Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Google seiten werden auf verschiedene seiten umgeleitet oder nicht geladen (https://www.trojaner-board.de/91241-google-seiten-verschiedene-seiten-umgeleitet-geladen.html)

andi_f 28.09.2010 15:39
Google seiten werden auf verschiedene seiten umgeleitet oder nicht geladen
 
hallo

ich hab oben genanntes problem kann mir hier jeman helfen??

Grüße

Andi

markusg 28.09.2010 15:46
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide.

andi_f 28.09.2010 16:04
OTL Logfile:
Code:
OTL logfile created on: 28.09.2010 16:52:17 - Run 1
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Dokumente und Einstellungen\User\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 125,00 Mb Available Physical Memory | 24,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,70 Gb Total Space | 10,69 Gb Free Space | 28,36% Space Free | Partition Type: NTFS
Drive D: | 34,37 Gb Total Space | 22,63 Gb Free Space | 65,84% Space Free | Partition Type: NTFS
Drive E: | 2,45 Gb Total Space | 0,59 Gb Free Space | 23,87% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ANDI
Current User Name: User
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\User\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.exe ()
PRC - C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
PRC - C:\Programme\PostgreSQL\8.3\bin\postgres.exe (PostgreSQL Global Development Group)
PRC - C:\WINDOWS\explorer.exe ()
PRC - C:\WINDOWS\system32\winlogon.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\User\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (yviye7czeon) -- C:\WINDOWS\System32\aaslblzkjmk.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (avast! Web Scanner) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (aspnet_state) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (DfSdkS) -- C:\Programme\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe (mst software GmbH, Germany)
SRV - (pgsql-8.3) -- C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
SRV - (GEARSecurity) -- C:\WINDOWS\system32\gearsec.exe (GEAR Software)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (PalmUSBD) -- C:\WINDOWS\System32\drivers\PalmUSBD.sys File not found
DRV - (iMSPCLOj) -- C:\DOKUME~1\User\LOKALE~1\Temp\iMSPCLOj.sys File not found
DRV - (alfacleaner) -- C:\WINDOWS\System32\drivers\hesvc.sys File not found
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS File not found
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvcap) nVidia WDM Video Capture (universal) -- C:\WINDOWS\system32\drivers\nvcap.sys ()
DRV - (NVXBAR) -- C:\WINDOWS\system32\drivers\nvxbar.sys (NVIDIA Corporation)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (wlags48d) -- C:\WINDOWS\system32\drivers\wlags48d.sys (Agere Systems)
DRV - (viaagp1) -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (Intels51) -- C:\WINDOWS\system32\drivers\ctxs51.sys (Intel Corporation)
DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (EL90XBC) -- C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (Ps2) -- C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = hxxp://de.rd.yahoo.com/customize/ie/defaults/cs/ymsgr6/us/*hxxp://www.yahoo.com/ext/search/search.html
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de7.hpwis.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de7.hpwis.com
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de7.hpwis.com
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de7.hpwis.com
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de8.hpwis.com/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://srch-de8.hpwis.com/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de8.hpwis.com/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://srch-de8.hpwis.com/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://srch-de8.hpwis.com/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de8.hpwis.com/
IE - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.17 13:52:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.17 13:52:04 | 000,000,000 | ---D | M]
 
[2009.07.15 13:05:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Extensions
[2010.08.30 07:41:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\default.tgt\extensions
[2007.06.13 19:44:11 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\default.tgt\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.08.29 21:51:14 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2004.09.03 16:33:27 | 000,018,944 | ---- | M] (Alambik Ltd) -- C:\Programme\Mozilla Firefox\plugins\NPAlambik.dll
[2010.08.06 14:33:56 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.06 14:33:56 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.08.06 14:33:56 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.08.06 14:33:56 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.08.06 14:33:56 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.09.25 23:55:52 | 000,419,520 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 14475 more lines...
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {F742E03D-8892-42AE-8049-CB5A51BE5B14} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Cmaudio] C:\WINDOWS\CMICNFG.CPL (C-Media Corporation)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006..\Run: [jnyfalps] c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\jnyfalps.exe ()
O4 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011..\Run: [RecordNow!]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: isamonitor.exe = C:\Programme\iVideoCodec\isamonitor.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: pmsngr.exe = C:\Programme\iVideoCodec\pmsngr.exe File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..Trusted Domains:  ([]msn in My Computer)
O15 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..Trusted Domains: onmycam.com ([]* is out of zone range - 6)
O15 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..Trusted Domains: onmycam.net ([]* is out of zone range - 6)
O15 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..Trusted Domains: onmycam.org ([]* is out of zone range - 6)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} https://www.cuworld.com/PIC/inner_pic/packages/CUworld.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092944811500 (WUWebControl Class)
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} hxxp://secure2.comned.com/signuptemplates/securelogin-devel.cab (SecureLogin class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37961.189537037 (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} hxxp://messenger.zone.msn.com/binary/ZIntro.cab47946.cab (ZoneIntro Class)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_05)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab (Solitaire Showdown Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINDOWS\wc98pp.dll ()
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe ()
O22 - SharedTaskScheduler: {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - bonspells - Reg Error: Key error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003.06.27 15:40:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: Ip6FwHlp -  File not found
 
