Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Systemstart : Svchost/WinUPDT32 (https://www.trojaner-board.de/89932-systemstart-svchost-winupdt32.html)

ChaosGott 24.08.2010 13:42
Systemstart : Svchost/WinUPDT32
 
Hallo Leute ich bin neu hier und ich hoffe mal ich bin richtig^^ Also als 1.Sorry wegen meiner rechtschreibung (Lrs:pfui:) Naja also ich bin sehr gern im inet und seit neustem stimmt etwas nicht erstmal hab ich ein neuen prozess der so alle 5/10 min kommt und 3 sek bleibt das ding nennt sich :WinUPDT32.com und zudemm kommt noch 2 neue systemstart programme namens : svchost 2 mal und WinUPDT32 ist auch 2 mal dabei alles aus dem "Befehl" C:/WINDOWS/Win32Gl der allerdings Sich nicht auftreiben lässt -.- Ich habe mir schon HiJackThis Runtergeladen und dabei kamm das raus ...
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:21:32, on 24.08.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Programme\Java\jre6\bin\jqs.exe
c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtblfs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\HiJackThis204.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ievkbd.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Programme\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Programme\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe"
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKLM\..\Run: [WinUPDT32] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKCU\..\Run: [WinUPDT32] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com
O4 - HKLM\..\Policies\Explorer\Run: [WinUPDT32.exe] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [WinUPDT32.exe] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Programme\Acer WLAN 11g USB Dongle\ZDWlan.exe
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Security Suite CBE 10 (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10142 bytes
--- --- ---

Bitte um hilfe schnell achja ich hab schon 1 bis 15 mal selbst gesucht kamm aber nix ich kenne mich eig ein bisschen mit viren aus hatte schon ein paar :D aber niemals so einen schwer zu löschbaren :(

markusg 24.08.2010 14:06
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide

ChaosGott 24.08.2010 14:41
Zitat:
Zitat von markusg (Beitrag 559264)
ootl:
Systemscan mit OTL
download otl:
hxxp://oldtimer.geekstogo.com/OTL.exe

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide
CREATERESTOREPOINT auch rein in die box?

markusg 24.08.2010 14:54
ja das auch.

ChaosGott 24.08.2010 15:02
Ok es ist grad dabei un wo speichern sich die datein dann?

markusg 24.08.2010 15:06
1 wird sich im vordergrund öffnen, eins ist minimiert

ChaosGott 24.08.2010 15:34
OTL :OTL Logfile:
Code:
OTL logfile created on: 24.08.2010 16:00:31 - Run 1
OTL by OldTimer - Version 3.2.10.0    Folder = C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 168,19 Gb Free Space | 56,42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ACER-769C8142EE
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Steam\Steam.exe (Valve Corporation)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtblfs.exe (Kaspersky Lab)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Electronic Arts\Command & Conquer 3\RetailExe\1.4\cnc3game.dat (Electronic Arts Inc.)
PRC - C:\Programme\Electronic Arts\Command & Conquer 3\CNC3.exe (Electronic Arts Inc.)
PRC - C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
PRC - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
PRC - c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programme\Acer WLAN 11g USB Dongle\ZDWlan.exe (X-Micro Technology Corp.)
PRC - C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\mfc71u.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\sysenv.dll (HiTRUST)
MOD - C:\WINDOWS\system32\MSNChatHook.dll (HiTRUST)
MOD - C:\WINDOWS\system32\CryptoAPI.dll (HiTRUST)
MOD - C:\WINDOWS\system32\msvcp71.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (AVP) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab)
SRV - (AcerMemUsageCheckService) -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe (Acer Inc.)
SRV - (LightScribeService) -- c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (MSCSPTISRV) -- C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (SSScsiSV) -- C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SSScsiSV.exe (Sony Corporation)
SRV - (x10nets) -- C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SYMIDSCO) -- C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20100513.001\symidsco.sys File not found
DRV - (GMSIPCI) -- E:\INSTALL\GMSIPCI.SYS File not found
DRV - (GarenaPEngine) -- C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp File not found
DRV - (esgiguard) -- C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV - (EagleNT) -- C:\WINDOWS\System32\drivers\EagleNT.sys File not found
DRV - (cpuz130) -- C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\cpuz130\cpuz_x32.sys File not found
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (klbg) -- C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (AtiHdmiService) -- C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (MPE) -- C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (PAC207) -- C:\WINDOWS\system32\drivers\PFC027.SYS (PixArt Imaging Inc.)
DRV - (AmdLLD) -- C:\WINDOWS\system32\drivers\AmdLLD.sys (AMD, Inc.)
DRV - (ATITool) -- C:\WINDOWS\system32\drivers\ATITool.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (nvraid) NVIDIA nForce(tm) -- C:\WINDOWS\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvatabus) -- C:\WINDOWS\system32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (Hauppauge WinTV-HVR-1110) -- C:\WINDOWS\system32\drivers\HVR1110.sys (Hauppauge Computer Works Co.)
DRV - (psdfilter) -- C:\WINDOWS\system32\drivers\psdfilter.sys (HiTRUST)
DRV - (psdvdisk) -- C:\WINDOWS\system32\drivers\psdvdisk.sys (HiTRUST)
DRV - (X10Hid) -- C:\WINDOWS\system32\drivers\x10hid.sys (X10 Wireless Technology, Inc.)
DRV - (ZD1211BU(ZyDAS)) ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\WINDOWS\system32\drivers\ZD1211BU.sys (ZyDAS Technology Corporation)
DRV - (ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\WINDOWS\system32\drivers\ZD1211U.sys (ZyDAS Technology Corporation)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (ZDPSp50) -- C:\WINDOWS\system32\drivers\ZDPSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (BrScnUsb) -- C:\WINDOWS\system32\drivers\BrScnUsb.sys (Brother Industries Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-865584140-4230085389-3338066738-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: quickstores@quickstores.de:1.0.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.747
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.24 18:03:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.25 13:05:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\THBExt [2010.07.21 18:07:30 | 000,000,000 | ---D | M]
 
[2010.05.16 00:21:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2010.08.22 23:43:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\extensions
[2010.08.19 06:33:43 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.19 06:33:44 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.01 08:32:15 | 000,002,382 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\searchplugins\askcom.xml
[2010.08.20 19:30:35 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\searchplugins\icqplugin-1.xml
[2010.07.01 14:48:58 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\searchplugins\icqplugin-2.xml
[2010.06.22 22:39:53 | 000,000,947 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\searchplugins\icqplugin.xml
[2010.08.23 06:26:41 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.20 23:57:14 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.05.16 10:37:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.07.21 18:08:04 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010.06.10 20:28:03 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\quickstores@quickstores.de
[2010.05.16 10:37:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.08.14 13:37:06 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      loc
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\..\Toolbar\WebBrowser: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [HKLM] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Programme\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [ntiMUI] c:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinUPDT32] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O4 - HKU\S-1-5-21-865584140-4230085389-3338066738-500..\Run: [HKCU] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O4 - HKU\S-1-5-21-865584140-4230085389-3338066738-500..\Run: [WinUPDT32] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acer WLAN 11g USB Dongle.lnk = C:\Programme\Acer WLAN 11g USB Dongle\ZDWlan.exe (X-Micro Technology Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: WinUPDT32.exe = C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: WinUPDT32.exe = C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O7 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2006.08.11 21:40:56 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{f05bdada-7d20-11df-9e9c-0019216b1e64}\Shell\AutoRun\command - "" = .\Highspeed drivers.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: SSHNAS -  File not found
 
