Trojaner-Board - BKA-Trojaner: MBAM-Log

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - BKA-Trojaner: MBAM-Log (https://www.trojaner-board.de/98856-bka-trojaner-mbam-log.html)

BKA-Trojaner: MBAM-Log

Hallo zusammen!

So wie es aussieht, habe ich mir auch diesen dubiosen BKA-Trojaner eingefangen.

Also mein PC funktioniert soweit, es wird nur kein Desktop angezeigt. Daher starte ich zur Zeit meine Programme über den Taskmanager, was natürlich umständlich und nervig ist.

Ok wie schon im Titel steht hab ich den vollständigen Scan mit Malwarebytes gemacht.

Hier die Log-File:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6536
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512
 

09.05.2011 14:38:58

mbam-log-2011-05-09 (14-38-58).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)

Durchsuchte Objekte: 336176

Laufzeit: 1 Stunde(n), 56 Minute(n), 46 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 1

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 1

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 9
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

c:\WINDOWS\Oetsdsra.dll (Trojan.Hiloti) -> Delete on reboot.
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nrulagurinazobe (Trojan.Hiloti) -> Value: Nrulagurinazobe -> Delete on reboot.
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\WINDOWS\Oetsdsra.dll (Trojan.Hiloti) -> Delete on reboot.

c:\dokumente und einstellungen\administrator\anwendungsdaten\Adobe\plugs\mmc0.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\administrator\anwendungsdaten\Sun\Java\deployment\cache\6.0\63\4f37fd3f-44609f8c (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\system volume information\_restore{05ac8649-7f1b-4656-abda-ace5ba0abc5a}\RP167\A0068495.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\system volume information\_restore{05ac8649-7f1b-4656-abda-ace5ba0abc5a}\RP167\A0069495.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\system volume information\_restore{05ac8649-7f1b-4656-abda-ace5ba0abc5a}\RP167\A0070494.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\system volume information\_restore{05ac8649-7f1b-4656-abda-ace5ba0abc5a}\RP167\A0071495.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\system volume information\_restore{05ac8649-7f1b-4656-abda-ace5ba0abc5a}\RP167\A0072495.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\system volume information\_restore{05ac8649-7f1b-4656-abda-ace5ba0abc5a}\RP167\A0072504.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

Falls das relevant ist; ich hab davor noch einen Quick-Scan gemacht

Hier die Log-File des Quick-Scans:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6536
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512
 

09.05.2011 12:36:56

mbam-log-2011-05-09 (12-36-56).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 144578

Laufzeit: 8 Minute(n), 27 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 1

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 2

Infizierte Dateiobjekte der Registrierung: 1

Infizierte Verzeichnisse: 0

Infizierte Dateien: 2
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

c:\WINDOWS\Oetsdsra.dll (Trojan.Hiloti) -> Delete on reboot.
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nrulagurinazobe (Trojan.Hiloti) -> Value: Nrulagurinazobe -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\WINDOWS\Oetsdsra.dll (Trojan.Hiloti) -> Delete on reboot.

c:\dokumente und einstellungen\administrator\lokale einstellungen\Temp\0.6042184542126849.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

Wäre super, wenn mir Jemand helfen könnte.

Ich habe zwar den Thread "Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?" gelesen, falls dennoch Informationen fehlen sollte, oder ich was vergessen haben sollte, sagt mir einfach Bescheid :)

Vielen Dank schonmal im Vorraus!

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 09.05.2011 17:42:30 - Run 2

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

894,00 Mb Total Physical Memory | 565,00 Mb Available Physical Memory | 63,00% Memory free

2,00 Gb Paging File | 2,00 Gb Available in Paging File | 88,00% Paging File free

Paging file location(s): c:\pagefile.sys 1344 2688 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 67,37 Gb Total Space | 30,10 Gb Free Space | 44,68% Space Free | Partition Type: NTFS

Drive D: | 32,70 Gb Total Space | 18,73 Gb Free Space | 57,27% Space Free | Partition Type: NTFS

Drive E: | 642,92 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: LAGOS-5AB406078 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.09 16:34:08 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\OTL.exe

PRC - [2011.04.29 03:09:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.03.17 02:23:19 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.02.18 14:10:02 | 000,653,120 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

PRC - [2011.02.18 14:08:18 | 001,517,376 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.09 16:34:08 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\OTL.exe

MOD - [2010.08.23 18:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] --  -- (HidServ)

SRV - [2011.04.29 03:09:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.17 02:23:19 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.03.07 21:18:05 | 000,069,120 | ---- | M] (BOONTY) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe -- (Boonty Games)

SRV - [2011.02.18 14:08:18 | 001,517,376 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)

SRV - [2011.02.18 14:05:52 | 000,029,504 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)

SRV - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () [Disabled | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)

SRV - [2006.11.17 21:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Stopped] -- C:\Programme\Launch Manager\WisLMSvc.exe -- (WisLMSvc)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.03.17 02:23:20 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2010.12.13 09:39:38 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.11.29 20:27:40 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)

DRV - [2010.11.04 21:43:58 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.06.17 15:26:52 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.04.13 20:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)

DRV - [2007.12.05 07:26:40 | 002,782,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2007.11.05 09:55:04 | 000,017,952 | ---- | M] () [Kernel | System | Running] -- C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys -- (atitray)

DRV - [2006.12.21 17:26:00 | 004,405,248 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2006.09.24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2004.10.29 14:52:48 | 000,413,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)

DRV - [2004.08.03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)

DRV - [2003.04.28 12:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey)

DRV - [2001.09.04 21:35:30 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)

DRV - [2001.09.04 21:35:30 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)

DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

 

 

FF - HKLM\software\mozilla\Firefox\extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\html5video

FF - HKLM\software\mozilla\Firefox\extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Programme\DivX\DivX Plus Web Player\firefox\wpa

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.05.02 03:23:10 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.05.02 03:23:10 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.04.16 11:35:45 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins

 

[2011.04.16 11:35:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions

[2011.04.16 11:35:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2011.05.09 11:42:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\extensions

[2011.01.05 20:24:17 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.04.09 20:56:59 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.01.16 17:30:31 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.03.08 15:12:03 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2011.05.08 07:10:22 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\searchplugins\icqplugin.xml

[2011.05.09 11:42:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.01.16 21:11:50 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2011.03.24 16:11:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.03.24 16:11:05 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011.03.24 16:10:59 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.11.25 14:49:56 | 000,167,704 | ---- | M] (Tracker Software Products Ltd.) -- C:\Programme\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll

[2010.12.03 20:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.12.03 20:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.12.03 20:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.12.03 20:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.12.03 20:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.04.11 20:07:53 | 000,430,702 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 127.0.0.1        1-2005-search.com

O1 - Hosts: 14825 more lines...

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [HotkeyApp] C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)

O4 - HKLM..\Run: [LaunchAp] C:\Programme\Launch Manager\LaunchAp.exe ()

O4 - HKLM..\Run: [Lexmark 1200 Series] C:\Programme\Lexmark 1200 Series\lxczbmgr.exe (Lexmark International, Inc.)

O4 - HKLM..\Run: [LMgrOSD] C:\Programme\Launch Manager\OSDCtrl.exe ()

O4 - HKLM..\Run: [LMgrVolOSD] C:\Programme\Launch Manager\OSD.exe (Wistron Corp.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [SpybotSnD] C:\Programme\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)

O4 - HKLM..\Run: [Wbutton] C:\Programme\Launch Manager\Wbutton.exe ()

O4 - HKCU..\Run: [Nrulagurinazobe]  File not found

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 3538976

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -  File not found

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1288867643546 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1288869140406 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe\plugs\mmc0.exe) -  File not found

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O27 - HKLM IFEO\javaw.exe: Debugger - "C:\Programme\TuneUp Utilities 2011\TUAutoReactivator32.exe" (TuneUp Software)

O27 - HKLM IFEO\javaws.exe: Debugger - "C:\Programme\TuneUp Utilities 2011\TUAutoReactivator32.exe" (TuneUp Software)

O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.11.04 07:57:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2001.02.12 16:04:06 | 000,000,046 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O32 - AutoRun File - [2001.05.25 12:51:08 | 000,001,476 | R--- | M] () - E:\AUTORUN.INI -- [ CDFS ]

O33 - MountPoints2\E\Shell - "" = AutoRun

O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\BALDUR.EXE -- [2001.05.28 16:25:28 | 004,055,040 | R--- | M] (Bioware Corp.)

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: HidServ -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= -  File not found

MsConfig - StartUpReg: eDonkey2000 - hkey= - key= -  File not found

MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EB494956-AB43-2A1F-CA64-2BC87432D5CA} - Microsoft Windows Media Player 6.4

ActiveX: {EFA01345-51FD-7F93-F6DA-873052FCCD01} - Internet Explorer

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: VIDC.MKVC - C:\WINDOWS\System32\KMVIDC32.DLL ()

Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.09 17:26:14 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\Recent

[2011.05.09 12:21:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes

[2011.05.09 12:21:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2011.05.09 12:21:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2011.05.09 12:21:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2011.05.09 12:21:40 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011.05.09 12:21:40 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.05.04 22:17:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\VideoLAN

[2011.05.04 17:08:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Lexmark 1200 Series

[2011.05.04 17:08:07 | 000,000,000 | ---D | C] -- C:\Programme\Lexmark 1200 Series

[2011.05.04 17:07:39 | 000,299,520 | ---- | C] (InstallShield Corporation, Inc.) -- C:\WINDOWS\uninst.exe

[2011.05.04 17:07:09 | 000,000,000 | ---D | C] -- C:\Lexmark

[2011.04.28 03:02:26 | 000,000,000 | ---D | C] -- C:\7ae75bd9629932ef204995

[2011.04.26 17:37:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\LibreOffice 3.3

[2011.04.26 17:32:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\ShellNew

[2011.04.26 15:35:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Silverlight

[2011.04.26 15:34:53 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Silverlight

[2011.04.20 12:42:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Shareaza

[2011.04.20 12:42:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Shareaza

[2011.04.18 23:04:56 | 000,000,000 | ---D | C] -- C:\Programme\Black Isle

[2011.04.16 11:35:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Thunderbird

[2011.04.16 11:35:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Thunderbird

[2011.04.16 11:01:31 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Thunderbird

