Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Malwarebytes-Funde (https://www.trojaner-board.de/123562-malwarebytes-funde.html)

Horst1980 05.09.2012 19:04
Malwarebytes-Funde
 
Hallo liebes Forum,
im Juli hatte Malwarebytes ein paar Funde:
Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.28.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
TanteKaete :: TANTE_KAETE [Administrator]

28.07.2012 14:19:05
mbam-log-2012-07-28 (14-19-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 283207
Laufzeit: 51 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3AA42713-5C1E-48E2-B432-D8BF420DD31D} (Rogue.AntiVirus2008) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 4
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|StartMenuLogOff (PUM.Hijack.StartMenu) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel|Homepage (PUM.Hijack.HomePageControl) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Ich habe heute nochmal einen neuen Vollscan gemacht:
Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.05.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
TanteKaete :: TANTE_KAETE [Administrator]

05.09.2012 17:56:00
mbam-log-2012-09-05 (17-56-00).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 279778
Laufzeit: 28 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel|Homepage (PUM.Hijack.HomePageControl) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Defogger:
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:33 on 05/09/2012 (TanteKaete)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
OTL.txt
Code:
OTL logfile created on: 05.09.2012 18:35:56 - Run 1
OTL by OldTimer - Version 3.2.61.0    Folder = C:\Dokumente und Einstellungen\TanteKaete\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,27 Gb Available Physical Memory | 75,80% Memory free
11,63 Gb Paging File | 11,14 Gb Available in Paging File | 95,74% Paging File free
Paging file location(s): D:\pagefile.sys 9000 9000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,29 Gb Total Space | 15,55 Gb Free Space | 53,08% Space Free | Partition Type: NTFS
Drive D: | 200,46 Gb Total Space | 178,46 Gb Free Space | 89,02% Space Free | Partition Type: NTFS
Drive I: | 436,39 Gb Total Space | 39,53 Gb Free Space | 9,06% Space Free | Partition Type: NTFS
 
Computer Name: TANTE_KAETE | User Name: TanteKaete | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.05 18:34:28 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\OTL.exe
PRC - [2012.03.26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- %SystemRoot%\system32\wbem\WMIsvc.dll -- (winmgmt)
SRV - File not found [Disabled | Unknown] --  -- (Nlliwn2ruk)
SRV - File not found [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2012.09.05 14:41:30 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007.06.27 20:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006.11.03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\splitcam.sys -- (SPLITCAM)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\siusbmod.sys -- (siusbmod)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Auto | Stopped] -- System32\drivers\aspi32.sys -- (Aspi32)
DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2010.02.03 16:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.21 18:30:48 | 003,565,056 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007.03.18 12:33:20 | 000,165,376 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2007.03.18 12:33:20 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2006.10.25 10:25:48 | 000,028,672 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CO_Mon.sys -- (CO_Mon)
DRV - [2006.09.21 03:37:00 | 001,422,656 | R--- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmudaxu.sys -- (cmudau32)
DRV - [2005.09.12 16:40:08 | 000,047,744 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vserial.sys -- (vserial)
DRV - [2005.09.12 16:40:08 | 000,029,440 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\actser.sys -- (actser)
DRV - [2005.09.12 16:40:08 | 000,015,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vsb.sys -- (vsbus)
DRV - [2005.06.15 00:40:08 | 000,180,864 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005.03.15 17:04:00 | 000,161,792 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ov530vid.sys -- (ovt530)
DRV - [2005.02.23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2002.11.07 15:20:16 | 000,116,110 | ---- | M] (Mars Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MR97310v.sys -- (MR97310_VGA_DUAL_CAMERA)
DRV - [2001.11.01 09:30:30 | 000,041,759 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [1997.09.28 13:53:06 | 000,040,288 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mgnt.sys -- (MicroGuard)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://www.google.com/preferences?hl={SUB_RFC1766}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie?hl={SUB_RFC1766}
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie?hl={SUB_RFC1766}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {A1AA3292-673C-46C4-A7FE-830A38FBFA05}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{A1AA3292-673C-46C4-A7FE-830A38FBFA05}: "URL" = hxxp://www.google.de/search?q={searchTerms}&rlz=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.5.4
FF - prefs.js..extensions.enabledAddons: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120827
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.05 14:41:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.09.05 14:29:31 | 000,000,000 | ---D | M]
 
[2010.08.23 19:30:38 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Extensions
[2010.08.23 19:30:38 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.09.05 17:11:56 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions
[2012.09.05 17:11:56 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.09.05 17:09:41 | 000,527,931 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 14:30:18 | 000,741,958 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.05 13:42:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.05 14:41:30 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.09.05 14:29:13 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.05 14:41:27 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.09.05 14:29:13 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.09.05 14:29:13 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.05 14:29:12 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.09.05 14:29:12 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.11.12 21:08:07 | 000,438,439 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 15079 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O4 - HKLM..\Run: [MSC] C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuMyMusic = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: GreyMSIAds = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 1
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Vertrauenswürdige Sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1346857358843 (MUWebControl Class)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} Reg Error: Value error. (McFreeScan Class)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Programme\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.13 14:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\Open(&0)\command - "" = Recycled\ctfmon.exe
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell - "" = AutoRun
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell\AutoRun\command - "" = G:\DTE_Privacy_launcher.exe
O33 - MountPoints2\{cc64d7c2-cbdf-11de-8515-00123fb77450}\Shell\AutoRun\command - "" = H:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.05 18:34:23 | 000,599,040 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\OTL.exe
[2012.09.05 17:51:01 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\TanteKaete\Recent
[2012.09.05 17:19:49 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\esetsmartinstaller_enu.exe
[2012.09.05 16:21:50 | 000,000,000 | ---D | C] -- C:\Programme\Windows Defender
[2012.09.05 15:18:21 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Client
[2012.09.05 15:01:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Office Live Add-in
[2012.09.05 15:01:23 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft
[2012.09.05 14:32:13 | 000,000,000 | ---D | C] -- C:\Programme\xp-AntiSpy
[2012.09.05 14:32:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\TanteKaete\Startmenü\Programme\xp-AntiSpy
[2012.09.05 14:29:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.09.05 14:29:36 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.09.05 14:14:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2012.09.05 14:12:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Application Data
[2012.09.05 14:08:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SpywareBlaster
[2012.09.05 13:43:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\TanteKaete\Eigene Dateien
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.05 18:34:28 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\OTL.exe
[2012.09.05 18:33:07 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\defogger_reenable
[2012.09.05 18:32:21 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\Defogger.exe
[2012.09.05 18:01:56 | 000,000,358 | -H-- | M] () -- C:\WINDOWS\tasks\MpIdleTask.job
[2012.09.05 18:00:00 | 000,000,520 | ---- | M] () -- C:\WINDOWS\tasks\Automatische Wartung.job
[2012.09.05 17:52:13 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.09.05 17:51:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.09.05 17:51:44 | 000,224,024 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.09.05 17:19:52 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\esetsmartinstaller_enu.exe
[2012.09.05 15:47:57 | 000,460,810 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.09.05 15:47:57 | 000,442,942 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.09.05 15:47:57 | 000,085,674 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.09.05 15:47:57 | 000,072,208 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.09.05 15:47:39 | 000,000,057 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2012.09.05 15:22:53 | 000,001,912 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2012.09.05 15:12:15 | 000,003,001 | ---- | M] () -- C:\WINDOWS\System32\config.nt
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.05 18:33:07 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\defogger_reenable
[2012.09.05 18:32:18 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\Defogger.exe
[2012.09.05 17:51:44 | 000,224,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.09.05 16:21:55 | 000,001,091 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Defender.lnk
[2012.09.05 16:13:09 | 000,000,358 | -H-- | C] () -- C:\WINDOWS\tasks\MpIdleTask.job
[2012.09.05 15:22:53 | 000,001,912 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
[2012.09.05 15:18:41 | 000,001,684 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Security Essentials.lnk
[2010.01.09 02:08:28 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\PnkBstrK.sys
[2006.11.16 17:10:08 | 000,090,790 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\C
[2006.01.15 11:23:40 | 000,004,470 | RHS- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\ntuser.pol
[2006.01.14 21:34:11 | 000,000,816 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol
[2006.01.13 12:56:31 | 000,000,042 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\default.pls
[2006.01.03 01:00:38 | 000,224,768 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.01.02 15:40:09 | 000,000,143 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== LOP Check ==========
 
[2010.08.24 18:14:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2009.11.20 16:03:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2008.07.16 17:13:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iolo
[2008.03.26 18:50:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2006.02.24 18:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2012.09.05 14:10:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.01.07 16:32:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.12.30 18:03:59 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2009.12.06 01:55:38 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2009.11.20 16:03:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Buhl Data Service
[2009.11.20 16:03:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Buhl Data Service GmbH
[2010.07.09 23:06:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.04.14 22:49:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\GARMIN
[2006.07.14 11:53:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\ICAClient
[2008.07.16 17:13:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\iolo
[2006.01.03 14:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Leadertech
[2009.03.24 13:52:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Miranda
[2008.11.16 21:29:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\OpenOffice.org
[2006.01.04 16:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Opera
[2006.01.02 20:20:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Template
[2010.08.23 19:22:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Thunderbird
[2010.12.30 18:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\TuneUp Software
[2009.08.20 21:20:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\UBitMenu
[2012.09.05 18:00:00 | 000,000,520 | ---- | M] () -- C:\WINDOWS\Tasks\Automatische Wartung.job
[2006.01.03 17:30:00 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP-Anmeldungserinnerung 1.job
[2012.09.05 18:01:56 | 000,000,358 | -H-- | M] () -- C:\WINDOWS\Tasks\MpIdleTask.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 105 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5C321E34

< End of report >
Extras.txt
Code:
OTL Extras logfile created on: 05.09.2012 18:35:56 - Run 1
OTL by OldTimer - Version 3.2.61.0    Folder = C:\Dokumente und Einstellungen\TanteKaete\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,27 Gb Available Physical Memory | 75,80% Memory free
11,63 Gb Paging File | 11,14 Gb Available in Paging File | 95,74% Paging File free
Paging file location(s): D:\pagefile.sys 9000 9000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,29 Gb Total Space | 15,55 Gb Free Space | 53,08% Space Free | Partition Type: NTFS
Drive D: | 200,46 Gb Total Space | 178,46 Gb Free Space | 89,02% Space Free | Partition Type: NTFS
Drive I: | 436,39 Gb Total Space | 39,53 Gb Free Space | 9,06% Space Free | Partition Type: NTFS
 
Computer Name: TANTE_KAETE | User Name: TanteKaete | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.inf [@ = inffile] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- Reg Error: Key error.
batfile [open] -- "%1" %*
batfile [print] -- Reg Error: Key error.
cmdfile [edit] -- Reg Error: Key error.
cmdfile [open] -- "%1" %*
cmdfile [print] -- Reg Error: Key error.
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [open] -- Reg Error: Key error.
inffile [print] -- Reg Error: Key error.
inifile [print] -- Reg Error: Key error.
jsfile [edit] -- Reg Error: Key error.
jsfile [print] -- Reg Error: Key error.
jsefile [edit] -- Reg Error: Key error.
jsefile [print] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [edit] -- Reg Error: Key error.
regfile [merge] -- Reg Error: Key error.
regfile [print] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [print] -- Reg Error: Key error.
txtfile [printto] -- Reg Error: Key error.
vbefile [edit] -- Reg Error: Key error.
vbefile [print] -- Reg Error: Key error.
vbsfile [edit] -- Reg Error: Key error.
vbsfile [print] -- Reg Error: Key error.
wsffile [edit] -- Reg Error: Key error.
wsffile [print] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VLCPlayer\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OpenNew] -- cmd.exe /k cd %1 (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VLCPlayer\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0893078B-8A9A-84D6-D393-119B9B0B033A}" = CCC Help French
"{0E2A60F7-2907-5718-FF16-7D8FAF70051E}" = CCC Help Chinese Standard
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{14FAE013-AE19-4FC9-B5BF-E56ADC01ECE6}" = CCC Help Turkish
"{17BB2784-6EE4-D7FF-FE63-58A3AD2B3708}" = CCC Help Russian
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{233588CF-96D5-46AF-EF74-7EC382662791}" = Catalyst Control Center Graphics Full Existing
"{24E7B19B-EA09-483F-8735-97DD371E861B}" = SA32xx Media Converter
"{3260ECBC-9DDF-E7A3-0863-449473BC7BD5}" = CCC Help Chinese Traditional
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39C6C229-CFFD-639E-229A-E463FCD87478}" = CCC Help German
"{4F11FC80-CE8C-1BD4-5C39-EBE5744E5135}" = CCC Help Portuguese
"{4FAB2BA7-E16C-95D2-F326-60A68409373F}" = Catalyst Control Center HydraVision Full
"{529AA9A8-5020-6CFB-A809-BC5943C87077}" = CCC Help Thai
"{53604297-26FD-516D-6FF7-1063BA64A0A4}" = Catalyst Control Center Graphics Light
"{55BD3B0B-F054-9341-514F-295A5F7EA450}" = CCC Help Spanish
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5A4FA9C8-ED56-08C3-153B-FC5C19256290}" = CCC Help Dutch
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6C390D51-E5F0-4FCD-24C4-731ACAF34571}" = CCC Help Japanese
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AA8FA9A-1656-7DBD-633B-FE7A62BBED0C}" = CCC Help Czech
"{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel(R) PROSet for Wired Connections
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8C22131B-8634-CECF-F0D1-A2ECC160B450}" = CCC Help Norwegian
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90FBE4D0-2ACA-A8A8-2CC4-CFFBAE528504}" = CCC Help Finnish
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D74375E-3012-E7D2-9229-B220C91F326A}" = Catalyst Control Center Core Implementation
"{9EE8BDCA-7505-4895-D91E-8108DD16292E}" = CCC Help English
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8AF8BD3-61B5-7945-4D1B-217421F604FC}" = CCC Help Hungarian
"{AA46E1C5-A709-6D9B-D99D-92E4C6E042A9}" = CCC Help Korean
"{AA62A33C-9E5E-3913-7D88-7E58A8CB1493}" = CCC Help Greek
"{AFA7FAAA-D267-4243-9B09-165A68501031}" = Nero 7 Essentials
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B653F643-A1B4-9936-2DB6-FEA9A3110D8D}" = ccc-core-preinstall
"{B71C4637-0247-78CE-6A3D-D61645CB8921}" = ccc-utility
"{BC2E7C0B-1AC6-5F6C-F31D-E1E72D8E0B5C}" = CCC Help Danish
"{BF8C7DA7-2DE6-ED67-6C82-6BE82F8BA8D3}" = Catalyst Control Center Graphics Full New
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C409F338-BB20-6C4A-F40D-20CA07AF714C}" = CCC Help Polish
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1" = UBitMenuDE
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{D4B7B2DC-E688-A9D6-6EC0-56AE540E074C}" = Catalyst Control Center Localization All
"{D9CD701B-3F04-FC69-D974-F3A7F5E9BA30}" = CCC Help Swedish
"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding
"{E213321B-1E88-B38D-DAB2-D8CB9355984A}" = Skins
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4148D8F-ED3A-3097-509C-04D5560220F9}" = ccc-core-static
"{F7E68997-E626-952B-A7BF-F72066CD5D77}" = Catalyst Control Center Graphics Previews Common
"{FA36C82B-464D-51F2-A6A1-0BC9140BE067}" = CCC Help Italian
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner
"FS-720 Utilities" = Kyocera FS-720 Version 1.0
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PROSet" = Intel(R) PRO Network Connections Drivers
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"SpywareBlaster_is1" = SpywareBlaster 4.6
"VLC media player" = VLC media player 0.9.4
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR Archivierer
"xp-AntiSpy" = xp-AntiSpy 3.98-2
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05.09.2012 08:24:09 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 05.09.2012 08:39:50 | Computer Name = TANTE_KAETE | Source = SecurityCenter | ID = 1802
Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der
 WMI herstellen, um Antivirus- und Firewallprogramme von Drittanbietern zu überwachen.
 
Error - 05.09.2012 09:13:28 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 05.09.2012 09:17:07 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 05.09.2012 09:34:17 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 05.09.2012 10:19:27 | Computer Name = TANTE_KAETE | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 05.09.2012 10:54:19 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 05.09.2012 11:00:41 | Computer Name = TANTE_KAETE | Source = SecurityCenter | ID = 1802
Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der
 WMI herstellen, um Antivirus- und Firewallprogramme von Drittanbietern zu überwachen.
 