MsConfig - StartUpReg: HKCU - hkey= - key= - C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
MsConfig - StartUpReg: HKLM - hkey= - key= - C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
MsConfig - StartUpReg: LaunchApp - hkey= - key= - C:\WINDOWS\Alaunch.exe (Acer Inc.)
MsConfig - StartUpReg: nwiz - hkey= - key= -  File not found
MsConfig - StartUpReg: WinUPDT32 - hkey= - key= -  File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {1L17R80W-A452-56B0-123C-75UJ5M72XM20} - C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com Restart
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - Microsoft NetShow Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {29E7D24F-BF30-45E7-8A40-AD27AFD8F5C6} - Microsoft .NET Framework 1.0 Hotfix (KB979904)
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {407408d4-94ed-4d86-ab69-a7f649d112ee} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - Microsoft .NET Framework 1.0 Hotfix (KB930494)
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E4V6HJW0-7300-JV52-28V2-5XOW7R6OS476} - C:\WINDOWS\Win32Gl\svchost.exe
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E8EA5BD6-D931-4001-ABF6-81BAA500360A} - Microsoft .NET Framework 1.0 Hotfix (KB953295)
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3
ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (65034330371522560)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.23 16:36:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue
[2010.08.22 21:11:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Logs
[2010.08.22 16:14:32 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\Recent
[2010.08.19 18:17:48 | 000,030,016 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
[2010.08.19 18:16:29 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.08.19 15:16:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Samsung_USB_Drivers
[2010.08.14 17:03:57 | 000,000,000 | ---D | C] -- C:\Programme\IObit
[2010.08.14 13:41:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Neuer Ordner
[2010.08.14 13:36:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\95431C66CF9A4913BFFF6050785AFB65.TMP
[2010.08.14 13:36:14 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
[2010.08.11 23:01:03 | 000,000,000 | ---D | C] -- C:\Programme\Killing Floor
[2010.08.07 23:44:59 | 000,000,000 | ---D | C] -- C:\Programme\Steam
[2010.08.06 22:03:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\PunkBuster
[2010.08.06 22:03:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\BFBC2
[2010.08.06 22:02:46 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\SecuROM
[2010.08.06 16:45:46 | 000,000,000 | ---D | C] -- C:\Programme\ASCII
[2010.08.05 12:55:10 | 000,444,952 | ---- | C] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010.08.05 12:55:10 | 000,109,080 | ---- | C] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010.08.05 01:58:46 | 000,034,304 | ---- | C] (AMD, Inc.) -- C:\WINDOWS\System32\drivers\AmdLLD.sys
[2010.08.05 01:58:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
[2010.08.05 01:55:37 | 004,337,664 | ---- | C] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticaldd.dll
[2010.08.05 01:55:37 | 000,143,360 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiapfxx.exe
[2010.08.05 01:55:37 | 000,118,784 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atibtmon.exe
[2010.08.05 01:55:37 | 000,065,024 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\atimpc32.dll
[2010.08.05 01:55:37 | 000,053,248 | ---- | C] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticalrt.dll
[2010.08.05 01:55:37 | 000,053,248 | ---- | C] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticalcl.dll
[2010.08.05 01:54:18 | 000,000,000 | ---D | C] -- C:\Programme\ATI
[2010.08.05 01:53:28 | 000,000,000 | ---D | C] -- C:\ATI
[2010.08.05 01:37:52 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Futuremark Shared
[2010.08.01 16:23:33 | 000,026,176 | -H-- | C] (LogMeIn, Inc.) -- C:\WINDOWS\System32\hamachi.sys
[2010.07.25 22:17:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Command & Conquer 3 Tiberium Wars
[2010.07.25 18:24:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
[2010.07.25 17:56:22 | 000,000,000 | ---D | C] -- C:\Programme\Electronic Arts
[2006.05.25 19:18:48 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\Interop.Shell32.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[161 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[112 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.24 15:08:00 | 000,001,102 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.08.24 14:55:44 | 000,256,890 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\cglogs.dat
[2010.08.24 14:48:13 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2010.08.24 14:44:42 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.24 14:44:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.24 14:44:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.24 14:44:34 | 3220,754,432 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.24 14:43:52 | 005,505,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\NTUSER.DAT
[2010.08.24 14:43:41 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.ini
[2010.08.24 11:33:13 | 004,816,514 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.08.24 11:22:16 | 000,000,221 | RHS- | M] () -- C:\boot.ini
[2010.08.24 11:22:16 | 000,000,000 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.08.24 11:22:16 | 000,000,000 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.08.23 19:15:56 | 000,237,226 | ---- | M] () -- C:\^.rar
[2010.08.23 19:15:53 | 000,237,226 | ---- | M] () -- C:\^
[2010.08.23 16:49:24 | 000,218,808 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2010.08.23 16:45:23 | 000,137,256 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.08.22 01:40:35 | 000,040,960 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.13 10:26:27 | 000,178,648 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.13 00:38:39 | 001,029,528 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.08.13 00:38:39 | 000,460,608 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.08.13 00:38:39 | 000,442,602 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.08.13 00:38:39 | 000,085,350 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.08.13 00:38:39 | 000,071,868 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.08.12 21:26:04 | 000,030,528 | ---- | M] (TuneUp Software) -- C:\WINDOWS\System32\TURegOpt.exe
[2010.08.12 21:19:54 | 000,030,016 | ---- | M] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
[2010.08.11 23:31:48 | 000,002,810 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\stats.bin
[2010.08.06 20:25:30 | 000,138,056 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PnkBstrK.sys
[2010.08.06 20:25:02 | 002,434,856 | ---- | M] () -- C:\WINDOWS\System32\pbsvc_bc2.exe
[2010.08.05 12:55:10 | 000,444,952 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010.08.05 12:55:10 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010.08.01 18:02:49 | 000,038,608 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.08.01 17:12:53 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\Access.dat
[2010.07.29 18:51:00 | 000,113,933 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010.07.29 18:50:59 | 000,097,549 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010.07.27 08:29:42 | 008,503,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[161 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[112 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.24 06:59:37 | 3220,754,432 | -HS- | C] () -- C:\hiberfil.sys
[2010.08.23 19:15:56 | 000,237,226 | ---- | C] () -- C:\^.rar
[2010.08.23 19:15:53 | 000,237,226 | ---- | C] () -- C:\^
[2010.08.19 15:16:41 | 000,000,766 | ---- | C] () -- C:\WINDOWS\System32\Uninstall.ico
[2010.08.11 23:32:03 | 000,002,810 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\stats.bin
[2010.08.06 22:03:47 | 000,218,808 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2010.08.06 20:25:02 | 002,434,856 | ---- | C] () -- C:\WINDOWS\System32\pbsvc_bc2.exe
[2010.08.05 01:55:37 | 000,063,416 | ---- | C] () -- C:\WINDOWS\System32\atiapfxx.blb
[2010.07.04 13:22:50 | 000,000,095 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010.07.02 13:20:25 | 000,000,496 | ---- | C] () -- C:\WINDOWS\pcwListKill.ini
[2010.06.18 18:06:33 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PnkBstrK.sys
[2010.06.18 18:06:33 | 000,137,256 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.06.03 17:28:24 | 000,000,399 | ---- | C] () -- C:\WINDOWS\System32\Remover.ini
[2010.06.03 17:28:21 | 000,000,566 | ---- | C] () -- C:\WINDOWS\System32\SP207.INI
[2010.05.28 19:09:38 | 000,000,425 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010.05.28 19:09:38 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2010.05.28 18:26:29 | 000,031,664 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2010.05.20 22:34:18 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010.05.16 00:05:50 | 000,040,960 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.01.20 12:05:14 | 000,000,711 | ---- | C] () -- C:\WINDOWS\System32\Autorun.ini
[2008.01.19 19:13:50 | 000,000,095 | ---- | C] () -- C:\WINDOWS\alaunch.ini
[2008.01.19 19:10:40 | 000,006,212 | ---- | C] () -- C:\WINDOWS\HCWPNP.INI
[2006.11.10 15:08:50 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATITool.sys
[2006.08.11 21:44:12 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.08.11 21:42:58 | 000,000,046 | ---- | C] () -- C:\WINDOWS\commercial.ini
[2006.08.11 21:42:28 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\MWLPS.dll
[2006.08.11 21:41:18 | 000,001,024 | R--- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2006.08.11 21:40:34 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2006.08.11 21:40:34 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2006.08.11 21:40:34 | 000,001,024 | R--- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2006.08.11 21:40:34 | 000,001,024 | R--- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2006.08.11 21:31:32 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.07.11 23:19:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006.07.11 23:19:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006.07.11 23:19:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006.07.11 23:19:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006.07.11 23:19:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006.07.11 23:19:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006.07.11 23:19:00 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006.05.25 19:18:48 | 000,331,776 | ---- | C] () -- C:\WINDOWS\System32\ScrollBarLib.dll
[2006.04.12 15:08:36 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\InstallCheck.dll
[2006.04.09 22:19:32 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2006.03.08 18:19:28 | 001,421,824 | ---- | C] () -- C:\WINDOWS\System32\UIVCL.dll
[2006.03.08 18:11:30 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\APISlice.dll
[2005.11.10 12:27:42 | 000,003,218 | ---- | C] () -- C:\WINDOWS\System32\drivers\WINIO.sys
[2005.10.31 03:17:38 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2005.10.26 07:25:28 | 000,008,073 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.07.12 14:44:42 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD64.DLL
[2005.07.07 16:20:20 | 000,256,890 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\cglogs.dat
[2005.04.04 08:44:04 | 000,000,258 | ---- | C] () -- C:\WINDOWS\Clearlnk.ini
[2005.01.26 19:14:28 | 000,000,294 | ---- | C] () -- C:\WINDOWS\PowerOption.ini
[2004.12.17 03:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.08.10 21:00:00 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.03.23 16:38:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2003.02.26 13:07:20 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\HCW34Co.dll
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
 