[2011.04.11 18:10:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\FM 08

[2011.04.09 20:58:10 | 000,000,000 | ---D | C] -- C:\Programme\ICQ6Toolbar

[2011.04.09 20:57:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ICQ7.4

[2011.04.09 20:56:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ

[2011.04.09 20:54:19 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.4

[2011.01.25 03:43:00 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll

[2011.01.25 03:43:00 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll

[2011.01.25 03:43:00 | 000,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll

[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.09 17:46:47 | 000,448,714 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2011.05.09 17:46:47 | 000,432,554 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011.05.09 17:46:47 | 000,080,108 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2011.05.09 17:46:47 | 000,067,510 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011.05.09 17:40:59 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job

[2011.05.09 17:40:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.05.09 12:21:45 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.08 21:26:59 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\2gweorjqjutp92vjy9gake

[2011.05.08 00:37:19 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.05.04 22:17:01 | 000,000,691 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk

[2011.05.04 22:15:28 | 020,533,281 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\vlc-1.1.9-win32.exe

[2011.05.04 17:35:47 | 000,000,735 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Lexmark 1200 Series-Multifunktionscenter.lnk

[2011.05.04 17:30:16 | 000,000,076 | ---- | M] () -- C:\WINDOWS\dellstat.ini

[2011.05.04 17:21:12 | 000,000,100 | ---- | M] () -- C:\WINDOWS\lexstat.ini

[2011.04.28 12:15:25 | 000,005,632 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.04.16 11:37:40 | 000,011,494 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\chill.xspf

[2011.04.16 11:08:25 | 000,016,971 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Mix.xspf

[2011.04.16 11:01:36 | 000,001,632 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Thunderbird.lnk

[2011.04.16 03:55:09 | 000,130,888 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011.04.11 20:07:53 | 000,430,702 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011.04.09 20:57:55 | 000,001,451 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ICQ7.4.lnk

[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.05.09 12:21:45 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.08 21:26:59 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\2gweorjqjutp92vjy9gake

[2011.05.04 22:17:01 | 000,000,691 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk

[2011.05.04 22:15:15 | 020,533,281 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\vlc-1.1.9-win32.exe

[2011.05.04 17:35:47 | 000,000,735 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Lexmark 1200 Series-Multifunktionscenter.lnk

[2011.05.04 17:30:16 | 000,000,076 | ---- | C] () -- C:\WINDOWS\dellstat.ini

[2011.05.04 17:21:12 | 000,000,100 | ---- | C] () -- C:\WINDOWS\lexstat.ini

[2011.05.04 17:08:34 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\LEXPING.EXE

[2011.05.04 17:08:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxczvs.dll

[2011.05.04 17:08:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE

[2011.05.04 17:08:34 | 000,000,448 | ---- | C] () -- C:\WINDOWS\System32\LXCZ.LOC

[2011.05.04 17:08:07 | 000,000,270 | ---- | C] () -- C:\WINDOWS\System32\lxczcoin.ini

[2011.04.26 17:29:37 | 004,466,047 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Dialog.tlk

[2011.04.26 17:07:32 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\View Baldur's Gate

[2011.04.26 17:07:31 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Register Baldur's Gate

[2011.04.16 11:37:40 | 000,011,494 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\chill.xspf

[2011.04.16 11:08:25 | 000,016,971 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Mix.xspf

[2011.04.16 11:01:36 | 000,001,632 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Thunderbird.lnk

[2011.04.09 20:57:55 | 000,001,451 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ICQ7.4.lnk

[2011.02.04 22:05:48 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL

[2011.01.25 03:43:05 | 000,286,720 | ---- | C] () -- C:\WINDOWS\vsnpstd3.exe

[2011.01.25 03:43:05 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini

[2011.01.25 03:43:04 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd3.dll

[2011.01.25 03:43:03 | 000,413,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys

[2011.01.25 03:42:57 | 000,020,480 | ---- | C] () -- C:\WINDOWS\usnpstd3.exe

[2011.01.16 21:12:41 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2011.01.14 19:59:43 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2011.01.09 16:34:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PowerReg.dat

[2011.01.06 18:20:40 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll

[2011.01.06 14:25:57 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe

[2011.01.06 14:24:33 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\atiiprxx.exe

[2011.01.06 14:24:29 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat

[2011.01.06 14:24:29 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2011.01.06 14:24:29 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2011.01.06 14:24:29 | 000,158,080 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2011.01.06 14:24:28 | 000,000,011 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.ini

[2011.01.06 14:24:21 | 000,472,576 | ---- | C] () -- C:\WINDOWS\Radeon Omega Drivers v4.8.442 Uninstall.exe

[2011.01.06 12:35:53 | 000,114,509 | ---- | C] () -- C:\WINDOWS\unstall.exe

[2011.01.04 14:14:16 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll

[2011.01.04 14:14:15 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll

[2011.01.04 14:14:15 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll

[2010.11.11 10:08:53 | 000,004,255 | ---- | C] () -- C:\WINDOWS\System32\drivers\adv01nt5.dll

[2010.11.11 10:08:53 | 000,003,967 | ---- | C] () -- C:\WINDOWS\System32\drivers\adv02nt5.dll

[2010.11.11 10:08:53 | 000,003,711 | ---- | C] () -- C:\WINDOWS\System32\drivers\adv09nt5.dll

[2010.11.11 10:08:53 | 000,003,647 | ---- | C] () -- C:\WINDOWS\System32\drivers\adv07nt5.dll

[2010.11.11 10:08:53 | 000,003,615 | ---- | C] () -- C:\WINDOWS\System32\drivers\adv05nt5.dll

[2010.11.11 10:08:53 | 000,003,135 | ---- | C] () -- C:\WINDOWS\System32\drivers\adv08nt5.dll

[2010.11.04 21:50:13 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010.11.04 16:01:11 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe

[2010.11.04 15:52:39 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010.11.04 14:22:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010.11.04 11:24:14 | 000,009,867 | ---- | C] () -- C:\WINDOWS\System32\drivers\HOTKEY.sys

[2010.11.04 08:21:20 | 000,005,632 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.11.04 08:04:14 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010.11.04 07:53:46 | 000,022,880 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2010.11.04 07:48:26 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010.11.04 07:47:07 | 000,130,888 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2004.08.04 01:12:38 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004.03.17 11:29:42 | 000,122,368 | ---- | C] () -- C:\WINDOWS\System32\UnzDll.dll

[2004.03.17 11:29:40 | 000,139,776 | ---- | C] () -- C:\WINDOWS\System32\ZipDll.dll

[2004.03.17 11:29:38 | 000,618,496 | ---- | C] () -- C:\WINDOWS\System32\stlpmt45.dll

[2001.09.04 21:35:36 | 000,448,714 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2001.09.04 21:35:36 | 000,432,554 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.09.04 21:35:36 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.09.04 21:35:36 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2001.09.04 21:35:36 | 000,080,108 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2001.09.04 21:35:36 | 000,067,510 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.09.04 21:35:36 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2001.09.04 21:35:36 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.09.04 21:35:34 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.09.04 21:35:34 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.09.04 21:35:26 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2001.09.04 21:35:10 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.09.04 21:35:08 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.09.04 21:34:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 
 ========== LOP Check ==========

 

[2010.11.04 21:47:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DAEMON Tools Lite

[2011.01.16 17:30:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers

[2011.04.07 15:39:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\gtk-2.0

[2011.05.08 21:03:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICQ

[2011.01.09 16:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Leadertech

[2011.03.22 19:44:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\LibreOffice

[2011.01.05 13:15:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Local

[2010.11.04 22:57:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\MSNInstaller

[2011.03.24 16:20:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\OpenOffice.org

[2010.11.04 14:14:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Opera

[2011.05.09 17:21:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Shareaza

[2010.11.11 09:43:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\SumatraPDF

[2011.04.15 12:48:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\temp

[2011.04.16 11:35:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Thunderbird

[2011.03.08 15:01:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software

[2010.11.04 23:40:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue

[2011.04.26 16:04:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\uTorrent

[2011.03.07 21:21:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOONTY

[2010.11.04 21:43:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

[2011.01.04 17:10:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fujitsu

[2011.04.09 20:57:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ

[2011.01.04 12:57:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters

[2011.01.25 23:44:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan

[2011.03.08 15:06:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software

[2011.03.08 14:43:48 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}

[2011.05.09 17:40:59 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.05.08 21:26:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe

[2011.01.06 16:18:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\atitray

[2010.11.04 14:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Avira

[2010.11.04 21:47:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DAEMON Tools Lite

[2011.03.20 07:18:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DivX

[2011.01.16 17:30:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers

[2011.04.07 15:39:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\gtk-2.0

[2011.01.20 15:43:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Help

[2011.05.08 21:03:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICQ

[2010.11.04 08:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Identities

[2010.11.04 11:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\InstallShield

[2011.01.09 16:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Leadertech

[2011.03.22 19:44:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\LibreOffice

[2011.01.05 13:15:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Local

[2010.11.04 15:49:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia

[2011.05.09 12:21:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes

[2011.02.01 13:55:29 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft

[2010.11.04 14:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla

[2010.11.04 22:57:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\MSNInstaller

[2011.03.24 16:20:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\OpenOffice.org

[2010.11.04 14:14:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Opera

[2011.01.04 14:16:03 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\SecuROM

[2011.05.09 17:21:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Shareaza

[2011.04.11 17:09:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Skype

[2011.03.26 01:01:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\skypePM

[2010.11.11 09:43:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\SumatraPDF

[2010.11.04 14:37:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun

[2011.04.15 12:48:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\temp

[2011.04.16 11:35:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Thunderbird

[2011.03.08 15:01:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software

[2010.11.04 23:40:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue

[2011.04.26 16:04:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\uTorrent

[2011.04.03 14:00:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\vlc

 
 < %APPDATA%\*.exe /s >

[2011.03.22 19:51:38 | 002,608,640 | ---- | M] (SMEStorage) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\LibreOffice\3\user\uno_packages\cache\uno_packages\416.tmp_\SMEStorage.OpenOffice.oxt\SMEStorage\SMEStorage.Dialog.exe

[2011.03.22 19:51:50 | 000,028,672 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\LibreOffice\3\user\uno_packages\cache\uno_packages\421.tmp_\StarXpert_MultiDiff.oxt\StarXpert_MultiDiff\sendmail98.exe

[2010.11.04 22:57:37 | 000,827,368 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\MSNInstaller\msnauins.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2011.01.29 16:13:32 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2004.08.04 02:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys

[2011.01.29 16:13:32 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2011.01.29 16:13:32 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2004.08.04 02:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys

[2011.01.29 16:13:32 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2001.09.04 21:36:20 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2001.09.04 21:36:20 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2010.11.04 21:43:58 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

 
 < %systemroot%\System32\config\*.sav >

[2010.11.04 14:31:07 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2010.11.04 13:22:22 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav

[2010.11.04 14:31:07 | 009,437,184 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2010.11.04 14:31:07 | 002,621,440 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 844 bytes -> C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\View Baldur's Gate: Tales of The Sword Coast Readme.lnk

@Alternate Data Stream - 741 bytes -> C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Register Baldur's Gate: Tales of the Sword Coast.lnk
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKCU..\Run: [Nrulagurinazobe]  File not found

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.11.04 07:57:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2001.02.12 16:04:06 | 000,000,046 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O32 - AutoRun File - [2001.05.25 12:51:08 | 000,001,476 | R--- | M] () - E:\AUTORUN.INI -- [ CDFS ]

O33 - MountPoints2\E\Shell - "" = AutoRun

O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\BALDUR.EXE -- [2001.05.28 16:25:28 | 004,055,040 | R--- | M] (Bioware Corp.)