Error - 05.09.2012 11:23:25 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 05.09.2012 11:52:00 | Computer Name = TANTE_KAETE | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
 werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
[ System Events ]
Error - 05.09.2012 09:45:22 | Computer Name = TANTE_KAETE | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

        Neue
 Signaturversion:      Vorherige Signaturversion: 0.0.0.0    Aktualisierungsquelle: %%851

        Aktualisierungsphase:
 %%852    Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=0.0.0.0&avdelta=0.0.0.0&asdelta=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signaturtyp:
 %%801    Aktualisierungstyp: %%803    Benutzer: NT-AUTORITÄT\NETZWERKDIENST    Aktuelle Modulversion:
      Vorherige Modulversion: 0.0.0.0    Fehlercode: 0x80072ee7    Fehlerbeschreibung: The server
 name or address could not be resolved
 
Error - 05.09.2012 09:45:22 | Computer Name = TANTE_KAETE | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

        Neue
 Signaturversion:      Vorherige Signaturversion: 0.0.0.0    Aktualisierungsquelle: %%851

        Aktualisierungsphase:
 %%852    Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=0.0.0.0&avdelta=0.0.0.0&asdelta=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signaturtyp:
 %%800    Aktualisierungstyp: %%803    Benutzer: NT-AUTORITÄT\NETZWERKDIENST    Aktuelle Modulversion:
      Vorherige Modulversion: 0.0.0.0    Fehlercode: 0x80072ee7    Fehlerbeschreibung: The server
 name or address could not be resolved
 
Error - 05.09.2012 09:45:22 | Computer Name = TANTE_KAETE | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

        Neue
 Signaturversion:      Vorherige Signaturversion: 0.0.0.0    Aktualisierungsquelle: %%851

        Aktualisierungsphase:
 %%852    Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=0.0.0.0&avdelta=0.0.0.0&asdelta=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signaturtyp:
 %%801    Aktualisierungstyp: %%803    Benutzer: NT-AUTORITÄT\NETZWERKDIENST    Aktuelle Modulversion:
      Vorherige Modulversion: 0.0.0.0    Fehlercode: 0x80072ee7    Fehlerbeschreibung: The server
 name or address could not be resolved
 
Error - 05.09.2012 09:45:22 | Computer Name = TANTE_KAETE | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

        Neue
 Signaturversion:      Vorherige Signaturversion: 0.0.0.0    Aktualisierungsquelle: %%851

        Aktualisierungsphase:
 %%852    Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=0.0.0.0&avdelta=0.0.0.0&asdelta=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signaturtyp:
 %%800    Aktualisierungstyp: %%803    Benutzer: NT-AUTORITÄT\NETZWERKDIENST    Aktuelle Modulversion:
      Vorherige Modulversion: 0.0.0.0    Fehlercode: 0x80072ee7    Fehlerbeschreibung: The server
 name or address could not be resolved
 
Error - 05.09.2012 10:10:24 | Computer Name = TANTE_KAETE | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

        Neue
 Signaturversion:      Vorherige Signaturversion: 0.0.0.0    Aktualisierungsquelle: %%859

        Aktualisierungsphase:
 %%852    Quellpfad: hxxp://www.microsoft.com    Signaturtyp: %%800    Aktualisierungstyp: %%803

        Benutzer:
 NT-AUTORITÄT\SYSTEM    Aktuelle Modulversion:      Vorherige Modulversion: 0.0.0.0    Fehlercode:
 0x8024402c    Fehlerbeschreibung: Unerwartetes Problem bei der Überprüfung auf Updates.
 Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie
 unter "Hilfe und Support".
 
Error - 05.09.2012 10:12:58 | Computer Name = TANTE_KAETE | Source = DCOM | ID = 10010
Description = Der Server "{C49E32C6-BC8B-11D2-85D4-00105A1F8304}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 05.09.2012 10:21:38 | Computer Name = TANTE_KAETE | Source = DCOM | ID = 10010
Description = Der Server "{C49E32C6-BC8B-11D2-85D4-00105A1F8304}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 05.09.2012 10:23:50 | Computer Name = TANTE_KAETE | Source = DCOM | ID = 10010
Description = Der Server "{C49E32C6-BC8B-11D2-85D4-00105A1F8304}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 05.09.2012 10:50:03 | Computer Name = TANTE_KAETE | Source = DCOM | ID = 10010
Description = Der Server "{C49E32C6-BC8B-11D2-85D4-00105A1F8304}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 05.09.2012 11:36:24 | Computer Name = TANTE_KAETE | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse
 00123FB77450 wurde durch  den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
 
[ TuneUp Events ]
Error - 31.12.2010 05:40:31 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 31.12.2010 08:48:55 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 31.12.2010 12:41:56 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 01.01.2011 07:33:49 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 02.01.2011 14:22:42 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 03.01.2011 14:35:03 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 04.01.2011 02:31:46 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 05.01.2011 13:42:26 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 05.01.2011 16:15:16 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
Error - 06.01.2011 13:11:34 | Computer Name = TANTE_KAETE | Source = TuneUp.UtilitiesSvc | ID = 300
Description =
 
 
< End of report >
gmer.log
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-05 19:36:57
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f Maxtor_7L250S0 rev.BACE1G10
Running: tqfbrqhp.exe; Driver: C:\DOKUME~1\TANTEK~1\LOKALE~1\Temp\uwldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                  section is writeable [0xB99A4000, 0x1C5D38, 0xE8000020]
.text          C:\WINDOWS\system32\DRIVERS\atksgt.sys                                    section is writeable [0xAEB54300, 0x22020, 0xE8000020]
.text          C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                    section is writeable [0xBA3D8300, 0x1B7E, 0xE8000020]

---- Devices - GMER 1.0.15 ----

Device                                                                                    mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device                                                                                    AE6EDD20
Device                                                                                    AE705631

AttachedDevice                                                                            fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                   
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODI03.00.00.01PRO  D75DDEBEF0371A271F5ECFB3D5F5F0D0D4E0A3DCCFE91BB77F1388F8D88D717B36BFF3352AEB2784523E3B7D52667F526583EADB1605D6EB0D3DFCE626DA7CCE0B78DA3CA6765C76305C2596816472F89D7960E3094519A2CE9E5AFA6EEA1EB9F5C67154870F2DB9A61324DD629384AD5853EDD5A5D5031AAAA1FCB7CB91FC6E8A902E4025D2658D965EDF792878C66462C613D51C458A13FCD6D8E28C07139C525C180708C225B455DF964F3B7B9B90FDAD604D52067653136E7686B064ADFB48D5CA73EE41DC77ABDC188C366BBB2B6106FDE960FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D14078EDD5E5BE2F6E667A2D97226D213B5556345ED617E41E537A7F780A440DC5E14CBC718209940E4E3C7D439FA656D4B375D6EBB0066B0CA761F025A541A47228480ED5D890DCA49AEF991CF784475297B38B9C6EE3EAEEEB4E1D9B8A5F76B6951E892DE16086676ABEE0A3391CC1603FEB194702FA10317C395AFAC07ADE9F84D34C900403CA554C67C56B5EC27F5816CE9BA1A36D20ECC2B4487CCDAB772D8FC72FC25F67B2F0C22DDE5AF279ED18EA2E3C02D6DB53ED927D9B8AEF6314DD6979BE7B81EBC3F0C92B37AFACE24F95AB48A8D1532D31AD0A728EDF1A45E54848A8A1CA88A9925852301A97

---- EOF - GMER 1.0.15 ----

Ein Problem ist, dass ich nicht in der Lage bin die Windows-Firewall und den Security-Center-Dienst dauerhaft einzuschalten, beide Dienste sind nach einem Neustart wieder beendet.

Der Security-Center erkennt außerdem keine Virensoftware und das obwohl ich Microsoft Security Essentials verwende.

Bei der Windows Firewall erhalte ich unter dem Reiter "Erweitert" die Fehlermeldung: "Die Netzwerkverbindungseinstellungen wurden beschädigt. Klicken sie auf "Wiederherstellen", um das Problem zu beheben. Dadurch werden alle Windows-Firewalleinstellungen gelöscht und einige Programme funktioneren evtl. nicht mehr richtig."

Leider hilft das Klicken auf den Wiederherstellungsbutton garnix.

Ich erwähne das nur, da im ersten Malwarebytes-Log Meldungen vorkommen, die mit dem Security-Center-Dienst, Firewall und Virenschutz zu tun haben.

So, das wars erstmal von mir.
Danke schonmal fürs Lesen. :crazy:


PS: Bevor jemand denkt ich würde doppelt posten: Mein Thema vom 27.07.12 betrifft einen anderen Rechner von mir, ich hatte es nur ein wenig verschoben, mich auch mit diesem Problem zu beschäftigen.

cosinus 12.09.2012 10:57
Wo ist das Log vom ESET OnlinceScanner? Das Tool tacht bei dir auf hast du aber noch nicht damit gescannt oder nur das Log vergessen?

Horst1980 12.09.2012 12:48
Ich habe den ESET Online-Scanner noch nicht ausgeführt, da ich erstmal mit http://www.trojaner-board.de/69886-a...-beachten.html begonnen habe.

Ich werde das Log Morgen Abend posten.

Ich werde dann auch gleich den adwCleaner (Search) ausführen und das Log hier posten.


Viele Grüße und bis Morgen.

Horst1980 13.09.2012 18:35
Guten Abend cosinus,

hier die LOGs:

ESET Online-Scanner:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=cb528270e568a04dbef5339ebe935a45
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-13 05:24:52
# local_time=2012-09-13 07:24:52 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=crash
# scanned=77737
# found=1
# cleaned=0
# scan_time=8079
I:\Sicherungen\Downloads\NEU\SoftonicDownloader_fuer_freecol.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
Der Fund ist sinnigerweise eine Sicherung meines anderen Rechners, auf dem dasselbe gefunden wurde.
Ich würde den Ordner einfach löschen, wenn da von Deiner Seite nichts dagegen spricht.


AdwCleaner:
Code:
# AdwCleaner v2.001 - Datei am 09/13/2012 um 19:27:07 erstellt
# Aktualisiert am 09/09/2012 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)
# Benutzer : TanteKaete - TANTE_KAETE
# Bootmodus : Normal
# Ausgeführt unter : C:\Dokumente und Einstellungen\TanteKaete\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\AskBarDis
Wert Gefunden : HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel [Homepage]

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Die Registrierungsdatenbank ist sauber.

*************************

AdwCleaner[R1].txt - [1377 octets] - [13/09/2012 19:27:07]

########## EOF - C:\AdwCleaner[R1].txt - [1437 octets] ##########

cosinus 14.09.2012 12:09
Code:
I:\Sicherungen\Downloads\NEU\SoftonicDownloader_fuer_freecol.exe
Vermüllte Software von Softonic scheint gerade stark in Mode zu sein! :stirn:

Finger weg von Softonic!! :pfui:

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Horst1980 14.09.2012 15:23
Hier der AdwCleaner-LOG:

Code:
# AdwCleaner v2.001 - Datei am 09/14/2012 um 16:14:41 erstellt
# Aktualisiert am 09/09/2012 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)
# Benutzer : TanteKaete - TANTE_KAETE
# Bootmodus : Normal
# Ausgeführt unter : C:\Dokumente und Einstellungen\TanteKaete\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\AskBarDis
Wert Gelöscht : HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel [Homepage]

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.6001.18702

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

*************************

AdwCleaner[R1].txt - [1506 octets] - [13/09/2012 19:27:07]
AdwCleaner[S1].txt - [1789 octets] - [14/09/2012 16:14:41]

########## EOF - C:\AdwCleaner[S1].txt - [1849 octets] ##########

cosinus 14.09.2012 19:56
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Horst1980 14.09.2012 20:29
Guten Abend, :party:

hier der neueste OTL-Log:
Code:
OTL logfile created on: 14.09.2012 21:16:15 - Run 2
OTL by OldTimer - Version 3.2.61.4    Folder = C:\Dokumente und Einstellungen\TanteKaete\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,54 Gb Available Physical Memory | 84,88% Memory free
11,63 Gb Paging File | 11,39 Gb Available in Paging File | 97,91% Paging File free
Paging file location(s): D:\pagefile.sys 9000 9000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,29 Gb Total Space | 13,77 Gb Free Space | 47,01% Space Free | Partition Type: NTFS
Drive D: | 200,46 Gb Total Space | 98,18 Gb Free Space | 48,97% Space Free | Partition Type: NTFS
Drive I: | 436,39 Gb Total Space | 142,26 Gb Free Space | 32,60% Space Free | Partition Type: NTFS
 
Computer Name: TANTE_KAETE | User Name: TanteKaete | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.14 21:13:53 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\OTL.exe
PRC - [2012.03.26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008.04.14 04:22:16 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- %SystemRoot%\system32\wbem\WMIsvc.dll -- (winmgmt)
SRV - File not found [Disabled | Unknown] --  -- (Nlliwn2ruk)
SRV - File not found [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2012.09.14 18:23:57 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.14 18:21:53 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007.06.27 20:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006.11.03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\splitcam.sys -- (SPLITCAM)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\siusbmod.sys -- (siusbmod)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Auto | Stopped] -- System32\drivers\aspi32.sys -- (Aspi32)
DRV - [2012.09.14 20:32:16 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{009E499E-C50D-4D06-972B-6F15E617D5A6}\MpKsl07272756.sys -- (MpKsl07272756)
DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2010.02.03 16:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.21 18:30:48 | 003,565,056 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007.03.18 12:33:20 | 000,165,376 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2007.03.18 12:33:20 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2006.10.25 10:25:48 | 000,028,672 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CO_Mon.sys -- (CO_Mon)
DRV - [2006.09.21 03:37:00 | 001,422,656 | R--- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmudaxu.sys -- (cmudau32)
DRV - [2005.09.12 16:40:08 | 000,047,744 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vserial.sys -- (vserial)
DRV - [2005.09.12 16:40:08 | 000,029,440 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\actser.sys -- (actser)
DRV - [2005.09.12 16:40:08 | 000,015,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vsb.sys -- (vsbus)
DRV - [2005.06.15 00:40:08 | 000,180,864 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005.03.15 17:04:00 | 000,161,792 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ov530vid.sys -- (ovt530)
DRV - [2005.02.23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2002.11.07 15:20:16 | 000,116,110 | ---- | M] (Mars Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MR97310v.sys -- (MR97310_VGA_DUAL_CAMERA)
DRV - [2001.11.01 09:30:30 | 000,041,759 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [1997.09.28 13:53:06 | 000,040,288 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mgnt.sys -- (MicroGuard)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://www.google.com/preferences?hl={SUB_RFC1766}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie?hl={SUB_RFC1766}
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie?hl={SUB_RFC1766}
IE - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..\SearchScopes,DefaultScope = {A1AA3292-673C-46C4-A7FE-830A38FBFA05}
IE - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..\SearchScopes\{A1AA3292-673C-46C4-A7FE-830A38FBFA05}: "URL" = hxxp://www.google.de/search?q={searchTerms}&rlz=
IE - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledAddons: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20120827
FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.5.5
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.14 18:21:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.09.14 18:20:19 | 000,000,000 | ---D | M]
 
[2010.08.23 19:30:38 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Extensions
[2010.08.23 19:30:38 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.09.14 18:15:49 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions
[2012.09.05 17:11:56 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.09.14 18:15:49 | 000,527,915 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 14:30:18 | 000,741,958 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.14 18:20:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.14 18:21:54 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.09.05 14:29:13 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.05 14:41:27 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.09.05 14:29:13 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.09.05 14:29:13 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.05 14:29:12 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.09.05 14:29:12 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.11.12 21:08:07 | 000,438,439 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 15079 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O4 - HKLM..\Run: [MSC] C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: GreyMSIAds = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = Reg Error: Value error. File not found
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuMyMusic = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 1
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O15 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..Trusted Domains: microsoft.com ([*.update] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..Trusted Domains: microsoft.com ([*.update] https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..Trusted Domains: microsoft.com ([update] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..Trusted Domains: microsoft.com ([update] https in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\..Trusted Domains: windowsupdate.com ([download] http in Vertrauenswürdige Sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1346857358843 (MUWebControl Class)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} Reg Error: Value error. (McFreeScan Class)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Programme\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.13 14:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\Open(&0)\command - "" = Recycled\ctfmon.exe
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell - "" = AutoRun
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell\AutoRun\command - "" = G:\DTE_Privacy_launcher.exe
O33 - MountPoints2\{cc64d7c2-cbdf-11de-8515-00123fb77450}\Shell\AutoRun\command - "" = H:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: winmgmt - %SystemRoot%\system32\wbem\WMIsvc.dll File not found
 