MsConfig - Services: "iPodService"
MsConfig - Services: "GEARSecurity"
MsConfig - Services: "gusvc"
MsConfig - Services: "yviye7czeon"
MsConfig - Services: "Viewpoint Manager Service"
MsConfig - Services: "usnjsvc"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE - (Microsoft Corporation)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^PalTalk.lnk - C:\PROGRA~1\PALTAL~1\paltalk.exe - File not found
MsConfig - StartUpReg: Aim6 - hkey= - key= - C:\Programme\AIM6\aim6.exe File not found
MsConfig - StartUpReg: AlfaCleaner - hkey= - key= - C:\Programme\AlfaCleaner\AlfaCleaner.exe File not found
MsConfig - StartUpReg: Camfrog - hkey= - key= - C:\Programme\Camfrog\Camfrog Video Chat\CamfrogNet.exe File not found
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= -  File not found
MsConfig - StartUpReg: CUCore Agent - hkey= - key= - C:\PROGRA~1\GEMEIN~1\FIRSTV~1\ConfAgent.exe File not found
MsConfig - StartUpReg: Dit - hkey= - key= - C:\WINDOWS\Dit.exe ()
MsConfig - StartUpReg: DW4 - hkey= - key= -  File not found
MsConfig - StartUpReg: eijvahafr - hkey= - key= - c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\eijvahafr.exe File not found
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programme\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
MsConfig - StartUpReg: jnyfalps - hkey= - key= - c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\jnyfalps.exe ()
MsConfig - StartUpReg: KBD - hkey= - key= - C:\HP\KBD\KBD.EXE File not found
MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: links - hkey= - key= -  File not found
MsConfig - StartUpReg: messengerskinner - hkey= - key= - C:\Programme\MessengerSkinner\MessengerSkinner.exe File not found
MsConfig - StartUpReg: NeroCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: nwiz - hkey= - key= -  File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Computer, Inc.)
MsConfig - StartUpReg: RecordNow! - hkey= - key= -  File not found
MsConfig - StartUpReg: SpybotSD TeaTimer - hkey= - key= - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: vmlib - hkey= - key= -  File not found
MsConfig - StartUpReg: webHancer Agent - hkey= - key= - C:\Program Files\webHancer\Programs\whAgent.exe File not found
MsConfig - StartUpReg: webHancer Survey Companion - hkey= - key= - C:\Program Files\webHancer\Programs\whSurvey.exe File not found
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Programme\Winamp\winampa.exe ()
MsConfig - StartUpReg: Zone Labs Client - hkey= - key= - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {057997dd-71e4-43cc-b161-3f8180691a9e} - Q824145
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {2298d453-bcae-4519-bf33-1cbf3faf1524} - Q867801
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4d64f3ba-f112-4efe-a02e-96680859937c} - KB918899
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {588A559B-BBC9-4148-A2C0-96A33D1DBC26} - Microsoft .NET Framework 1.0 Hotfix (KB928367)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5b7bf89d-d196-4c32-a303-a57b8ab7f18d} - KB918439
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {65289DE3-4C1A-11D6-B6E1-00B0D049139F} - Microsoft .NET Framework 1.0 Service Pack 2 (KB867461)
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {78705f0d-e8db-4b2d-8193-982bdda15ecd} - .NET Framework
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {8D1D0E9A-C799-4D28-9E29-0061D1E66E43} - Microsoft .NET Framework 1.1 Hotfix (KB928366)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {9BFBE94F-2FAF-11D6-8712-0002B3281F8B} - Microsoft .NET Framework 1.0 Service Pack 1 (KB867461)
ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {D82A39FB-1784-4608-BFE8-1ACBFF3079C1} - Microsoft .NET Framework 1.0 Service Pack 3 (KB867461)
ActiveX: {dd772a76-bef3-44d7-8b39-502c8504c1f1} - KB925486
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {f15ee071-deb7-4cbb-951f-431c98338d8e} - KB911567
ActiveX: {F279058C-50B2-4BE4-60C9-369CACF06821} - .NET Framework
ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSACM.sx5363s - sx5363s.acm File not found
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.JPEG - C:\WINDOWS\System32\JpegCode.dll (Zoran Microelectronics Ltd.)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\JpegCode.dll (Zoran Microelectronics Ltd.)
Drivers32: vidc.RMP4 - C:\WINDOWS\System32\rmp4.dll (Sigma Designs, Inc.)
Drivers32: vidc.xvid - C:\WINDOWS\System32\xvid.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivXNetworks)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619756233228288)
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.09.28 16:49:20 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe
[2010.09.28 02:23:59 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\User\Recent
[2010.09.26 12:12:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Tracing
[2010.09.26 12:10:00 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft
[2010.09.26 12:09:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\microsoft
[2010.09.26 12:09:38 | 000,000,000 | ---D | C] -- C:\Programme\Windows Live SkyDrive
[2010.09.26 12:09:00 | 000,000,000 | ---D | C] -- C:\Programme\Windows Live
[2010.09.26 12:06:01 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Windows Live
[2010.09.19 21:45:13 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\Server
[2010.09.06 08:15:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads
[2010.09.01 09:56:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\SecondLife
[2010.09.01 09:42:38 | 000,000,000 | ---D | C] -- C:\Programme\SecondLifeViewer2
[2010.08.26 16:17:19 | 000,000,000 | ---D | C] -- C:\Programme\QuickPar
[2010.08.26 16:16:47 | 000,503,439 | ---- | C] (Peter B Clements) -- C:\Dokumente und Einstellungen\User\Desktop\QuickPar-0.9.1.0-DEU.exe
[2010.08.20 19:17:05 | 000,000,000 | ---D | C] -- C:\Programme\PostgreSQL
[2010.08.20 19:13:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\PokerStrategy.com
[2010.08.20 19:13:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Eigene Dateien\PokerStrategy.com
[2010.08.20 18:56:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
[2010.08.20 18:48:59 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET
[2010.08.18 00:20:41 | 000,028,160 | ---- | C] (mst software GmbH, Germany) -- C:\WINDOWS\System32\DfSdkBt.exe
[2010.08.18 00:20:33 | 000,000,000 | ---D | C] -- C:\Programme\Ashampoo
[2010.08.17 23:02:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla-Cache
[2010.08.17 23:01:16 | 000,000,000 | ---D | C] -- C:\Programme\PartyGaming
[2010.08.12 22:10:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\PokerStrategy
[2010.08.12 22:08:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Equilator
[2010.08.12 22:07:52 | 000,000,000 | ---D | C] -- C:\Programme\PokerStrategy.com
[2010.08.12 00:55:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\vlc
[2010.08.09 22:19:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\cache
[2010.08.09 22:16:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\FullTiltPoker
[2010.08.09 22:14:52 | 000,000,000 | ---D | C] -- C:\Programme\Full Tilt Poker
[2010.08.06 14:52:56 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010.08.06 14:52:55 | 000,165,584 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010.08.06 14:52:54 | 000,023,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010.08.06 14:52:52 | 000,046,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010.08.06 14:52:50 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010.08.06 14:52:50 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010.08.06 14:52:49 | 000,028,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010.08.06 14:52:01 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010.08.06 14:52:00 | 000,167,592 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010.08.06 14:51:45 | 000,000,000 | ---D | C] -- C:\Programme\Alwil Software
[2010.08.06 14:51:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2010.08.06 14:35:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NOS
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 90 Days ==========
 