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\autorun.exe

[2011.05.08 21:26:59 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\2gweorjqjutp92vjy9gake

@Alternate Data Stream - 844 bytes -> C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\View Baldur's Gate: Tales of The Sword Coast Readme.lnk

@Alternate Data Stream - 741 bytes -> C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Register Baldur's Gate: Tales of the Sword Coast.lnk

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Ja, Rechner wurde neu gestartet.

Hier die Log-File des Fix:

Code:

All processes killed

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Nrulagurinazobe deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.

C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\AUTOEXEC.BAT moved successfully.

File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.

File move failed. E:\AUTORUN.INI scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.

File move failed. E:\BALDUR.EXE scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.

File G:\autorun.exe not found.

C:\Dokumente und Einstellungen\Administrator\2gweorjqjutp92vjy9gake moved successfully.

Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\View Baldur's Gate: Tales of The Sword Coast Readme.lnk .

Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Register Baldur's Gate: Tales of the Sword Coast.lnk .

========== COMMANDS ==========

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 741266122 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Java cache emptied: 817762 bytes

->FireFox cache emptied: 56816643 bytes

->Opera cache emptied: 0 bytes

->Flash cache emptied: 3369 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: LocalService

->Temp folder emptied: 65984 bytes

->Temporary Internet Files folder emptied: 33950 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 4268625 bytes

%systemroot%\System32 .tmp files removed: 2951 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 7500916 bytes

RecycleBin emptied: 62422142 bytes

 

Total Files Cleaned = 833,00 mb

 

 

OTL by OldTimer - Version 3.2.22.3 log created on 05092011_200657
 

Files\Folders moved on Reboot...

File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.

File move failed. E:\AUTORUN.INI scheduled to be moved on reboot.

File move failed. E:\BALDUR.EXE scheduled to be moved on reboot.
 

Registry entries deleted on Reboot...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Code:

2011/05/09 20:29:12.0062 2500        TDSS rootkit removing tool 2.5.0.0 May  1 2011 14:20:16

2011/05/09 20:29:12.0296 2500        ================================================================================

2011/05/09 20:29:12.0296 2500        SystemInfo:

2011/05/09 20:29:12.0296 2500        

2011/05/09 20:29:12.0296 2500        OS Version: 5.1.2600 ServicePack: 3.0

2011/05/09 20:29:12.0296 2500        Product type: Workstation

2011/05/09 20:29:12.0296 2500        ComputerName: LAGOS-5AB406078

2011/05/09 20:29:12.0296 2500        UserName: Administrator

2011/05/09 20:29:12.0296 2500        Windows directory: C:\WINDOWS

2011/05/09 20:29:12.0296 2500        System windows directory: C:\WINDOWS

2011/05/09 20:29:12.0296 2500        Processor architecture: Intel x86

2011/05/09 20:29:12.0296 2500        Number of processors: 1

2011/05/09 20:29:12.0296 2500        Page size: 0x1000

2011/05/09 20:29:12.0296 2500        Boot type: Normal boot

2011/05/09 20:29:12.0296 2500        ================================================================================

2011/05/09 20:29:12.0625 2500        Initialize success

2011/05/09 20:29:31.0421 2852        ================================================================================

2011/05/09 20:29:31.0421 2852        Scan started

2011/05/09 20:29:31.0421 2852        Mode: Manual; 

2011/05/09 20:29:31.0421 2852        ================================================================================

2011/05/09 20:29:31.0921 2852        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/09 20:29:31.0953 2852        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

2011/05/09 20:29:32.0031 2852        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/09 20:29:32.0109 2852        AFD             (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys

2011/05/09 20:29:32.0437 2852        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/09 20:29:32.0468 2852        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/09 20:29:32.0656 2852        ati2mtag        (ec2743bf722d4356375a0a01b69a81e0) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2011/05/09 20:29:32.0828 2852        atitray         (6e51838f65c4f5264af489773a53d678) C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys

2011/05/09 20:29:32.0875 2852        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/09 20:29:32.0937 2852        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/09 20:29:33.0031 2852        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

2011/05/09 20:29:33.0062 2852        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

2011/05/09 20:29:33.0109 2852        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys

2011/05/09 20:29:33.0187 2852        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/09 20:29:33.0250 2852        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/09 20:29:33.0312 2852        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/05/09 20:29:33.0406 2852        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/09 20:29:33.0437 2852        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/09 20:29:33.0500 2852        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/09 20:29:33.0578 2852        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/05/09 20:29:33.0625 2852        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/05/09 20:29:33.0781 2852        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/09 20:29:33.0859 2852        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/09 20:29:33.0968 2852        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\DRIVERS\dmio.sys

2011/05/09 20:29:34.0000 2852        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/09 20:29:34.0046 2852        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/09 20:29:34.0140 2852        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/09 20:29:34.0218 2852        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/09 20:29:34.0406 2852        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/05/09 20:29:34.0546 2852        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/09 20:29:34.0578 2852        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/09 20:29:34.0625 2852        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/09 20:29:34.0687 2852        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/09 20:29:34.0734 2852        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/09 20:29:34.0796 2852        giveio          (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

2011/05/09 20:29:34.0937 2852        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/09 20:29:35.0015 2852        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

2011/05/09 20:29:35.0062 2852        Hotkey          (8b566ea71d5b76157a9cdb78f25a5731) C:\WINDOWS\system32\drivers\Hotkey.sys

2011/05/09 20:29:35.0171 2852        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/09 20:29:35.0281 2852        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/09 20:29:35.0328 2852        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/09 20:29:35.0593 2852        IntcAzAudAddService (001aaca6ed0e6b00fc5b8faf74977e81) C:\WINDOWS\system32\drivers\RtkHDAud.sys

2011/05/09 20:29:35.0703 2852        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/09 20:29:35.0750 2852        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/09 20:29:35.0812 2852        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/09 20:29:35.0859 2852        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/09 20:29:35.0890 2852        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/09 20:29:35.0921 2852        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/09 20:29:35.0984 2852        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/09 20:29:36.0031 2852        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/09 20:29:36.0062 2852        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/09 20:29:36.0109 2852        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/09 20:29:36.0171 2852        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/09 20:29:36.0343 2852        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/09 20:29:36.0406 2852        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/09 20:29:36.0421 2852        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/09 20:29:36.0453 2852        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/09 20:29:36.0546 2852        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/09 20:29:36.0625 2852        MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/09 20:29:36.0703 2852        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/09 20:29:36.0750 2852        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/09 20:29:36.0796 2852        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/09 20:29:36.0843 2852        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/09 20:29:36.0906 2852        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/09 20:29:36.0953 2852        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/05/09 20:29:36.0984 2852        Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/09 20:29:37.0031 2852        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/05/09 20:29:37.0062 2852        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/09 20:29:37.0125 2852        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/05/09 20:29:37.0171 2852        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/09 20:29:37.0218 2852        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/09 20:29:37.0250 2852        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/09 20:29:37.0296 2852        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/09 20:29:37.0328 2852        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/09 20:29:37.0390 2852        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/09 20:29:37.0468 2852        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/09 20:29:37.0531 2852        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/09 20:29:37.0625 2852        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/09 20:29:37.0687 2852        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/09 20:29:37.0750 2852        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/09 20:29:37.0781 2852        NwlnkIpx        (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys

2011/05/09 20:29:37.0828 2852        NwlnkNb         (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys

2011/05/09 20:29:37.0859 2852        NwlnkSpx        (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys

2011/05/09 20:29:37.0906 2852        NWRDR           (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys

2011/05/09 20:29:37.0968 2852        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys

2011/05/09 20:29:38.0000 2852        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/09 20:29:38.0046 2852        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/09 20:29:38.0078 2852        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/09 20:29:38.0156 2852        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/05/09 20:29:38.0187 2852        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/05/09 20:29:38.0437 2852        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/09 20:29:38.0484 2852        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/09 20:29:38.0531 2852        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/09 20:29:38.0578 2852        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/05/09 20:29:38.0765 2852        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/09 20:29:38.0812 2852        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/09 20:29:38.0843 2852        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/09 20:29:38.0875 2852        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/09 20:29:38.0921 2852        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/09 20:29:38.0968 2852        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/09 20:29:39.0015 2852        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/05/09 20:29:39.0078 2852        RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/09 20:29:39.0140 2852        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/09 20:29:39.0218 2852        rtl8139         (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

2011/05/09 20:29:39.0296 2852        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/09 20:29:39.0359 2852        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys

2011/05/09 20:29:39.0421 2852        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/09 20:29:39.0515 2852        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/05/09 20:29:39.0578 2852        SNPSTD3         (43b8c052890896c6d1617ca90b2730e0) C:\WINDOWS\system32\DRIVERS\snpstd3.sys

2011/05/09 20:29:39.0687 2852        speedfan        (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys

2011/05/09 20:29:39.0781 2852        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/09 20:29:39.0875 2852        sptd            (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys

2011/05/09 20:29:39.0875 2852        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2011/05/09 20:29:39.0890 2852        sptd - detected LockedFile.Multi.Generic (1)