MsConfig - Services: "UxTuneUp"
MsConfig - Services: "TapiSrv"
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 0
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: MsMpSvc - C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: WinMgmt - %SystemRoot%\system32\wbem\WMIsvc.dll File not found
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: MsMpSvc - C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm -  File not found
SafeBootNet: nm.sys -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: vsmon - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: WinMgmt - %SystemRoot%\system32\wbem\WMIsvc.dll File not found
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6524D45C-1FD8-4A12-FDE3-CD638A3C6E15} - Vektorgrafik-Rendering (VML)
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - rundll32.exe C:\WINDOWS\system32\Setup\FxsOcm.dll,XP_UninstallProvider
ActiveX: {A38B334A-A0A2-436D-BAA0-34FE5E517E44} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player 9 ActiveX
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /HideWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
System Restore Service not available.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.14 21:13:44 | 000,599,552 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\OTL.exe
[2012.09.14 21:12:31 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\TanteKaete\Recent
[2012.09.14 21:12:12 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Trojaner Board
[2012.09.14 19:18:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Silverlight
[2012.09.14 19:17:30 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Silverlight
[2012.09.14 18:42:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Winamp
[2012.09.14 18:37:23 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Nero
[2012.09.14 18:37:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nero
[2012.09.14 18:30:49 | 000,000,000 | ---D | C] -- C:\Programme\ATI
[2012.09.14 18:28:55 | 000,000,000 | ---D | C] -- C:\AMD
[2012.09.14 18:22:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner
[2012.09.14 18:20:17 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2012.09.14 18:18:02 | 000,000,000 | ---D | C] -- C:\Programme\FileHippo.com
[2012.09.13 17:08:18 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.09.05 17:19:49 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\esetsmartinstaller_enu.exe
[2012.09.05 16:21:50 | 000,000,000 | ---D | C] -- C:\Programme\Windows Defender
[2012.09.05 15:18:21 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Client
[2012.09.05 15:01:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Office Live Add-in
[2012.09.05 15:01:23 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft
[2012.09.05 14:32:13 | 000,000,000 | ---D | C] -- C:\Programme\xp-AntiSpy
[2012.09.05 14:32:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\TanteKaete\Startmenü\Programme\xp-AntiSpy
[2012.09.05 14:29:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.09.05 14:29:36 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.09.05 14:14:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2012.09.05 14:12:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Application Data
[2012.09.05 14:08:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SpywareBlaster
[2012.09.05 13:43:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\TanteKaete\Eigene Dateien
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.14 21:13:53 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\OTL.exe
[2012.09.14 21:07:44 | 000,226,304 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.14 21:00:00 | 000,000,520 | ---- | M] () -- C:\WINDOWS\tasks\Automatische Wartung.job
[2012.09.14 20:52:31 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.09.14 20:41:44 | 000,000,358 | -H-- | M] () -- C:\WINDOWS\tasks\MpIdleTask.job
[2012.09.14 20:31:58 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.09.14 20:31:55 | 000,004,470 | RHS- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\ntuser.pol
[2012.09.14 20:31:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.09.14 20:29:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.09.14 20:03:22 | 000,001,189 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2012.09.14 19:45:46 | 000,483,052 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.09.14 19:45:46 | 000,080,456 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.09.14 19:45:45 | 000,504,316 | ---- | M] () -- C:\WINDOWS\System32\prfh0407.dat
[2012.09.14 19:45:45 | 000,504,316 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.09.14 19:45:45 | 000,096,130 | ---- | M] () -- C:\WINDOWS\System32\prfc0407.dat
[2012.09.14 19:39:49 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.09.14 19:32:55 | 000,096,130 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.09.14 18:28:12 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.13 19:21:35 | 000,512,399 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\adwcleaner.exe
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.09.05 18:43:30 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\tqfbrqhp.exe
[2012.09.05 18:33:07 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\defogger_reenable
[2012.09.05 18:32:21 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\Defogger.exe
[2012.09.05 17:19:52 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\esetsmartinstaller_enu.exe
[2012.09.05 15:47:39 | 000,000,057 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2012.09.05 15:22:53 | 000,001,912 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2012.09.05 15:12:15 | 000,003,001 | ---- | M] () -- C:\WINDOWS\System32\config.nt
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.14 19:45:45 | 000,504,316 | ---- | C] () -- C:\WINDOWS\System32\prfh0407.dat
[2012.09.14 19:45:45 | 000,096,130 | ---- | C] () -- C:\WINDOWS\System32\prfc0407.dat
[2012.09.14 19:32:53 | 000,107,882 | ---- | C] () -- C:\WINDOWS\System32\mib_ii.mib
[2012.09.14 19:32:53 | 000,049,275 | ---- | C] () -- C:\WINDOWS\System32\wfospf.mib
[2012.09.14 19:32:53 | 000,048,593 | ---- | C] () -- C:\WINDOWS\System32\hostmib.mib
[2012.09.14 19:32:53 | 000,038,608 | ---- | C] () -- C:\WINDOWS\System32\nipx.mib
[2012.09.14 19:32:53 | 000,034,317 | ---- | C] () -- C:\WINDOWS\System32\msiprip2.mib
[2012.09.14 19:32:53 | 000,030,448 | ---- | C] () -- C:\WINDOWS\System32\mcastmib.mib
[2012.09.14 19:32:53 | 000,026,236 | ---- | C] () -- C:\WINDOWS\System32\wins.mib
[2012.09.14 19:32:53 | 000,026,100 | ---- | C] () -- C:\WINDOWS\System32\lmmib2.mib
[2012.09.14 19:32:53 | 000,021,386 | ---- | C] () -- C:\WINDOWS\System32\mipx.mib
[2012.09.14 19:32:53 | 000,020,079 | ---- | C] () -- C:\WINDOWS\System32\http.mib
[2012.09.14 19:32:53 | 000,016,617 | ---- | C] () -- C:\WINDOWS\System32\authserv.mib
[2012.09.14 19:32:53 | 000,015,799 | ---- | C] () -- C:\WINDOWS\System32\ipforwd.mib
[2012.09.14 19:32:53 | 000,013,767 | ---- | C] () -- C:\WINDOWS\System32\msipbtp.mib
[2012.09.14 19:32:53 | 000,010,313 | ---- | C] () -- C:\WINDOWS\System32\mripsap.mib
[2012.09.14 19:32:53 | 000,006,179 | ---- | C] () -- C:\WINDOWS\System32\ftp.mib
[2012.09.14 19:32:53 | 000,004,597 | ---- | C] () -- C:\WINDOWS\System32\dhcp.mib
[2012.09.14 19:32:53 | 000,004,332 | ---- | C] () -- C:\WINDOWS\System32\smi.mib
[2012.09.14 19:32:53 | 000,000,698 | ---- | C] () -- C:\WINDOWS\System32\inetsrv.mib
[2012.09.14 19:32:53 | 000,000,581 | ---- | C] () -- C:\WINDOWS\System32\msft.mib
[2012.09.14 19:32:52 | 000,015,597 | ---- | C] () -- C:\WINDOWS\System32\accserv.mib
[2012.09.14 18:23:43 | 000,000,884 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.09.14 17:04:19 | 000,225,262 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msimain.sdb
[2012.09.14 16:30:27 | 000,000,322 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.09.13 19:21:14 | 000,512,399 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\adwcleaner.exe
[2012.09.05 18:43:26 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\tqfbrqhp.exe
[2012.09.05 18:33:07 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\defogger_reenable
[2012.09.05 18:32:18 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Desktop\Defogger.exe
[2012.09.05 16:13:09 | 000,000,358 | -H-- | C] () -- C:\WINDOWS\tasks\MpIdleTask.job
[2012.09.05 15:22:53 | 000,001,912 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
[2010.01.09 02:08:28 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\PnkBstrK.sys
[2006.11.16 17:10:08 | 000,090,790 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\C
[2006.01.15 11:23:40 | 000,004,470 | RHS- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\ntuser.pol
[2006.01.14 21:34:11 | 000,000,816 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol
[2006.01.13 12:56:31 | 000,000,042 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\default.pls
[2006.01.03 01:00:38 | 000,226,304 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.01.02 15:40:09 | 000,000,143 | ---- | C] () -- C:\Dokumente und Einstellungen\TanteKaete\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== LOP Check ==========
 
[2010.08.24 18:14:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2009.11.20 16:03:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2008.07.16 17:13:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iolo
[2008.03.26 18:50:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2006.02.24 18:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2012.09.05 14:10:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.01.07 16:32:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.12.30 18:03:59 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2009.12.06 01:55:38 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2011.01.06 19:13:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\TuneUp Software
[2011.01.07 18:13:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\TuneUp Software
[2009.11.20 16:03:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Buhl Data Service
[2009.11.20 16:03:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Buhl Data Service GmbH
[2010.07.09 23:06:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.04.14 22:49:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\GARMIN
[2006.07.14 11:53:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\ICAClient
[2008.07.16 17:13:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\iolo
[2006.01.03 14:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Leadertech
[2009.03.24 13:52:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Miranda
[2008.11.16 21:29:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\OpenOffice.org
[2006.01.04 16:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Opera
[2006.01.02 20:20:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Template
[2010.08.23 19:22:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Thunderbird
[2010.12.30 18:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\TuneUp Software
[2009.08.20 21:20:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\UBitMenu
[2012.09.14 21:00:00 | 000,000,520 | ---- | M] () -- C:\WINDOWS\Tasks\Automatische Wartung.job
[2006.01.03 17:30:00 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP-Anmeldungserinnerung 1.job
[2012.09.14 19:39:49 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2012.09.14 20:41:44 | 000,000,358 | -H-- | M] () -- C:\WINDOWS\Tasks\MpIdleTask.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.16 17:13:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Adobe
[2006.09.27 11:24:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Ahead
[2006.10.25 23:19:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\ArcSoft
[2009.10.20 00:08:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\ATI
[2009.11.20 16:03:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Buhl Data Service
[2009.11.20 16:03:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Buhl Data Service GmbH
[2006.01.10 22:37:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\CyberLink
[2011.02.11 21:20:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\dvdcss
[2010.07.09 23:06:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.04.14 22:49:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\GARMIN
[2009.06.20 11:45:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Google
[2011.01.06 22:21:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Hamachi
[2006.01.12 03:31:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Help
[2006.07.14 11:53:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\ICAClient
[2006.01.03 03:03:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Identities
[2008.07.16 17:13:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\iolo
[2006.01.15 18:46:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Jasc Software Inc
[2006.01.03 14:28:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Leadertech
[2006.02.24 18:32:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Macromedia
[2012.07.28 14:14:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Malwarebytes
[2012.09.05 13:25:15 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Microsoft
[2009.03.24 13:52:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Miranda
[2010.01.03 23:57:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Move Networks
[2008.10.08 16:28:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Mozilla
[2008.11.16 21:29:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\OpenOffice.org
[2008.11.16 21:23:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\OpenOffice.org2
[2006.01.04 16:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Opera
[2012.09.05 13:46:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Real
[2011.05.20 17:27:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Skype
[2011.03.18 21:13:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\skypePM
[2005.12.20 19:50:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Sun
[2007.06.22 15:42:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\teamspeak2
[2006.01.02 20:20:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Template
[2010.08.23 19:22:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\Thunderbird
[2010.12.30 18:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\TuneUp Software
[2009.08.20 21:20:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\UBitMenu
[2009.01.28 20:42:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\vlc
 
< %APPDATA%\*.exe /s >
[2009.08.20 21:20:21 | 000,696,341 | ---- | M] () -- C:\Dokumente und Einstellungen\TanteKaete\Anwendungsdaten\UBitMenu\unins000.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2006.01.03 02:49:37 | 018,782,319 | ---- | M] () .cab file -- C:\dell\MEDIAEXE\Media\I386\sp2.cab:AGP440.sys
[2004.08.04 16:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
[2004.08.04 16:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.09.26 16:34:26 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.09.26 16:34:26 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\i386\AGP440.SYS
 
< MD5 for: ATAPI.SYS  >
[2006.01.03 02:49:37 | 018,782,319 | ---- | M] () .cab file -- C:\dell\MEDIAEXE\Media\I386\sp2.cab:atapi.sys
[2004.08.04 16:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
[2004.08.04 16:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.09.26 16:34:26 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.09.26 16:34:26 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\i386\atapi.sys
[2004.08.04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[2004.08.04 00:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 16:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\i386\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2005.04.25 15:28:14 | 000,871,040 | ---- | M] (Intel Corporation) MD5=D593517879E65167DF35F6015814AC59 -- C:\dell\MEDIAEXE\Media\I386\iaStor.sys
[2005.04.25 15:28:14 | 000,871,040 | ---- | M] (Intel Corporation) MD5=D593517879E65167DF35F6015814AC59 -- C:\dell\MEDIAEXE\RepFiles\iastor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 16:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\i386\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 16:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\i386\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 16:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\i386\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 16:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\i386\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 16:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\i386\winlogon.exe
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 16:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\i386\ws2ifsl.sys
[2004.08.04 16:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2004.08.13 14:46:20 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2004.08.13 14:46:20 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2004.08.13 14:46:20 | 000,417,792 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 105 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5C321E34

< End of report >

cosinus 15.09.2012 12:11
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
SRV - File not found [Disabled | Unknown] --  -- (Nlliwn2ruk)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: GreyMSIAds = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = Reg Error: Value error. File not found
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuMyMusic = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKU\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 1
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.13 14:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
O33 - MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\Shell\Open(&0)\command - "" = Recycled\ctfmon.exe
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell - "" = AutoRun
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\Shell\AutoRun\command - "" = G:\DTE_Privacy_launcher.exe
O33 - MountPoints2\{cc64d7c2-cbdf-11de-8515-00123fb77450}\Shell\AutoRun\command - "" = H:\Setup.exe
@Alternate Data Stream - 105 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5C321E34
:Files
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{*
I:\Sicherungen\Downloads\NEU\SoftonicDownloader_fuer_freecol.exe
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Horst1980 15.09.2012 12:23
Guten Morgen: :kaffee:

Das OTL-Fix-Log:
Code:
All processes killed
========== OTL ==========
Error: No service named Nlliwn2ruk was found to stop!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nlliwn2ruk deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{BA52B914-B692-46c4-B683-905236F6F655} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA52B914-B692-46c4-B683-905236F6F655}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoInternetOpenWith deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\GreyMSIAds deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoRecentDocsNetHood deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutorunSetting deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSaveSettings deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoTrayItemsDisplay deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSharedDocuments deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSMMyPictures deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoStartMenuMyMusic deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\StartMenuLogOff deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoUserNameInStartMenu deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoLogoff deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFavoritesMenu deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\Intellimenus deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSimpleStartMenu deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1838793929-2746509759-4267296665-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableChangePassword deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9492787e-6ccf-11db-a5bc-00123fb77450}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9492787e-6ccf-11db-a5bc-00123fb77450}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9492787e-6ccf-11db-a5bc-00123fb77450}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9492787e-6ccf-11db-a5bc-00123fb77450}\ not found.
File C:\Recycled\ctfmon.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb1899f2-bbc7-11de-84f2-00123fb77450}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb1899f2-bbc7-11de-84f2-00123fb77450}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bb1899f2-bbc7-11de-84f2-00123fb77450}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb1899f2-bbc7-11de-84f2-00123fb77450}\ not found.
File G:\DTE_Privacy_launcher.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc64d7c2-cbdf-11de-8515-00123fb77450}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc64d7c2-cbdf-11de-8515-00123fb77450}\ not found.
File H:\Setup.exe not found.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:5C321E34 deleted successfully.
========== FILES ==========
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357} folder moved successfully.
I:\Sicherungen\Downloads\NEU\SoftonicDownloader_fuer_freecol.exe moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\TanteKaete\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\TanteKaete\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 49152 bytes
->Temporary Internet Files folder emptied: 116263 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 41 bytes
 
User: Lars
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 124013 bytes
->Flash cache emptied: 41 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 67442 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: TanteKaete
->Temp folder emptied: 1063424 bytes
->Temporary Internet Files folder emptied: 295046 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 69677104 bytes
->Flash cache emptied: 500 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2673152 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 34021 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 71,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.61.4 log created on 09152012_131559