========== LOP Check ==========
 
[2010.07.25 22:16:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
[2010.07.12 14:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DMCache
[2010.08.14 19:19:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICQ
[2010.07.12 14:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\IDM
[2010.06.25 21:43:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Publish Providers
[2010.06.19 16:11:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\QuickStoresToolbar
[2010.06.10 20:04:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ScanSoft
[2010.06.25 21:43:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sony
[2010.06.25 21:50:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sony Creative Software
[2010.06.15 15:22:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TeamViewer
[2010.07.03 15:56:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Toolbar4
[2010.05.31 18:50:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
[2010.08.01 17:39:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Tunngle
[2010.08.23 16:36:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue
[2010.06.19 21:08:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\WeGame
[2010.08.22 21:11:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Logs
[2010.05.17 20:16:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010.07.05 21:23:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NtiDvdCopy
[2010.05.28 18:26:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2010.06.25 21:37:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony
[2010.05.31 18:50:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.06.20 00:12:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tunngle
[2010.06.18 18:07:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ubisoft
[2010.05.31 18:49:49 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.05.16 04:07:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\X10 Commander
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.05.17 07:26:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe
[2010.05.21 10:15:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\AdobeUM
[2010.05.15 20:18:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ATI
[2010.06.10 17:25:13 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Brother
[2010.07.25 22:16:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
[2010.07.12 14:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DMCache
[2010.06.07 20:01:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Google
[2010.08.14 19:19:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICQ
[2010.05.16 03:46:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Identities
[2010.07.12 14:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\IDM
[2010.05.16 03:46:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia
[2010.07.05 11:13:44 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft
[2010.05.16 00:21:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
[2010.07.04 00:35:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\OpenOffice.org2
[2010.06.25 21:43:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Publish Providers
[2010.06.19 16:11:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\QuickStoresToolbar
[2010.06.10 20:04:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ScanSoft
[2010.08.06 22:02:46 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\SecuROM
[2010.08.24 15:48:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Skype
[2010.08.24 14:13:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\skypePM
[2010.06.25 21:43:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sony
[2010.05.17 06:54:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sony Corporation
[2010.06.25 21:50:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sony Creative Software
[2010.05.16 10:34:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun
[2010.06.15 15:22:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TeamViewer
[2010.07.03 15:56:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Toolbar4
[2010.05.31 18:50:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
[2010.08.01 17:39:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Tunngle
[2010.06.21 16:43:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\U3
[2010.08.23 16:36:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue
[2010.06.19 21:08:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\WeGame
[2010.05.16 11:15:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.05.28 18:27:00 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}\ARPPRODUCTICON.exe
[2010.06.10 20:27:58 | 000,704,248 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\QuickStoresToolbar\unins000.exe
[2010.03.03 15:00:50 | 000,045,304 | ---- | M] (Andreas Breitschopp - Softwareentwicklung und -vertrieb) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\QuickStoresToolbar\Update.exe
[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\U3\temp\cleanup.exe
[2008.05.02 10:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2004.08.10 21:00:00 | 017,006,491 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
[2004.08.10 21:00:00 | 017,006,491 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.05.22 10:20:23 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.05.22 10:20:23 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.10 21:00:00 | 017,006,491 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
[2004.08.10 21:00:00 | 017,006,491 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.05.22 10:20:23 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.05.22 10:20:23 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: NVATA.SYS  >
[2006.06.28 13:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\WINDOWS\system32\autorun\Drivers\CHIPSET\IDE\Win2K\sata_ide\nvata.sys
[2006.06.28 13:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\WINDOWS\system32\autorun\Drivers\CHIPSET\IDE\WinXP\sata_ide\nvata.sys
 
< MD5 for: NVATABUS.SYS  >
[2006.06.28 18:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\i386\$OEM$\$$\OEMDIR\nvatabus.sys
[2006.06.28 18:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\i386\$OEM$\TEXTMODE\nvatabus.sys
[2006.06.28 18:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\WINDOWS\OemDir\nvatabus.sys
[2006.06.28 13:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\WINDOWS\system32\autorun\Drivers\CHIPSET\IDE\Win2K\sataraid\nvatabus.sys
[2006.06.28 13:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\WINDOWS\system32\autorun\Drivers\CHIPSET\IDE\WinXP\sataraid\nvatabus.sys
[2006.06.28 18:38:56 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA -- C:\WINDOWS\system32\drivers\nvatabus.sys
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007.03.08 17:48:40 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.10 21:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.10 21:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.08.11 22:11:52 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2006.08.11 22:11:52 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2006.08.11 22:11:52 | 000,446,464 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.04.14 04:22:08 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
[2008.04.14 04:22:18 | 001,384,479 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msvbvm60.dll
[161 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
--- --- ---

Extra :OTL Logfile:
Code:
OTL Extras logfile created on: 24.08.2010 16:00:32 - Run 1
OTL by OldTimer - Version 3.2.10.0    Folder = C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 168,19 Gb Free Space | 56,42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ACER-769C8142EE
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\ICQ7.1\ICQ.exe" = C:\Programme\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1 -- (ICQ, LLC.)
"C:\Programme\ICQ7.1\aolload.exe" = C:\Programme\ICQ7.1\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ7.1\ICQ.exe" = C:\Programme\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1 -- (ICQ, LLC.)
"C:\Programme\ICQ7.1\aolload.exe" = C:\Programme\ICQ7.1\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
"C:\Dokumente und Einstellungen\Administrator\Desktop\Doni\Steamless Left4Dead2 Pack\left4dead2.exe" = C:\Dokumente und Einstellungen\Administrator\Desktop\Doni\Steamless Left4Dead2 Pack\left4dead2.exe:*:Enabled:left4dead2 -- ()
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"C:\Dokumente und Einstellungen\Administrator\Desktop\Lufti\World of Warcraft\Repair.exe" = C:\Dokumente und Einstellungen\Administrator\Desktop\Lufti\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility -- (Blizzard Entertainment, Inc.)
"C:\Dokumente und Einstellungen\Administrator\Desktop\Lufti\World of Warcraft\WoW-3.2.0-deDE-downloader.exe" = C:\Dokumente und Einstellungen\Administrator\Desktop\Lufti\World of Warcraft\WoW-3.2.0-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Dokumente und Einstellungen\Administrator\Desktop\Lufti\World of Warcraft\Launcher.exe" = C:\Dokumente und Einstellungen\Administrator\Desktop\Lufti\World of Warcraft\Launcher.exe:*:Enabled:Launcher.exe -- (Blizzard Entertainment)
"C:\Programme\Garrys Mod 11\hl2.exe" = C:\Programme\Garrys Mod 11\hl2.exe:*:Enabled:hl2 -- ()
"C:\Programme\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe" = C:\Programme\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2 -- (EA Digital Illusions CE AB)
"C:\Programme\Steam\Steam.exe" = C:\Programme\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Programme\Steam\SteamApps\common\alien swarm\swarm.exe" = C:\Programme\Steam\SteamApps\common\alien swarm\swarm.exe:*:Enabled:Alien Swarm -- ()
"C:\Programme\Steam\SteamApps\common\alien swarm\srcds.exe" = C:\Programme\Steam\SteamApps\common\alien swarm\srcds.exe:*:Enabled:Alien Swarm Dedicated Server -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{147AAF68-A89A-8E2E-97EE-A1F1430F9F68}" = Catalyst Control Center Graphics Previews Common
"{1774C3D2-30FF-70EE-A1AF-1B771E2D2D33}" = ccc-utility
"{31DDEBE2-0F7D-A4AA-B8A9-9E1FD795FC2A}" = CCC Help English
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{6CA5F5DC-33C3-D56F-F399-BD5792397089}" = CCC Help English
"{6F42FC6B-947B-9B89-29B0-545F0815AD7F}" = ATI Parental Control & Encoder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{96DA8A90-1BD6-F86A-D51B-B46882A80980}" = ccc-utility
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Security Suite CBE 10
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A00E5C2A-C348-000B-D8D3-45313B6C6A1B}" = Catalyst Control Center InstallProxy
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2274248-9536-B9E2-0886-84BF1F292219}" = ATI Catalyst Install Manager
"{CE567716-7997-E0AE-DD81-1A5D49A5FB25}" = Catalyst Control Center Graphics Previews Common
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"Garrys Mod Final [DiGiTALZONE] 2010 Edition" = Garrys Mod Final [DiGiTALZONE] 2010 Edition
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Security Suite CBE 10
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"PunkBusterSvc" = PunkBuster Services
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Steam App 240" = Counter-Strike: Source
"Steam App 630" = Alien Swarm
"TuneUp Utilities" = TuneUp Utilities
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Garrys Mod Update #1" = Garrys Mod Update #1
"GMOD Final [DiGiTALZONE] Rev.ini FiX" = GMOD Final [DiGiTALZONE] Rev.ini FiX
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 14.08.2010 06:30:04 | Computer Name = ACER-769C8142EE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3855, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x10487c22.
 