[2010.09.28 16:56:22 | 000,004,726 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.dat
[2010.09.28 16:56:18 | 000,004,574 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps_navps.dat
[2010.09.28 16:49:22 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe
[2010.09.28 08:35:34 | 000,001,230 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.09.28 08:33:51 | 000,004,412 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.09.28 08:33:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.09.28 08:33:07 | 536,399,872 | -HS- | M] () -- C:\hiberfil.sys
[2010.09.28 02:24:29 | 012,320,768 | -H-- | M] () -- C:\Dokumente und Einstellungen\User\NTUSER.DAT
[2010.09.27 18:42:52 | 000,298,429 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Shenaniganz Flyer.JPG
[2010.09.27 17:52:52 | 000,000,565 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI
[2010.09.27 17:52:38 | 000,020,130 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\shenaniganz 2.jpg
[2010.09.27 17:49:40 | 000,165,842 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\shenaniganz.jpg
[2010.09.27 17:40:52 | 000,352,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.09.26 12:25:17 | 041,778,581 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Pl0yb0201010Sl00.rar
[2010.09.26 12:11:44 | 000,099,384 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.09.26 12:11:07 | 000,000,982 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Meine freigegebenen Ordner.lnk
[2010.09.25 23:55:52 | 000,419,520 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.09.21 09:07:42 | 000,003,011 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010.09.21 08:51:46 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2010.09.14 18:38:40 | 000,084,992 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.13 22:52:03 | 000,008,203 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\shorthanded.xml
[2010.09.08 09:19:57 | 000,002,523 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Microsoft Excel.lnk
[2010.09.07 17:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010.09.07 17:11:54 | 000,167,592 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010.09.07 16:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010.09.07 16:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010.09.07 16:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010.09.07 16:47:19 | 000,100,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010.09.07 16:47:16 | 000,094,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010.09.07 16:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010.09.07 16:46:51 | 000,028,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010.09.06 00:37:45 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2010.09.03 14:33:58 | 005,507,991 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\flash1018276.zip
[2010.09.01 03:12:51 | 000,079,637 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Anmeldung_ManCongr3-2010.pdf
[2010.08.26 16:17:20 | 000,000,658 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\QuickPar.lnk
[2010.08.26 16:17:04 | 000,503,439 | ---- | M] (Peter B Clements) -- C:\Dokumente und Einstellungen\User\Desktop\QuickPar-0.9.1.0-DEU.exe
[2010.08.26 14:48:25 | 000,001,488 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\UseNeXT.lnk
[2010.08.20 19:30:55 | 000,008,190 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Shorthanded.xml
[2010.08.20 19:16:34 | 000,000,371 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\postgresinstall.bat
[2010.08.20 19:12:07 | 000,001,988 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PokerStrategy.com Elephant.lnk
[2010.08.20 19:05:33 | 001,194,458 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.08.20 19:05:33 | 000,528,124 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.08.20 19:05:33 | 000,503,164 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.08.20 19:05:33 | 000,105,578 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.08.20 19:05:33 | 000,088,018 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.08.19 18:47:10 | 000,064,188 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Wittchow Herbert.pdf
[2010.08.19 12:05:36 | 000,017,408 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Hösl Photovoltaik.xls
[2010.08.19 08:35:16 | 000,066,463 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Habrmann.pdf
[2010.08.18 01:23:34 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.18 00:20:43 | 000,001,655 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ein-Klick-Optimierung.lnk
[2010.08.18 00:20:43 | 000,000,749 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ashampoo WinOptimizer 6.lnk
[2010.08.18 00:05:46 | 000,000,520 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.08.18 00:05:46 | 000,000,271 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.08.18 00:05:46 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2010.08.17 23:01:48 | 000,001,618 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\PartyPoker.lnk
[2010.08.13 14:13:48 | 000,001,724 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 7.0.lnk
[2010.08.12 23:59:00 | 000,000,151 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010.08.12 23:20:33 | 000,000,909 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Spybot - Search & Destroy.lnk
[2010.08.12 22:08:06 | 000,001,986 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PokerStrategy.com Equilator.lnk
[2010.08.12 21:37:14 | 000,416,732 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100925-235552.backup
[2010.08.12 00:55:12 | 000,000,695 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2010.08.11 22:06:28 | 000,248,714 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps_nav.dat
[2010.08.09 22:15:36 | 000,000,772 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Full Tilt Poker.lnk
[2010.08.06 14:29:08 | 000,552,960 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.exe
[2010.07.25 00:44:23 | 000,044,772 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\wklnhst.dat
[2010.07.19 00:56:23 | 006,434,626 | -H-- | M] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.09.27 18:36:34 | 000,298,429 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Shenaniganz Flyer.JPG
[2010.09.27 17:52:38 | 000,020,130 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\shenaniganz 2.jpg
[2010.09.27 17:49:38 | 000,165,842 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\shenaniganz.jpg
[2010.09.26 12:19:54 | 041,778,581 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Pl0yb0201010Sl00.rar
[2010.09.06 00:37:45 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2010.09.06 00:37:45 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2010.09.03 14:29:06 | 005,507,991 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\flash1018276.zip
[2010.09.01 03:12:48 | 000,079,637 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Anmeldung_ManCongr3-2010.pdf
[2010.08.26 16:17:20 | 000,000,658 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\QuickPar.lnk
[2010.08.24 20:58:33 | 000,008,203 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\shorthanded.xml
[2010.08.20 19:25:34 | 000,008,190 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Shorthanded.xml
[2010.08.20 19:16:34 | 000,000,371 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\postgresinstall.bat
[2010.08.20 19:12:07 | 000,001,988 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PokerStrategy.com Elephant.lnk
[2010.08.19 18:47:10 | 000,064,188 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Wittchow Herbert.pdf
[2010.08.19 12:03:23 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Hösl Photovoltaik.xls
[2010.08.19 08:35:16 | 000,066,463 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Habrmann.pdf
[2010.08.18 00:20:43 | 000,001,655 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ein-Klick-Optimierung.lnk
[2010.08.18 00:20:43 | 000,000,749 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Ashampoo WinOptimizer 6.lnk
[2010.08.17 23:01:48 | 000,001,618 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\PartyPoker.lnk
[2010.08.13 14:13:48 | 000,001,724 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 7.0.lnk
[2010.08.12 23:20:33 | 000,000,909 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Spybot - Search & Destroy.lnk
[2010.08.12 22:08:06 | 000,001,986 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PokerStrategy.com Equilator.lnk
[2010.08.12 00:55:12 | 000,000,695 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2010.08.09 22:15:36 | 000,000,772 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Full Tilt Poker.lnk
[2010.08.06 14:29:09 | 000,248,714 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps_nav.dat
[2010.08.06 14:29:09 | 000,004,570 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.dat
[2010.08.06 14:29:09 | 000,004,516 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps_navps.dat
[2010.08.06 14:29:08 | 000,552,960 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.exe
[2010.04.18 03:03:14 | 000,000,036 | ---- | C] () -- C:\WINDOWS\rasqervy.dll
[2010.04.18 03:02:45 | 000,000,008 | ---- | C] () -- C:\WINDOWS\sdfinacs.dll
[2010.04.18 03:02:43 | 000,000,005 | ---- | C] () -- C:\WINDOWS\sdfixwcs.dll
[2010.04.18 02:59:44 | 000,000,168 | ---- | C] () -- C:\WINDOWS\wuasirvy.dll
[2010.02.14 13:55:46 | 000,360,448 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\fvung.exe
[2007.04.06 11:32:02 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2006.10.15 03:00:53 | 000,000,018 | ---- | C] () -- C:\WINDOWS\cnc.ini
[2006.03.15 19:48:08 | 000,000,020 | ---- | C] () -- C:\WINDOWS\systemsplit.ini
[2006.02.22 22:48:33 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Install.dat
[2006.02.08 16:00:15 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2005.12.24 22:29:42 | 000,007,207 | R--- | C] () -- C:\WINDOWS\Disktool.INI
[2005.12.24 22:29:42 | 000,006,399 | R--- | C] () -- C:\WINDOWS\fwupgrade.ini
[2005.12.24 22:29:42 | 000,003,677 | R--- | C] () -- C:\WINDOWS\PlaySnd.INI
[2005.10.06 18:39:23 | 000,577,536 | ---- | C] () -- C:\WINDOWS\System32\ncVEAudio.dll
[2005.10.06 18:39:23 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\ncvDS61.dll
[2005.10.06 18:39:23 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ncUtil62.dll
[2005.10.06 18:39:22 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\ncCompress.dll
[2005.10.06 18:39:20 | 000,184,320 | ---- | C] () -- C:\WINDOWS\System32\howl.dll
[2005.10.06 18:39:20 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\nczlib.dll
[2005.10.06 18:39:20 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\zlib32.dll
[2005.10.06 18:39:20 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\RegistrationId.dll
[2005.10.04 15:23:17 | 000,000,137 | ---- | C] () -- C:\WINDOWS\qti.ini
[2005.07.29 10:41:59 | 000,000,457 | ---- | C] () -- C:\Programme\INSTALL.LOG
[2005.07.29 10:20:59 | 000,044,772 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\wklnhst.dat
[2005.07.28 18:41:53 | 000,000,192 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2005.07.19 13:43:17 | 000,000,664 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005.05.23 17:40:38 | 000,003,359 | ---- | C] () -- C:\WINDOWS\tm.ini
[2005.04.28 06:22:38 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005.04.28 06:22:34 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005.04.28 06:22:34 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2005.02.08 14:20:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QuickInstall.INI
[2005.01.26 13:50:31 | 000,000,004 | ---- | C] () -- C:\WINDOWS\info147.sys
[2004.12.26 12:25:20 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2004.12.01 15:11:25 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004.11.16 12:44:43 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2004.09.19 15:29:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WATCH.INI
[2004.09.16 14:26:40 | 000,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004.09.16 14:26:40 | 000,012,634 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS
[2004.09.12 11:23:22 | 000,000,118 | ---- | C] () -- C:\WINDOWS\telephon.ini
[2004.09.08 13:33:26 | 000,000,565 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
[2004.09.07 17:01:17 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004.09.07 15:56:27 | 000,287,744 | ---- | C] () -- C:\WINDOWS\uno364mi.dll
[2004.09.07 15:56:27 | 000,109,568 | ---- | C] () -- C:\WINDOWS\vos364mi.dll
[2004.09.07 15:56:27 | 000,091,648 | ---- | C] () -- C:\WINDOWS\osl364mi.dll
[2004.09.07 15:56:27 | 000,000,137 | ---- | C] () -- C:\WINDOWS\uno.ini
[2004.09.07 15:45:28 | 000,051,712 | ---- | C] () -- C:\WINDOWS\wc98pp.dll
[2004.09.07 12:56:50 | 000,084,992 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004.09.07 12:56:50 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2004.08.19 21:35:50 | 000,126,878 | ---- | C] () -- C:\WINDOWS\System32\drivers\nvcap.sys
[2003.11.12 17:55:47 | 001,892,352 | ---- | C] () -- C:\WINDOWS\CMIWCNFG.DLL
[2003.11.12 17:55:47 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRMDRV.DLL
[2003.11.12 17:55:47 | 000,003,424 | ---- | C] () -- C:\WINDOWS\cmiainfo.sys
[2003.11.12 17:55:47 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2003.11.12 17:55:47 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2003.11.12 17:55:46 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll
[2003.10.14 15:32:07 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003.09.22 20:20:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003.07.16 13:09:31 | 000,626,688 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2003.07.12 01:04:06 | 000,438,272 | ---- | C] () -- C:\WINDOWS\System32\PaintX.dll
[2003.07.07 12:49:04 | 000,000,151 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2003.06.29 16:59:44 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2003.06.29 16:38:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\Dit.DLL
[2003.06.29 16:38:56 | 000,000,208 | ---- | C] () -- C:\WINDOWS\Dit.INI
[2003.06.27 15:55:09 | 000,249,921 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM15.dll
[2003.06.27 15:55:09 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes15.dll
[2003.06.27 15:54:46 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2003.06.27 15:37:16 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2003.06.27 15:23:01 | 000,001,972 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2003.02.18 18:26:28 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll
[2002.08.07 12:06:22 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\dsrmp4.dll
[2002.05.15 16:46:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\RSAG726E.dll
[2002.04.05 16:00:30 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\RSAG726D.dll
 