2011/05/09 20:29:39.0906 2852        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/09 20:29:39.0968 2852        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/09 20:29:40.0046 2852        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

2011/05/09 20:29:40.0093 2852        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/05/09 20:29:40.0140 2852        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/09 20:29:40.0171 2852        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/09 20:29:40.0328 2852        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/09 20:29:40.0406 2852        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/09 20:29:40.0484 2852        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/09 20:29:40.0531 2852        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/09 20:29:40.0593 2852        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/09 20:29:40.0781 2852        TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

2011/05/09 20:29:40.0843 2852        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/09 20:29:40.0937 2852        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/09 20:29:41.0031 2852        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/09 20:29:41.0078 2852        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/09 20:29:41.0109 2852        usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

2011/05/09 20:29:41.0156 2852        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/05/09 20:29:41.0218 2852        usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/05/09 20:29:41.0265 2852        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/09 20:29:41.0312 2852        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/09 20:29:41.0406 2852        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/09 20:29:41.0468 2852        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/09 20:29:41.0531 2852        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/09 20:29:41.0640 2852        WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

2011/05/09 20:29:41.0703 2852        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/05/09 20:29:41.0953 2852        ================================================================================

2011/05/09 20:29:41.0953 2852        Scan finished

2011/05/09 20:29:41.0953 2852        ================================================================================

2011/05/09 20:29:41.0968 2840        Detected object count: 1

2011/05/09 20:30:05.0375 2840        LockedFile.Multi.Generic(sptd) - User select action: Skip 

2011/05/09 20:30:12.0000 2900        ================================================================================

2011/05/09 20:30:12.0000 2900        Scan started

2011/05/09 20:30:12.0000 2900        Mode: Manual; 

2011/05/09 20:30:12.0000 2900        ================================================================================

2011/05/09 20:30:12.0296 2900        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/09 20:30:12.0359 2900        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

2011/05/09 20:30:12.0437 2900        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/09 20:30:12.0500 2900        AFD             (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys

2011/05/09 20:30:12.0812 2900        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/09 20:30:12.0828 2900        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/09 20:30:13.0031 2900        ati2mtag        (ec2743bf722d4356375a0a01b69a81e0) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2011/05/09 20:30:13.0203 2900        atitray         (6e51838f65c4f5264af489773a53d678) C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys

2011/05/09 20:30:13.0234 2900        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/09 20:30:13.0312 2900        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/09 20:30:13.0390 2900        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

2011/05/09 20:30:13.0421 2900        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

2011/05/09 20:30:13.0453 2900        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys

2011/05/09 20:30:13.0531 2900        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/09 20:30:13.0593 2900        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/09 20:30:13.0656 2900        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/05/09 20:30:13.0734 2900        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/09 20:30:13.0765 2900        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/09 20:30:13.0812 2900        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/09 20:30:13.0890 2900        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/05/09 20:30:13.0937 2900        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/05/09 20:30:14.0093 2900        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/09 20:30:14.0156 2900        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/09 20:30:14.0203 2900        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\DRIVERS\dmio.sys

2011/05/09 20:30:14.0250 2900        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/09 20:30:14.0312 2900        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/09 20:30:14.0375 2900        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/09 20:30:14.0453 2900        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/09 20:30:14.0500 2900        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/05/09 20:30:14.0546 2900        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/09 20:30:14.0578 2900        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/09 20:30:14.0609 2900        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/09 20:30:14.0656 2900        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/09 20:30:14.0703 2900        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/09 20:30:14.0750 2900        giveio          (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

2011/05/09 20:30:14.0812 2900        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/09 20:30:14.0859 2900        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

2011/05/09 20:30:14.0921 2900        Hotkey          (8b566ea71d5b76157a9cdb78f25a5731) C:\WINDOWS\system32\drivers\Hotkey.sys

2011/05/09 20:30:15.0015 2900        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/09 20:30:15.0093 2900        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/09 20:30:15.0140 2900        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/09 20:30:15.0406 2900        IntcAzAudAddService (001aaca6ed0e6b00fc5b8faf74977e81) C:\WINDOWS\system32\drivers\RtkHDAud.sys

2011/05/09 20:30:15.0515 2900        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/09 20:30:15.0546 2900        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/09 20:30:15.0609 2900        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/09 20:30:15.0656 2900        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/09 20:30:15.0687 2900        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/09 20:30:15.0734 2900        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/09 20:30:15.0781 2900        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/09 20:30:15.0828 2900        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/09 20:30:15.0859 2900        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/09 20:30:15.0906 2900        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/09 20:30:15.0953 2900        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/09 20:30:16.0125 2900        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/09 20:30:16.0171 2900        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/09 20:30:16.0203 2900        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/09 20:30:16.0218 2900        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/09 20:30:16.0296 2900        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/09 20:30:16.0375 2900        MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/09 20:30:16.0406 2900        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/09 20:30:16.0453 2900        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/09 20:30:16.0500 2900        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/09 20:30:16.0546 2900        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/09 20:30:16.0609 2900        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/09 20:30:16.0656 2900        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/05/09 20:30:16.0687 2900        Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/09 20:30:16.0718 2900        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/05/09 20:30:16.0765 2900        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/09 20:30:16.0828 2900        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/05/09 20:30:16.0875 2900        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/09 20:30:16.0906 2900        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/09 20:30:16.0937 2900        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/09 20:30:16.0984 2900        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/09 20:30:17.0015 2900        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/09 20:30:17.0046 2900        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/09 20:30:17.0125 2900        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/09 20:30:17.0171 2900        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/09 20:30:17.0265 2900        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/09 20:30:17.0328 2900        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/09 20:30:17.0375 2900        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/09 20:30:17.0421 2900        NwlnkIpx        (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys

2011/05/09 20:30:17.0453 2900        NwlnkNb         (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys

2011/05/09 20:30:17.0500 2900        NwlnkSpx        (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys

2011/05/09 20:30:17.0562 2900        NWRDR           (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys

2011/05/09 20:30:17.0609 2900        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys

2011/05/09 20:30:17.0640 2900        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/09 20:30:17.0671 2900        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/09 20:30:17.0703 2900        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/09 20:30:17.0765 2900        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/05/09 20:30:17.0812 2900        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/05/09 20:30:18.0031 2900        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/09 20:30:18.0062 2900        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/09 20:30:18.0109 2900        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/09 20:30:18.0156 2900        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/05/09 20:30:18.0328 2900        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/09 20:30:18.0375 2900        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/09 20:30:18.0406 2900        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/09 20:30:18.0437 2900        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/09 20:30:18.0500 2900        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/09 20:30:18.0531 2900        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/09 20:30:18.0562 2900        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/05/09 20:30:18.0625 2900        RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/09 20:30:18.0671 2900        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/09 20:30:18.0750 2900        rtl8139         (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

2011/05/09 20:30:18.0812 2900        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/09 20:30:18.0859 2900        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys

2011/05/09 20:30:18.0921 2900        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/09 20:30:19.0000 2900        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/05/09 20:30:19.0062 2900        SNPSTD3         (43b8c052890896c6d1617ca90b2730e0) C:\WINDOWS\system32\DRIVERS\snpstd3.sys

2011/05/09 20:30:19.0156 2900        speedfan        (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys

2011/05/09 20:30:19.0203 2900        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/09 20:30:19.0281 2900        sptd            (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys

2011/05/09 20:30:19.0281 2900        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2011/05/09 20:30:19.0296 2900        sptd - detected LockedFile.Multi.Generic (1)

2011/05/09 20:30:19.0312 2900        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/09 20:30:19.0375 2900        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/09 20:30:19.0437 2900        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

2011/05/09 20:30:19.0484 2900        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/05/09 20:30:19.0531 2900        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/09 20:30:19.0562 2900        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/09 20:30:19.0703 2900        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/09 20:30:19.0781 2900        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/09 20:30:19.0828 2900        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/09 20:30:19.0875 2900        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/09 20:30:19.0937 2900        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/09 20:30:20.0125 2900        TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

2011/05/09 20:30:20.0187 2900        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/09 20:30:20.0281 2900        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/09 20:30:20.0343 2900        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/09 20:30:20.0406 2900        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/09 20:30:20.0437 2900        usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

2011/05/09 20:30:20.0500 2900        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/05/09 20:30:20.0546 2900        usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/05/09 20:30:20.0609 2900        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/09 20:30:20.0656 2900        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/09 20:30:20.0750 2900        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/09 20:30:20.0796 2900        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/09 20:30:20.0859 2900        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/09 20:30:20.0984 2900        WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

2011/05/09 20:30:21.0062 2900        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/05/09 20:30:21.0265 2900        ================================================================================

2011/05/09 20:30:21.0265 2900        Scan finished

2011/05/09 20:30:21.0265 2900        ================================================================================

2011/05/09 20:30:21.0281 2796        Detected object count: 1

2011/05/09 20:30:41.0953 2796        LockedFile.Multi.Generic(sptd) - User select action: Skip 

2011/05/09 20:33:44.0078 3076        ================================================================================

2011/05/09 20:33:44.0078 3076        Scan started

2011/05/09 20:33:44.0078 3076        Mode: Manual; 

2011/05/09 20:33:44.0078 3076        ================================================================================

2011/05/09 20:33:47.0093 3076        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/09 20:33:47.0140 3076        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

2011/05/09 20:33:47.0359 3076        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/09 20:33:47.0484 3076        AFD             (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys

2011/05/09 20:33:47.0906 3076        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/09 20:33:47.0968 3076        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/09 20:33:48.0515 3076        ati2mtag        (ec2743bf722d4356375a0a01b69a81e0) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2011/05/09 20:33:48.0750 3076        atitray         (6e51838f65c4f5264af489773a53d678) C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys

2011/05/09 20:33:48.0953 3076        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/09 20:33:49.0031 3076        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/09 20:33:49.0125 3076        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

2011/05/09 20:33:49.0187 3076        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

2011/05/09 20:33:49.0296 3076        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys

2011/05/09 20:33:49.0421 3076        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/09 20:33:49.0500 3076        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/09 20:33:49.0562 3076        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/05/09 20:33:49.0781 3076        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/09 20:33:49.0859 3076        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/09 20:33:50.0078 3076        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/09 20:33:50.0546 3076        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/05/09 20:33:50.0656 3076        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/05/09 20:33:51.0328 3076        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/09 20:33:51.0625 3076        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/09 20:33:51.0703 3076        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\DRIVERS\dmio.sys