Error - 16.08.2010 08:59:53 | Computer Name = ACER-769C8142EE | Source = EventSystem | ID = 4609
Description = Das COM+-Ereignissystem hat einen ungültigen Rückgabecode während
der internen Verarbeitung erkannt. HRESULT war 800706BA von Zeile 44 von d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
 Wenden Sie sich an den Microsoft-Produktsuppor
 
Error - 16.08.2010 14:14:01 | Computer Name = ACER-769C8142EE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung ts3client_win32.exe, Version 1.0.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 17.08.2010 16:56:43 | Computer Name = ACER-769C8142EE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung BFBC2Game.exe, Version 1.0.1.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 18.08.2010 00:01:07 | Computer Name = ACER-769C8142EE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3855, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x10417c22.
 
Error - 18.08.2010 14:46:48 | Computer Name = ACER-769C8142EE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung BFBC2Game.exe, Version 1.0.1.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 20.08.2010 00:31:29 | Computer Name = ACER-769C8142EE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3855, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x10417c22.
 
Error - 20.08.2010 08:12:42 | Computer Name = ACER-769C8142EE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung javaw.exe, Version 6.0.200.2, fehlgeschlagenes
 Modul java.dll, Version 6.0.200.2, Fehleradresse 0x00005875.
 
Error - 23.08.2010 08:12:43 | Computer Name = ACER-769C8142EE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3855, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x10417c22.
 
Error - 24.08.2010 00:59:58 | Computer Name = ACER-769C8142EE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3855, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x10417c22.
 
[ System Events ]
Error - 24.08.2010 00:57:39 | Computer Name = ACER-769C8142EE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "TuneUp.UtilitiesSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {FCA02D56-BF9D-4591-AD41-E59AF763C64A}
 
Error - 24.08.2010 00:57:43 | Computer Name = ACER-769C8142EE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 24.08.2010 00:57:43 | Computer Name = ACER-769C8142EE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "TuneUp.UtilitiesSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {FCA02D56-BF9D-4591-AD41-E59AF763C64A}
 
Error - 24.08.2010 00:58:03 | Computer Name = ACER-769C8142EE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "TuneUp.UtilitiesSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {FCA02D56-BF9D-4591-AD41-E59AF763C64A}
 
Error - 24.08.2010 00:58:15 | Computer Name = ACER-769C8142EE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "TuneUp.UtilitiesSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {FCA02D56-BF9D-4591-AD41-E59AF763C64A}
 
Error - 24.08.2010 00:58:47 | Computer Name = ACER-769C8142EE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 24.08.2010 01:00:55 | Computer Name = ACER-769C8142EE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  nvatabus  nvraid
 
Error - 24.08.2010 05:20:32 | Computer Name = ACER-769C8142EE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  nvatabus  nvraid
 
Error - 24.08.2010 05:35:27 | Computer Name = ACER-769C8142EE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  nvatabus  nvraid
 
Error - 24.08.2010 08:45:49 | Computer Name = ACER-769C8142EE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  nvatabus  nvraid
 
[ TuneUp Events ]
Error - 06.07.2010 03:03:42 | Computer Name = ACER-769C8142EE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
 
< End of report >
--- --- ---

markusg 24.08.2010 15:59
• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKLM..\Run: [HKLM] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O4 - HKLM..\Run: [WinUPDT32] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O4 - HKU\S-1-5-21-865584140-4230085389-3338066738-500..\Run: [HKCU] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O4 - HKU\S-1-5-21-865584140-4230085389-3338066738-500..\Run: [WinUPDT32] C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: WinUPDT32.exe = C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)
O7 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: WinUPDT32.exe = C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com
(Microsoft)
O7 - HKU\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\Win32Gl\svchost.exe
(CVeSyuu)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
C:\WINDOWS\System32\atiapfxx.blb
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten


öffne danach den arbeitsplatz, dort C:
dann öffne _OTL
rechtsklick auf moved files. wähle zu moved files.rar oder zip hinzufügen.
lad das archiv, welches sich in _otl befindet hoch:
http://www.trojaner-board.de/54791-a...ner-board.html
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

ChaosGott 24.08.2010 19:40
Also ich habe nach dem neustart keine textdatei gefunden nur 2 die ich dir ja schon gepostet habe mit dem extra und otl naja was nun? ist vill 1 von den beiden die richtige? Fail! Ich glaub ich habs ist es vill das ?

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HKLM deleted successfully.
C:\WINDOWS\Win32Gl\svchost.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinUPDT32 deleted successfully.
C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com moved successfully.
Registry value HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\Software\Microsoft\Windows\CurrentVersion\Run\\HKCU deleted successfully.
File C:\WINDOWS\Win32Gl\svchost.exe not found.
Registry value HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\Software\Microsoft\Windows\CurrentVersion\Run\\WinUPDT32 deleted successfully.
File C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\WinUPDT32.exe deleted successfully.
File C:\WINDOWS\system32\WinUPDT32\WinUPDT32.com not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\Policies deleted successfully.
File C:\WINDOWS\Win32Gl\svchost.exe not found.
Registry value HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\WinUPDT32.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\Policies deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 65601 bytes

User: All Users

User: Default User
->Flash cache emptied: 75 bytes

User: LocalService
->Flash cache emptied: 434 bytes

User: NetworkService
->Flash cache emptied: 2079 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 859893046 bytes
->Temporary Internet Files folder emptied: 37037376 bytes
->Java cache emptied: 2612840 bytes
->FireFox cache emptied: 107030821 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 82513 bytes
->Temporary Internet Files folder emptied: 616405 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 8101892 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3181459 bytes
%systemroot%\System32 .tmp files removed: 102934343 bytes
%systemroot%\System32\dllcache .tmp files removed: 70466048 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 180672 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.137,00 mb


OTL by OldTimer - Version 3.2.10.0 log created on 08242010_203144

Richtig? war im _Otl ordner :D

markusg 24.08.2010 20:02
war es.
nun bitte _OTL bzw moved files packen und hochladen.
dann weiter:
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

ChaosGott 24.08.2010 20:09
Öhh wo speichern sich die rar denn wenn ich sieh hochlade P.s Datei: MovedFiles.rar empfangen

Vorgang erfolgreich abgeschlossen.

Und nun wo ises ich machjetzt noch combo aber wo die rar ist weiß net?

markusg 24.08.2010 20:14
das sehen wir nur intern.

und sie ist angekommen. thx

ChaosGott 24.08.2010 20:36
Combofix Logfile:
Code:
ComboFix 10-08-24.02 - Administrator 24.08.2010  21:22:33.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3071.2243 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Eigene Dateien\Downloads\ComboFix.exe
AV: Kaspersky Security Suite CBE 10 *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE 10 *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\cglogs.dat
C:\Install.exe
c:\windows\PixArt\PAC207\Monitor.exe
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000011_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\_000013_.tmp.dll
c:\windows\system32\autorun.ini

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


(((((((((((((((((((((((  Dateien erstellt von 2010-07-24 bis 2010-08-24  ))))))))))))))))))))))))))))))
.

2010-08-24 18:31 . 2010-08-24 18:38        --------        d-----w-        C:\_OTL
2010-08-23 14:36 . 2010-08-23 14:36        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Uniblue
2010-08-22 19:11 . 2010-08-22 19:11        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\EA Logs
2010-08-19 16:17 . 2010-08-12 19:19        30016        ----a-w-        c:\windows\system32\uxtuneup.dll
2010-08-19 13:16 . 2010-08-19 13:17        --------        d-----w-        c:\windows\system32\Samsung_USB_Drivers
2010-08-14 15:03 . 2010-08-14 15:03        --------        d-----w-        c:\programme\IObit
2010-08-14 11:41 . 2010-08-14 11:41        --------        d-----w-        c:\windows\Neuer Ordner
2010-08-14 11:36 . 2010-08-14 11:36        --------        d-----w-        c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-08-11 21:01 . 2010-08-14 13:36        --------        d-----w-        c:\programme\Killing Floor
2010-08-07 21:44 . 2010-08-24 14:36        --------        d-----w-        c:\programme\Steam
2010-08-06 20:03 . 2010-08-06 20:03        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\PunkBuster
2010-08-06 20:02 . 2010-08-06 20:02        --------        d--h--r-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\SecuROM
2010-08-06 18:25 . 2010-08-06 18:25        2434856        ----a-w-        c:\windows\system32\pbsvc_bc2.exe
2010-08-06 14:45 . 2010-08-06 14:45        --------        d-----w-        c:\programme\ASCII
2010-08-05 10:55 . 2010-08-05 10:55        444952        ----a-w-        c:\windows\system32\wrap_oal.dll
2010-08-05 10:55 . 2010-08-05 10:55        109080        ----a-w-        c:\windows\system32\OpenAL32.dll
2010-08-04 23:58 . 2007-06-29 12:47        34304        ----a-w-        c:\windows\system32\drivers\AmdLLD.sys
2010-08-04 23:58 . 2010-08-04 23:58        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
2010-08-04 23:55 . 2010-07-07 01:58        53248        ----a-w-        c:\windows\system32\aticalrt.dll
2010-08-04 23:55 . 2010-07-07 01:58        53248        ----a-w-        c:\windows\system32\aticalcl.dll
2010-08-04 23:55 . 2010-07-07 01:57        4337664        ----a-w-        c:\windows\system32\aticaldd.dll
2010-08-04 23:55 . 2010-07-07 01:29        143360        ----a-w-        c:\windows\system32\atiapfxx.exe
2010-08-04 23:55 . 2010-07-07 01:15        65024        ----a-w-        c:\windows\system32\atimpc32.dll
2010-08-04 23:55 . 2009-05-11 21:35        118784        ----a-w-        c:\windows\system32\atibtmon.exe
2010-08-04 23:54 . 2010-08-04 23:57        --------        d-----w-        c:\programme\ATI
2010-08-04 23:53 . 2010-08-04 23:53        --------        d-----w-        C:\ATI
2010-08-04 23:37 . 2010-08-04 23:37        --------        d-----w-        c:\programme\Gemeinsame Dateien\Futuremark Shared
2010-08-01 14:23 . 2010-02-03 13:56        26176        ---ha-w-        c:\windows\system32\hamachi.sys