========== LOP Check ==========
 
[2010.08.06 14:51:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2008.08.31 17:51:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ElsterFormular
[2008.04.05 12:13:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
[2004.09.12 11:15:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2008.04.02 18:12:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\InterVideo
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Christian\Anwendungsdaten\InterVideo
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\InterVideo
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\elephant\Anwendungsdaten\InterVideo
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gast\Anwendungsdaten\InterVideo
[2006.02.23 17:05:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AlfaCleaner
[2006.02.23 17:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Skinux
[2008.02.22 15:08:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\.gaim
[2006.02.23 17:14:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\AlfaCleaner
[2010.08.18 00:24:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Azureus
[2010.08.18 00:24:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Camfrog
[2007.11.14 22:21:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\CamfrogWEB
[2005.07.29 10:42:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ICQ
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\InterVideo
[2004.09.21 17:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Kazaa Lite
[2004.09.07 16:45:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Leadertech
[2007.10.09 15:36:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\MessengerSkinner
[2008.04.02 18:07:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Paltalk
[2010.09.06 08:30:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Piugxa
[2010.09.01 09:57:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\SecondLife
[2006.02.23 17:14:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Skinux
[2008.04.12 11:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TmpRecentIcons
[2010.09.06 07:53:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\UseNeXT
[2007.11.14 18:53:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Viewpoint
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.02.22 15:08:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\.gaim
[2010.08.13 14:15:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Adobe
[2010.08.13 14:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\AdobeUM
[2006.02.23 17:14:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\AlfaCleaner
[2004.09.07 16:40:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Apple Computer
[2004.12.26 12:26:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ArcSoft
[2010.08.18 00:24:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Azureus
[2010.08.18 00:24:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Camfrog
[2007.11.14 22:21:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\CamfrogWEB
[2005.07.28 22:05:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Google
[2003.06.29 14:54:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Help
[2005.07.29 10:42:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ICQ
[2003.06.27 15:40:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Identities
[2003.06.29 15:29:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\InterVideo
[2004.09.21 17:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Kazaa Lite
[2004.09.07 16:45:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Leadertech
[2004.10.18 13:06:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Macromedia
[2007.10.09 15:36:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\MessengerSkinner
[2007.06.13 17:12:00 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Microsoft
[2009.07.15 13:05:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla
[2010.08.17 23:02:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla-Cache
[2005.07.19 11:14:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\MSN6
[2008.04.02 18:07:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Paltalk
[2010.09.06 08:30:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Piugxa
[2009.08.19 19:35:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Real
[2010.09.01 09:57:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\SecondLife
[2006.02.23 17:14:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Skinux
[2004.09.07 16:46:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Sonic
[2004.11.15 13:34:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Sun
[2004.02.16 01:07:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Symantec
[2004.09.09 17:29:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Talkback
[2008.04.12 11:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TmpRecentIcons
[2007.05.23 16:02:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\U3
[2010.09.06 07:53:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\UseNeXT
[2007.11.14 18:53:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Viewpoint
[2010.09.28 02:05:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\vlc
[2008.04.02 18:13:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Yahoo!
[2005.05.11 22:31:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Yahoo! Messenger
 
< %APPDATA%\*.exe /s >
[2008.03.12 16:07:57 | 013,320,192 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Real\RealPlayer\setup\AU_setup.exe
[2009.06.01 08:59:33 | 000,390,664 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Real\RealPlayer\Update\RealPlayer11.exe
[2006.04.05 19:38:10 | 000,110,592 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\U3\temp\cleanup.exe
 
< %SYSTEMDRIVE%\*.exe >
[2006.03.27 21:02:07 | 000,024,064 | ---- | M] (Microsoft Corporation) -- C:\mshta.exe
 