Files\Folders moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_4bc.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 16.09.2012 14:00
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Horst1980 16.09.2012 16:49
Hier das tdsskiller-Log:
Code:
17:40:45.0890 3112  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
17:40:45.0906 3112  ============================================================
17:40:45.0906 3112  Current date / time: 2012/09/16 17:40:45.0906
17:40:45.0906 3112  SystemInfo:
17:40:45.0906 3112 
17:40:45.0906 3112  OS Version: 5.1.2600 ServicePack: 3.0
17:40:45.0906 3112  Product type: Workstation
17:40:45.0906 3112  ComputerName: TANTE_KAETE
17:40:45.0906 3112  UserName: TanteKaete
17:40:45.0906 3112  Windows directory: C:\WINDOWS
17:40:45.0906 3112  System windows directory: C:\WINDOWS
17:40:45.0906 3112  Processor architecture: Intel x86
17:40:45.0906 3112  Number of processors: 2
17:40:45.0906 3112  Page size: 0x1000
17:40:45.0906 3112  Boot type: Normal boot
17:40:45.0906 3112  ============================================================
17:40:47.0265 3112  Drive \Device\Harddisk0\DR0 - Size: 0x3A35294400 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76BA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:40:47.0265 3112  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:40:47.0328 3112  ============================================================
17:40:47.0328 3112  \Device\Harddisk0\DR0:
17:40:47.0328 3112  MBR partitions:
17:40:47.0328 3112  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1F647, BlocksNum 0x3A962B1
17:40:47.0343 3112  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x3AB5937, BlocksNum 0x190EDEBA
17:40:47.0343 3112  \Device\Harddisk1\DR1:
17:40:47.0343 3112  MBR partitions:
17:40:47.0343 3112  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x1F647, BlocksNum 0x368C7588
17:40:47.0343 3112  ============================================================
17:40:47.0421 3112  C: <-> \Device\Harddisk0\DR0\Partition1
17:40:47.0437 3112  I: <-> \Device\Harddisk1\DR1\Partition1
17:40:47.0468 3112  D: <-> \Device\Harddisk0\DR0\Partition2
17:40:47.0468 3112  ============================================================
17:40:47.0468 3112  Initialize success
17:40:47.0468 3112  ============================================================
17:41:28.0031 1872  ============================================================
17:41:28.0031 1872  Scan started
17:41:28.0031 1872  Mode: Manual; SigCheck; TDLFS;
17:41:28.0031 1872  ============================================================
17:41:28.0187 1872  ================ Scan system memory ========================
17:41:28.0203 1872  System memory - ok
17:41:28.0203 1872  ================ Scan services =============================
17:41:28.0296 1872  [ D5A6658CBFBBF9A0F8827E83C9FDE806 ] 6to4            C:\WINDOWS\System32\6to4svc.dll
17:41:29.0156 1872  6to4 - ok
17:41:29.0171 1872  Abiosdsk - ok
17:41:29.0203 1872  [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5        C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
17:41:29.0812 1872  abp480n5 - ok
17:41:29.0843 1872  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:41:30.0000 1872  ACPI - ok
17:41:30.0015 1872  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\drivers\ACPIEC.sys
17:41:30.0156 1872  ACPIEC - ok
17:41:30.0187 1872  [ 6463D1DB354B13E6CED4D67F6E4910F4 ] actser          C:\WINDOWS\system32\drivers\actser.sys
17:41:30.0187 1872  actser ( UnsignedFile.Multi.Generic ) - warning
17:41:30.0187 1872  actser - detected UnsignedFile.Multi.Generic (1)
17:41:30.0234 1872  Adobe LM Service - ok
17:41:30.0296 1872  [ B2B64AF436FACCFA854DD397027C5360 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:41:30.0328 1872  AdobeFlashPlayerUpdateSvc - ok
17:41:30.0359 1872  [ 9A11864873DA202C996558B2106B0BBC ] adpu160m        C:\WINDOWS\system32\DRIVERS\adpu160m.sys
17:41:30.0484 1872  adpu160m - ok
17:41:30.0515 1872  [ 8BED39E3C35D6A489438B8141717A557 ] aec            C:\WINDOWS\system32\drivers\aec.sys
17:41:30.0671 1872  aec - ok
17:41:30.0703 1872  [ A7B8A3A79D35215D798A300DF49ED23F ] Afc            C:\WINDOWS\system32\drivers\Afc.sys
17:41:30.0718 1872  Afc ( UnsignedFile.Multi.Generic ) - warning
17:41:30.0718 1872  Afc - detected UnsignedFile.Multi.Generic (1)
17:41:30.0750 1872  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD            C:\WINDOWS\System32\drivers\afd.sys
17:41:30.0796 1872  AFD - ok
17:41:30.0828 1872  [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440          C:\WINDOWS\system32\DRIVERS\agp440.sys
17:41:30.0968 1872  agp440 - ok
17:41:31.0000 1872  [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ          C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
17:41:31.0140 1872  agpCPQ - ok
17:41:31.0156 1872  [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x        C:\WINDOWS\system32\DRIVERS\aha154x.sys
17:41:31.0234 1872  Aha154x - ok
17:41:31.0265 1872  [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2        C:\WINDOWS\system32\DRIVERS\aic78u2.sys
17:41:31.0390 1872  aic78u2 - ok
17:41:31.0406 1872  [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx        C:\WINDOWS\system32\DRIVERS\aic78xx.sys
17:41:31.0531 1872  aic78xx - ok
17:41:31.0562 1872  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter        C:\WINDOWS\system32\alrsvc.dll
17:41:31.0718 1872  Alerter - ok
17:41:31.0734 1872  [ 190CD73D4984F94D823F9444980513E5 ] ALG            C:\WINDOWS\System32\alg.exe
17:41:31.0875 1872  ALG - ok
17:41:31.0890 1872  [ 1140AB9938809700B46BB88E46D72A96 ] AliIde          C:\WINDOWS\system32\DRIVERS\aliide.sys
17:41:32.0015 1872  AliIde - ok
17:41:32.0031 1872  [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541        C:\WINDOWS\system32\DRIVERS\alim1541.sys
17:41:32.0171 1872  alim1541 - ok
17:41:32.0171 1872  [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp          C:\WINDOWS\system32\DRIVERS\amdagp.sys
17:41:32.0328 1872  amdagp - ok
17:41:32.0343 1872  [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint          C:\WINDOWS\system32\DRIVERS\amsint.sys
17:41:32.0421 1872  amsint - ok
17:41:32.0453 1872  [ D45960BE52C3C610D361977057F98C54 ] AppMgmt        C:\WINDOWS\System32\appmgmts.dll
17:41:32.0609 1872  AppMgmt - ok
17:41:32.0625 1872  [ 62D318E9A0C8FC9B780008E724283707 ] asc            C:\WINDOWS\system32\DRIVERS\asc.sys
17:41:32.0765 1872  asc - ok
17:41:32.0781 1872  [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p        C:\WINDOWS\system32\DRIVERS\asc3350p.sys
17:41:32.0843 1872  asc3350p - ok
17:41:32.0859 1872  [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550        C:\WINDOWS\system32\DRIVERS\asc3550.sys
17:41:32.0984 1872  asc3550 - ok
17:41:33.0000 1872  Aspi32 - ok
17:41:33.0109 1872  [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
17:41:33.0125 1872  aspnet_state - ok
17:41:33.0156 1872  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:41:33.0296 1872  AsyncMac - ok
17:41:33.0312 1872  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi          C:\WINDOWS\system32\DRIVERS\atapi.sys
17:41:33.0437 1872  atapi - ok
17:41:33.0453 1872  Atdisk - ok
17:41:33.0500 1872  [ 2911A46A482F1BBE39F47BAC4CF6F609 ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe
17:41:33.0625 1872  Ati HotKey Poller - ok
17:41:33.0687 1872  [ 2B2CC2C47F5DE490F27D4292F0EDC034 ] ATI Smart      C:\WINDOWS\system32\ati2sgag.exe
17:41:33.0718 1872  ATI Smart ( UnsignedFile.Multi.Generic ) - warning
17:41:33.0718 1872  ATI Smart - detected UnsignedFile.Multi.Generic (1)
17:41:33.0796 1872  [ E9375396F55B58C2042C7C9844D297E3 ] ati2mtag        C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
17:41:33.0921 1872  ati2mtag - ok
17:41:33.0953 1872  [ 5B80E84AF6B02ECAB72DAE9AFEE06309 ] atksgt          C:\WINDOWS\system32\DRIVERS\atksgt.sys
17:41:33.0968 1872  atksgt ( UnsignedFile.Multi.Generic ) - warning
17:41:33.0968 1872  atksgt - detected UnsignedFile.Multi.Generic (1)
17:41:33.0984 1872  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc        C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:41:34.0125 1872  Atmarpc - ok
17:41:34.0156 1872  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll
17:41:34.0312 1872  AudioSrv - ok
17:41:34.0390 1872  [ D9F724AA26C010A217C97606B160ED68 ] audstub        C:\WINDOWS\system32\DRIVERS\audstub.sys
17:41:34.0515 1872  audstub - ok
17:41:34.0546 1872  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
17:41:34.0671 1872  Beep - ok
17:41:34.0718 1872  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll
17:41:34.0937 1872  BITS - ok
17:41:34.0968 1872  [ B71549F23736ADF83A571061C47777FD ] Browser        C:\WINDOWS\System32\browser.dll
17:41:35.0015 1872  Browser - ok
17:41:35.0062 1872  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf          C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
17:41:35.0203 1872  cbidf - ok
17:41:35.0203 1872  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k        C:\WINDOWS\system32\drivers\cbidf2k.sys
17:41:35.0343 1872  cbidf2k - ok
17:41:35.0375 1872  [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE        C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:41:35.0500 1872  CCDECODE - ok
17:41:35.0531 1872  [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt        C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
17:41:35.0593 1872  cd20xrnt - ok
17:41:35.0609 1872  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio        C:\WINDOWS\system32\drivers\Cdaudio.sys
17:41:35.0734 1872  Cdaudio - ok
17:41:35.0765 1872  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys
17:41:35.0890 1872  Cdfs - ok
17:41:35.0906 1872  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom          C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:41:36.0031 1872  Cdrom - ok
17:41:36.0046 1872  Changer - ok
17:41:36.0078 1872  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc          C:\WINDOWS\system32\cisvc.exe
17:41:36.0203 1872  CiSvc - ok
17:41:36.0234 1872  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv        C:\WINDOWS\system32\clipsrv.exe
17:41:36.0375 1872  ClipSrv - ok
17:41:36.0406 1872  [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:41:36.0437 1872  clr_optimization_v2.0.50727_32 - ok
17:41:36.0484 1872  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
17:41:36.0515 1872  clr_optimization_v4.0.30319_32 - ok
17:41:36.0531 1872  [ C687F81290303D90099B027A6474F99F ] CmdIde          C:\WINDOWS\system32\DRIVERS\cmdide.sys
17:41:36.0656 1872  CmdIde - ok
17:41:36.0703 1872  [ E88181D85616EA843A6E56D1D5758E0B ] cmudau32        C:\WINDOWS\system32\drivers\cmudaxu.sys
17:41:36.0796 1872  cmudau32 ( UnsignedFile.Multi.Generic ) - warning
17:41:36.0796 1872  cmudau32 - detected UnsignedFile.Multi.Generic (1)
17:41:36.0796 1872  COMSysApp - ok
17:41:36.0828 1872  [ 6BE1D6403727BDD8A2B2568DBE6BFB8B ] CO_Mon          C:\WINDOWS\system32\Drivers\CO_Mon.sys
17:41:36.0843 1872  CO_Mon ( UnsignedFile.Multi.Generic ) - warning
17:41:36.0843 1872  CO_Mon - detected UnsignedFile.Multi.Generic (1)
17:41:36.0859 1872  [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray        C:\WINDOWS\system32\DRIVERS\cpqarray.sys
17:41:36.0984 1872  Cpqarray - ok
17:41:37.0015 1872  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll
17:41:37.0140 1872  CryptSvc - ok
17:41:37.0187 1872  [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k        C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
17:41:37.0343 1872  dac2w2k - ok
17:41:37.0375 1872  [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt        C:\WINDOWS\system32\DRIVERS\dac960nt.sys
17:41:37.0500 1872  dac960nt - ok
17:41:37.0546 1872  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll
17:41:37.0609 1872  DcomLaunch - ok
17:41:37.0656 1872  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll
17:41:37.0796 1872  Dhcp - ok
17:41:37.0812 1872  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys
17:41:37.0937 1872  Disk - ok
17:41:37.0953 1872  dmadmin - ok
17:41:37.0984 1872  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys
17:41:38.0140 1872  dmboot - ok
17:41:38.0171 1872  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys
17:41:38.0312 1872  dmio - ok
17:41:38.0375 1872  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys
17:41:38.0515 1872  dmload - ok
17:41:38.0531 1872  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll
17:41:38.0656 1872  dmserver - ok
17:41:38.0703 1872  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys
17:41:38.0828 1872  DMusic - ok
17:41:38.0843 1872  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll
17:41:38.0906 1872  Dnscache - ok
17:41:38.0937 1872  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc        C:\WINDOWS\System32\dot3svc.dll
17:41:39.0078 1872  Dot3svc - ok
17:41:39.0093 1872  [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o          C:\WINDOWS\system32\DRIVERS\dpti2o.sys
17:41:39.0234 1872  dpti2o - ok
17:41:39.0250 1872  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud        C:\WINDOWS\system32\drivers\drmkaud.sys
17:41:39.0390 1872  drmkaud - ok
17:41:39.0421 1872  [ D57A8FC800B501AC05B10D00F66D127A ] E100B          C:\WINDOWS\system32\DRIVERS\e100b325.sys
17:41:39.0468 1872  E100B - ok
17:41:39.0500 1872  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost        C:\WINDOWS\System32\eapsvc.dll
17:41:39.0625 1872  EapHost - ok
17:41:39.0656 1872  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc          C:\WINDOWS\System32\ersvc.dll
17:41:39.0781 1872  ERSvc - ok
17:41:39.0812 1872  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe
17:41:39.0843 1872  Eventlog - ok
17:41:39.0875 1872  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem    C:\WINDOWS\system32\es.dll
17:41:39.0937 1872  EventSystem - ok
17:41:39.0968 1872  [ 38D332A6D56AF32635675F132548343E ] Fastfat        C:\WINDOWS\system32\drivers\Fastfat.sys
17:41:40.0109 1872  Fastfat - ok
17:41:40.0140 1872  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
17:41:40.0187 1872  FastUserSwitchingCompatibility - ok
17:41:40.0203 1872  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc            C:\WINDOWS\system32\DRIVERS\fdc.sys
17:41:40.0343 1872  Fdc - ok
17:41:40.0359 1872  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys
17:41:40.0500 1872  Fips - ok
17:41:40.0531 1872  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:41:40.0656 1872  Flpydisk - ok
17:41:40.0687 1872  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys
17:41:40.0828 1872  FltMgr - ok
17:41:40.0875 1872  [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
17:41:40.0875 1872  FontCache3.0.0.0 - ok
17:41:40.0890 1872  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:41:41.0031 1872  Fs_Rec - ok
17:41:41.0062 1872  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:41:41.0203 1872  Ftdisk - ok
17:41:41.0218 1872  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc            C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:41:41.0359 1872  Gpc - ok
17:41:41.0375 1872  [ D956358054E99E6FFAC69CD87E893A89 ] grmnusb        C:\WINDOWS\system32\drivers\grmnusb.sys
17:41:41.0390 1872  grmnusb ( UnsignedFile.Multi.Generic ) - warning
17:41:41.0390 1872  grmnusb - detected UnsignedFile.Multi.Generic (1)
17:41:41.0421 1872  [ 833051C6C6C42117191935F734CFBD97 ] hamachi        C:\WINDOWS\system32\DRIVERS\hamachi.sys
17:41:41.0437 1872  hamachi - ok
17:41:41.0484 1872  [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus        C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:41:41.0609 1872  HDAudBus - ok
17:41:41.0656 1872  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc        C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:41:41.0781 1872  helpsvc - ok
17:41:41.0812 1872  [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ        C:\WINDOWS\System32\hidserv.dll
17:41:41.0953 1872  HidServ - ok
17:41:41.0984 1872  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb          C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:41:42.0125 1872  HidUsb - ok
17:41:42.0156 1872  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll
17:41:42.0281 1872  hkmsvc - ok
17:41:42.0296 1872  [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn            C:\WINDOWS\system32\DRIVERS\hpn.sys
17:41:42.0421 1872  hpn - ok
17:41:42.0453 1872  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys
17:41:42.0500 1872  HTTP - ok
17:41:42.0500 1872  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll
17:41:42.0640 1872  HTTPFilter - ok
17:41:42.0640 1872  [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt        C:\WINDOWS\system32\drivers\i2omgmt.sys
17:41:42.0765 1872  i2omgmt - ok
17:41:42.0796 1872  [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp          C:\WINDOWS\system32\DRIVERS\i2omp.sys
17:41:42.0937 1872  i2omp - ok
17:41:42.0953 1872  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:41:43.0093 1872  i8042prt - ok
17:41:43.0156 1872  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
17:41:43.0156 1872  IDriverT ( UnsignedFile.Multi.Generic ) - warning
17:41:43.0156 1872  IDriverT - detected UnsignedFile.Multi.Generic (1)
17:41:43.0234 1872  [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc          C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:41:43.0281 1872  idsvc - ok
17:41:43.0312 1872  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi          C:\WINDOWS\system32\DRIVERS\imapi.sys
17:41:43.0437 1872  Imapi - ok
17:41:43.0468 1872  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe
17:41:43.0593 1872  ImapiService - ok
17:41:43.0609 1872  [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u        C:\WINDOWS\system32\DRIVERS\ini910u.sys
17:41:43.0765 1872  ini910u - ok
17:41:43.0781 1872  [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde        C:\WINDOWS\system32\DRIVERS\intelide.sys
17:41:43.0906 1872  IntelIde - ok
17:41:43.0937 1872  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:41:44.0062 1872  intelppm - ok
17:41:44.0093 1872  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw          C:\WINDOWS\system32\drivers\ip6fw.sys
17:41:44.0218 1872  Ip6Fw - ok
17:41:44.0250 1872  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:41:44.0390 1872  IpFilterDriver - ok
17:41:44.0421 1872  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:41:44.0546 1872  IpInIp - ok
17:41:44.0578 1872  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat          C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:41:44.0734 1872  IpNat - ok
17:41:44.0750 1872  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec          C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:41:44.0875 1872  IPSec - ok
17:41:44.0890 1872  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys
17:41:45.0031 1872  IRENUM - ok
17:41:45.0078 1872  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:41:45.0203 1872  isapnp - ok
17:41:45.0218 1872  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:41:45.0343 1872  Kbdclass - ok
17:41:45.0375 1872  [ B6D6C117D771C98130497265F26D1882 ] kbdhid          C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:41:45.0500 1872  kbdhid - ok
17:41:45.0531 1872  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys
17:41:45.0656 1872  kmixer - ok
17:41:45.0687 1872  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys
17:41:45.0750 1872  KSecDD - ok
17:41:45.0781 1872  [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver    C:\WINDOWS\System32\srvsvc.dll
17:41:45.0843 1872  lanmanserver - ok
17:41:45.0859 1872  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
17:41:45.0906 1872  lanmanworkstation - ok
17:41:45.0906 1872  lbrtfdc - ok
17:41:45.0953 1872  [ 7107430352B2DF1DC00F556FA5F3EBA8 ] LexBceS        C:\WINDOWS\system32\LEXBCES.EXE
17:41:45.0984 1872  LexBceS ( UnsignedFile.Multi.Generic ) - warning
17:41:45.0984 1872  LexBceS - detected UnsignedFile.Multi.Generic (1)
17:41:46.0031 1872  [ 975B6CF65F44E95883F3855BAE8CECAF ] lirsgt          C:\WINDOWS\system32\DRIVERS\lirsgt.sys
17:41:46.0046 1872  lirsgt ( UnsignedFile.Multi.Generic ) - warning
17:41:46.0046 1872  lirsgt - detected UnsignedFile.Multi.Generic (1)
17:41:46.0078 1872  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts        C:\WINDOWS\System32\lmhsvc.dll
17:41:46.0218 1872  LmHosts - ok
17:41:46.0250 1872  [ B7550A7107281D170CE85524B1488C98 ] Messenger      C:\WINDOWS\System32\msgsvc.dll
17:41:46.0375 1872  Messenger - ok
17:41:46.0406 1872  [ 01B447C215E5D563245D30E3788789B7 ] MicroGuard      C:\WINDOWS\system32\drivers\mgnt.sys
17:41:46.0406 1872  MicroGuard ( UnsignedFile.Multi.Generic ) - warning
17:41:46.0406 1872  MicroGuard - detected UnsignedFile.Multi.Generic (1)
17:41:46.0421 1872  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd          C:\WINDOWS\system32\drivers\mnmdd.sys
17:41:46.0546 1872  mnmdd - ok
17:41:46.0578 1872  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc        C:\WINDOWS\system32\mnmsrvc.exe
17:41:46.0703 1872  mnmsrvc - ok
17:41:46.0734 1872  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem          C:\WINDOWS\system32\drivers\Modem.sys
17:41:46.0875 1872  Modem - ok
17:41:46.0875 1872  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:41:47.0015 1872  Mouclass - ok
17:41:47.0062 1872  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:41:47.0187 1872  mouhid - ok
17:41:47.0203 1872  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys
17:41:47.0328 1872  MountMgr - ok
17:41:47.0375 1872  [ D993BEA500E7382DC4E760BF4F35EFCB ] MpFilter        C:\WINDOWS\system32\DRIVERS\MpFilter.sys
17:41:47.0406 1872  MpFilter - ok
17:41:47.0515 1872  MpKsla153a0e7 - ok
17:41:47.0531 1872  [ 50238C1C9E35E623E698B2CE7E9BA01C ] MR97310_VGA_DUAL_CAMERA C:\WINDOWS\system32\DRIVERS\mr97310v.sys
17:41:47.0546 1872  MR97310_VGA_DUAL_CAMERA ( UnsignedFile.Multi.Generic ) - warning
17:41:47.0562 1872  MR97310_VGA_DUAL_CAMERA - detected UnsignedFile.Multi.Generic (1)
17:41:47.0593 1872  [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x        C:\WINDOWS\system32\DRIVERS\mraid35x.sys
17:41:47.0734 1872  mraid35x - ok
17:41:47.0750 1872  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:41:47.0906 1872  MRxDAV - ok
17:41:47.0953 1872  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:41:48.0078 1872  MRxSmb - ok
17:41:48.0109 1872  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC          C:\WINDOWS\system32\msdtc.exe
17:41:48.0250 1872  MSDTC - ok
17:41:48.0265 1872  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys
17:41:48.0406 1872  Msfs - ok
17:41:48.0406 1872  MSIServer - ok
17:41:48.0437 1872  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV        C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:41:48.0562 1872  MSKSSRV - ok
17:41:48.0593 1872  [ 24516BF4E12A46CB67302E2CDCB8CDDF ] MsMpSvc        C:\Programme\Microsoft Security Client\MsMpEng.exe
17:41:48.0609 1872  MsMpSvc - ok
17:41:48.0625 1872  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:41:48.0750 1872  MSPCLOCK - ok
17:41:48.0765 1872  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM          C:\WINDOWS\system32\drivers\MSPQM.sys
17:41:48.0906 1872  MSPQM - ok
17:41:48.0921 1872  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:41:49.0046 1872  mssmbios - ok
17:41:49.0062 1872  [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE          C:\WINDOWS\system32\drivers\MSTEE.sys
17:41:49.0187 1872  MSTEE - ok
17:41:49.0218 1872  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup            C:\WINDOWS\system32\drivers\Mup.sys
17:41:49.0265 1872  Mup - ok
17:41:49.0312 1872  [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC        C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:41:49.0468 1872  NABTSFEC - ok
17:41:49.0515 1872  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll
17:41:49.0656 1872  napagent - ok
17:41:49.0687 1872  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys
17:41:49.0828 1872  NDIS - ok
17:41:49.0843 1872  [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP          C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:41:49.0968 1872  NdisIP - ok
17:41:50.0000 1872  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:41:50.0046 1872  NdisTapi - ok
17:41:50.0078 1872  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio        C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:41:50.0203 1872  Ndisuio - ok
17:41:50.0203 1872  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan        C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:41:50.0328 1872  NdisWan - ok
17:41:50.0406 1872  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy        C:\WINDOWS\system32\drivers\NDProxy.sys
17:41:50.0437 1872  NDProxy - ok
17:41:50.0468 1872  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS        C:\WINDOWS\system32\DRIVERS\netbios.sys
17:41:50.0593 1872  NetBIOS - ok
17:41:50.0609 1872  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT          C:\WINDOWS\system32\DRIVERS\netbt.sys
17:41:50.0734 1872  NetBT - ok
17:41:50.0765 1872  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe
17:41:50.0906 1872  NetDDE - ok
17:41:50.0906 1872  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe
17:41:51.0031 1872  NetDDEdsdm - ok
17:41:51.0078 1872  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe
17:41:51.0218 1872  Netlogon - ok
17:41:51.0234 1872  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll
17:41:51.0375 1872  Netman - ok
17:41:51.0484 1872  [ 9DA26B773BD04B867A8E9F427CD048FC ] NetSvc          C:\Programme\Intel\PROSetWired\NCS\Sync\NetSvc.exe
17:41:51.0515 1872  NetSvc ( UnsignedFile.Multi.Generic ) - warning
17:41:51.0515 1872  NetSvc - detected UnsignedFile.Multi.Generic (1)
17:41:51.0531 1872  [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:41:51.0562 1872  NetTcpPortSharing - ok
17:41:51.0593 1872  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla            C:\WINDOWS\System32\mswsock.dll
17:41:51.0640 1872  Nla - ok
17:41:51.0734 1872  [ A328A46D87BB92CE4D8A4528E9D84787 ] NMIndexingService C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
17:41:51.0796 1872  NMIndexingService - ok
17:41:51.0828 1872  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys
17:41:51.0953 1872  Npfs - ok
17:41:52.0000 1872  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys
17:41:52.0140 1872  Ntfs - ok
17:41:52.0156 1872  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp        C:\WINDOWS\system32\lsass.exe
17:41:52.0281 1872  NtLmSsp - ok
17:41:52.0375 1872  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc        C:\WINDOWS\system32\ntmssvc.dll
17:41:52.0578 1872  NtmsSvc - ok
17:41:52.0593 1872  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys
17:41:52.0718 1872  Null - ok
17:41:52.0781 1872  [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv              C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:41:52.0953 1872  nv - ok
17:41:52.0968 1872  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:41:53.0093 1872  NwlnkFlt - ok
17:41:53.0109 1872  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:41:53.0234 1872  NwlnkFwd - ok
17:41:53.0296 1872  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
17:41:53.0343 1872  odserv - ok
17:41:53.0390 1872  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
17:41:53.0406 1872  ose - ok
17:41:53.0437 1872  [ 71CFFB1E06AA8978A7B4A346C191F8BA ] ovt530          C:\WINDOWS\system32\Drivers\ov530vid.sys
17:41:53.0453 1872  ovt530 ( UnsignedFile.Multi.Generic ) - warning
17:41:53.0453 1872  ovt530 - detected UnsignedFile.Multi.Generic (1)
17:41:53.0484 1872  [ F84785660305B9B903FB3BCA8BA29837 ] Parport        C:\WINDOWS\system32\DRIVERS\parport.sys
17:41:53.0625 1872  Parport - ok
17:41:53.0640 1872  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr        C:\WINDOWS\system32\drivers\PartMgr.sys
17:41:53.0781 1872  PartMgr - ok
17:41:53.0796 1872  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys
17:41:53.0921 1872  ParVdm - ok
17:41:53.0937 1872  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI            C:\WINDOWS\system32\DRIVERS\pci.sys
17:41:54.0062 1872  PCI - ok
17:41:54.0062 1872  PCIDump - ok
17:41:54.0093 1872  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\DRIVERS\pciide.sys
17:41:54.0218 1872  PCIIde - ok
17:41:54.0265 1872  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\drivers\Pcmcia.sys
17:41:54.0390 1872  Pcmcia - ok
17:41:54.0406 1872  PDCOMP - ok
17:41:54.0406 1872  PDFRAME - ok
17:41:54.0406 1872  PDRELI - ok
17:41:54.0421 1872  PDRFRAME - ok
17:41:54.0437 1872  [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2          C:\WINDOWS\system32\DRIVERS\perc2.sys
17:41:54.0578 1872  perc2 - ok
17:41:54.0593 1872  [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib        C:\WINDOWS\system32\DRIVERS\perc2hib.sys
17:41:54.0718 1872  perc2hib - ok
17:41:54.0750 1872  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe
17:41:54.0765 1872  PlugPlay - ok
17:41:54.0781 1872  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent    C:\WINDOWS\system32\lsass.exe
17:41:54.0906 1872  PolicyAgent - ok
17:41:54.0937 1872  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:41:55.0078 1872  PptpMiniport - ok
17:41:55.0078 1872  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
17:41:55.0203 1872  ProtectedStorage - ok
17:41:55.0218 1872  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys
17:41:55.0343 1872  PSched - ok
17:41:55.0359 1872  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink        C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:41:55.0515 1872  Ptilink - ok
17:41:55.0546 1872  [ 183EF96BCC2EC3D5294CB2C2C0ECBCD1 ] PxHelp20        C:\WINDOWS\system32\Drivers\PxHelp20.sys
17:41:55.0546 1872  PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
17:41:55.0546 1872  PxHelp20 - detected UnsignedFile.Multi.Generic (1)
17:41:55.0578 1872  [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080          C:\WINDOWS\system32\DRIVERS\ql1080.sys
17:41:55.0703 1872  ql1080 - ok
17:41:55.0718 1872  [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt        C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
17:41:55.0843 1872  Ql10wnt - ok
17:41:55.0859 1872  [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160        C:\WINDOWS\system32\DRIVERS\ql12160.sys
17:41:55.0984 1872  ql12160 - ok
17:41:56.0000 1872  [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240          C:\WINDOWS\system32\DRIVERS\ql1240.sys
17:41:56.0140 1872  ql1240 - ok
17:41:56.0156 1872  [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280          C:\WINDOWS\system32\DRIVERS\ql1280.sys
17:41:56.0281 1872  ql1280 - ok
17:41:56.0296 1872  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:41:56.0421 1872  RasAcd - ok
17:41:56.0468 1872  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto        C:\WINDOWS\System32\rasauto.dll
17:41:56.0593 1872  RasAuto - ok
17:41:56.0593 1872  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp        C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:41:56.0734 1872  Rasl2tp - ok
17:41:56.0765 1872  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll
17:41:56.0906 1872  RasMan - ok
17:41:56.0921 1872  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:41:57.0031 1872  RasPppoe - ok
17:41:57.0046 1872  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys
17:41:57.0171 1872  Raspti - ok
17:41:57.0187 1872  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss          C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:41:57.0328 1872  Rdbss - ok
17:41:57.0359 1872  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:41:57.0500 1872  RDPCDD - ok
17:41:57.0531 1872  [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr          C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:41:57.0687 1872  rdpdr - ok
17:41:57.0703 1872  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD          C:\WINDOWS\system32\drivers\RDPWD.sys
17:41:57.0765 1872  RDPWD - ok
17:41:57.0796 1872  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr      C:\WINDOWS\system32\sessmgr.exe
17:41:57.0921 1872  RDSessMgr - ok
17:41:57.0953 1872  [ ED761D453856F795A7FE056E42C36365 ] redbook        C:\WINDOWS\system32\DRIVERS\redbook.sys
17:41:58.0078 1872  redbook - ok
17:41:58.0109 1872  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll
17:41:58.0234 1872  RemoteAccess - ok
17:41:58.0265 1872  [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry  C:\WINDOWS\system32\regsvc.dll
17:41:58.0406 1872  RemoteRegistry - ok
17:41:58.0453 1872  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe
17:41:58.0593 1872  RpcLocator - ok
17:41:58.0625 1872  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs          C:\WINDOWS\system32\rpcss.dll
17:41:58.0671 1872  RpcSs - ok
17:41:58.0703 1872  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe
17:41:58.0843 1872  RSVP - ok
17:41:58.0875 1872  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs          C:\WINDOWS\system32\lsass.exe
17:41:59.0000 1872  SamSs - ok
17:41:59.0031 1872  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe
17:41:59.0156 1872  SCardSvr - ok
17:41:59.0203 1872  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll
17:41:59.0343 1872  Schedule - ok
17:41:59.0375 1872  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:41:59.0515 1872  Secdrv - ok
17:41:59.0546 1872  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll
17:41:59.0671 1872  seclogon - ok
17:41:59.0703 1872  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll
17:41:59.0828 1872  SENS - ok
17:41:59.0859 1872  [ 657C1205C6B6B475449E6454CF32B712 ] Ser2pl          C:\WINDOWS\system32\DRIVERS\ser2pl.sys
17:41:59.0859 1872  Ser2pl ( UnsignedFile.Multi.Generic ) - warning
17:41:59.0859 1872  Ser2pl - detected UnsignedFile.Multi.Generic (1)
17:41:59.0890 1872  [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum        C:\WINDOWS\system32\DRIVERS\serenum.sys
17:42:00.0015 1872  serenum - ok
17:42:00.0031 1872  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\DRIVERS\serial.sys
17:42:00.0156 1872  Serial - ok
17:42:00.0218 1872  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy        C:\WINDOWS\system32\drivers\Sfloppy.sys
17:42:00.0343 1872  Sfloppy - ok
17:42:00.0390 1872  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll
17:42:00.0546 1872  SharedAccess - ok
17:42:00.0562 1872  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
17:42:00.0593 1872  ShellHWDetection - ok
17:42:00.0593 1872  Simbad - ok
17:42:00.0609 1872  [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp          C:\WINDOWS\system32\DRIVERS\sisagp.sys
17:42:00.0734 1872  sisagp - ok
17:42:00.0750 1872  siusbmod - ok
17:42:00.0765 1872  [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP            C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:42:00.0890 1872  SLIP - ok
17:42:00.0921 1872  [ 708A1B41E7E850B2B1309073551CBD53 ] SNMP            C:\WINDOWS\System32\snmp.exe
17:42:01.0062 1872  SNMP - ok
17:42:01.0078 1872  [ 0702E1D16B7003049918595057F3904F ] SNMPTRAP        C:\WINDOWS\System32\snmptrap.exe
17:42:01.0203 1872  SNMPTRAP - ok
17:42:01.0234 1872  [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow        C:\WINDOWS\system32\DRIVERS\sparrow.sys
17:42:01.0296 1872  Sparrow - ok
17:42:01.0312 1872  SPLITCAM - ok
17:42:01.0375 1872  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys
17:42:01.0500 1872  splitter - ok
17:42:01.0546 1872  [ 60784F891563FB1B767F70117FC2428F ] Spooler        C:\WINDOWS\system32\spoolsv.exe
17:42:01.0593 1872  Spooler - ok
17:42:01.0625 1872  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys
17:42:01.0750 1872  sr - ok
17:42:01.0781 1872  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice      C:\WINDOWS\system32\srsvc.dll
17:42:01.0906 1872  srservice - ok
17:42:01.0953 1872  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv            C:\WINDOWS\system32\DRIVERS\srv.sys
17:42:02.0000 1872  Srv - ok
17:42:02.0031 1872  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV        C:\WINDOWS\System32\ssdpsrv.dll
17:42:02.0171 1872  SSDPSRV - ok
17:42:02.0203 1872  [ 352B663A81402BE7CD7BD4EA27C9998C ] STHDA          C:\WINDOWS\system32\drivers\sthda.sys
17:42:02.0250 1872  STHDA - ok
17:42:02.0281 1872  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll
17:42:02.0421 1872  stisvc - ok
17:42:02.0453 1872  [ 77813007BA6265C4B6098187E6ED79D2 ] streamip        C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:42:02.0578 1872  streamip - ok
17:42:02.0609 1872  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys
17:42:02.0734 1872  swenum - ok
17:42:02.0750 1872  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys
17:42:02.0875 1872  swmidi - ok
17:42:02.0890 1872  SwPrv - ok
17:42:02.0906 1872  [ 1FF3217614018630D0A6758630FC698C ] symc810        C:\WINDOWS\system32\DRIVERS\symc810.sys
17:42:03.0015 1872  symc810 - ok
17:42:03.0046 1872  [ 070E001D95CF725186EF8B20335F933C ] symc8xx        C:\WINDOWS\system32\DRIVERS\symc8xx.sys
17:42:03.0171 1872  symc8xx - ok
17:42:03.0187 1872  [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi          C:\WINDOWS\system32\DRIVERS\sym_hi.sys
17:42:03.0328 1872  sym_hi - ok
17:42:03.0343 1872  [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3          C:\WINDOWS\system32\DRIVERS\sym_u3.sys
17:42:03.0468 1872  sym_u3 - ok
17:42:03.0484 1872  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys
17:42:03.0625 1872  sysaudio - ok
17:42:03.0656 1872  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog      C:\WINDOWS\system32\smlogsvc.exe
17:42:03.0781 1872  SysmonLog - ok
17:42:03.0828 1872  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv        C:\WINDOWS\System32\tapisrv.dll
17:42:03.0984 1872  TapiSrv - ok
17:42:04.0031 1872  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip          C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:42:04.0062 1872  Tcpip - ok
17:42:04.0093 1872  [ 4E53BBCC4BE37D7A4BD6EF1098C89FF7 ] Tcpip6          C:\WINDOWS\system32\DRIVERS\tcpip6.sys
17:42:04.0125 1872  Tcpip6 - ok
17:42:04.0156 1872  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys
17:42:04.0281 1872  TDPIPE - ok
17:42:04.0296 1872  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP          C:\WINDOWS\system32\drivers\TDTCP.sys
17:42:04.0421 1872  TDTCP - ok
17:42:04.0437 1872  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys
17:42:04.0578 1872  TermDD - ok
17:42:04.0609 1872  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService    C:\WINDOWS\System32\termsrv.dll
17:42:04.0765 1872  TermService - ok
17:42:04.0781 1872  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll
17:42:04.0796 1872  Themes - ok
17:42:04.0828 1872  [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr        C:\WINDOWS\system32\tlntsvr.exe
17:42:04.0953 1872  TlntSvr - ok
17:42:04.0968 1872  [ D213A9247DC347F305A2D4CC9B951487 ] TosIde          C:\WINDOWS\system32\DRIVERS\toside.sys
17:42:05.0093 1872  TosIde - ok
17:42:05.0125 1872  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll
17:42:05.0265 1872  TrkWks - ok
17:42:05.0296 1872  [ 8F861EDA21C05857EB8197300A92501C ] tunmp          C:\WINDOWS\system32\DRIVERS\tunmp.sys
17:42:05.0421 1872  tunmp - ok
17:42:05.0437 1872  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys
17:42:05.0562 1872  Udfs - ok
17:42:05.0593 1872  [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra          C:\WINDOWS\system32\DRIVERS\ultra.sys
17:42:05.0656 1872  ultra - ok
17:42:05.0687 1872  [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update          C:\WINDOWS\system32\DRIVERS\update.sys
17:42:05.0859 1872  Update - ok
17:42:05.0906 1872  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll
17:42:06.0031 1872  upnphost - ok
17:42:06.0062 1872  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS            C:\WINDOWS\System32\ups.exe
17:42:06.0187 1872  UPS - ok
17:42:06.0218 1872  [ E919708DB44ED8543A7C017953148330 ] usbaudio        C:\WINDOWS\system32\drivers\usbaudio.sys
17:42:06.0343 1872  usbaudio - ok
17:42:06.0359 1872  [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp        C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:42:06.0515 1872  usbccgp - ok
17:42:06.0546 1872  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci        C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:42:06.0671 1872  usbehci - ok
17:42:06.0703 1872  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:42:06.0828 1872  usbhub - ok
17:42:06.0859 1872  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:42:06.0984 1872  usbprint - ok
17:42:07.0015 1872  [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan        C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:42:07.0140 1872  usbscan - ok
17:42:07.0140 1872  [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR        C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:42:07.0265 1872  USBSTOR - ok
17:42:07.0281 1872  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci        C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:42:07.0406 1872  usbuhci - ok
17:42:07.0421 1872  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave        C:\WINDOWS\System32\drivers\vga.sys
17:42:07.0546 1872  VgaSave - ok
17:42:07.0562 1872  [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp          C:\WINDOWS\system32\DRIVERS\viaagp.sys
17:42:07.0687 1872  viaagp - ok
17:42:07.0718 1872  [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde          C:\WINDOWS\system32\DRIVERS\viaide.sys
17:42:07.0843 1872  ViaIde - ok
17:42:07.0875 1872  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap        C:\WINDOWS\system32\drivers\VolSnap.sys
17:42:08.0015 1872  VolSnap - ok
17:42:08.0046 1872  [ 1C8A783E90C34D205596F1AB4A97E261 ] vsbus          C:\WINDOWS\system32\DRIVERS\vsb.sys
17:42:08.0046 1872  vsbus ( UnsignedFile.Multi.Generic ) - warning
17:42:08.0046 1872  vsbus - detected UnsignedFile.Multi.Generic (1)
17:42:08.0078 1872  [ 3377DAA1CB8CAC46A538C236F5F3D58F ] vserial        C:\WINDOWS\system32\DRIVERS\vserial.sys
17:42:08.0078 1872  vserial ( UnsignedFile.Multi.Generic ) - warning
17:42:08.0078 1872  vserial - detected UnsignedFile.Multi.Generic (1)
17:42:08.0109 1872  [ 68F106273BE29E7B7EF8266977268E78 ] VSS            C:\WINDOWS\System32\vssvc.exe
17:42:08.0265 1872  VSS - ok
17:42:08.0281 1872  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] w32time        C:\WINDOWS\system32\w32time.dll
17:42:08.0421 1872  w32time - ok
17:42:08.0453 1872  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:42:08.0578 1872  Wanarp - ok
17:42:08.0578 1872  WDICA - ok
17:42:08.0593 1872  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys
17:42:08.0718 1872  wdmaud - ok
17:42:08.0750 1872  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient      C:\WINDOWS\System32\webclnt.dll
17:42:08.0875 1872  WebClient - ok
17:42:08.0937 1872  [ DA2DADB42916E59C6E4BBA593BCCDA73 ] winmgmt        C:\WINDOWS\system32\wbem\WMIsvc.dll
17:42:09.0046 1872  winmgmt - ok
17:42:09.0078 1872  [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN        C:\WINDOWS\system32\MsPMSNSv.dll
17:42:09.0125 1872  WmdmPmSN - ok
17:42:09.0171 1872  [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi            C:\WINDOWS\System32\advapi32.dll
17:42:09.0250 1872  Wmi - ok
17:42:09.0281 1872  [ 042A78FCD1ADFB0FBA9865D55C6F5CC1 ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:42:09.0375 1872  WmiApSrv - ok
17:42:09.0437 1872  [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc  C:\Programme\Windows Media Player\WMPNetwk.exe
17:42:09.0515 1872  WMPNetworkSvc - ok
17:42:09.0531 1872  [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb          C:\WINDOWS\system32\DRIVERS\wpdusb.sys
17:42:09.0546 1872  WpdUsb - ok
17:42:09.0640 1872  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
17:42:09.0687 1872  WPFFontCache_v0400 - ok
17:42:09.0718 1872  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll
17:42:09.0843 1872  wscsvc - ok
17:42:09.0859 1872  [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC        C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:42:09.0984 1872  WSTCODEC - ok
17:42:10.0015 1872  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll
17:42:10.0156 1872  wuauserv - ok
17:42:10.0171 1872  [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf          C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:42:10.0218 1872  WudfPf - ok
17:42:10.0234 1872  [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd          C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:42:10.0265 1872  WudfRd - ok
17:42:10.0281 1872  [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc        C:\WINDOWS\System32\WUDFSvc.dll
17:42:10.0312 1872  WudfSvc - ok
17:42:10.0406 1872  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll
17:42:10.0609 1872  WZCSVC - ok
17:42:10.0625 1872  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov        C:\WINDOWS\System32\xmlprov.dll
17:42:10.0781 1872  xmlprov - ok
17:42:10.0796 1872  ================ Scan global ===============================
17:42:10.0812 1872  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
17:42:10.0859 1872  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:42:10.0890 1872  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:42:10.0906 1872  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
17:42:10.0906 1872  [Global] - ok
17:42:10.0906 1872  ================ Scan MBR ==================================
17:42:10.0921 1872  [ 7D467BC296DA93E3B8DBE9878A0961C3 ] \Device\Harddisk0\DR0
17:42:11.0062 1872  \Device\Harddisk0\DR0 - ok
17:42:11.0078 1872  [ E5FA06ACA0D60BA9C870D0EF3D9898C9 ] \Device\Harddisk1\DR1
17:42:11.0156 1872  \Device\Harddisk1\DR1 - ok
17:42:11.0156 1872  ================ Scan VBR ==================================
17:42:11.0156 1872  [ 5B2E060D5D686E2182ED1F066753BE6E ] \Device\Harddisk0\DR0\Partition1
17:42:11.0156 1872  \Device\Harddisk0\DR0\Partition1 - ok
17:42:11.0171 1872  [ 26FC1D085834C32F97B9A13366781FCF ] \Device\Harddisk0\DR0\Partition2
17:42:11.0171 1872  \Device\Harddisk0\DR0\Partition2 - ok
17:42:11.0171 1872  [ 0062BF7B2C0C4D184B52643933740DD3 ] \Device\Harddisk1\DR1\Partition1
17:42:11.0171 1872  \Device\Harddisk1\DR1\Partition1 - ok
17:42:11.0171 1872  ============================================================
17:42:11.0171 1872  Scan finished
17:42:11.0171 1872  ============================================================
17:42:11.0281 1848  Detected object count: 18
17:42:11.0281 1848  Actual detected object count: 18
17:45:30.0859 1848  actser ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  actser ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  Afc ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  Afc ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  ATI Smart ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  ATI Smart ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  atksgt ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  cmudau32 ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  cmudau32 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  CO_Mon ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  CO_Mon ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  grmnusb ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  grmnusb ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  LexBceS ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0859 1848  LexBceS ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0859 1848  lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  MicroGuard ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  MicroGuard ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  MR97310_VGA_DUAL_CAMERA ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  MR97310_VGA_DUAL_CAMERA ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  NetSvc ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  NetSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  ovt530 ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  ovt530 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  Ser2pl ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  Ser2pl ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  vsbus ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  vsbus ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:45:30.0875 1848  vserial ( UnsignedFile.Multi.Generic ) - skipped by user
17:45:30.0875 1848  vserial ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 17.09.2012 08:47
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Horst1980 17.09.2012 18:45
Guten Abend,

