININIT.INI
[2009.10.20 10:22:17 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009.06.10 06:31:04 | 000,089,088 | ---- | C] () -- C:\Windows\System32\nvimage.dll
[2009.05.08 14:20:08 | 000,000,271 | ---- | C] () -- C:\Windows\mousing.ini
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.08.20 20:05:13 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008.08.20 19:54:03 | 000,000,027 | ---- | C] () -- C:\Windows\CDE DX4400DEFGIPS.ini
[2008.08.07 17:54:54 | 000,000,218 | ---- | C] () -- C:\Windows\SIERRA.INI
[2008.04.01 15:13:07 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.04.01 15:13:06 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.03.31 12:55:09 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2009.08.06 13:49:23 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\AlcaTech
[2010.06.26 19:30:44 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Any Video Converter
[2008.08.08 15:33:28 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Atari
[2010.05.14 12:28:22 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Audio Record Edit Toolbox
[2010.07.04 11:29:16 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Audio Recorder for Free
[2008.08.06 12:32:22 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Buhl Data Service GmbH
[2010.05.22 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\CoSoSys
[2010.04.07 17:36:42 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\COWON
[2010.01.22 14:19:35 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Desktopicon
[2010.06.29 15:32:08 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\DVDVideoSoftIEHelpers
[2008.08.20 20:38:07 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\EPSON
[2010.07.21 08:48:39 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Fighters
[2010.07.23 16:58:08 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\ICQ
[2010.06.06 16:26:21 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Mount&Blade Warband
[2010.04.07 17:32:01 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\NCH Swift Sound
[2010.03.23 15:44:49 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Opera
[2010.04.07 17:37:26 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Sony
[2009.09.04 18:27:07 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\streamripper
[2010.07.20 13:09:22 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\TeamViewer
[2009.05.18 19:00:57 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Teeworlds
[2008.10.03 09:48:50 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Template
[2010.06.28 18:33:58 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Ulead Systems
[2009.10.20 11:23:56 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Uniblue
[2010.01.15 21:20:52 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Warsow 0.5
[2010.05.03 19:08:18 | 000,000,000 | ---D | M] -- C:\Users\Raphael\AppData\Roaming\Youtube Downloader HD
[2010.07.23 12:12:14 | 000,032,604 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.07.23 17:00:00 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{D762C80B-0833-4074-98C0-D5E095D75440}.job
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---