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-24 19:30 . 2010-07-04 19:27        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2010-08-24 19:22 . 2010-05-15 22:25        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Skype
2010-08-24 18:35 . 2008-01-19 20:10        38608        ----a-w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-08-24 18:29 . 2010-05-15 22:30        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\skypePM
2010-08-24 18:10 . 2010-05-17 18:16        --------        d-----w-        c:\programme\ICQ7.1
2010-08-24 18:09 . 2010-05-17 18:16        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\ICQ
2010-08-24 17:09 . 2010-06-18 16:06        218808        ----a-w-        c:\windows\system32\PnkBstrB.exe
2010-08-24 15:21 . 2010-06-18 16:06        137256        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2010-08-23 16:18 . 2010-07-20 16:47        --------        d-----w-        c:\programme\Garrys Mod 11
2010-08-19 16:18 . 2010-05-31 16:50        --------        d-----w-        c:\programme\TuneUp Utilities 2010
2010-08-19 13:22 . 2008-01-19 17:05        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-08-13 20:08 . 2010-08-13 20:08        503808        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4684e287-n\msvcp71.dll
2010-08-13 20:08 . 2010-08-13 20:08        499712        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4684e287-n\jmc.dll
2010-08-13 20:08 . 2010-08-13 20:08        348160        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4684e287-n\msvcr71.dll
2010-08-13 20:08 . 2010-08-13 20:08        61440        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-38568387-n\decora-sse.dll
2010-08-13 20:08 . 2010-08-13 20:08        12800        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-38568387-n\decora-d3d.dll
2010-08-12 22:38 . 2008-01-19 19:04        85350        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-12 22:38 . 2008-01-19 19:04        460608        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-12 19:26 . 2010-05-31 16:51        30528        ----a-w-        c:\windows\system32\TURegOpt.exe
2010-08-06 18:25 . 2010-06-18 16:06        138056        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\PnkBstrK.sys
2010-08-06 18:25 . 2010-06-18 16:06        138056        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\PnkBstrK.sys
2010-08-06 18:25 . 2010-06-18 16:06        75064        ----a-w-        c:\windows\system32\PnkBstrA.exe
2010-08-06 18:09 . 2010-07-25 15:56        --------        d-----w-        c:\programme\Electronic Arts
2010-08-04 23:55 . 2010-05-15 18:06        --------        d-----w-        c:\programme\ATI Technologies
2010-08-04 10:40 . 2010-08-04 10:40        144896        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\6181453.tmp
2010-08-01 15:39 . 2010-06-19 22:12        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Tunngle
2010-08-01 15:12 . 2010-06-21 15:45        0        ----a-w-        c:\windows\system32\Access.dat
2010-07-29 16:51 . 2010-07-21 16:07        113933        ----a-w-        c:\windows\system32\drivers\klin.dat
2010-07-29 16:50 . 2010-07-21 16:07        97549        ----a-w-        c:\windows\system32\drivers\klick.dat
2010-07-25 20:16 . 2010-07-25 16:24        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
2010-07-25 10:52 . 2010-06-29 06:37        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-07-21 16:21 . 2010-07-21 16:21        932368        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-07-21 16:21 . 2010-07-21 16:21        678416        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-07-21 16:21 . 2010-07-21 16:21        604688        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-07-21 16:21 . 2010-07-21 16:21        522768        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-07-21 16:21 . 2010-07-21 16:21        1096208        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-07-21 16:06 . 2010-07-21 16:06        --------        d-----w-        c:\programme\Kaspersky Lab
2010-07-20 21:57 . 2010-05-15 22:25        --------        d-----r-        c:\programme\Skype
2010-07-20 21:56 . 2010-07-20 21:56        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype
2010-07-20 21:56 . 2010-05-15 22:25        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype
2010-07-12 12:12 . 2010-07-12 12:07        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\IDM
2010-07-12 12:12 . 2010-05-29 22:55        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\DMCache
2010-07-07 02:27 . 2006-08-02 08:07        5069312        ----a-w-        c:\windows\system32\drivers\ati2mtag.sys
2010-07-07 01:53 . 2006-08-02 07:45        15499264        ----a-w-        c:\windows\system32\atioglxx.dll
2010-07-07 01:50 . 2006-08-02 08:12        311296        ----a-w-        c:\windows\system32\atiiiexx.dll
2010-07-07 01:48 . 2010-05-15 18:07        446464        ----a-w-        c:\windows\system32\ATIDEMGX.dll
2010-07-07 01:47 . 2006-08-02 08:08        299520        ----a-w-        c:\windows\system32\ati2dvag.dll
2010-07-07 01:41 . 2006-08-02 07:55        3869952        ----a-w-        c:\windows\system32\ati3duag.dll
2010-07-07 01:33 . 2006-08-02 08:02        208896        ----a-w-        c:\windows\system32\atipdlxx.dll
2010-07-07 01:32 . 2006-08-02 08:02        155648        ----a-w-        c:\windows\system32\Oemdspif.dll
2010-07-07 01:32 . 2006-08-02 08:02        26112        ----a-w-        c:\windows\system32\Ati2mdxx.exe
2010-07-07 01:32 . 2006-08-02 08:02        43520        ----a-w-        c:\windows\system32\ati2edxx.dll
2010-07-07 01:32 . 2006-08-02 08:02        159744        ----a-w-        c:\windows\system32\ati2evxx.dll
2010-07-07 01:31 . 2006-08-02 08:01        602112        ----a-w-        c:\windows\system32\ati2evxx.exe
2010-07-07 01:29 . 2006-08-02 08:00        53248        ----a-w-        c:\windows\system32\ATIDDC.DLL
2010-07-07 01:28 . 2006-08-02 07:51        2273920        ----a-w-        c:\windows\system32\ativvaxx.dll
2010-07-07 01:27 . 2010-05-15 18:07        887724        ----a-w-        c:\windows\system32\ativva6x.dat
2010-07-07 01:27 . 2010-05-15 18:07        3        ----a-w-        c:\windows\system32\ativva5x.dat
2010-07-07 01:25 . 2006-08-02 07:41        573440        ----a-w-        c:\windows\system32\atikvmag.dll
2010-07-07 01:24 . 2008-09-30 15:19        393216        ----a-w-        c:\windows\system32\atiok3x2.dll
2010-07-07 01:24 . 2008-09-30 14:33        184320        ----a-w-        c:\windows\system32\atiadlxx.dll
2010-07-07 01:23 . 2006-08-02 07:40        17408        ----a-w-        c:\windows\system32\atitvo32.dll
2010-07-07 01:19 . 2006-08-02 07:35        704512        ----a-w-        c:\windows\system32\ati2cqag.dll
2010-07-07 01:15 . 2008-09-30 14:38        65024        ----a-w-        c:\windows\system32\amdpcom32.dll
2010-07-07 01:15 . 2006-08-02 07:38        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll
2010-07-06 07:17 . 2010-07-06 06:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Blizzard Entertainment
2010-07-06 05:18 . 2010-05-18 04:39        --------        d-----w-        c:\programme\Gemeinsame Dateien\Blizzard Entertainment
2010-07-05 19:23 . 2010-07-05 19:23        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\NtiDvdCopy
2010-07-04 19:51 . 2004-08-10 19:00        3328        ----a-w-        c:\windows\system32\drivers\pciide.sys
2010-07-03 22:35 . 2010-05-17 14:33        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\OpenOffice.org2
2010-07-03 22:35 . 2010-05-17 14:34        1        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-07-03 13:56 . 2010-05-23 08:07        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Toolbar4
2010-06-30 12:28 . 2007-04-25 14:22        149504        ----a-w-        c:\windows\system32\schannel.dll
2010-06-25 19:51 . 2010-05-17 04:49        --------        d-----w-        c:\programme\Sony
2010-06-25 19:50 . 2010-06-25 19:50        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sony Creative Software
2010-06-25 19:43 . 2010-06-25 19:43        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Publish Providers
2010-06-25 19:43 . 2010-06-25 19:41        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sony
2010-06-25 19:37 . 2010-06-25 19:37        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sony
2010-06-25 12:48 . 2010-06-25 12:48        503808        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1655d461-n\msvcp71.dll
2010-06-25 12:48 . 2010-06-25 12:48        499712        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1655d461-n\jmc.dll
2010-06-25 12:48 . 2010-06-25 12:48        348160        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1655d461-n\msvcr71.dll
2010-06-25 12:48 . 2010-06-25 12:48        61440        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4868ace4-n\decora-sse.dll
2010-06-25 12:48 . 2010-06-25 12:48        12800        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4868ace4-n\decora-d3d.dll
2010-06-24 12:10 . 2007-10-10 23:46        672768        ----a-w-        c:\windows\system32\wininet.dll
2010-06-24 12:10 . 2007-08-13 17:45        81920        ----a-w-        c:\windows\system32\ieencode.dll
2010-06-24 09:02 . 2007-03-08 15:32        1852032        ----a-w-        c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2006-08-14 10:34        354304        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-06-18 17:01 . 2010-06-18 16:06        2337865        ----a-w-        c:\windows\system32\pbsvc.exe
2010-06-17 14:03 . 2004-08-10 19:00        80384        ----a-w-        c:\windows\system32\iccvid.dll
2010-06-15 02:16 . 2010-06-15 02:16        86016        ----a-w-        c:\windows\system32\frapsvid.dll
2010-06-14 14:31 . 2004-08-10 19:00        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2007-06-26 06:08        1172480        ----a-w-        c:\windows\system32\msxml3.dll
2010-06-10 18:27 . 2010-06-10 18:28        704248        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\QuickStoresToolbar\unins000.exe
2010-05-28 17:09 . 2010-05-28 16:28        50        ----a-w-        c:\windows\system32\bridf08b.dat
2010-05-28 16:27 . 2010-05-28 16:27        10134        ----a-r-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}\ARPPRODUCTICON.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2010-05-06 07:08        109144        ----a-w-        c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\shellex.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-11 7626752]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-11 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-31 16208384]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"ntiMUI"="c:\programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\programme\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\programme\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"AVP"="c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe" [2010-05-06 361120]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Acer WLAN 11g USB Dongle.lnk - c:\programme\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          \0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-07-11 21:19        1519616        ----a-w-        c:\windows\system32\nwiz.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ICQ"="c:\programme\ICQ7.1\ICQ.exe" silent loginmode=4
"WinUPDT32"=c:\windows\system32\WinUPDT32\WinUPDT32.com
"Steam"="c:\programme\steam\steam.exe" -silent
"HKCU"=c:\windows\Win32Gl\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PPort11reminder"="c:\programme\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\dokumente und einstellungen\All Users\Anwendungsdaten\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
"SsAAD.exe"=c:\progra~1\Sony\SONICS~1\SsAAD.exe
"WinUPDT32"=c:\windows\system32\WinUPDT32\WinUPDT32.com
"Acer Empowering Technology Monitor"=c:\windows\system32\SysMonitor.exe
"ATICustomerCare"="c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe"
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"<NO NAME>"=c:\windows\Win32Gl
"HKLM"=c:\windows\Win32Gl\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\ICQ7.1\\ICQ.exe"=
"c:\\Programme\\ICQ7.1\\aolload.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Doni\\Steamless Left4Dead2 Pack\\left4dead2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Lufti\\World of Warcraft\\Repair.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Lufti\\World of Warcraft\\WoW-3.2.0-deDE-downloader.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Lufti\\World of Warcraft\\Launcher.exe"=
"c:\\Programme\\Garrys Mod 11\\hl2.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\Steam\\SteamApps\\common\\alien swarm\\swarm.exe"=
"c:\\Programme\\Steam\\SteamApps\\common\\alien swarm\\srcds.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14.10.2009 21:18 36880]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [12.08.2010 21:23 1051968]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.09.2009 14:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02.10.2009 19:39 19472]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [25.02.2010 11:18 10064]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [28.11.2005 11:45 7040]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [07.06.2010 19:56 136176]
S3 cpuz130;cpuz130;\??\c:\dokume~1\ADMINI~1\LOKALE~1\Temp\cpuz130\cpuz_x32.sys --> c:\dokume~1\ADMINI~1\LOKALE~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 esgiguard;esgiguard;\??\c:\programme\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\programme\Enigma Software Group\SpyHunter\esgiguard.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\dokume~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp --> c:\dokume~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp [?]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [03.06.2010 17:28 616064]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-06-07 17:56]