hier das Combofix-Log:
Code:
ComboFix 12-09-16.01 - TanteKaete 17.09.2012  19:36:43.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3070.2465 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\TanteKaete\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\programme\xp-AntiSpy
c:\programme\xp-AntiSpy\Uninstall.exe
c:\programme\xp-AntiSpy\xp-AntiSpy.chm
c:\programme\xp-AntiSpy\xp-AntiSpy.exe
c:\programme\xp-AntiSpy\xp-AntiSpy.url
c:\windows\IsUn0407.exe
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\win32
c:\windows\win32\Autostart.bat
c:\windows\win32\WAIT.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-17 bis 2012-09-17  ))))))))))))))))))))))))))))))
.
.
2012-09-17 17:28 . 2012-09-17 17:28        29904        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{AC291DFE-441F-49EB-B87A-3630C1ADB1B3}\MpKsl5efebffc.sys
2012-09-16 15:47 . 2012-08-22 22:15        7022536        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{AC291DFE-441F-49EB-B87A-3630C1ADB1B3}\mpengine.dll
2012-09-15 12:56 . 2012-09-15 12:56        --------        d-----w-        c:\programme\Defraggler
2012-09-15 11:55 . 2009-03-06 14:19        286720        ------w-        c:\windows\system32\dllcache\pdh.dll
2012-09-15 11:55 . 2009-02-09 11:21        111104        ------w-        c:\windows\system32\dllcache\services.exe
2012-09-15 11:55 . 2009-02-09 10:51        401408        ------w-        c:\windows\system32\dllcache\rpcss.dll
2012-09-15 11:55 . 2009-02-06 10:39        35328        ------w-        c:\windows\system32\dllcache\sc.exe
2012-09-15 11:55 . 2009-02-09 10:51        678400        ------w-        c:\windows\system32\dllcache\advapi32.dll
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\AutoRecover
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\Repository
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\mof
2012-09-15 11:46 . 2012-09-15 11:56        --------        d-----w-        c:\windows\system32\wbem\Performance
2012-09-15 11:46 . 2012-09-17 17:32        --------        d-----w-        c:\windows\system32\wbem\Logs
2012-09-15 11:19 . 2012-08-22 22:15        7022536        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-15 11:15 . 2012-09-15 11:15        --------        d-----w-        C:\_OTL
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\wbem\snmp\smimsgif.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\wbem\snmp\smierrsy.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\dllcache\smimsgif.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\dllcache\smierrsy.dll
2012-09-14 17:25 . 2004-08-04 14:00        15872        ----a-w-        c:\windows\system32\wbem\snmp\smierrsm.dll
2012-09-14 17:25 . 2004-08-04 14:00        15872        ----a-w-        c:\windows\system32\dllcache\smierrsm.dll
2012-09-14 17:25 . 2004-08-04 14:00        10240        ----a-w-        c:\windows\system32\wbem\snmpstup.dll
2012-09-14 17:25 . 2004-08-04 14:00        10240        ----a-w-        c:\windows\system32\dllcache\snmpstup.dll
2012-09-14 17:17 . 2012-09-14 17:47        --------        d-----w-        c:\programme\Microsoft Silverlight
2012-09-14 16:37 . 2012-09-14 16:37        --------        d-----w-        c:\programme\Gemeinsame Dateien\Nero
2012-09-14 16:30 . 2012-09-14 16:30        --------        d-----w-        c:\programme\ATI
2012-09-14 16:28 . 2012-09-14 16:28        --------        d-----w-        C:\AMD
2012-09-14 16:23 . 2012-09-14 16:23        696520        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-09-14 16:18 . 2012-09-14 16:18        --------        d-----w-        c:\programme\FileHippo.com
2012-09-14 15:58 . 2012-09-14 16:01        --------        d-----w-        c:\dokumente und einstellungen\Lars
2012-09-14 15:04 . 2011-03-11 14:10        471552        ------w-        c:\windows\system32\dllcache\aclayers.dll
2012-09-14 14:42 . 2006-06-29 11:07        14048        ------w-        c:\windows\system32\spmsg2.dll
2012-09-13 15:08 . 2012-09-13 15:08        --------        d-----w-        c:\programme\ESET
2012-09-05 14:12 . 2012-05-31 10:25        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-09-05 13:18 . 2012-09-05 13:18        --------        d-----w-        c:\programme\Microsoft Security Client
2012-09-05 13:01 . 2012-09-05 13:01        --------        d-----w-        c:\programme\Microsoft
2012-09-05 12:59 . 2010-02-12 10:03        293376        ------w-        c:\windows\system32\browserchoice.exe
2012-09-05 12:14 . 2012-09-05 12:14        --------        d-----w-        c:\windows\Internet Logs
2012-09-05 11:43 . 2012-09-05 11:43        --------        d-----w-        c:\dokumente und einstellungen\TanteKaete\Eigene Dateien
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-14 16:23 . 2011-11-25 10:14        73416        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-07 15:04 . 2012-07-28 12:14        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-07-06 13:59 . 2004-08-13 12:40        78336        ----a-w-        c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-13 12:51        139784        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:25 . 2004-08-13 12:40        1866240        ----a-w-        c:\windows\system32\win32k.sys
2012-07-02 17:39 . 2004-08-13 12:40        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-07-02 17:39 . 2004-08-13 12:40        43520        ------w-        c:\windows\system32\licmgr10.dll
2012-07-02 17:39 . 2004-08-13 12:40        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-13 12:40        385024        ------w-        c:\windows\system32\html.iec
2012-09-14 16:21 . 2012-09-14 16:20        266720        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\programme\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableChangePassword"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoLogoff"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UxTuneUp"=2 (0x2)
"TapiSrv"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R1 MpKsl5efebffc;MpKsl5efebffc;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{AC291DFE-441F-49EB-B87A-3630C1ADB1B3}\MpKsl5efebffc.sys [17.09.2012 19:28 29904]
R2 MicroGuard;MicroGuard Copy Protection;c:\windows\system32\drivers\mgnt.sys [05.10.2006 22:09 40288]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [14.09.2012 18:23 250568]
S3 cmudau32;Headset Master 5.1 USB Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [28.03.2008 11:54 1422656]
S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;c:\windows\system32\drivers\MR97310v.sys [19.08.2006 21:37 116110]
S3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [25.10.2006 22:43 161792]
S3 siusbmod;siusbmod;c:\windows\system32\DRIVERS\siusbmod.sys --> c:\windows\system32\DRIVERS\siusbmod.sys [?]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSL5EFEBFFC
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-14 16:23]
.
2006-01-03 c:\windows\Tasks\ISP-Anmeldungserinnerung 1.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-13 02:22]
.
2012-09-17 c:\windows\Tasks\MpIdleTask.job
- c:\programme\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://www.die-staemme.de/
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: windowsupdate.com\download
TCP: DhcpNameServer = 195.234.128.7 195.234.128.16 85.233.58.60
FF - ProfilePath - c:\dokumente und einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\
FF - prefs.js: browser.startup.homepage - about:blank
 