Logfile 2:
OTL Logfile:
Code:
OTL Extras logfile created on: 23.07.2010 17:00:14 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\Raphael\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 445,66 Gb Total Space | 304,92 Gb Free Space | 68,42% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 17,56 Gb Free Space | 87,86% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: RAPHAEL-PC
Current User Name: Raphael
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EF82C00-183E-476C-80DC-ABF80635FF4B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3B9FF56C-35FA-4248-8B86-18B350E8A201}" = lport=10243 | protocol=6 | dir=in | app=system |
"{450DB06B-31CA-4BB3-A840-8BE291F959E5}" = rport=10243 | protocol=6 | dir=out | app=system |
"{56FC21CC-9E24-4E34-902C-60A13C9353A8}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6ED3E88E-A4DE-4564-942E-D744A52C7876}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8E6402A8-D69F-4F1F-AB3A-0C10338D6776}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{990A6A6B-95CB-4FE4-83F7-EF46E98D6C49}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B982E647-4D2F-409F-845F-593B5C3BE563}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C28FCB17-C284-430A-AD61-31A1E10B6C12}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E52881EB-0DEF-4C84-8F7E-093F9B512932}" = lport=2869 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{116073AF-7FF3-484B-8D36-6F59BF357B8C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1273786A-FCF3-4065-B03E-5FEE4F721CCD}" = protocol=6 | dir=in | app=c:\program files\sierra\fearcombat\fearmp.exe |
"{15DF92F9-6C72-4CAB-9B7A-B7BFAEC8C2FC}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{1906FC9B-4D17-439B-9186-FD9685991CD7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{19899320-0796-4271-ACC4-DF5F06C21B44}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{1A1D9FCA-396B-4F65-A980-D83153016B44}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{213A84AD-B1D4-43F6-9874-00A89AF1131C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{28DA01B3-32D2-493B-A07D-C85189EF36D5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{28F16DB3-A334-4C06-841D-222D058E0FAD}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{303E5D0F-41C3-489A-A52C-C6E1EF74DAD7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{36BF0AB8-EFA2-41A1-826A-E542DC44DA97}" = protocol=6 | dir=out | app=system |
"{37B01B91-0FBA-4E04-A69A-D37D2478A79B}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{3935B333-5845-459D-978F-47553D15D184}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4F21FFF4-B2B2-4FDE-87F7-F8264B7D643E}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{508819EE-8C0E-4811-9F81-19BFA18281EA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{52BF1346-DFD5-4529-8779-796C68D56579}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{55C2F5AD-C40A-4CED-A818-F9AF0CBFC5C2}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{56019E20-0275-4696-9E16-5B9248FE97D8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{66C9D839-B9E3-4A05-8724-91638AC17EA4}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{6E7A2EA3-D2AF-4FAD-AF80-A5D8AA4B6F06}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{7FAA4A7E-470F-4775-91FE-E4CC35BE89C0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{83176666-185A-4014-8152-2B23C109B985}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe |
"{897802FC-C0E6-4A4F-B552-F60FB947091A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8FAB9E00-1AF7-4EDD-AEA0-66135BB09B53}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A299DBD5-E2D4-4753-9F6A-FDD2CD253F8A}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{A325A5D2-B5CA-4501-A298-943F901991F7}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{BD5EAEA5-2B2F-49AA-A1D0-E1F02CD70996}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{C4A8006A-C1CE-4DE4-8D43-3E8BD419A76E}" = protocol=17 | dir=in | app=c:\users\raphael\saved games\call of duty 4 an heeke (simon)\iw3mp.exe |
"{CD4ECBAD-F00A-4296-BB23-AD7620860DFA}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{D51B741C-B7F5-4FC3-BCB8-47FFCAAC9247}" = dir=in | app=c:\program files\homecinema\makedisc\makedisc.exe |
"{E23F131B-05CA-4B44-933E-BEA8E3CE1634}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{E3F65D02-9549-4DA5-9640-02904530F758}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EAA65814-557C-4970-A2E9-47124A062E4E}" = protocol=17 | dir=in | app=c:\program files\sierra\fearcombat\fearmp.exe |
"{EE4A4D74-FE7A-41B7-AA8E-FBF4920FAEE2}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{F66A24D0-580F-4394-A9D0-ED853879C2D4}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{FC3CC0A6-F80B-4603-A847-330DAA9BE3C8}" = protocol=6 | dir=in | app=c:\users\raphael\saved games\call of duty 4 an heeke (simon)\iw3mp.exe |
"{FFEAF8AC-9460-4579-BA76-F0B2F257E8E8}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{0912E483-7484-4DC8-B57E-D577DEA516C3}C:\program files\cs\cts bots\cstrike.exe" = protocol=6 | dir=in | app=c:\program files\cs\cts bots\cstrike.exe |
"TCP Query User{14B91DBE-E5B6-465D-A7A5-54605E35BC97}I:\cs\cts bots\cstrike.exe" = protocol=6 | dir=in | app=i:\cs\cts bots\cstrike.exe |
"TCP Query User{291CC19B-D056-402A-8DBF-EF0A59D1BFBD}C:\program files\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files\xfire\xfire.exe |
"TCP Query User{2C58B56E-4B39-4BE1-9795-B28BAC513E6C}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{3C2778A5-EB20-4DC7-A51C-2CEEC56C335F}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{3C8BBA1B-9ABD-4D32-8C79-CBDDD18E4838}C:\users\raphael\cs\cts bots\hlds.exe" = protocol=6 | dir=in | app=c:\users\raphael\cs\cts bots\hlds.exe |
"TCP Query User{42A633BF-BDC5-407F-A9F9-41C7335534AC}C:\users\raphael\cs\cts bots\hltv.exe" = protocol=6 | dir=in | app=c:\users\raphael\cs\cts bots\hltv.exe |
"TCP Query User{455F41DD-9A32-4419-B4D0-18C37A51A199}C:\users\raphael\desktop\teeworlds-0.5.1-win32\teeworlds_srv.exe" = protocol=6 | dir=in | app=c:\users\raphael\desktop\teeworlds-0.5.1-win32\teeworlds_srv.exe |
"TCP Query User{4A040D6A-DE29-4DEE-9ABE-F4FE60E1C3AA}C:\users\raphael\desktop\teeworlds-0.5.2-win32\teeworlds_srv.exe" = protocol=6 | dir=in | app=c:\users\raphael\desktop\teeworlds-0.5.2-win32\teeworlds_srv.exe |
"TCP Query User{5AE4511B-FAD6-44E7-9F88-11692065E16F}C:\users\raphael\saved games\microsoft games\cs\cts bots\cstrike.exe" = protocol=6 | dir=in | app=c:\users\raphael\saved games\microsoft games\cs\cts bots\cstrike.exe |
"TCP Query User{6407E3D9-04C9-4198-BCF9-D835F8EC599F}C:\program files\safari\safari.exe" = protocol=6 | dir=in | app=c:\program files\safari\safari.exe |
"TCP Query User{679FF2A2-8802-47A0-912A-9EE9D8BFF10B}C:\program files\warsow 0.5\warsow_x86.exe" = protocol=6 | dir=in | app=c:\program files\warsow 0.5\warsow_x86.exe |
"TCP Query User{6F0A5EAD-6F41-4096-A8A0-5B2BC99731B0}C:\users\raphael\desktop\hd dvd-rom-laufwerk\cs\cts bots\cstrike.exe" = protocol=6 | dir=in | app=c:\users\raphael\desktop\hd dvd-rom-laufwerk\cs\cts bots\cstrike.exe |
"TCP Query User{77DEED52-698D-4CFF-931B-9053F98854E8}C:\users\raphael\saved games\cs\cts bots\cstrike.exe" = protocol=6 | dir=in | app=c:\users\raphael\saved games\cs\cts bots\cstrike.exe |
"TCP Query User{79A6605C-17B7-40D7-80FD-A06491E4E07E}C:\users\raphael\saved games\cs\cts bots\hltv.exe" = protocol=6 | dir=in | app=c:\users\raphael\saved games\cs\cts bots\hltv.exe |
"TCP Query User{826DC100-9803-4F2A-9140-62BE2B49DD90}C:\program files\sixteen tons entertainment\gotcha! demo\gotchademo.exe" = protocol=6 | dir=in | app=c:\program files\sixteen tons entertainment\gotcha! demo\gotchademo.exe |
"TCP Query User{865EECAF-15E9-401A-927F-BD5B99719192}C:\program files\wolfenstein - enemy territory\etded.exe" = protocol=6 | dir=in | app=c:\program files\wolfenstein - enemy territory\etded.exe |
"TCP Query User{9A2672E4-918B-498E-9257-8EB41ED027AD}C:\users\raphael\saved games\call of duty\codmp.exe" = protocol=6 | dir=in | app=c:\users\raphael\saved games\call of duty\codmp.exe |
"TCP Query User{9E50E19D-F3FB-4059-841D-CC214B35546B}C:\users\raphael\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv.exe" = protocol=6 | dir=in | app=c:\users\raphael\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv.exe |
"TCP Query User{A0F4529F-C18D-4947-A6AC-194641797D8F}C:\program files\pyro studios\imperial glory\imperialglory.exe" = protocol=6 | dir=in | app=c:\program files\pyro studios\imperial glory\imperialglory.exe |
"TCP Query User{A5AABFD1-4287-4A82-A00E-B18D1D42262E}C:\program files\jowood\spellforce\spellforce.exe" = protocol=6 | dir=in | app=c:\program files\jowood\spellforce\spellforce.exe |
"TCP Query User{AF4BA39A-3EA9-438E-BC45-718E9FFCAE1F}C:\users\raphael\cs\cts bots\cstrike.exe" = protocol=6 | dir=in | app=c:\users\raphael\cs\cts bots\cstrike.exe |
"TCP Query User{B80B45AA-219F-4DCC-9D28-07E596034081}C:\users\raphael\saved games\call of duty 4 an heeke (simon)\iw3mp.exe" = protocol=6 | dir=in | app=c:\users\raphael\saved games\call of duty 4 an heeke (simon)\iw3mp.exe |
"TCP Query User{B8255CED-12EF-48A3-A99F-CFCC10C84120}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=6 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe |
"TCP Query User{BB0BF5EA-40A5-490E-A573-7C3A0C77063E}I:\call of duty\codmp.exe" = protocol=6 | dir=in | app=i:\call of duty\codmp.exe |
"TCP Query User{E049D464-F11D-4F19-BE61-F403F4B570D1}C:\program files\phenomedia\moorhuhn kart 3 demo\game\moorhuhn_kart3.exe" = protocol=6 | dir=in | app=c:\program files\phenomedia\moorhuhn kart 3 demo\game\moorhuhn_kart3.exe |
"TCP Query User{E213119F-00EC-4F00-898A-2EE3585E3559}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe |
"TCP Query User{EA041DED-B5E8-4FC6-AC10-68E0CF5396B3}I:\cs\cts bots\hltv.exe" = protocol=6 | dir=in | app=i:\cs\cts bots\hltv.exe |
"TCP Query User{ED2F2597-3420-4622-BECF-6C352A3205AB}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"TCP Query User{FB88CD83-1E26-4C16-A180-1DD43961C694}C:\program files\ubisoft\ghost recon advanced warfighter\graw.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\ghost recon advanced warfighter\graw.exe |
"UDP Query User{0A4A766D-E729-456B-9B5E-62FD09309D00}C:\users\raphael\desktop\teeworlds-0.5.2-win32\teeworlds_srv.exe" = protocol=17 | dir=in | app=c:\users\raphael\desktop\teeworlds-0.5.2-win32\teeworlds_srv.exe |
"UDP Query User{1278010B-2DF1-4E6D-BA61-63F4CC89A2F5}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe |
"UDP Query User{2CDA3F0B-9B23-4FED-8238-F40FD1AD7168}C:\program files\jowood\spellforce\spellforce.exe" = protocol=17 | dir=in | app=c:\program files\jowood\spellforce\spellforce.exe |
"UDP Query User{2E9323FF-7EE7-4311-8110-921AFDA97CCE}C:\users\raphael\desktop\teeworlds-0.5.1-win32\teeworlds_srv.exe" = protocol=17 | dir=in | app=c:\users\raphael\desktop\teeworlds-0.5.1-win32\teeworlds_srv.exe |
"UDP Query User{330BB61C-0614-4BDF-BB1D-9366270C83D7}C:\users\raphael\desktop\hd dvd-rom-laufwerk\cs\cts bots\cstrike.exe" = protocol=17 | dir=in | app=c:\users\raphael\desktop\hd dvd-rom-laufwerk\cs\cts bots\cstrike.exe |
"UDP Query User{43D0B491-46CA-47A0-94B4-D00CFB399031}C:\users\raphael\saved games\call of duty\codmp.exe" = protocol=17 | dir=in | app=c:\users\raphael\saved games\call of duty\codmp.exe |
"UDP Query User{4534A116-5B66-44D2-BF4A-AC180E8369EE}C:\program files\warsow 0.5\warsow_x86.exe" = protocol=17 | dir=in | app=c:\program files\warsow 0.5\warsow_x86.exe |
"UDP Query User{524423BA-0FB1-431C-8DB5-4A0865E714C2}C:\users\raphael\saved games\cs\cts bots\cstrike.exe" = protocol=17 | dir=in | app=c:\users\raphael\saved games\cs\cts bots\cstrike.exe |
"UDP Query User{84C16C15-023D-478B-8D8E-5FC9A1CCAF26}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"UDP Query User{919952EB-DBF6-4367-A1A7-EF81252750A2}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=17 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe |
"UDP Query User{A053D51E-30ED-4093-A3BB-32B8B43E7F15}C:\users\raphael\saved games\microsoft games\cs\cts bots\cstrike.exe" = protocol=17 | dir=in | app=c:\users\raphael\saved games\microsoft games\cs\cts bots\cstrike.exe |
"UDP Query User{A9925B4A-351A-4F10-A7B1-7FB0294D28D5}I:\cs\cts bots\cstrike.exe" = protocol=17 | dir=in | app=i:\cs\cts bots\cstrike.exe |
"UDP Query User{ADA7DA9B-D424-4AE6-A6B0-2837B33123EE}C:\program files\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files\xfire\xfire.exe |
"UDP Query User{BFADD87A-4F42-4C1D-A060-56291DE4E60F}C:\users\raphael\cs\cts bots\cstrike.exe" = protocol=17 | dir=in | app=c:\users\raphael\cs\cts bots\cstrike.exe |
"UDP Query User{C120C1DD-BA48-4D4F-8E8F-737921B4EC3D}C:\program files\sixteen tons entertainment\gotcha! demo\gotchademo.exe" = protocol=17 | dir=in | app=c:\program files\sixteen tons entertainment\gotcha! demo\gotchademo.exe |
"UDP Query User{C8C6CB61-62F4-4679-AB8D-A4ED6D5497AC}I:\cs\cts bots\hltv.exe" = protocol=17 | dir=in | app=i:\cs\cts bots\hltv.exe |
"UDP Query User{C9091D58-584F-4380-85B9-1E37C457C622}C:\users\raphael\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv.exe" = protocol=17 | dir=in | app=c:\users\raphael\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv.exe |
"UDP Query User{C9A3A05D-F537-490D-B8D5-0277D653618B}C:\users\raphael\cs\cts bots\hltv.exe" = protocol=17 | dir=in | app=c:\users\raphael\cs\cts bots\hltv.exe |
"UDP Query User{D6E8112F-3E5C-4C81-B001-B63C5558DBE9}C:\users\raphael\saved games\call of duty 4 an heeke (simon)\iw3mp.exe" = protocol=17 | dir=in | app=c:\users\raphael\saved games\call of duty 4 an heeke (simon)\iw3mp.exe |
"UDP Query User{D971E3C5-BE81-4086-B213-ECFDBF997A77}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{D9FF76EF-51F1-4C50-A308-565B7CB2F372}C:\program files\safari\safari.exe" = protocol=17 | dir=in | app=c:\program files\safari\safari.exe |
"UDP Query User{DC587643-0C4D-4A9D-80A3-AD1D4861BFA7}C:\program files\phenomedia\moorhuhn kart 3 demo\game\moorhuhn_kart3.exe" = protocol=17 | dir=in | app=c:\program files\phenomedia\moorhuhn kart 3 demo\game\moorhuhn_kart3.exe |
"UDP Query User{DD950AF7-A413-45B0-B112-82E57547A608}C:\program files\ubisoft\ghost recon advanced warfighter\graw.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\ghost recon advanced warfighter\graw.exe |
"UDP Query User{E7200818-FBA8-417D-BBB8-1372EAE2F294}C:\program files\cs\cts bots\cstrike.exe" = protocol=17 | dir=in | app=c:\program files\cs\cts bots\cstrike.exe |
"UDP Query User{E939D663-0539-4DC6-8B13-225FA48D14AD}C:\users\raphael\saved games\cs\cts bots\hltv.exe" = protocol=17 | dir=in | app=c:\users\raphael\saved games\cs\cts bots\hltv.exe |
"UDP Query User{EECC93B4-240E-4487-8C85-21036FAEBBC6}C:\program files\pyro studios\imperial glory\imperialglory.exe" = protocol=17 | dir=in | app=c:\program files\pyro studios\imperial glory\imperialglory.exe |
"UDP Query User{EF1F5584-F154-4C3C-96B9-A0AFD61B1A4E}C:\program files\wolfenstein - enemy territory\etded.exe" = protocol=17 | dir=in | app=c:\program files\wolfenstein - enemy territory\etded.exe |
"UDP Query User{F871DB41-51DD-4345-ACE0-88CDE7D79F26}C:\users\raphael\cs\cts bots\hlds.exe" = protocol=17 | dir=in | app=c:\users\raphael\cs\cts bots\hlds.exe |
"UDP Query User{FA7B66D5-91CC-4E3E-9CB0-0ACA8BBD500A}I:\call of duty\codmp.exe" = protocol=17 | dir=in | app=i:\call of duty\codmp.exe |
"UDP Query User{FD5354B9-2D31-41F8-9842-0CF3E38BDF79}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1FCC8C70-66B9-420D-942C-2C2A8441C744}" = Imperial Glory
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{25569723-DC5A-4467-A639-79535BF01B71}" = Adobe Help Center 2.1
"{266C7330-C0F4-49E5-8F20-A56F9F822875}" = SweetIM Toolbar for Internet Explorer 3.3
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6833245E-DD86-479A-882A-8360D62C8194}" = NVIDIA PhysX
"{75E607CF-7BAE-4B88-84B3-97F3DF44BA28}" = FEARCombat
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}" = Camera RAW Plug-In for EPSON Creativity Suite
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9919E625-F1EC-4945-AC40-83BEE74B78CC}" =
"{9F251952-43A3-1305-997C-5B285C76FCAD}" = ATI Catalyst Install Manager
"{A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}" = Adobe Photoshop Elements 5.0
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.5 - Deutsch
"{AC76BA86-7AD7-1031-7B44-A81300000003}_814" = KB408682
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FFFDEC7F-B24F-4C40-8639-7702671B8D67}_is1" = NS Virtual DJ 6.0 Full
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 5" = Adobe Photoshop Elements 5.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"gysuyww" = Favorit
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"LetsTrade" = LetsTrade Komponenten
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.12.2009 13:25:59 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 02.12.2009 01:44:55 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 02.12.2009 09:06:29 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 02.12.2009 14:02:35 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 02.12.2009 14:14:15 | Computer Name = Raphael-PC | Source = Application Hang | ID = 1002
Description = Programm FreeYouTubeToMP3Converter.exe, Version 3.2.3.67 arbeitet
nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf
 im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
 über das Problem zu suchen.  Prozess-ID: 145c  Anfangszeit: 01ca737a65c9a2b0  Zeitpunkt
 der Beendigung: 62
 