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-06-07 17:56]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\programme\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-PAC207_Monitor - c:\windows\PixArt\PAC207\Monitor.exe
HKLM-Run-Monitor - c:\windows\PixArt\PAC207\Monitor.exe
MSConfigStartUp-HKCU - c:\windows\Win32Gl\svchost.exe
MSConfigStartUp-HKLM - c:\windows\Win32Gl\svchost.exe
MSConfigStartUp-WinUPDT32 - c:\windows\system32\WinUPDT32\WinUPDT32.com
ActiveSetup-installed components - Restart
ActiveSetup-{1L17R80W-A452-56B0-123C-75UJ5M72XM20} - c:\windows\system32\WinUPDT32\WinUPDT32.com
ActiveSetup-{E4V6HJW0-7300-JV52-28V2-5XOW7R6OS476} - c:\windows\Win32Gl\svchost.exe
AddRemove-Garrys Mod Update #1 - 0:\programme\Garrys Mod 11\Uninstall.exe
AddRemove-GMOD Final [DiGiTALZONE] Rev.ini FiX - c:\programme\Garrys Mod 11\Uninstall Rev.ini



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-24 21:30
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\dokume~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Electronic Arts\C*o*m*m*a*n*d* *&* *C*o*n*q*u*e*r* *3* *T*i*b*e*r*i*u*m* *W*a*r*s*"!\Kundendienst]
"Order"=hex:08,00,00,00,02,00,00,00,b8,02,00,00,01,00,00,00,04,00,00,00,de,00,
  00,00,00,00,00,00,d0,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,be,00,32,\

[HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\Software\SecuROM\License information*]
"datasecu"=hex:5a,89,9b,c4,9a,3d,3b,cb,35,ee,3c,56,a7,e5,95,ba,ce,95,9f,f8,0e,
  0e,84,44,60,65,39,8f,0b,07,20,4c,f7,66,c7,29,c4,e8,78,a4,d9,74,6f,f9,d9,3e,\
"rkeysecu"=hex:92,e2,19,33,15,91,a8,eb,f9,ff,4e,6e,54,7d,63,c0

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c5,29,e2,2b,5e,a2,23,ea,a8,cb,38,d3,a5,a8,72,fd,82,bd,f5,8d,f2,
  c8,17,80,fd,28,d3,d5,d7,93,1d,d4,1d,ac,d1,96,0d,fd,f1,3d,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c08de8fa-e854-4d38-b4ab-0460d15e853b}]
@Denied: (Full) (Everyone)
"Model"=dword:000000b7
"Therad"=dword:00000024
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
  38,95,44,ab,9e,50,1b,eb,77,d1,ab,1a,10,3b,69,da,2b,11,4b,83,e0,8b,c5,07,bb,\
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1408)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(4036)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MSVCP71.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\windows\RTHDCPL.EXE
c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\PnkBstrA.exe
c:\programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\progra~1\COMMON~1\X10\Common\x10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\eHome\ehmsas.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-24  21:35:19 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-08-24 19:35

Vor Suchlauf: 15 Verzeichnis(se), 181.494.292.480 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 181.538.652.160 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 019939FBEAB7B4EEDFEF9A78E10417D3
--- --- ---

Soo noch was? :D

markusg 24.08.2010 20:42
Start programme zubehör editor, kopiere ein:

folder::
C:\WINDOWS\Win32Gl
C:\WINDOWS\system32\WinUPDT32


Datei speichern unter, ort, dort wo sich combofix.exe befindet, dateityp, alle name cfscript.txt
ziehe cfscript.txt auf combofix, programm startet, log posten.

ChaosGott 24.08.2010 20:55
Combofix Logfile:
Code:
ComboFix 10-08-24.03 - Administrator 24.08.2010  21:48:23.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3071.2279 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Eigene Dateien\Downloads\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Administrator\Eigene Dateien\Downloads\cfscript.txt
AV: Kaspersky Security Suite CBE 10 *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE 10 *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\WinUPDT32
c:\windows\system32\WinUPDT32\plugin.dat
c:\windows\Win32Gl
c:\windows\Win32Gl\Desktop.ini

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-24 bis 2010-08-24  ))))))))))))))))))))))))))))))
.