 
< MD5 for: AGP440.SYS  >
[2007.04.13 15:46:33 | 022,286,026 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2007.04.13 15:46:33 | 022,286,026 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\agp440.sys
[2004.08.04 08:07:41 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004.08.04 08:07:41 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2002.08.29 14:00:00 | 010,180,476 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2007.04.13 15:46:33 | 022,286,026 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2002.08.29 14:00:00 | 010,180,476 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp1.cab:atapi.sys
[2007.04.13 15:46:33 | 022,286,026 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2002.10.16 17:31:10 | 000,087,040 | ---- | M] (Microsoft Corporation) MD5=3DF589B9A15FF9EF4AA499F98C1C16D5 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2002.08.29 14:00:00 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\$NtUninstallQ331060$\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\atapi.sys
[2004.08.04 07:59:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004.08.04 07:59:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\eventlog.dll
[2004.08.04 09:57:18 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004.08.04 09:57:18 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll
[2002.08.29 14:00:00 | 000,049,152 | ---- | M] (Microsoft Corporation) MD5=B9358A1FB66CF656328FD8B792B2CCC4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2003.05.29 12:48:20 | 000,999,424 | ---- | M] (Microsoft Corporation) MD5=0589140C62D1A5D1ADC13C79266122DA -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2002.08.29 14:00:00 | 001,007,104 | ---- | M] (Microsoft Corporation) MD5=22B0A56E6C5847292437078B484EC61B -- C:\WINDOWS\$NtUninstallKB820291$\explorer.exe
[2004.08.04 09:57:53 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2004.08.04 09:57:53 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.06.13 15:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\explorer.exe
[2007.06.13 15:21:45 | 001,036,288 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\netlogon.dll
[2002.08.29 14:00:00 | 000,399,360 | ---- | M] (Microsoft Corporation) MD5=BCA549B21E651111CE7BAD0FC8C45F4B -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004.08.04 09:57:30 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004.08.04 09:57:30 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\scecli.dll
[2004.08.04 09:57:33 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004.08.04 09:57:33 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll
[2002.08.29 14:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=ADD49C10F5DADFA81912D124FE1C9A99 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004.06.17 19:55:43 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=34280AB3C7BEC4BA2E423567F6045369 -- C:\WINDOWS\SoftwareDistribution\Download\256adcee6446c05a52e0f442d0ccb199\sp1qfe\user32.dll
[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\user32.dll
[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\SoftwareDistribution\Download\6f667da50bb6ed52a71fae1f7f60833d\sp2gdr\user32.dll
[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\dllcache\user32.dll
[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\SoftwareDistribution\Download\6f667da50bb6ed52a71fae1f7f60833d\sp2qfe\user32.dll
[2004.08.04 09:57:36 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2004.08.04 09:57:36 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2004.12.29 03:32:21 | 000,576,000 | ---- | M] (Microsoft Corporation) MD5=63A33FD2F52FE082158C3CD68951B761 -- C:\WINDOWS\SoftwareDistribution\Download\4f1709dfc1fee2cb8465d8e2cfdd8be8\sp1qfe\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2003.09.25 18:52:01 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=8D928268AFBF31F8A34CE610DA175352 -- C:\WINDOWS\$NtUninstallKB890859_0$\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\user32.dll
[2005.03.02 20:21:03 | 000,562,688 | ---- | M] (Microsoft Corporation) MD5=DEF116925E1EA04691EC6362F197451E -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 20:21:03 | 000,562,688 | ---- | M] (Microsoft Corporation) MD5=DEF116925E1EA04691EC6362F197451E -- C:\WINDOWS\SoftwareDistribution\Download\6f667da50bb6ed52a71fae1f7f60833d\sp1qfe\user32.dll
[2002.11.22 21:28:16 | 000,530,432 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\$NtUninstallKB824141$\user32.dll
[2002.08.29 14:00:00 | 000,561,664 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\$NtUninstallKB826939$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\userinit.exe
[2002.08.29 14:00:00 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=BEBD3F08461F9A88E5ABCE0CB9707000 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2004.08.04 09:58:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2004.08.04 09:58:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 09:58:19 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2002.08.29 14:00:00 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2004.06.17 19:42:13 | 000,488,448 | ---- | M] (Microsoft Corporation) MD5=E40A881E0EF53994B22D9DB55E94DBED -- C:\WINDOWS\SoftwareDistribution\Download\256adcee6446c05a52e0f442d0ccb199\sp1qfe\winlogon.exe
[2004.06.17 02:09:16 | 000,488,448 | ---- | M] (Microsoft Corporation) MD5=E40A881E0EF53994B22D9DB55E94DBED -- C:\WINDOWS\SoftwareDistribution\Download\33ff811e0317795b71f6b10d11879c13\sp1qfe\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\winlogon.exe
[2004.08.04 09:58:19 | 000,507,392 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2002.08.29 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2002.08.29 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2003.06.27 17:31:53 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2003.06.27 17:31:53 | 000,606,208 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2003.06.27 17:31:53 | 000,413,696 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
--- --- ---

andi_f 28.09.2010 16:04
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 28.09.2010 16:52:17 - Run 1
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Dokumente und Einstellungen\User\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 125,00 Mb Available Physical Memory | 24,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,70 Gb Total Space | 10,69 Gb Free Space | 28,36% Space Free | Partition Type: NTFS
Drive D: | 34,37 Gb Total Space | 22,63 Gb Free Space | 65,84% Space Free | Partition Type: NTFS
Drive E: | 2,45 Gb Total Space | 0,59 Gb Free Space | 23,87% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ANDI
Current User Name: User
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1006\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe ()
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L ()
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L ()
Drive [find] -- %SystemRoot%\Explorer.exe ()
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\MSN Messenger\msncall.exe" = C:\Programme\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -- File not found
"C:\Programme\MSN Messenger\livecall.exe" = C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\MSN Messenger\msncall.exe" = C:\Programme\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -- File not found
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Programme\Yahoo!\Messenger\YServer.exe" = C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)
"C:\Programme\MSN Messenger\livecall.exe" = C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
"C:\Programme\Gemeinsame Dateien\AOL\Loader\aolload.exe" = C:\Programme\Gemeinsame Dateien\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- File not found
"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- File not found
"C:\WINDOWS\Explorer.EXE" = C:\WINDOWS\Explorer.EXE:*:Enabled:enable -- ()
"C:\Programme\PokerStrategy.com\PokerStrategy.com Equilator\Equilator.exe" = C:\Programme\PokerStrategy.com\PokerStrategy.com Equilator\Equilator.exe:*:Enabled:PokerStrategy Equilator -- (PokerStrategy)
"C:\Programme\SecondLifeViewer2\SLVoice.exe" = C:\Programme\SecondLifeViewer2\SLVoice.exe:*:Enabled:SLVoice -- (Vivox Inc.)
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{10798AE3-DCBB-43C3-9C93-C23512427E25}" = Die Sims Deluxe
"{11B569C2-4BF6-4ED0-9D17-A4273943CB24}" = Adobe Photoshop Album 2.0 Starter Edition
"{15F52B39-04CB-4EDB-9A8C-496C4A5588E2}" = Rayman 3
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20F1FFAF-1BFF-450C-A8C7-03D1BE24B950}" = Microsoft .NET Framework (German)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3F262ADC-5AD2-48E5-A586-44315E04A9E2}" = Microsoft Picture It!-Bibliothek 10
"{42756145-9997-4D28-809B-8756BFD00106}" = Microsoft Picture It! Foto Premium 10
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows-Journal-Viewer
"{4B6224D0-94CF-49C6-A856-E3FAF8FC8FED}" = PokerStrategy.com Elephant
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5BBFB0E4-2250-49C3-A8A3-65BE2197D13B}" = MP3 Player Utilities
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{75AECBC5-B17D-424B-B847-D7B72B6CB97C}" = Internet Access
"{791B20D4-AE59-4DE9-B45F-BA01F3D0A493}" = ArcSoft ShowBiz 2
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7F34A21F-2DEB-4598-BB19-611D6BD24271}" = Managed DirectX (0901)
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Einfache Internetanmeldung
"{91110407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{911B0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = RecordNow!
"{9705A7E1-3DD1-4BAC-8CA9-FE7B1473BEC9}" = iTunes
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A31289C6-04EF-4437-A35B-7CC96167145C}" = Leisure Suit Larry - Magna Cum Laude
"{AC76BA86-7AD7-1031-7B44-A70000000000}" = Adobe Reader 7.0 - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B26E3B0D-C2FA-4370-B068-7C476766F029}" = Microsoft Works
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C438DF2B-C5DF-4783-9CA5-9B89E501FA62}" = Works Update
"{C6A12D9B-D86A-4ee6-B980-95E4B26A2E13}" = Microsoft Works Suite-Add-Ins für Microsoft Word
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E142615E-5ED8-4511-9BF0-0284BFA25766}" = ArcSoft PhotoImpression
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EA1CB7AC-E221-4822-A789-0ADB051DC498}" = Medion Flash XL
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Ashampoo WinOptimizer 6_is1" = Ashampoo WinOptimizer 6.60
"avast5" = avast! Free Antivirus
"CCleaner" = CCleaner (remove only)
"C-Media Audio" = C-Media 3D Audio
"C-Media Audio Driver" = C-Media WDM Audio Driver
"Digital Camera Driver" = Digital Camera Driver
"Find 5_is1" = Find 5 1.0.2
"hp deskjet 930c series" = hp deskjet 930c series (nur entfernen)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Einfache Internetanmeldung
"InstallShield_{9705A7E1-3DD1-4BAC-8CA9-FE7B1473BEC9}" = iTunes
"InstallShield_{A31289C6-04EF-4437-A35B-7CC96167145C}" = Leisure Suit Larry - Magna Cum Laude
"jnyfalps" = Favorit
"LimeWire" = LimeWire 4.9.7
"MessengerSkinner" = MessengerSkinner
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft .NET Framework Full v1.0.3705 (1031)" = Microsoft .NET Framework (German) v1.0.3705
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PartyPoker" = PartyPoker
"PictureItPrem_v10" = Microsoft Picture It! Foto Premium 10
"PokerStars" = PokerStars
"PS2" = PS2
"Python 1.5 combined Win32 extensions" = Python 1.5 combined Win32 extensions
"Python 1.5.2 (final)" = Python 1.5.2 (final)
"QuickPar" = QuickPar 0.9
"QuickTime" = QuickTime
"rmp4" = Sigma REALmagic MPEG-4 Video Codec
"SecondLifeViewer2" = SecondLifeViewer2 (remove only)
"SimCity 3000" = SimCity 3000
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"Tcl 8.0.5 for Windows" = Tcl 8.0.5 for Windows
"T-Online Browser" = T-Online Browser 4.0
"T-Online Messenger (TOM)" = T-Online Messenger (TOM) 4.0
"Ulead Photo Express 3.0 SE" = Ulead Photo Express 3.0 SE
"UseNeXT_is1" = UseNeXT
"VLC media player" = VLC media player 1.1.2
"VR-Web" = VR-Web
"WebVideo" = WebVideo Support
"WIC" = Windows Imaging Component
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR Archivierer
"Works2005Setup" = Setup-Start von Microsoft Works 2005
"XviD" = XviD MPEG-4 Codec
"Yahoo! Messenger" = Yahoo! Messenger
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.09.2010 03:26:04 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3855,
 fehlgeschlagenes Modul xul.dll, Version 1.9.2.3855, Fehleradresse 0x004837e1.
 