Error - 03.12.2009 01:39:35 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 03.12.2009 09:07:56 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 03.12.2009 12:43:49 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 03.12.2009 13:38:27 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 03.12.2009 14:24:22 | Computer Name = Raphael-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 20.07.2010 02:31:51 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 20.07.2010 10:57:16 | Computer Name = Raphael-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 20.07.2010 um 16:29:16 unerwartet heruntergefahren.
 
Error - 20.07.2010 14:00:15 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 21.07.2010 02:27:47 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 21.07.2010 14:14:49 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 22.07.2010 03:57:06 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.5 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 22.07.2010 12:05:03 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.4 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 22.07.2010 15:21:27 | Computer Name = Raphael-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 22.07.2010 um 20:07:35 unerwartet heruntergefahren.
 
Error - 22.07.2010 15:21:32 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
Error - 23.07.2010 04:02:47 | Computer Name = Raphael-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
 001D92B5B81B wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
 hat eine DHCPNACK-Meldung gesendet).
 
 
< End of report >
--- --- ---

nochdigger 24.07.2010 06:10
Hallo

Löschen mit OTL
Code:
:OTL
PRC - C:\Users\Raphael\AppData\Local\ljnmjpm.exe ()
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (AVFSFilter) -- C:\Windows\System32\DRIVERS\avfsfilter.sys File not found
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - No CLSID value found.
O2 - BHO: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found.
O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} - No CLSID value found.
O2 - BHO: (Loader Class) - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - I:\LeopardXP\FindeXer.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKCU..\Run: [ljnmjpm] c:\users\raphael\appdata\local\ljnmjpm.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SetVisualStyle = C:\Windows\Resources\Themes\LeopardXP\LeopardXP.msstyles File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: Crawler Screensaver - {CDAFD956-97BE-443D-8EF7-F4F094EB5766} - C:\Program Files\Crawler\SSaver\CSSaver.exe File not found
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O33 - MountPoints2\{758231ab-87fd-11dd-ba34-0015af726fcd}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found
O33 - MountPoints2\{a6dad563-a500-11dd-a77d-0015af726fcd}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found
O33 - MountPoints2\{d4721310-5fea-11de-bafe-001d92b5b81b}\Shell\AutoRun\command - "" = I:\avira.exe -- File not found


:services
:files
C:\Users\Raphael\AppData\Local\gysuyww.bat
C:\Users\Raphael\AppData\Local\ljnmjpm_nav.dat
C:\Users\Raphael\AppData\Local\d3d9caps.dat
C:\Users\Raphael\AppData\Local\ljnmjpm.exe
C:\Users\Raphael\AppData\Local\ljnmjpm.dat
C:\Users\Raphael\AppData\Local\ljnmjpm_navps.dat


:reg
:Commands
[purity]
[emptytemp]
[reboot]
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

Anschließend versuche erneut Malwarebytes laufen zu lassen, sollte das nicht funktionieren versuche es nach dieser Anleitung.

MFG

Raphael7436 08.08.2010 10:03
All processes killed
========== OTL ==========
No active process named ljnmjpm.exe was found!
Error: No service named NwlnkFwd was found to stop!
Service\Driver key NwlnkFwd not found.
File C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found not found.
Error: No service named NwlnkFlt was found to stop!
Service\Driver key NwlnkFlt not found.
File C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found not found.
Error: No service named IpInIp was found to stop!
Service\Driver key IpInIp not found.
File C:\Windows\System32\DRIVERS\ipinip.sys File not found not found.
Error: No service named AVFSFilter was found to stop!
Service\Driver key AVFSFilter not found.
File C:\Windows\System32\DRIVERS\avfsfilter.sys File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ljnmjpm not found.
File c:\users\raphael\appdata\local\ljnmjpm.exe not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\SetVisualStyle not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CDAFD956-97BE-443D-8EF7-F4F094EB5766}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDAFD956-97BE-443D-8EF7-F4F094EB5766}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{758231ab-87fd-11dd-ba34-0015af726fcd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{758231ab-87fd-11dd-ba34-0015af726fcd}\ not found.
File I:\setupSNK.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6dad563-a500-11dd-a77d-0015af726fcd}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6dad563-a500-11dd-a77d-0015af726fcd}\ not found.
File I:\setupSNK.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4721310-5fea-11de-bafe-001d92b5b81b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4721310-5fea-11de-bafe-001d92b5b81b}\ not found.
File I:\avira.exe not found.
========== SERVICES/DRIVERS ==========
========== FILES ==========
C:\Users\Raphael\AppData\Local\gysuyww.bat moved successfully.
File\Folder C:\Users\Raphael\AppData\Local\ljnmjpm_nav.dat not found.
File\Folder C:\Users\Raphael\AppData\Local\d3d9caps.dat not found.
File\Folder C:\Users\Raphael\AppData\Local\ljnmjpm.exe not found.
File\Folder C:\Users\Raphael\AppData\Local\ljnmjpm.dat not found.
File\Folder C:\Users\Raphael\AppData\Local\ljnmjpm_navps.dat not found.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Raphael
->Temp folder emptied: 97368 bytes
->Temporary Internet Files folder emptied: 2252801 bytes
->Java cache emptied: 0 bytes
->Apple Safari cache emptied: 10166272 bytes
->Flash cache emptied: 29227 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 12,00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 08082010_105436

Files\Folders moved on Reboot...