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Age of Empires 2.0 - e:\spiele\Age Of Empire\UNINSTAL.EXE
AddRemove-Age of Empires II: The Conquerors Expansion 1.0 - e:\spiele\Age Of Empire\UNINSTALX.EXE
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
AddRemove-xp-AntiSpy - c:\programme\xp-AntiSpy\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-09-17 19:40
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@DACL=(02 0010)
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@DACL=(02 0010)
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@DACL=(02 0010)
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI03.00.00.01PRO"="D75DDEBEF0371A271F5ECFB3D5F5F0D0D4E0A3DCCFE91BB77F1388F8D88D717B36BFF3352AEB2784523E3B7D52667F526583EADB1605D6EB0D3DFCE626DA7CCE0B78DA3CA6765C76305C2596816472F89D7960E3094519A2CE9E5AFA6EEA1EB9F5C67154870F2DB9A61324DD629384AD5853EDD5A5D5031AAAA1FCB7CB91FC6E8A902E4025D2658D965EDF792878C66462C613D51C458A13FCD6D8E28C07139C525C180708C225B455DF964F3B7B9B90FDAD604D52067653136E7686B064ADFB48D5CA73EE41DC77ABDC188C366BBB2B6106FDE960FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D14078EDD5E5BE2F6E667A2D97226D213B5556345ED617E41E537A7F780A440DC5E14CBC718209940E4E3C7D439FA656D4B375D6EBB0066B0CA761F025A541A47228480ED5D890DCA49AEF991CF784475297B38B9C6EE3EAEEEB4E1D9B8A5F76B6951E892DE16086676ABEE0A3391CC1603FEB194702FA10317C395AFAC07ADE9F84D34C900403CA554C67C56B5EC27F5816CE9BA1A36D20ECC2B4487CCDAB772D8FC72FC25F67B2F0C22DDE5AF279ED18EA2E3C02D6DB53ED927D9B8AEF6314DD6979BE7B81EBC3F0C92B37AFACE24F95AB48A8D1532D31AD0A728EDF1A45E54848A8A1CA88A9925852301A975E9C95357E8285BC05359BA03CFE528B523A3F4B6757BFEE50B5344EF90AC5C036F4954BCB86E38241817CD0C76AA3B1EA30C33862E9348655ACB9305CC82D109CCFD0B07D3F088B7380393C5A8754FD44CC423D13CD604A2AE891EC27CB19AF3DF6717F21C2802F56236E1CFA4265F86B69F70395CB11599ADB703EB79CD1D30FDA82D06A7F12F5EB4EBA3105E83BAE2F11259217F71AE4DF2257605514F13326F8B9585C28CEF75C706D22E7D3606207FB72F33C8475AC20C463F5A460F89EF6E7B2CFD6A1D7543A18983165C4C39F4D54DD9DC934C7403FD2FB879CCCD6464AD87E03DD22CC852419ED9F70D369F9F5EB452CFE9F92E9C3F1CD1338E30D60E4FE438D75F27423396148EC7D0C859E07775277F0DAD8C21B96D0F9E6ABBEB6EEB694BA3AD5C12F88658EFBD203F59FBF136FA2771AAE6A5CE238516705D818E8F92C53D8B823BBB6B82DED626B769B916470442C017EBC4CEE6623866624976B97FE703F9B0149511C9515243B0A2E89C998B13D4FC1B1B81016366C68048B65FF5851831E246A8B80CCFB30911765733C4F19EC1CBC94B23E2DDC5BD4ED9E068DA07E39A7A5217984AF644C02227DAFC00A72DC8D51F79E21EB643ADC52A8CAFBBE99056BB0A88D7A7F990E6114F4D0F2B33CB64CF1B5161E86B8A2CC8BB5407C9BD8E354E15A9146F1CE7A8F0588AF347AFCCC0558B7F3820890E8299E4D5"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2012-09-17  19:43:07
ComboFix-quarantined-files.txt  2012-09-17 17:43
.
Vor Suchlauf: 11 Verzeichnis(se), 15.018.995.712 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 15.156.355.072 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - AB9653304C0692A9ED9B7B4E5D3CDB2C