Error - 01.09.2010 09:18:08 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
 Modul xvid.ax, Version 0.0.0.0, Fehleradresse 0x0003d928.
 
Error - 05.09.2010 19:57:45 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3855,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.3520, Fehleradresse 0x0000100b.
 
Error - 20.09.2010 19:24:40 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
 Modul xvid.ax, Version 0.0.0.0, Fehleradresse 0x0003d928.
 
Error - 26.09.2010 06:13:24 | Computer Name = ANDI | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 26.09.2010 06:13:24 | Computer Name = ANDI | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Der angegebene Server kann den angeforderten
 Vorgang nicht ausführen.  .
 
Error - 27.09.2010 20:05:17 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
 Modul xvid.ax, Version 0.0.0.0, Fehleradresse 0x0003d928.
 
Error - 27.09.2010 20:06:44 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
 Modul xvid.ax, Version 0.0.0.0, Fehleradresse 0x0003d928.
 
Error - 27.09.2010 20:13:48 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
 Modul xvid.ax, Version 0.0.0.0, Fehleradresse 0x0003d928.
 
Error - 28.09.2010 07:01:57 | Computer Name = ANDI | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3909,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.3520, Fehleradresse 0x0000100b.
 
[ System Events ]
Error - 21.09.2010 02:12:35 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
Error - 21.09.2010 03:07:50 | Computer Name = ANDI | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
 Fehlers fehlgeschlagen:  %%5
 
Error - 21.09.2010 03:07:51 | Computer Name = ANDI | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
 Fehlers fehlgeschlagen:  %%5
 
Error - 21.09.2010 03:07:51 | Computer Name = ANDI | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
 Fehlers fehlgeschlagen:  %%5
 
Error - 22.09.2010 09:40:35 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
Error - 25.09.2010 09:58:07 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
Error - 26.09.2010 04:27:13 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
Error - 27.09.2010 11:42:44 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
Error - 27.09.2010 16:00:55 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
Error - 28.09.2010 02:34:32 | Computer Name = ANDI | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  alfacleaner
 
 
< End of report >
--- --- ---

markusg 28.09.2010 16:15
• Starte bitte die OTL.exe.
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.exe ()
SRV - (yviye7czeon) -- C:\WINDOWS\System32\aaslblzkjmk.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
DRV - (PalmUSBD) -- C:\WINDOWS\System32\drivers\PalmUSBD.sys File not found
DRV - (iMSPCLOj) -- C:\DOKUME~1\User\LOKALE~1\Temp\iMSPCLOj.sys File not found
DRV - (alfacleaner) -- C:\WINDOWS\System32\drivers\hesvc.sys File not found
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS File not found
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found
O2 - BHO: (no name) - {F742E03D-8892-42AE-8049-CB5A51BE5B14} - No CLSID value found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
O3 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found
O4 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1006..\Run: [jnyfalps] c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\jnyfalps.exe
()
O4 - HKU\S-1-5-21-1427476829-1789590150-2651740016-1011..\Run: [RecordNow!] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: isamonitor.exe = C:\Programme\iVideoCodec\isamonitor.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: pmsngr.exe = C:\Programme\iVideoCodec\pmsngr.exe File not found
:FILES
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten


öffne arbeitsplatz, c: dort rechtsklick auf _OTL und zu _OTL.zip oder rar hinzufügen.
archiv zu uns hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html

bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

andi_f 28.09.2010 16:28
All processes killed
========== OTL ==========
No active process named jnyfalps.exe was found!
Service yviye7czeon stopped successfully!
Service yviye7czeon deleted successfully!
File C:\WINDOWS\System32\aaslblzkjmk.exe File not found not found.
Service AppMgmt stopped successfully!
Service AppMgmt deleted successfully!
File C:\WINDOWS\System32\appmgmts.dll File not found not found.
Error: Unable to stop service PalmUSBD!
Service\Driver key PalmUSBD not found.
File C:\WINDOWS\System32\drivers\PalmUSBD.sys File not found not found.
Error: Unable to stop service iMSPCLOj!
Service\Driver key iMSPCLOj not found.
File C:\DOKUME~1\User\LOKALE~1\Temp\iMSPCLOj.sys File not found not found.
Error: Unable to stop service alfacleaner!
Service\Driver key alfacleaner not found.
File C:\WINDOWS\System32\drivers\hesvc.sys File not found not found.
Error: No service named ALCXWDM) Service for Realtek AC97 Audio (WDM was found to stop!
Service\Driver key ALCXWDM) Service for Realtek AC97 Audio (WDM not found.
File C:\WINDOWS\System32\drivers\ALCXWDM.SYS File not found not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F742E03D-8892-42AE-8049-CB5A51BE5B14}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F742E03D-8892-42AE-8049-CB5A51BE5B14}\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry key HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1006\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry key HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry key HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry key HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1011\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry key HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1006\Software\Microsoft\Windows\CurrentVersion\Run not found.
c:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.exe moved successfully.
Registry key HKEY_USERS\S-1-5-21-1427476829-1789590150-2651740016-1011\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run not found.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Andreas

User: Christian

User: Default User

User: elephant

User: Gast

User: LocalService

User: NetworkService

User: User
->Flash cache emptied: 5616 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Andreas
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 114822 bytes

User: Christian
->Temp folder emptied: 10672 bytes
->Temporary Internet Files folder emptied: 114822 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 114822 bytes

User: elephant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 114822 bytes

User: Gast
->Temp folder emptied: 8839 bytes
->Temporary Internet Files folder emptied: 114822 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
Unable to create HKLM\Software\OldTimer Tools\OTL key.
->Temporary Internet Files folder emptied: 907616 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
Unable to create HKLM\Software\OldTimer Tools\OTL key.
->Temporary Internet Files folder emptied: 33170 bytes

User: User
->Temp folder emptied: 2938958 bytes
->Temporary Internet Files folder emptied: 14048443 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 52351494 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Unable to create HKLM\Software\OldTimer Tools\OTL key.
Windows Temp folder emptied: 8538 bytes
RecycleBin emptied: shell32.dll unable to determine bytes removed.