Registry entries deleted on Reboot..





Malwarebytes funktioniert immer noch nicht.

nochdigger 08.08.2010 16:30
Hallo

bitte lass Combofix dein System bereinigen/prüfen

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
MFG

Raphael7436 11.08.2010 10:15
Combofix Logfile:
Code:
ComboFix 10-08-10.05 - Raphael 11.08.2010  10:56:19.1.4 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3069.2052 [GMT 2:00]
ausgeführt von:: c:\users\Raphael\Desktop\cofi.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Raphael\AppData\Local\gykeo.dat
c:\users\Raphael\AppData\Local\gykeo.exe
c:\users\Raphael\AppData\Local\gykeo_nav.dat
c:\users\Raphael\AppData\Local\gykeo_navps.dat
c:\users\Raphael\AppData\Local\spcilqc.dat
c:\users\Raphael\AppData\Local\spcilqc_nav.dat
c:\users\Raphael\AppData\Local\spcilqc_navps.dat
c:\users\Raphael\AppData\Roaming\Desktopicon
c:\users\Raphael\AppData\Roaming\Desktopicon\config.ini

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games


(((((((((((((((((((((((  Dateien erstellt von 2010-07-11 bis 2010-08-11  ))))))))))))))))))))))))))))))
.

2010-08-11 08:27 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-11 08:27 . 2010-08-11 08:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-11 08:27 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-08 22:22 . 2010-08-08 22:22        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Sierra
2010-08-08 19:59 . 2010-08-08 19:59        --------        d-----w-        c:\users\Raphael\AppData\Local\Activision
2010-08-08 12:39 . 2010-08-08 12:39        --------        d-----w-        c:\program files\iPod
2010-08-08 12:39 . 2010-08-08 12:40        --------        d-----w-        c:\program files\iTunes
2010-08-08 12:36 . 2010-08-08 12:36        --------        d-----w-        c:\program files\Bonjour
2010-08-08 08:57 . 2010-08-08 08:57        90        ----a-w-        c:\users\Raphael\AppData\Local\gysuyww.bat
2010-08-07 17:14 . 2010-08-07 17:14        --------        d-----w-        C:\_OTL
2010-07-22 10:59 . 2010-07-22 10:59        --------        d-----w-        c:\programdata\Malwarebytes
2010-07-21 06:50 . 2010-07-21 07:20        --------        d-----w-        c:\programdata\clp
2010-07-21 06:49 . 2010-07-21 09:22        --------        d-----w-        c:\programdata\Common Toolkit Suite
2010-07-21 06:49 . 2010-07-21 09:22        --------        d-----w-        c:\program files\Common Files\Common Toolkit Suite
2010-07-21 06:48 . 2010-07-21 06:48        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Fighters
2010-07-21 06:48 . 2010-07-21 06:48        --------        d-----w-        c:\users\Raphael\AppData\Local\PackageAware
2010-07-20 12:34 . 2010-07-20 12:35        --------        d-----w-        c:\program files\QuickTime
2010-07-20 10:13 . 2010-07-20 11:09        --------        d-----w-        c:\users\Raphael\AppData\Roaming\TeamViewer

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-11 09:05 . 2008-04-30 09:59        --------        d-----w-        c:\programdata\NVIDIA
2010-08-11 08:46 . 2008-01-21 07:15        674344        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-11 08:46 . 2008-01-21 07:15        146028        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-11 08:28 . 2009-02-04 16:15        --------        d-----w-        c:\users\Raphael\AppData\Roaming\ICQ
2010-08-10 09:34 . 2009-01-18 16:29        --------        d-----w-        c:\programdata\Google Updater
2010-08-09 09:40 . 2008-08-22 16:14        2148        ----a-w-        c:\users\Raphael\AppData\Roaming\wklnhst.dat
2010-08-08 13:24 . 2008-03-28 11:35        --------        d--h--w-        c:\program files\InstallShield Installation Information
2010-08-08 13:11 . 2010-02-01 14:56        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Skype
2010-08-08 13:09 . 2010-02-01 15:06        --------        d-----w-        c:\users\Raphael\AppData\Roaming\skypePM
2010-08-08 12:39 . 2009-01-11 09:20        --------        d-----w-        c:\program files\Common Files\Apple
2010-08-08 12:24 . 2010-08-08 12:24        73000        ----a-w-        c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-08-08 12:20 . 2009-03-25 17:57        --------        d-----w-        c:\program files\Safari
2010-08-08 12:14 . 2010-08-08 12:14        72488        ----a-w-        c:\programdata\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-07-23 18:48 . 2008-08-06 10:27        99944        ----a-w-        c:\users\Raphael\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-21 18:06 . 2008-03-28 11:35        319456        ----a-w-        c:\windows\DIFxAPI.dll
2010-07-21 18:06 . 2008-03-28 11:35        --------        d-----w-        c:\program files\Realtek
2010-07-19 19:15 . 2008-04-01 13:28        --------        d-----w-        c:\program files\Common Files\Real
2010-07-15 08:31 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail
2010-07-12 15:30 . 2010-07-04 11:22        21840        ----atw-        c:\windows\system32\SIntfNT.dll
2010-07-12 15:30 . 2010-07-04 11:22        17212        ----atw-        c:\windows\system32\SIntf32.dll
2010-07-12 15:30 . 2010-07-04 11:22        12067        ----atw-        c:\windows\system32\SIntf16.dll
2010-07-06 14:55 . 2010-07-06 14:55        --------        d-----w-        c:\program files\Apple Software Update
2010-07-04 09:29 . 2010-07-04 09:29        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Audio Recorder for Free
2010-06-29 19:06 . 2010-06-29 19:06        --------        d-----w-        c:\program files\MSBuild
2010-06-29 13:32 . 2010-06-29 13:32        --------        d-----w-        c:\users\Raphael\AppData\Roaming\DVDVideoSoftIEHelpers
2010-06-28 16:52 . 2008-08-20 17:54        --------        d-----w-        c:\program files\epson
2010-06-28 16:46 . 2008-04-11 12:08        --------        d-----w-        c:\programdata\CyberLink
2010-06-28 16:37 . 2008-03-28 13:35        --------        d-----w-        c:\programdata\Ulead Systems
2010-06-28 16:33 . 2008-08-13 15:26        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Ulead Systems
2010-06-27 18:56 . 2008-04-30 10:04        --------        d-----w-        c:\programdata\Nero
2010-06-27 18:56 . 2008-04-30 10:04        --------        d-----w-        c:\program files\Common Files\Nero
2010-06-27 16:28 . 2008-04-01 13:34        --------        d-----w-        c:\program files\Common Files\Buhl Data Service
2010-06-27 12:28 . 2010-05-17 17:37        --------        d-----w-        c:\programdata\Xfire
2010-06-26 17:30 . 2009-11-16 10:20        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Any Video Converter
2010-06-26 12:40 . 2010-05-17 17:37        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Xfire
2010-06-26 12:11 . 2010-06-26 11:44        8379        ----a-w-        c:\windows\BricoPackFoldersDelete.cmd
2010-06-26 12:11 . 2010-06-26 12:11        118071        ----a-w-        c:\windows\BricoPackUninst.cmd
2010-06-21 12:53 . 2010-06-21 12:52        --------        d-----w-        c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-06 12:02 . 2010-03-29 07:40        134332        ---ha-w-        c:\windows\system32\mlfcache.dat
2010-06-04 10:29 . 2010-06-04 10:29        71992        ----a-w-        c:\programdata\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-02 14:24 . 2010-06-02 14:24        1173768        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-05-26 17:06 . 2010-06-09 17:31        34304        ----a-w-        c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-09 17:31        289792        ----a-w-        c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2009-10-03 08:44        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-18 14:35 . 2010-05-18 14:35        91424        ----a-w-        c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35        75040        ----a-w-        c:\windows\system32\jdns_sd.dll
2010-05-18 14:35 . 2010-05-18 14:35        197920        ----a-w-        c:\windows\system32\dnssdX.dll
2010-05-18 14:35 . 2010-05-18 14:35        107808        ----a-w-        c:\windows\system32\dns-sd.exe
2010-05-17 17:53 . 2010-05-17 17:53        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Realtime Audio Engine"="mmrtkrnl.exe" [2008-12-02 70144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Raphael^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Raphael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2006-12-22 06:29        67752        ----a-w-        c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04        39792        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2008-06-12 12:28        266497        ----a-w-        c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25        125952        ----a-w-        c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 06:01        180736        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-05-03 16:41        30192        ----a-w-        c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 13:53        141608        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-04-29 13:39        437584        ----a-w-        c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-04-03 10:56        13535776        ----a-w-        c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-04-03 10:56        92704        ----a-w-        c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-04-17 09:50        6111232        ----a-w-        c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11        25623336        ----a-r-        c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-20 16:15        1826816        ----a-w-        c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-01-18 16:29        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):c5,4d,15,c0,98,55,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe [x]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-05-03 30192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\System32\nvSCPAPISvr.exe [2009-06-10 232960]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-11-21 569344]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners

2010-08-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-06 17:47]

2010-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 12:28]

2010-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 12:28]

2010-08-11 c:\windows\Tasks\User_Feed_Synchronization-{D762C80B-0833-4074-98C0-D5E095D75440}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]
.
.
------- Zusätzlicher Suchlauf -------
.
mSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
MSConfigStartUp-BDRegion - c:\program files\Cyberlink\Shared Files\brs.exe
MSConfigStartUp-CursorXP - c:\program files\CursorXP\CursorXP.exe
MSConfigStartUp-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
MSConfigStartUp-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-PlayMovie - c:\program files\HomeCinema\PlayMovie\PMVService.exe
MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-toolbar_eula_launcher - c:\program files\GoogleEULA\EULALauncher.exe
MSConfigStartUp-UVS11 Preload - c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
MSConfigStartUp-yjuejum - c:\users\raphael\appdata\local\yjuejum.exe
AddRemove-MJ - c:\program files\d-lusion\MJ\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-11 11:07
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\mmrtkrnl.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-11  11:13:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-08-11 09:13

Vor Suchlauf: 10 Verzeichnis(se), 300.212.613.120 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 299.907.969.024 Bytes frei

- - End Of File - - C8980D1FBC47C286666E393AF0D137A9
--- --- ---

nochdigger 11.08.2010 21:23
Hallo

versuche bitte jetzt mal Malwarebytes laufen zu lassen.

MFG

Raphael7436 12.08.2010 12:40
Es funktioniert wiede nicht!*

Was soll ich tun??

nochdigger 12.08.2010 20:59
Hallo

Scripten mit Combofix

  • Öffne den Editor ( Start -> Zubehör -> Editor ) kopiere nun folgenden Text in das weiße Feld:
Code:
KILLALL::
Rootkit::
File::
c:\users\Raphael\AppData\Local\gysuyww.bat

Folder::
Registry::
Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt
  • Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!
http://users.pandora.be/bluepatchy/m...s/CFScript.gif
  • Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten


Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann

Zitat:
Es funktioniert wiede nicht!*

Was soll ich tun??
Was passiert denn genau?

Überprüfe dein System bitte mit OSAM und poste anschließend sämtliche Logs hierher.

MFG

Raphael7436 13.08.2010 10:28
Combofix Logfile:
Code:
ComboFix 10-08-10.05 - Raphael 13.08.2010  10:51:27.2.4 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3069.1958 [GMT 2:00]
ausgeführt von:: c:\users\Raphael\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\Raphael\Desktop\cfscript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\users\Raphael\AppData\Local\gysuyww.bat"
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Raphael\AppData\Local\gysuyww.bat

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-13 bis 2010-08-13  ))))))))))))))))))))))))))))))
.

2010-08-13 08:57 . 2010-08-13 09:04        --------        d-----w-        c:\users\Raphael\AppData\Local\temp
2010-08-13 08:57 . 2010-08-13 08:57        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-08-13 08:57 . 2010-08-13 08:57        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-08-13 01:01 . 2010-08-13 01:01        --------        d-----w-        c:\program files\Microsoft.NET
2010-08-12 14:20 . 2010-08-12 14:21        --------        d-----w-        c:\program files\Common Files\DVDVideoSoft
2010-08-12 14:20 . 2010-08-12 14:20        --------        d-----w-        c:\program files\DVDVideoSoft
2010-08-12 11:44 . 2010-05-27 20:08        81920        ----a-w-        c:\windows\system32\iccvid.dll
2010-08-12 11:44 . 2010-06-11 16:16        274944        ----a-w-        c:\windows\system32\schannel.dll
2010-08-12 11:44 . 2010-06-21 13:37        2037760        ----a-w-        c:\windows\system32\win32k.sys
2010-08-12 11:44 . 2010-06-18 17:31        36864        ----a-w-        c:\windows\system32\rtutils.dll
2010-08-12 11:44 . 2010-06-08 17:35        3600768        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-08-12 11:44 . 2010-06-08 17:35        3548040        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-08-11 14:27 . 2010-08-11 14:27        680        ----a-w-        c:\users\Raphael\AppData\Local\d3d9caps.dat
2010-08-11 08:27 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-11 08:27 . 2010-08-12 11:39        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-11 08:27 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-08 22:22 . 2010-08-08 22:22        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Sierra
2010-08-08 19:59 . 2010-08-08 19:59        --------        d-----w-        c:\users\Raphael\AppData\Local\Activision
2010-08-08 12:39 . 2010-08-08 12:39        --------        d-----w-        c:\program files\iPod
2010-08-08 12:39 . 2010-08-08 12:40        --------        d-----w-        c:\program files\iTunes
2010-08-08 12:36 . 2010-08-08 12:36        --------        d-----w-        c:\program files\Bonjour
2010-08-08 12:24 . 2010-08-08 12:24        73000        ----a-w-        c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-08-08 12:14 . 2010-08-08 12:14        72488        ----a-w-        c:\programdata\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-08-07 17:14 . 2010-08-07 17:14        --------        d-----w-        C:\_OTL
2010-07-22 10:59 . 2010-07-22 10:59        --------        d-----w-        c:\programdata\Malwarebytes
2010-07-21 06:50 . 2010-07-21 07:20        --------        d-----w-        c:\programdata\clp
2010-07-21 06:49 . 2010-07-21 09:22        --------        d-----w-        c:\programdata\Common Toolkit Suite
2010-07-21 06:49 . 2010-07-21 09:22        --------        d-----w-        c:\program files\Common Files\Common Toolkit Suite
2010-07-21 06:48 . 2010-07-21 06:48        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Fighters
2010-07-21 06:48 . 2010-07-21 06:48        --------        d-----w-        c:\users\Raphael\AppData\Local\PackageAware
2010-07-20 12:34 . 2010-07-20 12:35        --------        d-----w-        c:\program files\QuickTime
2010-07-20 10:13 . 2010-07-20 11:09        --------        d-----w-        c:\users\Raphael\AppData\Roaming\TeamViewer