cosinus 18.09.2012 13:53
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Horst1980 18.09.2012 17:57
Hier das neue Combofix-Log:
Code:
ComboFix 12-09-16.01 - TanteKaete 18.09.2012  18:46:42.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3070.2614 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\TanteKaete\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\TanteKaete\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-18 bis 2012-09-18  ))))))))))))))))))))))))))))))
.
.
2012-09-18 16:39 . 2012-09-18 16:39        29904        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{A1639D99-2D53-4F61-A450-C0581CD6C858}\MpKslb399fa9e.sys
2012-09-17 17:43 . 2012-08-22 22:15        7022536        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{A1639D99-2D53-4F61-A450-C0581CD6C858}\mpengine.dll
2012-09-15 12:56 . 2012-09-15 12:56        --------        d-----w-        c:\programme\Defraggler
2012-09-15 11:55 . 2009-03-06 14:19        286720        ------w-        c:\windows\system32\dllcache\pdh.dll
2012-09-15 11:55 . 2009-02-09 11:21        111104        ------w-        c:\windows\system32\dllcache\services.exe
2012-09-15 11:55 . 2009-02-09 10:51        401408        ------w-        c:\windows\system32\dllcache\rpcss.dll
2012-09-15 11:55 . 2009-02-06 10:39        35328        ------w-        c:\windows\system32\dllcache\sc.exe
2012-09-15 11:55 . 2009-02-09 10:51        678400        ------w-        c:\windows\system32\dllcache\advapi32.dll
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\AutoRecover
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\Repository
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\mof
2012-09-15 11:46 . 2012-09-15 11:56        --------        d-----w-        c:\windows\system32\wbem\Performance
2012-09-15 11:46 . 2012-09-18 16:49        --------        d-----w-        c:\windows\system32\wbem\Logs
2012-09-15 11:19 . 2012-08-22 22:15        7022536        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-15 11:15 . 2012-09-15 11:15        --------        d-----w-        C:\_OTL
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\wbem\snmp\smimsgif.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\wbem\snmp\smierrsy.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\dllcache\smimsgif.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\dllcache\smierrsy.dll
2012-09-14 17:25 . 2004-08-04 14:00        15872        ----a-w-        c:\windows\system32\wbem\snmp\smierrsm.dll
2012-09-14 17:25 . 2004-08-04 14:00        15872        ----a-w-        c:\windows\system32\dllcache\smierrsm.dll
2012-09-14 17:25 . 2004-08-04 14:00        10240        ----a-w-        c:\windows\system32\wbem\snmpstup.dll
2012-09-14 17:25 . 2004-08-04 14:00        10240        ----a-w-        c:\windows\system32\dllcache\snmpstup.dll
2012-09-14 17:17 . 2012-09-14 17:47        --------        d-----w-        c:\programme\Microsoft Silverlight
2012-09-14 16:37 . 2012-09-14 16:37        --------        d-----w-        c:\programme\Gemeinsame Dateien\Nero
2012-09-14 16:30 . 2012-09-14 16:30        --------        d-----w-        c:\programme\ATI
2012-09-14 16:28 . 2012-09-14 16:28        --------        d-----w-        C:\AMD
2012-09-14 16:23 . 2012-09-14 16:23        696520        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-09-14 16:18 . 2012-09-14 16:18        --------        d-----w-        c:\programme\FileHippo.com
2012-09-14 15:58 . 2012-09-14 16:01        --------        d-----w-        c:\dokumente und einstellungen\Lars
2012-09-14 15:04 . 2011-03-11 14:10        471552        ------w-        c:\windows\system32\dllcache\aclayers.dll
2012-09-14 14:42 . 2006-06-29 11:07        14048        ------w-        c:\windows\system32\spmsg2.dll
2012-09-13 15:08 . 2012-09-13 15:08        --------        d-----w-        c:\programme\ESET
2012-09-05 14:12 . 2012-05-31 10:25        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-09-05 13:18 . 2012-09-05 13:18        --------        d-----w-        c:\programme\Microsoft Security Client
2012-09-05 13:01 . 2012-09-05 13:01        --------        d-----w-        c:\programme\Microsoft
2012-09-05 12:59 . 2010-02-12 10:03        293376        ------w-        c:\windows\system32\browserchoice.exe
2012-09-05 12:14 . 2012-09-05 12:14        --------        d-----w-        c:\windows\Internet Logs
2012-09-05 11:43 . 2012-09-05 11:43        --------        d-----w-        c:\dokumente und einstellungen\TanteKaete\Eigene Dateien
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-14 16:23 . 2011-11-25 10:14        73416        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-07 15:04 . 2012-07-28 12:14        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-07-06 13:59 . 2004-08-13 12:40        78336        ----a-w-        c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-13 12:51        139784        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:25 . 2004-08-13 12:40        1866240        ----a-w-        c:\windows\system32\win32k.sys
2012-07-02 17:39 . 2004-08-13 12:40        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-07-02 17:39 . 2004-08-13 12:40        43520        ------w-        c:\windows\system32\licmgr10.dll
2012-07-02 17:39 . 2004-08-13 12:40        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-13 12:40        385024        ------w-        c:\windows\system32\html.iec
2012-09-14 16:21 . 2012-09-14 16:20        266720        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-09-17_17.40.39  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-09-18 16:39 . 2012-09-18 16:39        16384              c:\windows\Temp\Perflib_Perfdata_3b0.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\programme\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableChangePassword"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoLogoff"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UxTuneUp"=2 (0x2)
"TapiSrv"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R1 MpKslb399fa9e;MpKslb399fa9e;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{A1639D99-2D53-4F61-A450-C0581CD6C858}\MpKslb399fa9e.sys [18.09.2012 18:39 29904]
R2 MicroGuard;MicroGuard Copy Protection;c:\windows\system32\drivers\mgnt.sys [05.10.2006 22:09 40288]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [14.09.2012 18:23 250568]
S3 cmudau32;Headset Master 5.1 USB Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [28.03.2008 11:54 1422656]
S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;c:\windows\system32\drivers\MR97310v.sys [19.08.2006 21:37 116110]
S3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [25.10.2006 22:43 161792]
S3 siusbmod;siusbmod;c:\windows\system32\DRIVERS\siusbmod.sys --> c:\windows\system32\DRIVERS\siusbmod.sys [?]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSLB399FA9E
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-14 16:23]
.
2006-01-03 c:\windows\Tasks\ISP-Anmeldungserinnerung 1.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-13 02:22]
.
2012-09-18 c:\windows\Tasks\MpIdleTask.job
- c:\programme\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://www.die-staemme.de/
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: windowsupdate.com\download
FF - ProfilePath - c:\dokumente und einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\
FF - prefs.js: browser.startup.homepage - about:blank
 
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-09-18 18:51
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@DACL=(02 0010)
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@DACL=(02 0010)
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@DACL=(02 0010)
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI03.00.00.01PRO"="D75DDEBEF0371A271F5ECFB3D5F5F0D0D4E0A3DCCFE91BB77F1388F8D88D717B36BFF3352AEB2784523E3B7D52667F526583EADB1605D6EB0D3DFCE626DA7CCE0B78DA3CA6765C76305C2596816472F89D7960E3094519A2CE9E5AFA6EEA1EB9F5C67154870F2DB9A61324DD629384AD5853EDD5A5D5031AAAA1FCB7CB91FC6E8A902E4025D2658D965EDF792878C66462C613D51C458A13FCD6D8E28C07139C525C180708C225B455DF964F3B7B9B90FDAD604D52067653136E7686B064ADFB48D5CA73EE41DC77ABDC188C366BBB2B6106FDE960FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D14078EDD5E5BE2F6E667A2D97226D213B5556345ED617E41E537A7F780A440DC5E14CBC718209940E4E3C7D439FA656D4B375D6EBB0066B0CA761F025A541A47228480ED5D890DCA49AEF991CF784475297B38B9C6EE3EAEEEB4E1D9B8A5F76B6951E892DE16086676ABEE0A3391CC1603FEB194702FA10317C395AFAC07ADE9F84D34C900403CA554C67C56B5EC27F5816CE9BA1A36D20ECC2B4487CCDAB772D8FC72FC25F67B2F0C22DDE5AF279ED18EA2E3C02D6DB53ED927D9B8AEF6314DD6979BE7B81EBC3F0C92B37AFACE24F95AB48A8D1532D31AD0A728EDF1A45E54848A8A1CA88A9925852301A975E9C95357E8285BC05359BA03CFE528B523A3F4B6757BFEE50B5344EF90AC5C036F4954BCB86E38241817CD0C76AA3B1EA30C33862E9348655ACB9305CC82D109CCFD0B07D3F088B7380393C5A8754FD44CC423D13CD604A2AE891EC27CB19AF3DF6717F21C2802F56236E1CFA4265F86B69F70395CB11599ADB703EB79CD1D30FDA82D06A7F12F5EB4EBA3105E83BAE2F11259217F71AE4DF2257605514F13326F8B9585C28CEF75C706D22E7D3606207FB72F33C8475AC20C463F5A460F89EF6E7B2CFD6A1D7543A18983165C4C39F4D54DD9DC934C7403FD2FB879CCCD6464AD87E03DD22CC852419ED9F70D369F9F5EB452CFE9F92E9C3F1CD1338E30D60E4FE438D75F27423396148EC7D0C859E07775277F0DAD8C21B96D0F9E6ABBEB6EEB694BA3AD5C12F88658EFBD203F59FBF136FA2771AAE6A5CE238516705D818E8F92C53D8B823BBB6B82DED626B769B916470442C017EBC4CEE6623866624976B97FE703F9B0149511C9515243B0A2E89C998B13D4FC1B1B81016366C68048B65FF5851831E246A8B80CCFB30911765733C4F19EC1CBC94B23E2DDC5BD4ED9E068DA07E39A7A5217984AF644C02227DAFC00A72DC8D51F79E21EB643ADC52A8CAFBBE99056BB0A88D7A7F990E6114F4D0F2B33CB64CF1B5161E86B8A2CC8BB5407C9BD8E354E15A9146F1CE7A8F0588AF347AFCCC0558B7F3820890E8299E4D5"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2444)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2012-09-18  18:53:36
ComboFix-quarantined-files.txt  2012-09-18 16:53
ComboFix2.txt  2012-09-17 17:43
.
Vor Suchlauf: 13 Verzeichnis(se), 15.164.137.472 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 15.145.279.488 Bytes frei
.
- - End Of File - - C661B485E53258C6C6FCD6E32187142C

cosinus 19.09.2012 14:33
MIst, mir ist da ein Fehler unterlaufen :stirn:
Das hier sollte eigentlich in der CFScript stehen:

Code:
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=-
Korrigier das mal bitte ( nach dem = muss ein - hin ) in deiner CFScript.txt und mach das Scripten nochmal. Danke :)

Horst1980 19.09.2012 14:45
...jetzt habe ich grad 20,- € an das Trojaner-Board gespendet, weil Du mir jetzt schon beim 2. Rechner so erfolgreich hilfst und dann sowas. :blabla:

Werde das heute Abend korrigieren.