2011/05/09 20:33:51.0765 3076        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/09 20:33:51.0828 3076        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/09 20:33:51.0953 3076        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/09 20:33:52.0031 3076        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/09 20:33:52.0093 3076        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/05/09 20:33:52.0171 3076        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/09 20:33:52.0296 3076        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/09 20:33:52.0406 3076        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/09 20:33:52.0453 3076        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/09 20:33:52.0515 3076        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/09 20:33:52.0578 3076        giveio          (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

2011/05/09 20:33:52.0640 3076        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/09 20:33:52.0671 3076        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

2011/05/09 20:33:52.0718 3076        Hotkey          (8b566ea71d5b76157a9cdb78f25a5731) C:\WINDOWS\system32\drivers\Hotkey.sys

2011/05/09 20:33:52.0812 3076        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/09 20:33:52.0906 3076        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/09 20:33:52.0953 3076        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/09 20:33:53.0437 3076        IntcAzAudAddService (001aaca6ed0e6b00fc5b8faf74977e81) C:\WINDOWS\system32\drivers\RtkHDAud.sys

2011/05/09 20:33:53.0593 3076        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/09 20:33:53.0656 3076        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/09 20:33:53.0765 3076        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/09 20:33:53.0828 3076        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/09 20:33:53.0906 3076        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/09 20:33:53.0953 3076        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/09 20:33:54.0031 3076        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/09 20:33:54.0093 3076        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/09 20:33:54.0187 3076        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/09 20:33:54.0281 3076        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/09 20:33:54.0390 3076        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/09 20:33:54.0578 3076        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/09 20:33:54.0640 3076        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/09 20:33:54.0671 3076        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/09 20:33:54.0734 3076        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/09 20:33:54.0796 3076        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/09 20:33:54.0843 3076        MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/09 20:33:54.0906 3076        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/09 20:33:54.0953 3076        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/09 20:33:54.0984 3076        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/09 20:33:55.0031 3076        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/09 20:33:55.0093 3076        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/09 20:33:55.0140 3076        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/05/09 20:33:55.0171 3076        Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/09 20:33:55.0203 3076        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/05/09 20:33:55.0265 3076        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/09 20:33:55.0312 3076        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/05/09 20:33:55.0359 3076        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/09 20:33:55.0437 3076        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/09 20:33:55.0484 3076        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/09 20:33:55.0562 3076        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/09 20:33:55.0593 3076        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/09 20:33:55.0671 3076        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/09 20:33:55.0734 3076        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/09 20:33:55.0781 3076        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/09 20:33:55.0875 3076        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/09 20:33:55.0937 3076        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/09 20:33:55.0984 3076        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/09 20:33:56.0031 3076        NwlnkIpx        (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys

2011/05/09 20:33:56.0046 3076        NwlnkNb         (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys

2011/05/09 20:33:56.0093 3076        NwlnkSpx        (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys

2011/05/09 20:33:56.0140 3076        NWRDR           (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys

2011/05/09 20:33:56.0187 3076        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys

2011/05/09 20:33:56.0218 3076        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/09 20:33:56.0265 3076        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/09 20:33:56.0296 3076        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/09 20:33:56.0375 3076        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/05/09 20:33:56.0421 3076        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/05/09 20:33:56.0671 3076        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/09 20:33:56.0703 3076        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/09 20:33:56.0750 3076        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/09 20:33:56.0796 3076        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/05/09 20:33:56.0968 3076        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/09 20:33:57.0046 3076        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/09 20:33:57.0093 3076        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/09 20:33:57.0125 3076        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/09 20:33:57.0171 3076        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/09 20:33:57.0234 3076        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/09 20:33:57.0390 3076        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/05/09 20:33:57.0640 3076        RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/09 20:33:57.0765 3076        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/09 20:33:57.0937 3076        rtl8139         (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

2011/05/09 20:33:58.0015 3076        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/09 20:33:58.0078 3076        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys

2011/05/09 20:33:58.0140 3076        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/09 20:33:58.0234 3076        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/05/09 20:33:58.0296 3076        SNPSTD3         (43b8c052890896c6d1617ca90b2730e0) C:\WINDOWS\system32\DRIVERS\snpstd3.sys

2011/05/09 20:33:58.0390 3076        speedfan        (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys

2011/05/09 20:33:58.0468 3076        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/09 20:33:58.0562 3076        sptd            (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys

2011/05/09 20:33:58.0562 3076        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2011/05/09 20:33:58.0562 3076        sptd - detected LockedFile.Multi.Generic (1)

2011/05/09 20:33:58.0593 3076        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/09 20:33:58.0656 3076        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/09 20:33:58.0718 3076        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

2011/05/09 20:33:58.0781 3076        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/05/09 20:33:58.0812 3076        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/09 20:33:58.0859 3076        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/09 20:33:59.0046 3076        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/09 20:33:59.0125 3076        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/09 20:33:59.0171 3076        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/09 20:33:59.0250 3076        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/09 20:33:59.0343 3076        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/09 20:33:59.0531 3076        TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

2011/05/09 20:33:59.0625 3076        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/09 20:33:59.0718 3076        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/09 20:33:59.0796 3076        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/09 20:33:59.0843 3076        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/09 20:33:59.0890 3076        usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

2011/05/09 20:33:59.0953 3076        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/05/09 20:34:00.0000 3076        usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/05/09 20:34:00.0062 3076        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/09 20:34:00.0109 3076        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/09 20:34:00.0234 3076        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/09 20:34:00.0343 3076        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/09 20:34:00.0421 3076        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/09 20:34:00.0531 3076        WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

2011/05/09 20:34:00.0609 3076        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/05/09 20:34:01.0031 3076        ================================================================================

2011/05/09 20:34:01.0031 3076        Scan finished

2011/05/09 20:34:01.0031 3076        ================================================================================

2011/05/09 20:34:01.0062 2212        Detected object count: 1

2011/05/09 20:34:08.0062 2212        LockedFile.Multi.Generic(sptd) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Habe jetzt wieder Zugriff auf meinen Desktop.

Hier der Log:

Code:

ComboFix 11-05-09.02 - Administrator 10.05.2011  12:20:54.1.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.894.646 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Administrator\Eigene Dateien\Downloads\cofi.exe

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Adobe\plugs

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Adobe\plugs\mmc1563296.txt

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Adobe\shed

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Adobe\shed\thr1.chm

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Local

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Local\Temp\DDM\Settings\0.ddi

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Local\Temp\DDM\Settings\Schwerter.des.Koenigs.Extended.Directors.Cut.German.2007.a.avi.ddr

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Local\Temp\DDM\Settings\settings.ddi

c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Local\Temp\DDM\Settings\Temporary Downloaded Files\Schwerter.des.Koenigs.Extended.Directors.Cut.German.2007.a.avi.ddp

c:\dokumente und einstellungen\Administrator\WINDOWS

.

----- Datei Replikatoren -----

.