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-13 09:06 . 2008-01-21 07:15        674344        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-13 09:06 . 2008-01-21 07:15        146028        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-13 09:00 . 2008-04-30 09:59        --------        d-----w-        c:\programdata\NVIDIA
2010-08-13 01:04 . 2008-03-28 13:00        --------        d-----w-        c:\program files\Microsoft Works
2010-08-13 01:01 . 2008-03-28 13:15        --------        d-----w-        c:\programdata\Microsoft Help
2010-08-13 01:01 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail
2010-08-12 19:13 . 2009-02-04 16:15        --------        d-----w-        c:\users\Raphael\AppData\Roaming\ICQ
2010-08-12 16:45 . 2008-08-22 16:14        2148        ----a-w-        c:\users\Raphael\AppData\Roaming\wklnhst.dat
2010-08-12 16:12 . 2010-03-11 06:00        --------        d-----w-        c:\program files\ICQ7.0
2010-08-12 11:36 . 2009-01-18 16:29        --------        d-----w-        c:\programdata\Google Updater
2010-08-08 13:24 . 2008-03-28 11:35        --------        d--h--w-        c:\program files\InstallShield Installation Information
2010-08-08 13:11 . 2010-02-01 14:56        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Skype
2010-08-08 13:09 . 2010-02-01 15:06        --------        d-----w-        c:\users\Raphael\AppData\Roaming\skypePM
2010-08-08 12:39 . 2009-01-11 09:20        --------        d-----w-        c:\program files\Common Files\Apple
2010-08-08 12:20 . 2009-03-25 17:57        --------        d-----w-        c:\program files\Safari
2010-07-23 18:48 . 2008-08-06 10:27        99944        ----a-w-        c:\users\Raphael\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-21 18:06 . 2008-03-28 11:35        319456        ----a-w-        c:\windows\DIFxAPI.dll
2010-07-21 18:06 . 2008-03-28 11:35        --------        d-----w-        c:\program files\Realtek
2010-07-19 19:15 . 2008-04-01 13:28        --------        d-----w-        c:\program files\Common Files\Real
2010-07-12 15:30 . 2010-07-04 11:22        21840        ----atw-        c:\windows\system32\SIntfNT.dll
2010-07-12 15:30 . 2010-07-04 11:22        17212        ----atw-        c:\windows\system32\SIntf32.dll
2010-07-12 15:30 . 2010-07-04 11:22        12067        ----atw-        c:\windows\system32\SIntf16.dll
2010-07-06 14:55 . 2010-07-06 14:55        --------        d-----w-        c:\program files\Apple Software Update
2010-07-04 09:29 . 2010-07-04 09:29        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Audio Recorder for Free
2010-06-29 19:06 . 2010-06-29 19:06        --------        d-----w-        c:\program files\MSBuild
2010-06-29 13:32 . 2010-06-29 13:32        --------        d-----w-        c:\users\Raphael\AppData\Roaming\DVDVideoSoftIEHelpers
2010-06-28 16:52 . 2008-08-20 17:54        --------        d-----w-        c:\program files\epson
2010-06-28 16:46 . 2008-04-11 12:08        --------        d-----w-        c:\programdata\CyberLink
2010-06-28 16:37 . 2008-03-28 13:35        --------        d-----w-        c:\programdata\Ulead Systems
2010-06-28 16:33 . 2008-08-13 15:26        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Ulead Systems
2010-06-27 18:56 . 2008-04-30 10:04        --------        d-----w-        c:\programdata\Nero
2010-06-27 18:56 . 2008-04-30 10:04        --------        d-----w-        c:\program files\Common Files\Nero
2010-06-27 16:28 . 2008-04-01 13:34        --------        d-----w-        c:\program files\Common Files\Buhl Data Service
2010-06-27 12:28 . 2010-05-17 17:37        --------        d-----w-        c:\programdata\Xfire
2010-06-26 17:30 . 2009-11-16 10:20        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Any Video Converter
2010-06-26 12:40 . 2010-05-17 17:37        --------        d-----w-        c:\users\Raphael\AppData\Roaming\Xfire
2010-06-26 12:11 . 2010-06-26 11:44        8379        ----a-w-        c:\windows\BricoPackFoldersDelete.cmd
2010-06-26 12:11 . 2010-06-26 12:11        118071        ----a-w-        c:\windows\BricoPackUninst.cmd
2010-06-26 06:05 . 2010-08-12 11:41        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-12 11:41        71680        ----a-w-        c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-12 11:41        109056        ----a-w-        c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-12 11:41        133632        ----a-w-        c:\windows\system32\ieUnatt.exe
2010-06-21 12:53 . 2010-06-21 12:52        --------        d-----w-        c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-18 15:04 . 2010-08-12 11:41        302080        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-06-18 15:04 . 2010-08-12 11:41        144896        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-06-16 16:04 . 2010-08-12 11:41        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2010-06-11 16:15 . 2010-08-12 11:41        1248768        ----a-w-        c:\windows\system32\msxml3.dll
2010-06-06 12:02 . 2010-03-29 07:40        134332        ---ha-w-        c:\windows\system32\mlfcache.dat
2010-06-04 10:29 . 2010-06-04 10:29        71992        ----a-w-        c:\programdata\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-02 14:24 . 2010-06-02 14:24        1173768        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-05-26 17:06 . 2010-06-09 17:31        34304        ----a-w-        c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-09 17:31        289792        ----a-w-        c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2009-10-03 08:44        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-18 14:35 . 2010-05-18 14:35        91424        ----a-w-        c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35        75040        ----a-w-        c:\windows\system32\jdns_sd.dll
2010-05-18 14:35 . 2010-05-18 14:35        197920        ----a-w-        c:\windows\system32\dnssdX.dll
2010-05-18 14:35 . 2010-05-18 14:35        107808        ----a-w-        c:\windows\system32\dns-sd.exe
2010-05-17 17:53 . 2010-05-17 17:53        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Realtime Audio Engine"="mmrtkrnl.exe" [2008-12-02 70144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Raphael^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Raphael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2006-12-22 06:29        67752        ----a-w-        c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04        39792        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2008-06-12 12:28        266497        ----a-w-        c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25        125952        ----a-w-        c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 06:01        180736        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-05-03 16:41        30192        ----a-w-        c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 13:53        141608        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-04-29 13:39        437584        ----a-w-        c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-04-03 10:56        13535776        ----a-w-        c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-04-03 10:56        92704        ----a-w-        c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-04-17 09:50        6111232        ----a-w-        c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11        25623336        ----a-r-        c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-20 16:15        1826816        ----a-w-        c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-01-18 16:29        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):c5,4d,15,c0,98,55,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe [x]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-05-03 30192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\System32\nvSCPAPISvr.exe [2009-06-10 232960]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-11-21 569344]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners

2010-08-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-06 17:47]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 12:28]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 12:28]

2010-08-13 c:\windows\Tasks\User_Feed_Synchronization-{D762C80B-0833-4074-98C0-D5E095D75440}.job
- c:\windows\system32\msfeedssync.exe [2010-08-12 04:24]
.
.
------- Zusätzlicher Suchlauf -------
.
mSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Free YouTube to Mp3 Converter - c:\users\Raphael\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

AddRemove-gykeo - c:\users\raphael\appdata\local\gysuyww.bat



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-13 11:04
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\mmrtkrnl.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-13  11:09:09 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-08-13 09:09
ComboFix2.txt  2010-08-11 09:13

Vor Suchlauf: 13 Verzeichnis(se), 298.441.228.288 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 298.269.102.080 Bytes frei

- - End Of File - - A276961E4EDECCC4B619EAF7F129AF2D
--- --- ---



Schon bei der installation kommt eine Fehlermeldung :"MBAM_ERROR_EXPANDING_VARIABLES" (0,9) dort steht ich solle den genannten fehler an das Malwarbytes Antimalware Supportteam witergeben.


Beim starten erscheint wieder der obengenannte fehlercode aber noch etwas erscheint :
"MBAM_ERROR_MISSING_FILE (3,0 ,mbamswissarmy.sys) Das System kann den angegebenen Pfad nich finden" ich soll mich wieder an das Team wenden.

Wenn ich OSAM herunterlade ensteht nur eine Datei die mein PC nicht erkenen kann

nochdigger 13.08.2010 21:31
Hallo

das gefällt mir nicht:aufsmaul:

Stell Antivir (vorher Update) bitte mal wie hier angegeben ein
AntiVir
poste das Ergebnis hierher.

Außerdem überprüfe den Rechner mit MBRCheck

1. Prüfen

Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

MFG

Raphael7436 15.08.2010 14:33
Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Sonntag, 15. August 2010 13:26

Es wird nach 2715134 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : RAPHAEL-PC

Versionsinformationen:
BUILD.DAT : 10.0.0.567 32097 Bytes 19.04.2010 15:50:00
AVSCAN.EXE : 10.0.3.0 433832 Bytes 01.04.2010 11:37:36
AVSCAN.DLL : 10.0.3.0 56168 Bytes 30.03.2010 10:42:18
LUKE.DLL : 10.0.2.3 104296 Bytes 07.03.2010 17:33:00
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 10:59:48
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 08:05:36
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 18:27:50
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 16:37:44
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 15:37:44
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 10:29:04
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 00:39:27
VBASE006.VDF : 7.10.7.218 2294784 Bytes 02.06.2010 00:39:55
VBASE007.VDF : 7.10.9.165 4840960 Bytes 23.07.2010 00:40:54
VBASE008.VDF : 7.10.9.166 2048 Bytes 23.07.2010 00:40:54
VBASE009.VDF : 7.10.9.167 2048 Bytes 23.07.2010 00:40:55
VBASE010.VDF : 7.10.9.168 2048 Bytes 23.07.2010 00:40:55
VBASE011.VDF : 7.10.9.169 2048 Bytes 23.07.2010 00:40:55
VBASE012.VDF : 7.10.9.170 2048 Bytes 23.07.2010 00:40:55
VBASE013.VDF : 7.10.9.198 157696 Bytes 26.07.2010 00:40:57
VBASE014.VDF : 7.10.9.255 997888 Bytes 29.07.2010 00:41:09
VBASE015.VDF : 7.10.10.28 139264 Bytes 02.08.2010 00:41:11
VBASE016.VDF : 7.10.10.52 127488 Bytes 03.08.2010 00:41:13
VBASE017.VDF : 7.10.10.84 137728 Bytes 06.08.2010 00:41:14
VBASE018.VDF : 7.10.10.107 176640 Bytes 09.08.2010 00:41:17
VBASE019.VDF : 7.10.10.130 132608 Bytes 10.08.2010 00:41:18
VBASE020.VDF : 7.10.10.158 131072 Bytes 12.08.2010 00:41:20
VBASE021.VDF : 7.10.10.159 2048 Bytes 12.08.2010 00:41:20
VBASE022.VDF : 7.10.10.160 2048 Bytes 12.08.2010 00:41:20
VBASE023.VDF : 7.10.10.161 2048 Bytes 12.08.2010 00:41:20
VBASE024.VDF : 7.10.10.162 2048 Bytes 12.08.2010 00:41:21
VBASE025.VDF : 7.10.10.163 2048 Bytes 12.08.2010 00:41:21
VBASE026.VDF : 7.10.10.164 2048 Bytes 12.08.2010 00:41:21
VBASE027.VDF : 7.10.10.165 2048 Bytes 12.08.2010 00:41:21
VBASE028.VDF : 7.10.10.166 2048 Bytes 12.08.2010 00:41:21
VBASE029.VDF : 7.10.10.167 2048 Bytes 12.08.2010 00:41:21
VBASE030.VDF : 7.10.10.168 2048 Bytes 12.08.2010 00:41:21
VBASE031.VDF : 7.10.10.182 49664 Bytes 13.08.2010 00:41:22
Engineversion : 8.2.4.34
AEVDF.DLL : 8.1.2.1 106868 Bytes 15.08.2010 00:42:02
AESCRIPT.DLL : 8.1.3.42 1364347 Bytes 15.08.2010 00:42:02
AESCN.DLL : 8.1.6.1 127347 Bytes 15.08.2010 00:41:57
AESBX.DLL : 8.1.3.1 254324 Bytes 15.08.2010 00:42:03
AERDL.DLL : 8.1.8.2 614772 Bytes 15.08.2010 00:41:56
AEPACK.DLL : 8.2.3.5 471412 Bytes 15.08.2010 00:41:52
AEOFFICE.DLL : 8.1.1.8 201081 Bytes 15.08.2010 00:41:48
AEHEUR.DLL : 8.1.2.11 2834805 Bytes 15.08.2010 00:41:47
AEHELP.DLL : 8.1.13.2 242039 Bytes 15.08.2010 00:41:32
AEGEN.DLL : 8.1.3.19 393587 Bytes 15.08.2010 00:41:31
AEEMU.DLL : 8.1.2.0 393588 Bytes 15.08.2010 00:41:28
AECORE.DLL : 8.1.16.2 192887 Bytes 15.08.2010 00:41:27
AEBB.DLL : 8.1.1.0 53618 Bytes 15.08.2010 00:41:25
AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 10:59:12
AVPREF.DLL : 10.0.0.0 44904 Bytes 14.01.2010 10:59:08
AVREP.DLL : 10.0.0.8 62209 Bytes 18.02.2010 15:47:42
AVREG.DLL : 10.0.3.0 53096 Bytes 01.04.2010 11:35:46
AVSCPLR.DLL : 10.0.3.0 83816 Bytes 01.04.2010 11:39:50
AVARKT.DLL : 10.0.0.14 227176 Bytes 01.04.2010 11:22:12
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 26.01.2010 08:53:26
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 11:57:54
AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 14:38:56
NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 13:40:56
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28.01.2010 12:10:10
RCTEXT.DLL : 10.0.53.0 98152 Bytes 09.04.2010 13:14:30