Total Files Cleaned = 68,00 mb


OTL by OldTimer - Version 3.2.14.1 log created on 09282010_172003

markusg 28.09.2010 16:41
upload hat nicht geklappt, sorry verlesen, also noch uploaden bitte

andi_f 28.09.2010 17:09
was muss ich nochmal uploaden??

wo finde ich den comobfix log. musst nach dem erstellen des log neu starten weil nix mehr ging

andi_f 28.09.2010 17:10
Combofix Logfile:
Code:
ComboFix 10-09-27.05 - User 28.09.2010  17:45:59.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.49.1031.18.511.212 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\User\Desktop\ComboFix.exe
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804E5358-FFA4-00DA-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804E5358-FFA4-00EB-0D24-347CA8A3377C}
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\All Users\Dokumente\Server\admin.txt
c:\dokumente und einstellungen\All Users\Dokumente\Server\server.dat
c:\dokumente und einstellungen\User\Anwendungsdaten\Install.dat
c:\dokumente und einstellungen\User\Anwendungsdaten\MessengerSkinner
c:\dokumente und einstellungen\User\Anwendungsdaten\MessengerSkinner\Userdata\languages_v2.xml
c:\dokumente und einstellungen\User\Favoriten\Error Cleaner.url
c:\dokumente und einstellungen\User\Favoriten\Online Security Test.url
c:\dokumente und einstellungen\User\Favoriten\Privacy Protector.url
c:\dokumente und einstellungen\User\Favoriten\Spyware&Malware Protection.url
c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\fvung.exe
c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps.dat
c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps_nav.dat
c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\jnyfalps_navps.dat
C:\mshta.exe
c:\programme\INSTALL.LOG
c:\programme\messengerskinner
c:\programme\messengerskinner\download\defaultPack.cab
c:\programme\messengerskinner\MessengerSkinnerDll.dll
c:\programme\messengerskinner\resources\appconfig.xml
c:\programme\messengerskinner\resources\btn.rgn
c:\programme\messengerskinner\resources\btnBnr.rgn
c:\programme\messengerskinner\resources\btnIn.rgn
c:\programme\messengerskinner\resources\btnInNormal.bmp
c:\programme\messengerskinner\resources\btnInOver.bmp
c:\programme\messengerskinner\resources\btnNormal.bmp
c:\programme\messengerskinner\resources\btnNormal.gif
c:\programme\messengerskinner\resources\btnNormalBnr.bmp
c:\programme\messengerskinner\resources\btnNormalBnr.gif
c:\programme\messengerskinner\resources\btnOver.bmp
c:\programme\messengerskinner\resources\btnOver.gif
c:\programme\messengerskinner\resources\btnOverBnr.bmp
c:\programme\messengerskinner\resources\btnOverBnr.gif
c:\programme\messengerskinner\resources\languages_v2.xml
c:\programme\messengerskinner\Terms and conditions.url
c:\programme\messengerskinner\Website.url
c:\windows\rs.txt
c:\windows\system32\nvs2.inf
c:\windows\wc98pp.dll
c:\windows\wuasirvy.dll

.
(((((((((((((((((((((((  Dateien erstellt von 2010-08-28 bis 2010-09-28  ))))))))))))))))))))))))))))))
.

2010-09-28 15:20 . 2010-09-28 15:20        --------        d-----w-        C:\_OTL
2010-09-26 10:12 . 2010-09-27 22:15        --------        d-----w-        c:\dokumente und einstellungen\User\Tracing
2010-09-26 10:10 . 2010-09-26 10:10        --------        d-----w-        c:\programme\Microsoft
2010-09-26 10:09 . 2010-09-26 10:09        --------        d-----w-        c:\programme\Windows Live SkyDrive
2010-09-26 10:09 . 2010-09-26 10:09        --------        d-----w-        c:\programme\Windows Live
2010-09-26 10:06 . 2010-09-26 10:06        --------        d-----w-        c:\programme\Gemeinsame Dateien\Windows Live
2010-09-01 07:56 . 2010-09-28 10:30        --------        d-----w-        c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\SecondLife
2010-09-01 07:42 . 2010-09-01 08:02        --------        d-----w-        c:\programme\SecondLifeViewer2

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 00:05 . 2010-08-11 22:55        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\vlc
2010-09-27 22:14 . 2010-08-09 20:14        --------        d-----w-        c:\programme\Full Tilt Poker
2010-09-26 10:11 . 2004-09-08 15:43        99384        ----a-w-        c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-09-25 22:00 . 2008-08-31 17:10        --------        d-----w-        c:\programme\PokerStars
2010-09-08 18:54 . 2010-08-17 21:01        --------        d-----w-        c:\programme\PartyGaming
2010-09-07 15:12 . 2010-08-06 12:52        38848        ----a-w-        c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-08-06 12:52        167592        ----a-w-        c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-08-06 12:52        46672        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-08-06 12:52        165584        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-08-06 12:52        23376        ----a-w-        c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-08-06 12:52        100176        ----a-w-        c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-08-06 12:52        94544        ----a-w-        c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-08-06 12:52        17744        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-08-06 12:52        28880        ----a-w-        c:\windows\system32\drivers\aavmker4.sys
2010-09-06 06:50 . 2004-10-12 11:16        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2010-09-06 06:30 . 2005-04-25 13:53        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\Piugxa
2010-09-06 05:53 . 2006-11-22 17:02        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\UseNeXT
2010-09-01 07:57 . 2007-03-07 13:36        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\SecondLife
2010-08-30 05:40 . 2010-08-06 12:35        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS
2010-08-26 14:17 . 2010-08-26 14:17        --------        d-----w-        c:\programme\QuickPar
2010-08-26 12:48 . 2006-02-14 12:58        --------        d-----w-        c:\programme\UseNeXT
2010-08-20 17:17 . 2010-08-20 17:17        --------        d-----w-        c:\programme\PostgreSQL
2010-08-20 17:16 . 2010-08-20 17:16        371        ----a-w-        c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\postgresinstall.bat
2010-08-20 17:11 . 2010-08-12 20:07        --------        d-----w-        c:\programme\PokerStrategy.com
2010-08-20 17:05 . 2003-06-27 13:22        528124        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-20 17:05 . 2003-06-27 13:22        105578        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-20 16:48 . 2010-08-20 16:48        --------        d-----w-        c:\programme\Microsoft.NET
2010-08-17 22:24 . 2006-07-25 13:08        --------        d-----w-        c:\programme\PokerStars.NET
2010-08-17 22:24 . 2006-06-14 16:43        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\Azureus
2010-08-17 22:24 . 2006-02-22 21:06        --------        d-----w-        c:\programme\AlfaCleaner
2010-08-17 22:24 . 2006-01-10 09:42        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\Camfrog
2010-08-17 22:20 . 2010-08-17 22:20        --------        d-----w-        c:\programme\Ashampoo
2010-08-17 21:02 . 2010-08-17 21:02        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla-Cache
2010-08-13 12:14 . 2004-09-07 10:56        --------        d-----w-        c:\dokumente und einstellungen\User\Anwendungsdaten\AdobeUM
2010-08-13 09:24 . 2004-10-12 11:16        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-08-12 20:08 . 2003-06-29 12:51        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-08-11 22:53 . 2005-07-29 09:03        --------        d-----w-        c:\programme\VideoLAN
2010-08-06 12:59 . 2005-05-11 20:05        --------        d-----w-        c:\programme\Yahoo!
2010-08-06 12:51 . 2010-08-06 12:51        --------        d-----w-        c:\programme\Alwil Software
2010-08-06 12:51 . 2010-08-06 12:51        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Alwil Software
2010-07-24 22:44 . 2005-07-29 08:20        44772        ----a-w-        c:\dokumente und einstellungen\User\Anwendungsdaten\wklnhst.dat
.