c:\programme\Black Isle\BGII - SvA\setup-1pp.exe

c:\programme\Black Isle\BGII - SvA\setup-1pp_avatars.exe

c:\programme\Black Isle\BGII - SvA\Setup-1pp_female_dwarves.exe

c:\programme\Black Isle\BGII - SvA\Setup-1pp_thieves_galore.exe

c:\programme\Black Isle\BGII - SvA\Setup-AC_QUEST.exe

c:\programme\Black Isle\BGII - SvA\Setup-ACBre.exe

c:\programme\Black Isle\BGII - SvA\Setup-Amber.exe

c:\programme\Black Isle\BGII - SvA\Setup-Assassinations.exe

c:\programme\Black Isle\BGII - SvA\setup-atweaks.exe

c:\programme\Black Isle\BGII - SvA\setup-aurenaseph.exe

c:\programme\Black Isle\BGII - SvA\setup-aurpatch.exe

c:\programme\Black Isle\BGII - SvA\Setup-Banterpack.exe

c:\programme\Black Isle\BGII - SvA\Setup-BeregostCF.exe

c:\programme\Black Isle\BGII - SvA\setup-bg1npc.exe

c:\programme\Black Isle\BGII - SvA\setup-bg1npcmusic.exe

c:\programme\Black Isle\BGII - SvA\setup-bg1ub.exe

c:\programme\Black Isle\BGII - SvA\setup-bg2_tweaks.exe

c:\programme\Black Isle\BGII - SvA\setup-bg2fixpack.exe

c:\programme\Black Isle\BGII - SvA\setup-bgqe.exe

c:\programme\Black Isle\BGII - SvA\Setup-BGT-NPCSound.exe

c:\programme\Black Isle\BGII - SvA\Setup-BGT.exe

c:\programme\Black Isle\BGII - SvA\Setup-BGTMusic.exe

c:\programme\Black Isle\BGII - SvA\Setup-BGTTweak.exe

c:\programme\Black Isle\BGII - SvA\Setup-BP-Balancer.exe

c:\programme\Black Isle\BGII - SvA\Setup-BP-BGT-Worldmap.exe

c:\programme\Black Isle\BGII - SvA\Setup-BWFixpack.exe

c:\programme\Black Isle\BGII - SvA\Setup-BWInstallpack.exe

c:\programme\Black Isle\BGII - SvA\Setup-BWTextpack.exe

c:\programme\Black Isle\BGII - SvA\Setup-BWTrimpack.exe

c:\programme\Black Isle\BGII - SvA\setup-c#ajantis_sva.exe

c:\programme\Black Isle\BGII - SvA\setup-c#sb_silber.exe

c:\programme\Black Isle\BGII - SvA\setup-contain.exe

c:\programme\Black Isle\BGII - SvA\setup-crefixer.exe

c:\programme\Black Isle\BGII - SvA\Setup-DC.exe

c:\programme\Black Isle\BGII - SvA\Setup-DSotSC.exe

c:\programme\Black Isle\BGII - SvA\setup-fadingpromises.exe

c:\programme\Black Isle\BGII - SvA\setup-freeact.exe

c:\programme\Black Isle\BGII - SvA\setup-gavin_bg2_bgt.exe

c:\programme\Black Isle\BGII - SvA\Setup-GBThfKp.exe

c:\programme\Black Isle\BGII - SvA\setup-generalized_biffing.exe

c:\programme\Black Isle\BGII - SvA\Setup-GRoA.exe

c:\programme\Black Isle\BGII - SvA\Setup-GUI.exe

c:\programme\Black Isle\BGII - SvA\setup-hammers.exe

c:\programme\Black Isle\BGII - SvA\setup-iepbanters.exe

c:\programme\Black Isle\BGII - SvA\setup-infinityanimations.exe

c:\programme\Black Isle\BGII - SvA\Setup-Innate_Fix.exe

c:\programme\Black Isle\BGII - SvA\Setup-JA#BGT_Tweak.exe

c:\programme\Black Isle\BGII - SvA\Setup-Kelsey.exe

c:\programme\Black Isle\BGII - SvA\Setup-KelseyTOB.exe

c:\programme\Black Isle\BGII - SvA\setup-level1npcs.exe

c:\programme\Black Isle\BGII - SvA\setup-lightmaps.exe

c:\programme\Black Isle\BGII - SvA\setup-lucy.exe

c:\programme\Black Isle\BGII - SvA\Setup-NPCFlirt.exe

c:\programme\Black Isle\BGII - SvA\setup-p5tweaks.exe

c:\programme\Black Isle\BGII - SvA\setup-res_fixer.exe

c:\programme\Black Isle\BGII - SvA\setup-rr.exe

c:\programme\Black Isle\BGII - SvA\setup-scs.exe

c:\programme\Black Isle\BGII - SvA\setup-scsii.exe

c:\programme\Black Isle\BGII - SvA\setup-sirinescall.exe

c:\programme\Black Isle\BGII - SvA\Setup-slandor.exe

c:\programme\Black Isle\BGII - SvA\setup-soa.exe

c:\programme\Black Isle\BGII - SvA\Setup-Solaufein.exe

c:\programme\Black Isle\BGII - SvA\Setup-TDD.exe

c:\programme\Black Isle\BGII - SvA\Setup-TGC1E.exe

c:\programme\Black Isle\BGII - SvA\setup-toa.exe

c:\programme\Black Isle\BGII - SvA\Setup-TobEx.exe

c:\programme\Black Isle\BGII - SvA\Setup-TOD.exe

c:\programme\Black Isle\BGII - SvA\Setup-TotDG.exe

c:\programme\Black Isle\BGII - SvA\setup-tp.exe

c:\programme\Black Isle\BGII - SvA\Setup-TxtMusic.exe

c:\programme\Black Isle\BGII - SvA\SETUP-UB.exe

c:\programme\Black Isle\BGII - SvA\Setup-WeiDU.exe

c:\programme\Black Isle\BGII - SvA\Setup-XanBG1Friend.exe

c:\programme\Black Isle\BGII - SvA\setup-xpmod.exe

c:\programme\Black Isle\BGII - SvA\WeiDU.exe

c:\programme\Black Isle\BGII - SvA\WeiDU\WeiDU.exe

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_BOONTY_GAMES

-------\Service_Boonty Games

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-10 bis 2011-05-10  ))))))))))))))))))))))))))))))

.

.

2011-05-09 18:06 . 2011-05-09 18:06        --------        d-----w-        C:\_OTL

2011-05-09 10:21 . 2011-05-09 10:21        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes

2011-05-09 10:21 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-09 10:21 . 2011-05-09 10:21        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-05-09 10:21 . 2011-05-09 10:21        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-05-09 10:21 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-04 15:20 . 2006-07-13 11:26        94208        ----a-w-        c:\windows\system32\LXCZCUR.DLL

2011-05-04 15:20 . 2006-04-17 23:48        200704        ----a-w-        c:\windows\system32\LEXLMPM.DLL

2011-05-04 15:20 . 2006-07-13 11:25        458752        ----a-w-        c:\windows\system32\LXCZJSWR.DLL

2011-05-04 15:07 . 1997-04-08 18:08        299520        ----a-w-        c:\windows\uninst.exe

2011-05-04 15:07 . 2011-05-04 15:07        --------        d-----w-        C:\Lexmark

2011-05-04 14:38 . 2008-04-13 17:47        25856        -c--a-w-        c:\windows\system32\dllcache\usbprint.sys

2011-05-04 14:38 . 2008-04-13 17:47        25856        ----a-w-        c:\windows\system32\drivers\usbprint.sys

2011-04-28 01:02 . 2011-04-28 01:02        --------        d-----w-        C:\7ae75bd9629932ef204995

2011-04-26 15:32 . 2011-04-26 15:36        --------        d-----w-        c:\windows\ShellNew

2011-04-26 13:34 . 2011-04-26 13:34        --------        d-----w-        c:\programme\Microsoft Silverlight

2011-04-20 10:42 . 2011-04-20 10:42        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Shareaza

2011-04-20 10:42 . 2011-05-09 15:21        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Shareaza

2011-04-18 21:04 . 2011-05-04 16:05        --------        d-----w-        c:\programme\Black Isle

2011-04-16 09:35 . 2011-04-16 09:35        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Thunderbird

2011-04-16 09:35 . 2011-04-16 09:35        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Thunderbird

2011-04-16 09:01 . 2011-04-16 09:01        --------        d-----w-        c:\programme\Mozilla Thunderbird

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-24 14:10 . 2011-03-24 14:11        73728        ----a-w-        c:\windows\system32\javacpl.cpl

2011-03-24 14:10 . 2010-11-04 13:39        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-03-17 00:23 . 2010-11-04 12:43        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-03-07 05:33 . 2010-11-04 05:54        692736        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-04 06:44 . 2004-08-03 22:57        434176        ----a-w-        c:\windows\system32\vbscript.dll

2011-03-03 13:53 . 2004-08-03 22:46        1858048        ----a-w-        c:\windows\system32\win32k.sys

2011-02-18 12:10 . 2011-03-08 13:02        31552        ----a-w-        c:\windows\system32\TURegOpt.exe

2011-02-18 12:05 . 2011-03-08 13:02        29504        ----a-w-        c:\windows\system32\uxtuneup.dll

2011-02-17 13:51 . 2004-08-03 22:57        672768        ----a-w-        c:\windows\system32\wininet.dll

2011-02-17 13:51 . 2004-08-03 22:57        81920        ----a-w-        c:\windows\system32\ieencode.dll

2011-02-17 13:51 . 2004-08-03 20:59        61952        ----a-w-        c:\windows\system32\tdc.ocx

2011-02-17 13:50 . 2004-08-03 22:42        371200        ----a-w-        c:\windows\system32\html.iec

2011-02-17 13:18 . 2004-08-03 21:15        455936        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-17 13:18 . 2004-08-03 21:14        357888        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-17 12:54 . 2011-01-03 13:23        5632        ----a-w-        c:\windows\system32\xpsp4res.dll

2011-02-15 12:56 . 2004-08-03 22:54        290432        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-09 13:53 . 2004-08-03 22:57        270848        ----a-w-        c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2004-08-03 22:57        186880        ----a-w-        c:\windows\system32\encdec.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HotkeyApp"="c:\programme\Launch Manager\HotkeyApp.exe" [2006-12-14 192512]

"LMgrVolOSD"="c:\programme\Launch Manager\OSD.exe" [2006-12-26 180224]

"LMgrOSD"="c:\programme\Launch Manager\OSDCtrl.exe" [2006-08-29 241664]

"Wbutton"="c:\programme\Launch Manager\Wbutton.exe" [2006-11-09 86016]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]

"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]

"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]

"LaunchAp"="c:\programme\Launch Manager\LaunchAp.exe" [2005-07-25 32768]

"SpybotSnD"="c:\programme\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]

"Lexmark 1200 Series"="c:\programme\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Taskman"=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]

2011-04-09 18:54        119608        ----a-w-        c:\programme\ICQ7.4\ICQ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 10:44        248552        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"LaunchAp"=c:\programme\Launch Manager\LaunchAp.exe                                                                                                                                                                                                                                 

"snpstd3"=c:\windows\vsnpstd3.exe

"a-squared"="c:\programme\Emsisoft Anti-Malware\a2guard.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Programme\\ICQ7.4\\ICQ.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

"48528:TCP"= 48528:TCP:emule

"56740:UDP"= 56740:UDP:Emule

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [04.11.2010 21:43 691696]

R1 atitray;atitray;c:\programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [06.01.2011 14:24 17952]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [04.11.2010 14:43 136360]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [18.02.2011 14:08 1517376]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [29.11.2010 20:27 10064]

R3 WisLMSvc;WisLMSvc;c:\programme\Launch Manager\WisLMSvc.exe [04.11.2010 11:24 118784]

S1 mailKmd;mailKmd; [x]

S1 ntiomin;ntiomin; [x]

S4 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [09.04.2011 20:58 247096]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-10 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2011-01-04 21:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: Free YouTube to MP3 Converter - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\programme\ICQ7.4\ICQ.exe

FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-CtrlVol - c:\programme\Launch Manager\CtrlVol.exe

MSConfigStartUp-DAEMON Tools Lite - c:\programme\DAEMON Tools Lite\DTLite.exe

MSConfigStartUp-eDonkey2000 - c:\programme\eDonkey2000\eDonkey2000.exe

AddRemove-2kv4.8.442 - c:\windows\Radeon Omega Drivers v4.8.442

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-05-10 12:33

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  LaunchAp = c:\programme\Launch Manager\LaunchAp.exe????@???0???\???????0??????????? ??|???|???????|????????L???????8'????F?????????????h?????????????B????? ??|`??|????]??|[?A?????????z?A?_|????7~??????F?4^@???????????????A?????????z?A???@?('??6u@?('??7|????@?8'????? 

  CtrlVol = c:\programme\Launch Manager\CtrlVol.exe?8???@???0???\???????0??????????? ??|???|???????|????????L???????8'????F?????????????h?????????????B????? ??|`??|????]??|[?A?????????z?A???????7~??????F?4^@???????????????A??p??????z?A???@?('??6u@?('????????@?8'????? 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1177238915-746137067-682003330-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:1a,dd,4b,cb,10,a7,43,e4,cb,4d,15,45,26,8d,34,e1,02,ed,5d,b8,0b,12,68,

   26,78,fe,f5,20,1e,40,55,4f,4e,11,22,0e,8a,75,bf,82,19,14,94,d7,43,a4,fb,a6,\

"??"=hex:34,de,cf,1e,f9,84,41,e0,ad,b4,08,c3,9e,59,f7,9f

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(716)

c:\windows\system32\Ati2evxx.dll

.