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: mittel
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Sonntag, 15. August 2010 13:26

Der Suchlauf nach versteckten Objekten wird begonnen.
c:\windows\system32\sndvol.exe
c:\Windows\System32\SndVol.exe
[HINWEIS] Der Prozess ist nicht sichtbar.
c:\program files\common files\apple\mobile device support\applemobiledevicehelper.exe
c:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
[HINWEIS] Der Prozess ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceHelper.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunes.exe' - '150' Modul(e) wurden durchsucht
Durchsuche Prozess 'distnoted.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'Safari.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'MpCmdRun.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'ntvdm.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'conime.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'mmrtkrnl.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '159' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '151' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD3
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1047' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <BOOT>
C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
[FUND] Enthält Erkennungsmuster der Anwendung APPL/BoontyGames
Beginne mit der Suche in 'D:\' <RECOVER>

Beginne mit der Desinfektion:
C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
[FUND] Enthält Erkennungsmuster der Anwendung APPL/BoontyGames
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '482840ed.qua' verschoben!


Ende des Suchlaufs: Sonntag, 15. August 2010 14:55
Benötigte Zeit: 1:29:13 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

25124 Verzeichnisse wurden überprüft
529399 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
529398 Dateien ohne Befall
4816 Archive wurden durchsucht
0 Warnungen
1 Hinweise
669650 Objekte wurden beim Rootkitscan durchsucht
2 Versteckte Objekte wurden gefunden























MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: MEDIONPC
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: MEDIONPC
System Product Name: MS-7501
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 142):
0x82645000 \SystemRoot\system32\ntkrnlpa.exe
0x82612000 \SystemRoot\system32\hal.dll
0x8060B000 \SystemRoot\system32\kdcom.dll
0x80612000 \SystemRoot\system32\PSHED.dll
0x80623000 \SystemRoot\system32\BOOTVID.dll
0x8062B000 \SystemRoot\system32\CLFS.SYS
0x8066C000 \SystemRoot\system32\CI.dll
0x8074C000 \SystemRoot\system32\drivers\Wdf01000.sys
0x807C8000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x83001000 \SystemRoot\system32\drivers\acpi.sys
0x83047000 \SystemRoot\system32\drivers\WMILIB.SYS
0x83050000 \SystemRoot\system32\drivers\msisadrv.sys
0x83058000 \SystemRoot\system32\drivers\pci.sys
0x8307F000 \SystemRoot\System32\drivers\partmgr.sys
0x8308E000 \SystemRoot\system32\drivers\volmgr.sys
0x8309D000 \SystemRoot\System32\drivers\volmgrx.sys
0x830E7000 \SystemRoot\system32\DRIVERS\amdide.sys
0x830EE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x830FC000 \SystemRoot\System32\drivers\mountmgr.sys
0x8310C000 \SystemRoot\system32\drivers\atapi.sys
0x83114000 \SystemRoot\system32\drivers\ataport.SYS
0x83132000 \SystemRoot\system32\drivers\fltmgr.sys
0x83164000 \SystemRoot\system32\drivers\fileinfo.sys
0x83174000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x83179000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8320E000 \SystemRoot\system32\drivers\ndis.sys
0x83319000 \SystemRoot\system32\drivers\msrpc.sys
0x83344000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AA0D000 \SystemRoot\System32\drivers\tcpip.sys
0x8AAF7000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8AC00000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8AD10000 \SystemRoot\system32\drivers\volsnap.sys
0x8AD49000 \SystemRoot\System32\Drivers\spldr.sys
0x8AD51000 \SystemRoot\System32\Drivers\mup.sys
0x8AD60000 \SystemRoot\system32\drivers\mmrtkrnl.sys
0x8AD78000 \SystemRoot\system32\drivers\ks.sys
0x8ADA2000 \SystemRoot\System32\drivers\ecache.sys
0x8ADC9000 \SystemRoot\system32\drivers\disk.sys
0x8ADDA000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8AB12000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x8AB1A000 \SystemRoot\system32\drivers\crcdisk.sys
0x8AB23000 \SystemRoot\system32\DRIVERS\ahcix86s.sys
0x8AB64000 \SystemRoot\system32\DRIVERS\storport.sys
0x8AA00000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8337F000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x83388000 \SystemRoot\system32\DRIVERS\processr.sys

nochdigger 15.08.2010 15:55
Moin

die zweite Hälfte des MBRCheck fehlt:rolleyes:

MFG

Raphael7436 15.08.2010 16:09
Welche 2 hälfte???
nur das steht bei mir:



MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: MEDIONPC
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: MEDIONPC
System Product Name: MS-7501
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 141):
0x8261F000 \SystemRoot\system32\ntkrnlpa.exe
0x829D8000 \SystemRoot\system32\hal.dll
0x80403000 \SystemRoot\system32\kdcom.dll
0x8040A000 \SystemRoot\system32\PSHED.dll
0x8041B000 \SystemRoot\system32\BOOTVID.dll
0x80423000 \SystemRoot\system32\CLFS.SYS
0x80464000 \SystemRoot\system32\CI.dll
0x80544000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C0000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80605000 \SystemRoot\system32\drivers\acpi.sys
0x8064B000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80654000 \SystemRoot\system32\drivers\msisadrv.sys
0x8065C000 \SystemRoot\system32\drivers\pci.sys
0x80683000 \SystemRoot\System32\drivers\partmgr.sys
0x80692000 \SystemRoot\system32\drivers\volmgr.sys
0x806A1000 \SystemRoot\System32\drivers\volmgrx.sys
0x806EB000 \SystemRoot\system32\DRIVERS\amdide.sys
0x806F2000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x80700000 \SystemRoot\System32\drivers\mountmgr.sys
0x80710000 \SystemRoot\system32\drivers\atapi.sys
0x80718000 \SystemRoot\system32\drivers\ataport.SYS
0x80736000 \SystemRoot\system32\drivers\fltmgr.sys
0x80768000 \SystemRoot\system32\drivers\fileinfo.sys
0x80778000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8077D000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8300A000 \SystemRoot\system32\drivers\ndis.sys
0x83115000 \SystemRoot\system32\drivers\msrpc.sys
0x83140000 \SystemRoot\system32\drivers\NETIO.SYS
0x83207000 \SystemRoot\System32\drivers\tcpip.sys
0x832F1000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8AA01000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8AB11000 \SystemRoot\system32\drivers\volsnap.sys
0x8AB4A000 \SystemRoot\System32\Drivers\spldr.sys
0x8AB52000 \SystemRoot\System32\Drivers\mup.sys

nochdigger 15.08.2010 17:16
Hallo

lass das Programm mal 2-3min laufen und sieh dir das neue Log dann mal an;)