2010-08-24 18:31 . 2010-08-24 18:38        --------        d-----w-        C:\_OTL
2010-08-23 14:36 . 2010-08-23 14:36        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Uniblue
2010-08-22 19:11 . 2010-08-22 19:11        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\EA Logs
2010-08-19 16:17 . 2010-08-12 19:19        30016        ----a-w-        c:\windows\system32\uxtuneup.dll
2010-08-19 13:16 . 2010-08-19 13:17        --------        d-----w-        c:\windows\system32\Samsung_USB_Drivers
2010-08-14 15:03 . 2010-08-14 15:03        --------        d-----w-        c:\programme\IObit
2010-08-14 11:41 . 2010-08-14 11:41        --------        d-----w-        c:\windows\Neuer Ordner
2010-08-14 11:36 . 2010-08-14 11:36        --------        d-----w-        c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-08-13 20:08 . 2010-08-13 20:08        503808        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4684e287-n\msvcp71.dll
2010-08-13 20:08 . 2010-08-13 20:08        499712        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4684e287-n\jmc.dll
2010-08-13 20:08 . 2010-08-13 20:08        348160        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4684e287-n\msvcr71.dll
2010-08-13 20:08 . 2010-08-13 20:08        61440        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-38568387-n\decora-sse.dll
2010-08-13 20:08 . 2010-08-13 20:08        12800        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-38568387-n\decora-d3d.dll
2010-08-11 21:01 . 2010-08-14 13:36        --------        d-----w-        c:\programme\Killing Floor
2010-08-07 21:44 . 2010-08-24 14:36        --------        d-----w-        c:\programme\Steam
2010-08-06 20:03 . 2010-08-06 20:03        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\PunkBuster
2010-08-06 20:02 . 2010-08-06 20:02        --------        d--h--r-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\SecuROM
2010-08-06 18:25 . 2010-08-06 18:25        2434856        ----a-w-        c:\windows\system32\pbsvc_bc2.exe
2010-08-06 14:45 . 2010-08-06 14:45        --------        d-----w-        c:\programme\ASCII
2010-08-05 10:55 . 2010-08-05 10:55        444952        ----a-w-        c:\windows\system32\wrap_oal.dll
2010-08-05 10:55 . 2010-08-05 10:55        109080        ----a-w-        c:\windows\system32\OpenAL32.dll
2010-08-04 23:58 . 2007-06-29 12:47        34304        ----a-w-        c:\windows\system32\drivers\AmdLLD.sys
2010-08-04 23:58 . 2010-08-04 23:58        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
2010-08-04 23:55 . 2010-07-07 01:58        53248        ----a-w-        c:\windows\system32\aticalrt.dll
2010-08-04 23:55 . 2010-07-07 01:58        53248        ----a-w-        c:\windows\system32\aticalcl.dll
2010-08-04 23:55 . 2010-07-07 01:57        4337664        ----a-w-        c:\windows\system32\aticaldd.dll
2010-08-04 23:55 . 2010-07-07 01:29        143360        ----a-w-        c:\windows\system32\atiapfxx.exe
2010-08-04 23:55 . 2010-07-07 01:15        65024        ----a-w-        c:\windows\system32\atimpc32.dll
2010-08-04 23:55 . 2009-05-11 21:35        118784        ----a-w-        c:\windows\system32\atibtmon.exe
2010-08-04 23:54 . 2010-08-04 23:57        --------        d-----w-        c:\programme\ATI
2010-08-04 23:53 . 2010-08-04 23:53        --------        d-----w-        C:\ATI
2010-08-04 23:37 . 2010-08-04 23:37        --------        d-----w-        c:\programme\Gemeinsame Dateien\Futuremark Shared
2010-08-01 14:23 . 2010-02-03 13:56        26176        ---ha-w-        c:\windows\system32\hamachi.sys