- - - - - - - > 'explorer.exe'(2632)

c:\windows\system32\msi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

c:\windows\RTHDCPL.EXE

c:\programme\Lexmark 1200 Series\lxczbmon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-10  12:40:51 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-10 10:40

.

Vor Suchlauf: 14 Verzeichnis(se), 33.015.918.592 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 32.948.498.432 Bytes frei

.

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

.

Current=5 Default=5 Failed=1 LastKnownGood=3 Sets=1,2,3,4,5

- - End Of File - - 234FFD5A743B5E41C70A6C64782CD711

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Driver::

mailKmd

ntiomin
 

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"48528:TCP"=-

"56740:UDP"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Taskman"=-

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

ComboFix 11-05-09.02 - Administrator 10.05.2011  13:13:42.2.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.894.531 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Administrator\Desktop\cofi.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Administrator\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NTIOMIN

-------\Service_mailKmd

-------\Service_ntiomin

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-10 bis 2011-05-10  ))))))))))))))))))))))))))))))

.

.

2011-05-10 10:45 . 2011-04-14 16:40        142296        ----a-w-        c:\programme\Mozilla Firefox\components\browsercomps.dll

2011-05-10 10:45 . 2011-04-14 16:40        89048        ----a-w-        c:\programme\Mozilla Firefox\libEGL.dll

2011-05-10 10:45 . 2011-04-14 16:40        781272        ----a-w-        c:\programme\Mozilla Firefox\mozsqlite3.dll

2011-05-10 10:45 . 2011-04-14 16:40        465880        ----a-w-        c:\programme\Mozilla Firefox\libGLESv2.dll

2011-05-10 10:45 . 2011-04-14 16:40        1874904        ----a-w-        c:\programme\Mozilla Firefox\mozjs.dll

2011-05-10 10:45 . 2011-04-14 16:40        15832        ----a-w-        c:\programme\Mozilla Firefox\mozalloc.dll

2011-05-10 10:45 . 2010-01-01 08:00        1974616        ----a-w-        c:\programme\Mozilla Firefox\D3DCompiler_42.dll

2011-05-10 10:45 . 2010-01-01 08:00        1892184        ----a-w-        c:\programme\Mozilla Firefox\d3dx9_42.dll

2011-05-09 18:06 . 2011-05-09 18:06        --------        d-----w-        C:\_OTL

2011-05-09 10:21 . 2011-05-09 10:21        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes

2011-05-09 10:21 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-09 10:21 . 2011-05-09 10:21        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-05-09 10:21 . 2011-05-09 10:21        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-05-09 10:21 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-04 15:20 . 2006-07-13 11:26        94208        ----a-w-        c:\windows\system32\LXCZCUR.DLL

2011-05-04 15:20 . 2006-04-17 23:48        200704        ----a-w-        c:\windows\system32\LEXLMPM.DLL

2011-05-04 15:20 . 2006-07-13 11:25        458752        ----a-w-        c:\windows\system32\LXCZJSWR.DLL

2011-05-04 15:07 . 1997-04-08 18:08        299520        ----a-w-        c:\windows\uninst.exe

2011-05-04 15:07 . 2011-05-04 15:07        --------        d-----w-        C:\Lexmark

2011-05-04 14:38 . 2008-04-13 17:47        25856        -c--a-w-        c:\windows\system32\dllcache\usbprint.sys

2011-05-04 14:38 . 2008-04-13 17:47        25856        ----a-w-        c:\windows\system32\drivers\usbprint.sys

2011-04-28 01:02 . 2011-04-28 01:02        --------        d-----w-        C:\7ae75bd9629932ef204995

2011-04-26 15:32 . 2011-04-26 15:36        --------        d-----w-        c:\windows\ShellNew

2011-04-26 13:34 . 2011-04-26 13:34        --------        d-----w-        c:\programme\Microsoft Silverlight

2011-04-20 10:42 . 2011-04-20 10:42        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Shareaza

2011-04-20 10:42 . 2011-05-09 15:21        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Shareaza

2011-04-18 21:04 . 2011-05-04 16:05        --------        d-----w-        c:\programme\Black Isle

2011-04-16 09:35 . 2011-04-16 09:35        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Thunderbird

2011-04-16 09:35 . 2011-04-16 09:35        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Thunderbird

2011-04-16 09:01 . 2011-04-16 09:01        --------        d-----w-        c:\programme\Mozilla Thunderbird

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-24 14:10 . 2011-03-24 14:11        73728        ----a-w-        c:\windows\system32\javacpl.cpl

2011-03-24 14:10 . 2010-11-04 13:39        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-03-17 00:23 . 2010-11-04 12:43        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-03-07 05:33 . 2010-11-04 05:54        692736        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-04 06:44 . 2004-08-03 22:57        434176        ----a-w-        c:\windows\system32\vbscript.dll

2011-03-03 13:53 . 2004-08-03 22:46        1858048        ----a-w-        c:\windows\system32\win32k.sys

2011-02-18 12:10 . 2011-03-08 13:02        31552        ----a-w-        c:\windows\system32\TURegOpt.exe

2011-02-18 12:05 . 2011-03-08 13:02        29504        ----a-w-        c:\windows\system32\uxtuneup.dll

2011-02-17 13:51 . 2004-08-03 22:57        672768        ----a-w-        c:\windows\system32\wininet.dll

2011-02-17 13:51 . 2004-08-03 22:57        81920        ----a-w-        c:\windows\system32\ieencode.dll

2011-02-17 13:51 . 2004-08-03 20:59        61952        ----a-w-        c:\windows\system32\tdc.ocx

2011-02-17 13:50 . 2004-08-03 22:42        371200        ----a-w-        c:\windows\system32\html.iec

2011-02-17 13:18 . 2004-08-03 21:15        455936        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-17 13:18 . 2004-08-03 21:14        357888        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-17 12:54 . 2011-01-03 13:23        5632        ----a-w-        c:\windows\system32\xpsp4res.dll

2011-02-15 12:56 . 2004-08-03 22:54        290432        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-09 13:53 . 2004-08-03 22:57        270848        ----a-w-        c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2004-08-03 22:57        186880        ----a-w-        c:\windows\system32\encdec.dll

2011-04-14 16:40 . 2011-05-10 10:45        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HotkeyApp"="c:\programme\Launch Manager\HotkeyApp.exe" [2006-12-14 192512]

"LMgrVolOSD"="c:\programme\Launch Manager\OSD.exe" [2006-12-26 180224]

"LMgrOSD"="c:\programme\Launch Manager\OSDCtrl.exe" [2006-08-29 241664]

"Wbutton"="c:\programme\Launch Manager\Wbutton.exe" [2006-11-09 86016]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]

"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]

"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]

"LaunchAp"="c:\programme\Launch Manager\LaunchAp.exe" [2005-07-25 32768]

"SpybotSnD"="c:\programme\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]

"Lexmark 1200 Series"="c:\programme\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]

"CtrlVol"="c:\programme\Launch Manager\CtrlVol.exe" [BU]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]

2011-04-09 18:54        119608        ----a-w-        c:\programme\ICQ7.4\ICQ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 10:44        248552        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"LaunchAp"=c:\programme\Launch Manager\LaunchAp.exe                                                                                                                                                                                                                                 

"snpstd3"=c:\windows\vsnpstd3.exe

"a-squared"="c:\programme\Emsisoft Anti-Malware\a2guard.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Programme\\ICQ7.4\\ICQ.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [04.11.2010 21:43 691696]

R1 atitray;atitray;c:\programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [06.01.2011 14:24 17952]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [04.11.2010 14:43 136360]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [18.02.2011 14:08 1517376]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [29.11.2010 20:27 10064]

R3 WisLMSvc;WisLMSvc;c:\programme\Launch Manager\WisLMSvc.exe [04.11.2010 11:24 118784]

S4 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [09.04.2011 20:58 247096]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-10 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2011-01-04 21:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: Free YouTube to MP3 Converter - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\programme\ICQ7.4\ICQ.exe

FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\h9pm9f89.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-05-10 13:26

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  LaunchAp = c:\programme\Launch Manager\LaunchAp.exe????@???0???\???????0??????????? ??|???|???????|????????L???????8'????F?????????????h?????????????B????? ??|`??|????]??|[?A?????????z?A?_|????7~??????F?4^@???????????????A?????????z?A???@?('??6u@?('??7|????@?8'????? 

  CtrlVol = c:\programme\Launch Manager\CtrlVol.exe?8???@???0???\???????0??????????? ??|???|???????|????????L???????8'????F?????????????h?????????????B????? ??|`??|????]??|[?A?????????z?A?e?`???7~??????F?4^@???????????????A?9?0?????z?A???@?('??6u@?('?? ?`???@?8'????? 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1177238915-746137067-682003330-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:1a,dd,4b,cb,10,a7,43,e4,cb,4d,15,45,26,8d,34,e1,02,ed,5d,b8,0b,12,68,

   26,78,fe,f5,20,1e,40,55,4f,4e,11,22,0e,8a,75,bf,82,19,14,94,d7,43,a4,fb,a6,\

"??"=hex:34,de,cf,1e,f9,84,41,e0,ad,b4,08,c3,9e,59,f7,9f

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(704)

c:\windows\system32\Ati2evxx.dll

.

- - - - - - - > 'explorer.exe'(2988)

c:\windows\system32\msi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\wscntfy.exe

c:\programme\Lexmark 1200 Series\lxczbmon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-10  13:32:19 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-10 11:32

ComboFix2.txt  2011-05-10 10:40

.

Vor Suchlauf: 14 Verzeichnis(se), 32.917.491.712 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 32.902.811.648 Bytes frei

.

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

.