------- Sigcheck -------

[-] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\winlogon.exe
[7] 2004-08-04 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2004-08-04 07:58 . !HASH: COULD NOT OPEN FILE !!!!! . 507392 . . [------] . . c:\windows\system32\winlogon.exe
[7] 2004-06-17 . E40A881E0EF53994B22D9DB55E94DBED . 488448 . . [5.1.2600.1557] . . c:\windows\SoftwareDistribution\Download\256adcee6446c05a52e0f442d0ccb199\sp1qfe\winlogon.exe
[7] 2004-06-17 . E40A881E0EF53994B22D9DB55E94DBED . 488448 . . [5.1.2600.1557] . . c:\windows\SoftwareDistribution\Download\33ff811e0317795b71f6b10d11879c13\sp1qfe\winlogon.exe
[-] 2002-08-29 . 616896B708286DA98D6A099293F181D7 . 521728 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\explorer.exe
[-] 2007-06-13 13:21 . !HASH: COULD NOT OPEN FILE !!!!! . 1036288 . . [------] . . c:\windows\explorer.exe
[7] 2007-06-13 . 331ED93570BAF3CFE30340298762CD56 . 1036288 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-04 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2004-08-04 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2003-05-29 . 0589140C62D1A5D1ADC13C79266122DA . 999424 . . [6.00.2800.1221] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2002-08-29 . 22B0A56E6C5847292437078B484EC61B . 1007104 . . [6.00.2800.1106] . . c:\windows\$NtUninstallKB820291$\explorer.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-06-07 3809280]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-12-12 196608]
"Cmaudio"="cmicnfg.cpl" [2003-09-18 2244608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=c:\windows\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^PalTalk.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 07:57        15360        ----a-w-        c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dit]
2002-08-28 11:43        73728        ----a-w-        c:\windows\Dit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2004-01-16 10:16        229376        ----a-w-        c:\programme\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 09:50        155648        ----a-w-        c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-06-07 11:11        831488        ----a-w-        c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-08-25 10:58        98304        ----a-w-        c:\programme\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07        2260480        ------w-        c:\programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-09-25 00:11        132496        ----a-w-        c:\programme\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2007-05-14 22:22        35328        ----a-w-        c:\programme\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"GEARSecurity"=2 (0x2)
"gusvc"=2 (0x2)
"yviye7czeon"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"usnjsvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programme\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\PokerStrategy.com\\PokerStrategy.com Equilator\\Equilator.exe"=
"c:\\Programme\\SecondLifeViewer2\\SLVoice.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [06.08.2010 14:52 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [06.08.2010 14:52 17744]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\programme\PostgreSQL\8.3\bin\pg_ctl.exe runservice -w -N "pgsql-8.3" -D "c:\programme\PostgreSQL\8.3\data\" --> c:\programme\PostgreSQL\8.3\bin\pg_ctl.exe runservice -w -N pgsql-8.3 [?]
S1 alfacleaner;alfacleaner;\??\c:\windows\System32\drivers\hesvc.sys --> c:\windows\System32\drivers\hesvc.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
S3 DfSdkS;Defragmentation-Service;c:\programme\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [18.08.2010 00:20 406016]
S3 iMSPCLOj;iMSPCLOj;\??\c:\dokume~1\User\LOKALE~1\Temp\iMSPCLOj.sys --> c:\dokume~1\User\LOKALE~1\Temp\iMSPCLOj.sys [?]
S3 wlags48d;Agere Wireless PCCard Service;c:\windows\system32\drivers\wlags48d.sys [07.12.2003 19:51 153088]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
S4 yviye7czeon;Print Spooler Service;c:\windows\system32\aaslblzkjmk.exe /service --> c:\windows\system32\aaslblzkjmk.exe  [?]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
uDefault_Search_URL = hxxp://srch-de8.hpwis.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://de.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/us/*hxxp://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
Handler: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} -
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} - hxxps://www.cuworld.com/PIC/inner_pic/packages/CUworld.cab
FF - ProfilePath - c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\default.tgt\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\programme\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npunagi2.dll

---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-jnyfalps - c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\jnyfalps.exe
MSConfigStartUp-Aim6 - c:\programme\AIM6\aim6.exe
MSConfigStartUp-AlfaCleaner - c:\programme\AlfaCleaner\AlfaCleaner.exe
MSConfigStartUp-Camfrog - c:\programme\Camfrog\Camfrog Video Chat\CamfrogNet.exe
MSConfigStartUp-CUCore Agent - c:\progra~1\GEMEIN~1\FIRSTV~1\ConfAgent.exe
MSConfigStartUp-eijvahafr - c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\eijvahafr.exe
MSConfigStartUp-jnyfalps - c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\jnyfalps.exe
MSConfigStartUp-KBD - c:\hp\KBD\KBD.EXE
MSConfigStartUp-links - links.exe
MSConfigStartUp-messengerskinner - c:\programme\MessengerSkinner\MessengerSkinner.exe
MSConfigStartUp-vmlib - vmlib.exe
MSConfigStartUp-webHancer Agent - c:\program files\webHancer\Programs\whAgent.exe
MSConfigStartUp-webHancer Survey Companion - c:\program files\webHancer\Programs\whSurvey.exe
MSConfigStartUp-Zone Labs Client - c:\programme\Zone Labs\ZoneAlarm\zlclient.exe
AddRemove-jnyfalps - c:\dokumente und einstellungen\user\lokale einstellungen\anwendungsdaten\jnyfalps.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-28 17:53
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ØP*]
"DisplayName"="?\13?\13"
"DeviceDesc"="?\13?\13"
"ProviderName"=""
"MFG"="???\\"
"ReinstallString"="c:\\WINDOWS\\System32\\ReinstallBackups\\?\13\\DriverFiles\\.INF"
"DeviceInstanceIds"=multi:"0_9600_9700\\driver\\2kxp_inf\\cx_08530.inf\00"
.
Zeit der Fertigstellung: 2010-09-28  17:59:14
ComboFix-quarantined-files.txt  2010-09-28 15:59

Vor Suchlauf: 16 Verzeichnis(se), 11.453.411.328 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 11.421.650.944 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 63EE023E57710949FB9299F89DF746C5
--- --- ---

markusg 28.09.2010 17:17
ok nun _OTL wie beschrieben hochladen
dann:
VirusTotal - Free Online Virus, Malware and URL Scanner
prüfe dort
C:\WINDOWS\explorer.exe
und
C:\WINDOWS\system32\winlogon.exe
falls datei(n) bereits analysiert, klicke erneut prüfen, poste die ergebniss links.

markusg 28.09.2010 17:39
du sollst den ordner _OTlL mit rechts anklicken und zu _OTL.zip oder _OTL.rar hinzufügen, nicht nur das log hochladen

andi_f 28.09.2010 17:42
wie kann ich bei dem link prüfen lassen kann die datein nur senden???

markusg 28.09.2010 17:48
hi, du lädst die datei hoch, wenn status beended steht, dann kopierst du den link aus der adress leiste in deine nächste antwort

andi_f 28.09.2010 20:32
ich kann die nur hochladen und dann steht da nur senden!!!!!! da kommt nix muss ich mich da wo einloggen??? kenn mich da null aus!!

andi_f 28.09.2010 20:39
da kommt nur could not open file wenn ich das versuche


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:03 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131