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-24 19:53 . 2010-05-15 22:25        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Skype
2010-08-24 19:30 . 2010-07-04 19:27        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2010-08-24 18:35 . 2008-01-19 20:10        38608        ----a-w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-08-24 18:29 . 2010-05-15 22:30        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\skypePM
2010-08-24 18:10 . 2010-05-17 18:16        --------        d-----w-        c:\programme\ICQ7.1
2010-08-24 18:09 . 2010-05-17 18:16        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\ICQ
2010-08-24 17:09 . 2010-06-18 16:06        218808        ----a-w-        c:\windows\system32\PnkBstrB.exe
2010-08-24 15:21 . 2010-06-18 16:06        137256        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2010-08-23 16:18 . 2010-07-20 16:47        --------        d-----w-        c:\programme\Garrys Mod 11
2010-08-19 16:18 . 2010-05-31 16:50        --------        d-----w-        c:\programme\TuneUp Utilities 2010
2010-08-19 13:22 . 2008-01-19 17:05        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-08-12 22:38 . 2008-01-19 19:04        85350        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-12 22:38 . 2008-01-19 19:04        460608        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-12 19:26 . 2010-05-31 16:51        30528        ----a-w-        c:\windows\system32\TURegOpt.exe
2010-08-06 18:25 . 2010-06-18 16:06        138056        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\PnkBstrK.sys
2010-08-06 18:25 . 2010-06-18 16:06        138056        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\PnkBstrK.sys
2010-08-06 18:25 . 2010-06-18 16:06        75064        ----a-w-        c:\windows\system32\PnkBstrA.exe
2010-08-06 18:09 . 2010-07-25 15:56        --------        d-----w-        c:\programme\Electronic Arts
2010-08-04 23:55 . 2010-05-15 18:06        --------        d-----w-        c:\programme\ATI Technologies
2010-08-04 10:40 . 2010-08-04 10:40        144896        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\6181453.tmp
2010-08-01 15:39 . 2010-06-19 22:12        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Tunngle
2010-08-01 15:12 . 2010-06-21 15:45        0        ----a-w-        c:\windows\system32\Access.dat
2010-07-29 16:51 . 2010-07-21 16:07        113933        ----a-w-        c:\windows\system32\drivers\klin.dat
2010-07-29 16:50 . 2010-07-21 16:07        97549        ----a-w-        c:\windows\system32\drivers\klick.dat
2010-07-25 20:16 . 2010-07-25 16:24        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Command & Conquer 3 Tiberium Wars
2010-07-25 10:52 . 2010-06-29 06:37        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-07-21 16:21 . 2010-07-21 16:21        932368        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-07-21 16:21 . 2010-07-21 16:21        678416        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-07-21 16:21 . 2010-07-21 16:21        604688        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-07-21 16:21 . 2010-07-21 16:21        522768        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-07-21 16:21 . 2010-07-21 16:21        1096208        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-07-21 16:06 . 2010-07-21 16:06        --------        d-----w-        c:\programme\Kaspersky Lab
2010-07-20 21:57 . 2010-05-15 22:25        --------        d-----r-        c:\programme\Skype
2010-07-20 21:56 . 2010-07-20 21:56        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype
2010-07-20 21:56 . 2010-05-15 22:25        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype
2010-07-12 12:12 . 2010-07-12 12:07        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\IDM
2010-07-12 12:12 . 2010-05-29 22:55        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\DMCache
2010-07-07 02:27 . 2006-08-02 08:07        5069312        ----a-w-        c:\windows\system32\drivers\ati2mtag.sys
2010-07-07 01:53 . 2006-08-02 07:45        15499264        ----a-w-        c:\windows\system32\atioglxx.dll
2010-07-07 01:50 . 2006-08-02 08:12        311296        ----a-w-        c:\windows\system32\atiiiexx.dll
2010-07-07 01:48 . 2010-05-15 18:07        446464        ----a-w-        c:\windows\system32\ATIDEMGX.dll
2010-07-07 01:47 . 2006-08-02 08:08        299520        ----a-w-        c:\windows\system32\ati2dvag.dll
2010-07-07 01:41 . 2006-08-02 07:55        3869952        ----a-w-        c:\windows\system32\ati3duag.dll
2010-07-07 01:33 . 2006-08-02 08:02        208896        ----a-w-        c:\windows\system32\atipdlxx.dll
2010-07-07 01:32 . 2006-08-02 08:02        155648        ----a-w-        c:\windows\system32\Oemdspif.dll
2010-07-07 01:32 . 2006-08-02 08:02        26112        ----a-w-        c:\windows\system32\Ati2mdxx.exe
2010-07-07 01:32 . 2006-08-02 08:02        43520        ----a-w-        c:\windows\system32\ati2edxx.dll
2010-07-07 01:32 . 2006-08-02 08:02        159744        ----a-w-        c:\windows\system32\ati2evxx.dll
2010-07-07 01:31 . 2006-08-02 08:01        602112        ----a-w-        c:\windows\system32\ati2evxx.exe
2010-07-07 01:29 . 2006-08-02 08:00        53248        ----a-w-        c:\windows\system32\ATIDDC.DLL
2010-07-07 01:28 . 2006-08-02 07:51        2273920        ----a-w-        c:\windows\system32\ativvaxx.dll
2010-07-07 01:27 . 2010-05-15 18:07        887724        ----a-w-        c:\windows\system32\ativva6x.dat
2010-07-07 01:27 . 2010-05-15 18:07        3        ----a-w-        c:\windows\system32\ativva5x.dat
2010-07-07 01:25 . 2006-08-02 07:41        573440        ----a-w-        c:\windows\system32\atikvmag.dll
2010-07-07 01:24 . 2008-09-30 15:19        393216        ----a-w-        c:\windows\system32\atiok3x2.dll
2010-07-07 01:24 . 2008-09-30 14:33        184320        ----a-w-        c:\windows\system32\atiadlxx.dll
2010-07-07 01:23 . 2006-08-02 07:40        17408        ----a-w-        c:\windows\system32\atitvo32.dll
2010-07-07 01:19 . 2006-08-02 07:35        704512        ----a-w-        c:\windows\system32\ati2cqag.dll
2010-07-07 01:15 . 2008-09-30 14:38        65024        ----a-w-        c:\windows\system32\amdpcom32.dll
2010-07-07 01:15 . 2006-08-02 07:38        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll
2010-07-06 07:17 . 2010-07-06 06:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Blizzard Entertainment
2010-07-06 05:18 . 2010-05-18 04:39        --------        d-----w-        c:\programme\Gemeinsame Dateien\Blizzard Entertainment
2010-07-05 19:23 . 2010-07-05 19:23        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\NtiDvdCopy
2010-07-04 19:51 . 2004-08-10 19:00        3328        ----a-w-        c:\windows\system32\drivers\pciide.sys
2010-07-03 22:35 . 2010-05-17 14:33        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\OpenOffice.org2
2010-07-03 22:35 . 2010-05-17 14:34        1        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-07-03 13:56 . 2010-05-23 08:07        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Toolbar4
2010-06-30 12:28 . 2007-04-25 14:22        149504        ----a-w-        c:\windows\system32\schannel.dll
2010-06-25 12:48 . 2010-06-25 12:48        503808        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1655d461-n\msvcp71.dll
2010-06-25 12:48 . 2010-06-25 12:48        499712        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1655d461-n\jmc.dll
2010-06-25 12:48 . 2010-06-25 12:48        348160        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1655d461-n\msvcr71.dll
2010-06-25 12:48 . 2010-06-25 12:48        61440        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4868ace4-n\decora-sse.dll
2010-06-25 12:48 . 2010-06-25 12:48        12800        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4868ace4-n\decora-d3d.dll
2010-06-24 12:10 . 2007-10-10 23:46        672768        ----a-w-        c:\windows\system32\wininet.dll
2010-06-24 12:10 . 2007-08-13 17:45        81920        ----a-w-        c:\windows\system32\ieencode.dll
2010-06-24 09:02 . 2007-03-08 15:32        1852032        ----a-w-        c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2006-08-14 10:34        354304        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-06-18 17:01 . 2010-06-18 16:06        2337865        ----a-w-        c:\windows\system32\pbsvc.exe
2010-06-17 14:03 . 2004-08-10 19:00        80384        ----a-w-        c:\windows\system32\iccvid.dll
2010-06-15 02:16 . 2010-06-15 02:16        86016        ----a-w-        c:\windows\system32\frapsvid.dll
2010-06-14 14:31 . 2004-08-10 19:00        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2007-06-26 06:08        1172480        ----a-w-        c:\windows\system32\msxml3.dll
2010-06-10 18:27 . 2010-06-10 18:28        704248        ----a-w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\QuickStoresToolbar\unins000.exe
2010-05-28 17:09 . 2010-05-28 16:28        50        ----a-w-        c:\windows\system32\bridf08b.dat
2010-05-28 16:27 . 2010-05-28 16:27        10134        ----a-r-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}\ARPPRODUCTICON.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2010-05-06 07:08        109144        ----a-w-        c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\shellex.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-11 7626752]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-11 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-31 16208384]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"ntiMUI"="c:\programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\programme\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\programme\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"AVP"="c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe" [2010-05-06 361120]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Acer WLAN 11g USB Dongle.lnk - c:\programme\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          \0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-07-11 21:19        1519616        ----a-w-        c:\windows\system32\nwiz.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ICQ"="c:\programme\ICQ7.1\ICQ.exe" silent loginmode=4
"WinUPDT32"=c:\windows\system32\WinUPDT32\WinUPDT32.com
"Steam"="c:\programme\steam\steam.exe" -silent
"HKCU"=c:\windows\Win32Gl\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PPort11reminder"="c:\programme\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\dokumente und einstellungen\All Users\Anwendungsdaten\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
"SsAAD.exe"=c:\progra~1\Sony\SONICS~1\SsAAD.exe
"WinUPDT32"=c:\windows\system32\WinUPDT32\WinUPDT32.com
"Acer Empowering Technology Monitor"=c:\windows\system32\SysMonitor.exe
"ATICustomerCare"="c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe"
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"<NO NAME>"=c:\windows\Win32Gl
"HKLM"=c:\windows\Win32Gl\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\ICQ7.1\\ICQ.exe"=
"c:\\Programme\\ICQ7.1\\aolload.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Doni\\Steamless Left4Dead2 Pack\\left4dead2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Lufti\\World of Warcraft\\Repair.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Lufti\\World of Warcraft\\WoW-3.2.0-deDE-downloader.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Lufti\\World of Warcraft\\Launcher.exe"=
"c:\\Programme\\Garrys Mod 11\\hl2.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\Steam\\SteamApps\\common\\alien swarm\\swarm.exe"=
"c:\\Programme\\Steam\\SteamApps\\common\\alien swarm\\srcds.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14.10.2009 21:18 36880]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [12.08.2010 21:23 1051968]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.09.2009 14:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02.10.2009 19:39 19472]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [25.02.2010 11:18 10064]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [28.11.2005 11:45 7040]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [07.06.2010 19:56 136176]
S3 cpuz130;cpuz130;\??\c:\dokume~1\ADMINI~1\LOKALE~1\Temp\cpuz130\cpuz_x32.sys --> c:\dokume~1\ADMINI~1\LOKALE~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 esgiguard;esgiguard;\??\c:\programme\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\programme\Enigma Software Group\SpyHunter\esgiguard.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\dokume~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp --> c:\dokume~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp [?]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [03.06.2010 17:28 616064]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-06-07 17:56]

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-06-07 17:56]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\programme\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\3aco4acv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-24 21:53
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\dokume~1\ADMINI~1\LOKALE~1\Temp\EMY1C.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Electronic Arts\C*o*m*m*a*n*d* *&* *C*o*n*q*u*e*r* *3* *T*i*b*e*r*i*u*m* *W*a*r*s*"!\Kundendienst]
"Order"=hex:08,00,00,00,02,00,00,00,b8,02,00,00,01,00,00,00,04,00,00,00,de,00,
  00,00,00,00,00,00,d0,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,be,00,32,\

[HKEY_USERS\S-1-5-21-865584140-4230085389-3338066738-500\Software\SecuROM\License information*]
"datasecu"=hex:5a,89,9b,c4,9a,3d,3b,cb,35,ee,3c,56,a7,e5,95,ba,ce,95,9f,f8,0e,
  0e,84,44,60,65,39,8f,0b,07,20,4c,f7,66,c7,29,c4,e8,78,a4,d9,74,6f,f9,d9,3e,\
"rkeysecu"=hex:92,e2,19,33,15,91,a8,eb,f9,ff,4e,6e,54,7d,63,c0

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c5,29,e2,2b,5e,a2,23,ea,a8,cb,38,d3,a5,a8,72,fd,82,bd,f5,8d,f2,
  c8,17,80,fd,28,d3,d5,d7,93,1d,d4,1d,ac,d1,96,0d,fd,f1,3d,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c08de8fa-e854-4d38-b4ab-0460d15e853b}]
@Denied: (Full) (Everyone)
"Model"=dword:000000b7
"Therad"=dword:00000024
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
  38,95,44,ab,9e,50,1b,eb,77,d1,ab,1a,10,3b,69,da,2b,11,4b,83,e0,8b,c5,07,bb,\
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1408)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Zeit der Fertigstellung: 2010-08-24  21:54:50
ComboFix-quarantined-files.txt  2010-08-24 19:54
ComboFix2.txt  2010-08-24 19:35

Vor Suchlauf: 16 Verzeichnis(se), 181.545.070.592 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 181.531.045.888 Bytes frei

- - End Of File - - DF96B8D546038D05E5E261080B346FA1
--- --- ---
Und Nu^^


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:23 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129