Current=5 Default=5 Failed=1 LastKnownGood=3 Sets=1,2,3,4,5

- - End Of File - - 21E32143AB4B042BD3445560D5943227

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Ok, also GMER scheint ja wirklich ein sehr instabiles Tool zu sein. Das 1. Mal hatte ich nen Bluescreen, bevor der Scan beendet war. Beim 2. Mal konnte ich den Scan zwar beenden, aber nach dem Drücken auf "Copy" -> freeze

Naja wie auch immer; hier der OSAM-Log

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 16:36:53 on 10.05.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 4.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"WGASetup.job" - "Microsoft Corporation" - C:\WINDOWS\system32\KB905474\wgasetup.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DIRECTX.CPL" - "Microsoft Corporation" - C:\WINDOWS\system32\DIRECTX.CPL

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys

"atitray" (atitray) - ? - C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys  (File found, but it contains no detailed information)

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\cofi\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"Driver for MagicISO SCSI Host Controller" (mcdbus) - ? - C:\WINDOWS\System32\DRIVERS\mcdbus.sys  (File not found)

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"Hotkey" (Hotkey) - ? - C:\WINDOWS\system32\drivers\Hotkey.sys  (File found, but it contains no detailed information)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"speedfan" (speedfan) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\System32\speedfan.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

"USB PC Camera (SNPSTD3)" (SNPSTD3) - ? - C:\WINDOWS\System32\DRIVERS\snpstd3.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - C:\Programme\Tracker Software\Shell Extensions\XCShInfo.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} "PDF-XChange PDF Preview Provider" - "Tracker Software Products Ltd." - C:\Programme\Tracker Software\Shell Extensions\XCShInfo.dll

{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} "PDF-XChange PDF Property Handler" - "Tracker Software Products Ltd." - C:\Programme\Tracker Software\Shell Extensions\XCShInfo.dll

{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} "PDF-XChange PDF Thumbnail Provider" - "Tracker Software Products Ltd." - C:\Programme\Tracker Software\Shell Extensions\XCShInfo.dll

{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - C:\Programme\Tracker Software\Shell Extensions\XCShInfo.dll

{5B043439-4F53-436E-8CFE-28F80934DBE6} "PXCPreviewHandlerXP Class" - "Tracker Software Products Ltd." - C:\Programme\Tracker Software\Shell Extensions\PXCPrevHost.exe

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\SDShelEx-win32.dll

{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} "WinAceContext Menu (Add) Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll

{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} "WinAceContext Menu Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll

{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} "WinAceDrag-Drop Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll

{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} "WinAceProperty Sheet Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://go.microsoft.com/fwlink/?linkid=39204

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

"Exec" - ? - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe  (File not found)

"ICQ7.4" - "ICQ, LLC." - C:\Programme\ICQ7.4\ICQ.exe

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{855F3B16-6D32-4FE6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\desktop.ini

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"CtrlVol" - ? - C:\Programme\Launch Manager\CtrlVol.exe  (File not found)

"HotkeyApp" - "Wistron" - C:\Programme\Launch Manager\HotkeyApp.exe

"LaunchAp" - ? - C:\Programme\Launch Manager\LaunchAp.exe

"Lexmark 1200 Series" - "Lexmark International, Inc." - "C:\Programme\Lexmark 1200 Series\lxczbmgr.exe"

"LMgrOSD" - ? - C:\Programme\Launch Manager\OSDCtrl.exe

"LMgrVolOSD" - "Wistron Corp." - C:\Programme\Launch Manager\OSD.exe

"SpybotSnD" - "Safer Networking Limited" - "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

"Wbutton" - ? - "C:\Programme\Launch Manager\Wbutton.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe

"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Programme\Launch Manager\WisLMSvc.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"AtiExtEvent" - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Und hier der von MBR

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 3 (build 2600)

Logical Drives Mask:                0x0000001c
 

Kernel Drivers (total 123):

  0x804D7000 \WINDOWS\system32\ntoskrnl.exe

  0x806EF000 \WINDOWS\system32\hal.dll

  0xF7D64000 \WINDOWS\system32\KDCOM.DLL

  0xF7C74000 \WINDOWS\system32\BOOTVID.dll

  0xF7750000 spax.sys

  0xF7D66000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF7738000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF7709000 ACPI.sys

  0xF76F8000 pci.sys

  0xF7864000 isapnp.sys

  0xF7C78000 compbatt.sys

  0xF7C7C000 \WINDOWS\system32\DRIVERS\BATTC.SYS

  0xF7E2C000 pciide.sys

  0xF7AE4000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF7874000 MountMgr.sys

  0xF76D9000 ftdisk.sys

  0xF7D68000 dmload.sys

  0xF76B3000 dmio.sys

  0xF7C80000 ACPIEC.sys

  0xF7E2D000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS

  0xF7AEC000 PartMgr.sys

  0xF7884000 VolSnap.sys

  0xF769B000 atapi.sys

  0xF7894000 disk.sys

  0xF78A4000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF767B000 fltmgr.sys

  0xF7669000 sr.sys

  0xF78B4000 PxHelp20.sys

  0xF7652000 KSecDD.sys

  0xF75C5000 Ntfs.sys

  0xF7598000 NDIS.sys

  0xF7D6A000 speedfan.sys

  0xF757E000 Mup.sys

  0xF7E2E000 giveio.sys

  0xF7A34000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0xF7D34000 \SystemRoot\system32\DRIVERS\wmiacpi.sys

  0xF6A46000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xF6A32000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF7B74000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0xF6A0E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF7B7C000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF7A44000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF7A54000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF7A64000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF69EB000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF69C3000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0xF7A74000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF7B84000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF7B8C000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF7D3C000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0xF7B94000 \SystemRoot\system32\DRIVERS\RTL8139.SYS

  0xF7F5A000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF7A84000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF7D40000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF69AC000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF7A94000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF7AA4000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF7B9C000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF699B000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF7AB4000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF7BA4000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF7BAC000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF696B000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF7AC4000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF7D84000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF690D000 \SystemRoot\system32\DRIVERS\update.sys

  0xF7D5C000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF78D4000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF7904000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF7D86000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xEE3C8000 \SystemRoot\system32\drivers\RtkHDAud.sys

  0xEE3A4000 \SystemRoot\system32\drivers\portcls.sys

  0xF7914000 \SystemRoot\system32\drivers\drmk.sys

  0xF7D8A000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF7E8D000 \SystemRoot\System32\Drivers\Null.SYS

  0xF7D8C000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF7BCC000 \SystemRoot\System32\drivers\vga.sys

  0xF7D8E000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF7D90000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF7BD4000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF7BDC000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF7D08000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xEE349000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xEE2F0000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xEE2C8000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xEE2A6000 \SystemRoot\System32\drivers\afd.sys

  0xF7924000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF7BE4000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xEE27B000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xEE1E3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF7D20000 \SystemRoot\System32\Drivers\Hotkey.SYS

  0xF7934000 \SystemRoot\System32\Drivers\Fips.SYS

  0xEE1BD000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF7944000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xEE197000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF7D96000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xF6909000 \??\C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys

  0xF7964000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xEE157000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF7D9E000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xEE3A0000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF7BEC000 \SystemRoot\System32\watchdog.sys

  0xBF000000 \SystemRoot\System32\drivers\dxg.sys

  0xF7F84000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF012000 \SystemRoot\System32\ati2dvag.dll

  0xBF058000 \SystemRoot\System32\ati2cqag.dll

  0xBF0D2000 \SystemRoot\System32\atikvmag.dll

  0xBF140000 \SystemRoot\System32\atiok3x2.dll

  0xBF170000 \SystemRoot\System32\ati3duag.dll

  0xBF43F000 \SystemRoot\System32\ativvaxx.dll

  0xBF5D0000 \SystemRoot\System32\ATMFD.DLL

  0xEBD2A000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xEBBFC000 \SystemRoot\system32\DRIVERS\nwlnkipx.sys

  0xEBE37000 \SystemRoot\system32\DRIVERS\nwlnknb.sys

  0xEBD47000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xEBDD7000 \SystemRoot\system32\DRIVERS\nwlnkspx.sys

  0xEB9CC000 \SystemRoot\system32\DRIVERS\nwrdr.sys

  0xEB834000 \SystemRoot\system32\DRIVERS\srv.sys

  0xEB757000 \SystemRoot\system32\drivers\wdmaud.sys

  0xEB95C000 \SystemRoot\system32\drivers\sysaudio.sys

  0xF7E51000 \??\C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll
 

Processes (total 40):

       0 System Idle Process

       4 System

     528 C:\WINDOWS\system32\smss.exe

     696 csrss.exe

     732 C:\WINDOWS\system32\winlogon.exe

     784 C:\WINDOWS\system32\services.exe

     796 C:\WINDOWS\system32\lsass.exe

     976 C:\WINDOWS\system32\ati2evxx.exe

     996 C:\WINDOWS\system32\svchost.exe

    1092 svchost.exe

    1164 C:\WINDOWS\system32\ati2evxx.exe

    1216 C:\WINDOWS\system32\svchost.exe

    1280 svchost.exe

    1308 svchost.exe

    1432 C:\WINDOWS\system32\LEXBCES.EXE

    1448 C:\WINDOWS\system32\spoolsv.exe

    1464 C:\WINDOWS\system32\LEXPPS.EXE

    1564 C:\Programme\Avira\AntiVir Desktop\sched.exe

    1820 C:\Programme\Avira\AntiVir Desktop\avguard.exe

     196 C:\WINDOWS\explorer.exe

     276 C:\Programme\Avira\AntiVir Desktop\avshadow.exe

     688 C:\WINDOWS\system32\svchost.exe

     740 C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

    1020 C:\Programme\Launch Manager\HotkeyApp.exe

    1160 C:\Programme\Launch Manager\OSD.exe

    1244 C:\Programme\Launch Manager\OSDCtrl.exe

    1264 C:\Programme\Launch Manager\WButton.exe

    1372 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    1680 C:\WINDOWS\RTHDCPL.exe

    1776 C:\Programme\Launch Manager\LaunchAp.exe

    1904 C:\Programme\Lexmark 1200 Series\lxczbmgr.exe

    1948 C:\Programme\Lexmark 1200 Series\lxczbmon.exe

    2244 C:\Programme\Launch Manager\WisLMSvc.exe

    2324 C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

    2548 alg.exe

    2604 wmiprvse.exe

    3480 C:\WINDOWS\system32\wscntfy.exe

    3700 C:\Programme\Mozilla Firefox\firefox.exe

    3912 C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\osam_autorun_manager_5_0_portable\osam.exe

    1932 C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`ee100000  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000013`c5700000  (NTFS)
 

PhysicalDrive0 Model Number: WDCWD1200BEVS-22UST0, Rev: 01.01A01
 

      Size  Device Name          MBR Status

  --------------------------------------------

    111 GB  \\.\PhysicalDrive0   Windows XP MBR code detected

            SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
 
 

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!