MFG

Raphael7436 15.08.2010 17:32
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: MEDIONPC
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: MEDIONPC
System Product Name: MS-7501
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 141):
0x82640000 \SystemRoot\system32\ntkrnlpa.exe
0x8260D000 \SystemRoot\system32\hal.dll
0x80409000 \SystemRoot\system32\kdcom.dll
0x80410000 \SystemRoot\system32\PSHED.dll
0x80421000 \SystemRoot\system32\BOOTVID.dll
0x80429000 \SystemRoot\system32\CLFS.SYS
0x8046A000 \SystemRoot\system32\CI.dll
0x8054A000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C6000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80602000 \SystemRoot\system32\drivers\acpi.sys
0x80648000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80651000 \SystemRoot\system32\drivers\msisadrv.sys
0x80659000 \SystemRoot\system32\drivers\pci.sys
0x80680000 \SystemRoot\System32\drivers\partmgr.sys
0x8068F000 \SystemRoot\system32\drivers\volmgr.sys
0x8069E000 \SystemRoot\System32\drivers\volmgrx.sys
0x806E8000 \SystemRoot\system32\DRIVERS\amdide.sys
0x806EF000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x806FD000 \SystemRoot\System32\drivers\mountmgr.sys
0x8070D000 \SystemRoot\system32\drivers\atapi.sys
0x80715000 \SystemRoot\system32\drivers\ataport.SYS
0x80733000 \SystemRoot\system32\drivers\fltmgr.sys
0x80765000 \SystemRoot\system32\drivers\fileinfo.sys
0x80775000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8077A000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8300A000 \SystemRoot\system32\drivers\ndis.sys
0x83115000 \SystemRoot\system32\drivers\msrpc.sys
0x83140000 \SystemRoot\system32\drivers\NETIO.SYS
0x8320C000 \SystemRoot\System32\drivers\tcpip.sys
0x832F6000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8AA0D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8AB1D000 \SystemRoot\system32\drivers\volsnap.sys
0x8AB56000 \SystemRoot\System32\Drivers\spldr.sys
0x8AB5E000 \SystemRoot\System32\Drivers\mup.sys
0x8AB6D000 \SystemRoot\system32\drivers\mmrtkrnl.sys
0x8AB85000 \SystemRoot\system32\drivers\ks.sys
0x8ABAF000 \SystemRoot\System32\drivers\ecache.sys
0x8ABD6000 \SystemRoot\system32\drivers\disk.sys
0x83311000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8ABE7000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x8ABEF000 \SystemRoot\system32\drivers\crcdisk.sys
0x83332000 \SystemRoot\system32\DRIVERS\ahcix86s.sys
0x83373000 \SystemRoot\system32\DRIVERS\storport.sys
0x83200000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8317B000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x83184000 \SystemRoot\system32\DRIVERS\processr.sys
0x90601000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x90D1B000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x90DBC000 \SystemRoot\System32\drivers\watchdog.sys
0x90DC8000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x90DE9000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x83193000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x831A1000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x90DF9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x831B9000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x9100E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x9104C000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9105B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x910E8000 \SystemRoot\system32\DRIVERS\serial.sys
0x91102000 \SystemRoot\system32\DRIVERS\serenum.sys
0x9110C000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x9113B000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x91146000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x9115D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91168000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x9118B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x9119A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x911AE000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x911C3000 \SystemRoot\system32\DRIVERS\termdd.sys
0x911D3000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x911DE000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x911E9000 \SystemRoot\system32\DRIVERS\swenum.sys
0x911EB000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x91000000 \SystemRoot\system32\DRIVERS\umbus.sys
0x831C3000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x807EB000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x91400000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x805D3000 \SystemRoot\system32\drivers\portcls.sys
0x91604000 \SystemRoot\system32\drivers\drmk.sys
0x91629000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x91632000 \SystemRoot\System32\Drivers\Null.SYS
0x91639000 \SystemRoot\System32\Drivers\Beep.SYS
0x9165C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x91663000 \SystemRoot\System32\drivers\vga.sys
0x9166F000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x91690000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x91698000 \SystemRoot\system32\drivers\rdpencdd.sys
0x916A0000 \SystemRoot\System32\Drivers\Msfs.SYS
0x916AB000 \SystemRoot\System32\Drivers\Npfs.SYS
0x916B9000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x916C2000 \SystemRoot\system32\DRIVERS\tdx.sys
0x916D8000 \SystemRoot\system32\DRIVERS\smb.sys
0x916EC000 \SystemRoot\system32\drivers\afd.sys
0x91734000 \SystemRoot\System32\DRIVERS\netbt.sys
0x91766000 \SystemRoot\system32\DRIVERS\pacer.sys
0x9177C000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9178A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9179D000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x917A3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x917DF000 \SystemRoot\system32\drivers\nsiproxy.sys
0x917E9000 \SystemRoot\System32\Drivers\dfsc.sys
0x91A0E000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x91A30000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x91A45000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x91A47000 \SystemRoot\system32\DRIVERS\netr28u.sys
0x91ADB000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x91AF2000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x91AFB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x91B0B000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x91B14000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x91B1C000 \SystemRoot\System32\Drivers\fastfat.SYS
0x91B44000 \SystemRoot\System32\Drivers\crashdmp.sys
0x91B51000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x91B5B000 \SystemRoot\System32\Drivers\dump_ahcix86s.sys
0x99E20000 \SystemRoot\System32\win32k.sys
0x91B9C000 \SystemRoot\System32\drivers\Dxapi.sys
0x91BA6000 \SystemRoot\system32\DRIVERS\monitor.sys
0x9A040000 \SystemRoot\System32\TSDDD.dll
0x9A060000 \SystemRoot\System32\cdd.dll
0x91BB5000 \SystemRoot\system32\drivers\luafv.sys
0x91BD0000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9EC06000 \SystemRoot\system32\drivers\spsys.sys
0x9ECB6000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9ECC6000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9ECF0000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9ECFA000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9ED0D000 \SystemRoot\system32\drivers\HTTP.sys
0x9ED7A000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9ED97000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9EDB0000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9EDC5000 \SystemRoot\system32\drivers\mrxdav.sys
0x833B4000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA0403000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA043C000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA0454000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA047B000 \SystemRoot\System32\DRIVERS\srv.sys
0xA04C9000 \SystemRoot\system32\drivers\peauth.sys
0xA05A7000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA05B1000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA05BD000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77040000 \Windows\System32\ntdll.dll

Processes (total 51):
0 System Idle Process
4 System
444 C:\Windows\System32\smss.exe
524 csrss.exe
572 C:\Windows\System32\wininit.exe
584 csrss.exe
616 C:\Windows\System32\services.exe
628 C:\Windows\System32\lsass.exe
644 C:\Windows\System32\lsm.exe
788 C:\Windows\System32\svchost.exe
872 C:\Windows\System32\nvvsvc.exe
900 C:\Windows\System32\svchost.exe
964 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\winlogon.exe
1040 C:\Windows\System32\svchost.exe
1072 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\svchost.exe
1168 C:\Windows\System32\audiodg.exe
1224 C:\Windows\System32\svchost.exe
1240 C:\Windows\System32\SLsvc.exe
1372 C:\Windows\System32\svchost.exe
1428 C:\Windows\System32\svchost.exe
1592 C:\Windows\System32\rundll32.exe
1772 C:\Windows\System32\spoolsv.exe
1796 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1808 C:\Windows\System32\svchost.exe
320 C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
488 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
512 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
608 C:\Program Files\Bonjour\mDNSResponder.exe
1448 C:\Windows\System32\svchost.exe
1204 C:\Windows\System32\nvSCPAPISvr.exe
2064 C:\Windows\System32\svchost.exe
2120 C:\Windows\System32\SearchIndexer.exe
2128 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2532 C:\Windows\System32\taskeng.exe
3120 C:\Windows\System32\taskeng.exe
3140 C:\Windows\System32\dwm.exe
3252 C:\Windows\explorer.exe
3472 C:\Program Files\Windows Defender\MSASCui.exe
3488 C:\Windows\System32\mmrtkrnl.exe
3516 C:\Program Files\iTunes\iTunesHelper.exe
3576 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3744 C:\Program Files\Windows Media Player\wmpnscfg.exe
3888 C:\Program Files\Windows Media Player\wmpnetwk.exe
588 C:\Program Files\iPod\bin\iPodService.exe
1688 C:\Windows\System32\wbem\unsecapp.exe
2860 WmiPrvSE.exe
3088 C:\Program Files\Safari\Safari.exe
2228 C:\Users\Raphael\Desktop\MBRCheck-1.exe
3604 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000006f`70839c00 (FAT32)

PhysicalDrive0 Model Number: WDC WD5000AACS-00ZUB0, Rev: 1.10

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 RE: Windows 98 MBR code detected
SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E


Done!

Raphael7436 18.08.2010 18:46
Auf einmal funktioniert Malwarebytes:)


alwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4432

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

18.08.2010 19:45:23
mbam-log-2010-08-18 (19-45-23).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 297561
Laufzeit: 55 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\IGB (Rogue.Residue) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:32 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131