Viele Grüße. :)

cosinus 19.09.2012 16:22
Ok, danke! :daumenhoc

Horst1980 19.09.2012 19:46
Hier der korrigierte Combofix-Log:
Code:
ComboFix 12-09-16.01 - TanteKaete 19.09.2012  20:34:58.3.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3070.2612 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\TanteKaete\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\TanteKaete\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-19 bis 2012-09-19  ))))))))))))))))))))))))))))))
.
.
2012-09-19 18:26 . 2012-09-19 18:26        29904        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{7B9A4CA7-7DED-41FF-869F-00DB045A81A7}\MpKslb4a042a5.sys
2012-09-18 16:55 . 2012-08-22 22:15        7022536        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{7B9A4CA7-7DED-41FF-869F-00DB045A81A7}\mpengine.dll
2012-09-15 12:56 . 2012-09-15 12:56        --------        d-----w-        c:\programme\Defraggler
2012-09-15 11:55 . 2009-03-06 14:19        286720        ------w-        c:\windows\system32\dllcache\pdh.dll
2012-09-15 11:55 . 2009-02-09 11:21        111104        ------w-        c:\windows\system32\dllcache\services.exe
2012-09-15 11:55 . 2009-02-09 10:51        401408        ------w-        c:\windows\system32\dllcache\rpcss.dll
2012-09-15 11:55 . 2009-02-06 10:39        35328        ------w-        c:\windows\system32\dllcache\sc.exe
2012-09-15 11:55 . 2009-02-09 10:51        678400        ------w-        c:\windows\system32\dllcache\advapi32.dll
2012-09-15 11:46 . 2012-09-18 21:11        --------        d-----w-        c:\windows\system32\wbem\Repository
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\AutoRecover
2012-09-15 11:46 . 2012-09-15 11:46        --------        d-----w-        c:\windows\system32\wbem\mof
2012-09-15 11:46 . 2012-09-15 11:56        --------        d-----w-        c:\windows\system32\wbem\Performance
2012-09-15 11:46 . 2012-09-19 18:36        --------        d-----w-        c:\windows\system32\wbem\Logs
2012-09-15 11:19 . 2012-08-22 22:15        7022536        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-15 11:15 . 2012-09-15 11:15        --------        d-----w-        C:\_OTL
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\wbem\snmp\smimsgif.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\wbem\snmp\smierrsy.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\dllcache\smimsgif.dll
2012-09-14 17:25 . 2004-08-04 14:00        5632        ----a-w-        c:\windows\system32\dllcache\smierrsy.dll
2012-09-14 17:25 . 2004-08-04 14:00        15872        ----a-w-        c:\windows\system32\wbem\snmp\smierrsm.dll
2012-09-14 17:25 . 2004-08-04 14:00        15872        ----a-w-        c:\windows\system32\dllcache\smierrsm.dll
2012-09-14 17:25 . 2004-08-04 14:00        10240        ----a-w-        c:\windows\system32\wbem\snmpstup.dll
2012-09-14 17:25 . 2004-08-04 14:00        10240        ----a-w-        c:\windows\system32\dllcache\snmpstup.dll
2012-09-14 17:17 . 2012-09-14 17:47        --------        d-----w-        c:\programme\Microsoft Silverlight
2012-09-14 16:37 . 2012-09-14 16:37        --------        d-----w-        c:\programme\Gemeinsame Dateien\Nero
2012-09-14 16:30 . 2012-09-14 16:30        --------        d-----w-        c:\programme\ATI
2012-09-14 16:28 . 2012-09-14 16:28        --------        d-----w-        C:\AMD
2012-09-14 16:23 . 2012-09-14 16:23        696520        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-09-14 16:18 . 2012-09-14 16:18        --------        d-----w-        c:\programme\FileHippo.com
2012-09-14 15:58 . 2012-09-14 16:01        --------        d-----w-        c:\dokumente und einstellungen\Lars
2012-09-14 15:04 . 2011-03-11 14:10        471552        ------w-        c:\windows\system32\dllcache\aclayers.dll
2012-09-14 14:42 . 2006-06-29 11:07        14048        ------w-        c:\windows\system32\spmsg2.dll
2012-09-13 15:08 . 2012-09-13 15:08        --------        d-----w-        c:\programme\ESET
2012-09-05 14:12 . 2012-05-31 10:25        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-09-05 13:18 . 2012-09-05 13:18        --------        d-----w-        c:\programme\Microsoft Security Client
2012-09-05 13:01 . 2012-09-05 13:01        --------        d-----w-        c:\programme\Microsoft
2012-09-05 12:59 . 2010-02-12 10:03        293376        ------w-        c:\windows\system32\browserchoice.exe
2012-09-05 12:14 . 2012-09-05 12:14        --------        d-----w-        c:\windows\Internet Logs
2012-09-05 11:43 . 2012-09-05 11:43        --------        d-----w-        c:\dokumente und einstellungen\TanteKaete\Eigene Dateien
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-14 16:23 . 2011-11-25 10:14        73416        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-07 15:04 . 2012-07-28 12:14        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-07-06 13:59 . 2004-08-13 12:40        78336        ----a-w-        c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-13 12:51        139784        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:25 . 2004-08-13 12:40        1866240        ----a-w-        c:\windows\system32\win32k.sys
2012-07-02 17:39 . 2004-08-13 12:40        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-07-02 17:39 . 2004-08-13 12:40        43520        ------w-        c:\windows\system32\licmgr10.dll
2012-07-02 17:39 . 2004-08-13 12:40        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-13 12:40        385024        ------w-        c:\windows\system32\html.iec
2012-09-14 16:21 . 2012-09-14 16:20        266720        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-09-17_17.40.39  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-09-19 18:26 . 2012-09-19 18:26        16384              c:\windows\Temp\Perflib_Perfdata_310.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\programme\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableChangePassword"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoLogoff"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UxTuneUp"=2 (0x2)
"TapiSrv"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R1 MpKslb4a042a5;MpKslb4a042a5;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{7B9A4CA7-7DED-41FF-869F-00DB045A81A7}\MpKslb4a042a5.sys [19.09.2012 20:26 29904]
R2 MicroGuard;MicroGuard Copy Protection;c:\windows\system32\drivers\mgnt.sys [05.10.2006 22:09 40288]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [14.09.2012 18:23 250568]
S3 cmudau32;Headset Master 5.1 USB Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [28.03.2008 11:54 1422656]
S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;c:\windows\system32\drivers\MR97310v.sys [19.08.2006 21:37 116110]
S3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [25.10.2006 22:43 161792]
S3 siusbmod;siusbmod;c:\windows\system32\DRIVERS\siusbmod.sys --> c:\windows\system32\DRIVERS\siusbmod.sys [?]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSLB4A042A5
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-14 16:23]
.
2006-01-03 c:\windows\Tasks\ISP-Anmeldungserinnerung 1.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-13 02:22]
.
2012-09-19 c:\windows\Tasks\MpIdleTask.job
- c:\programme\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://www.die-staemme.de/
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: windowsupdate.com\download
FF - ProfilePath - c:\dokumente und einstellungen\TanteKaete\Anwendungsdaten\Mozilla\Firefox\Profiles\rr1dpeva.default\
FF - prefs.js: browser.startup.homepage - about:blank
 
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-09-19 20:39
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@DACL=(02 0010)
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@DACL=(02 0010)
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@DACL=(02 0010)
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODI03.00.00.01PRO"="D75DDEBEF0371A271F5ECFB3D5F5F0D0D4E0A3DCCFE91BB77F1388F8D88D717B36BFF3352AEB2784523E3B7D52667F526583EADB1605D6EB0D3DFCE626DA7CCE0B78DA3CA6765C76305C2596816472F89D7960E3094519A2CE9E5AFA6EEA1EB9F5C67154870F2DB9A61324DD629384AD5853EDD5A5D5031AAAA1FCB7CB91FC6E8A902E4025D2658D965EDF792878C66462C613D51C458A13FCD6D8E28C07139C525C180708C225B455DF964F3B7B9B90FDAD604D52067653136E7686B064ADFB48D5CA73EE41DC77ABDC188C366BBB2B6106FDE960FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D14078EDD5E5BE2F6E667A2D97226D213B5556345ED617E41E537A7F780A440DC5E14CBC718209940E4E3C7D439FA656D4B375D6EBB0066B0CA761F025A541A47228480ED5D890DCA49AEF991CF784475297B38B9C6EE3EAEEEB4E1D9B8A5F76B6951E892DE16086676ABEE0A3391CC1603FEB194702FA10317C395AFAC07ADE9F84D34C900403CA554C67C56B5EC27F5816CE9BA1A36D20ECC2B4487CCDAB772D8FC72FC25F67B2F0C22DDE5AF279ED18EA2E3C02D6DB53ED927D9B8AEF6314DD6979BE7B81EBC3F0C92B37AFACE24F95AB48A8D1532D31AD0A728EDF1A45E54848A8A1CA88A9925852301A975E9C95357E8285BC05359BA03CFE528B523A3F4B6757BFEE50B5344EF90AC5C036F4954BCB86E38241817CD0C76AA3B1EA30C33862E9348655ACB9305CC82D109CCFD0B07D3F088B7380393C5A8754FD44CC423D13CD604A2AE891EC27CB19AF3DF6717F21C2802F56236E1CFA4265F86B69F70395CB11599ADB703EB79CD1D30FDA82D06A7F12F5EB4EBA3105E83BAE2F11259217F71AE4DF2257605514F13326F8B9585C28CEF75C706D22E7D3606207FB72F33C8475AC20C463F5A460F89EF6E7B2CFD6A1D7543A18983165C4C39F4D54DD9DC934C7403FD2FB879CCCD6464AD87E03DD22CC852419ED9F70D369F9F5EB452CFE9F92E9C3F1CD1338E30D60E4FE438D75F27423396148EC7D0C859E07775277F0DAD8C21B96D0F9E6ABBEB6EEB694BA3AD5C12F88658EFBD203F59FBF136FA2771AAE6A5CE238516705D818E8F92C53D8B823BBB6B82DED626B769B916470442C017EBC4CEE6623866624976B97FE703F9B0149511C9515243B0A2E89C998B13D4FC1B1B81016366C68048B65FF5851831E246A8B80CCFB30911765733C4F19EC1CBC94B23E2DDC5BD4ED9E068DA07E39A7A5217984AF644C02227DAFC00A72DC8D51F79E21EB643ADC52A8CAFBBE99056BB0A88D7A7F990E6114F4D0F2B33CB64CF1B5161E86B8A2CC8BB5407C9BD8E354E15A9146F1CE7A8F0588AF347AFCCC0558B7F3820890E8299E4D5"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2716)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2012-09-19  20:41:54
ComboFix-quarantined-files.txt  2012-09-19 18:41
ComboFix2.txt  2012-09-18 16:53
ComboFix3.txt  2012-09-17 17:43
.
Vor Suchlauf: 13 Verzeichnis(se), 15.152.857.088 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 15.133.585.408 Bytes frei
.
- - End Of File - - 078090F683D866FFC3D1344E22B0D59B

cosinus 20.09.2012 11:04
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Horst1980 20.09.2012 17:27
GMER-Log:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-20 17:49:55
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f Maxtor_7L250S0 rev.BACE1G10
Running: l0cjuesy.exe; Driver: C:\DOKUME~1\TANTEK~1\LOKALE~1\Temp\uwldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                  section is writeable [0xB99A4000, 0x1C5D38, 0xE8000020]
.text          C:\WINDOWS\system32\DRIVERS\atksgt.sys                                    section is writeable [0xAEDCD300, 0x22020, 0xE8000020]
.text          C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                    section is writeable [0xBA4A0300, 0x1B7E, 0xE8000020]

---- Devices - GMER 1.0.15 ----

Device                                                                                    mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device                                                                                    AE6ECD20
Device                                                                                    AE704631

AttachedDevice                                                                            fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                   
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODI03.00.00.01PRO  D75DDEBEF0371A271F5ECFB3D5F5F0D0D4E0A3DCCFE91BB77F1388F8D88D717B36BFF3352AEB2784523E3B7D52667F526583EADB1605D6EB0D3DFCE626DA7CCE0B78DA3CA6765C76305C2596816472F89D7960E3094519A2CE9E5AFA6EEA1EB9F5C67154870F2DB9A61324DD629384AD5853EDD5A5D5031AAAA1FCB7CB91FC6E8A902E4025D2658D965EDF792878C66462C613D51C458A13FCD6D8E28C07139C525C180708C225B455DF964F3B7B9B90FDAD604D52067653136E7686B064ADFB48D5CA73EE41DC77ABDC188C366BBB2B6106FDE960FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D14078EDD5E5BE2F6E667A2D97226D213B5556345ED617E41E537A7F780A440DC5E14CBC718209940E4E3C7D439FA656D4B375D6EBB0066B0CA761F025A541A47228480ED5D890DCA49AEF991CF784475297B38B9C6EE3EAEEEB4E1D9B8A5F76B6951E892DE16086676ABEE0A3391CC1603FEB194702FA10317C395AFAC07ADE9F84D34C900403CA554C67C56B5EC27F5816CE9BA1A36D20ECC2B4487CCDAB772D8FC72FC25F67B2F0C22DDE5AF279ED18EA2E3C02D6DB53ED927D9B8AEF6314DD6979BE7B81EBC3F0C92B37AFACE24F95AB48A8D1532D31AD0A728EDF1A45E54848A8A1CA88A9925852301A97

---- EOF - GMER 1.0.15 ----
OSAM-Log:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:59:02 on 20.09.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 15.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"MpIdleTask.job" - "Microsoft Corporation" - C:\Programme\Microsoft Security Client\MpCmdRun.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"PRApplet.cpl" - "Intel(R) Corporation" - C:\WINDOWS\system32\PRApplet.cpl
"stac97.cpl" - "Sigmatel, Inc." - C:\WINDOWS\system32\stac97.cpl
"Startup.cpl" - ? - C:\WINDOWS\system32\Startup.cpl  (File found, but it contains no detailed information)

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"actser" (actser) - "Siemens AG" - C:\WINDOWS\System32\drivers\actser.sys
"Aspi32" (Aspi32) - ? - C:\WINDOWS\System32\drivers\aspi32.sys  (File not found)
"atksgt" (atksgt) - ? - C:\WINDOWS\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"catchme" (catchme) - ? - C:\DOKUME~1\TANTEK~1\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"CO_Mon" (CO_Mon) - ? - C:\WINDOWS\system32\Drivers\CO_Mon.sys  (File found, but it contains no detailed information)
"Dual-Mode Digital Camera" (MR97310_VGA_DUAL_CAMERA) - "Mars Semiconductor Corp." - C:\WINDOWS\System32\DRIVERS\mr97310v.sys
"ELTIMA Virtual Serial Ports Driver" (vserial) - "ELTIMA Software" - C:\WINDOWS\System32\DRIVERS\vserial.sys
"grmnusb" (grmnusb) - "GARMIN Corp." - C:\WINDOWS\System32\drivers\grmnusb.sys
"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\WINDOWS\System32\DRIVERS\hamachi.sys
"Headset Master 5.1 USB Sound Interface" (cmudau32) - "C-Media Inc" - C:\WINDOWS\System32\drivers\cmudaxu.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"lirsgt" (lirsgt) - ? - C:\WINDOWS\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"MicroGuard Copy Protection" (MicroGuard) - ? - C:\WINDOWS\system32\drivers\mgnt.sys  (File found, but it contains no detailed information)
"MpKsl3bc7a413" (MpKsl3bc7a413) - "Microsoft Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{4AB63EC9-362B-4414-B51E-3E85181780EB}\MpKsl3bc7a413.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PPdus ASPI Shell" (Afc) - "Arcsoft, Inc." - C:\WINDOWS\System32\drivers\Afc.sys
"Prolific Serial port driver" (Ser2pl) - "Prolific Technology Inc." - C:\WINDOWS\System32\DRIVERS\ser2pl.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"siusbmod" (siusbmod) - ? - C:\WINDOWS\System32\DRIVERS\siusbmod.sys  (File not found)
"Splitcam, WDM Camera Stream Splitter" (SPLITCAM) - ? - C:\WINDOWS\System32\DRIVERS\splitcam.sys  (File not found)
"uwldypow" (uwldypow) - ? - C:\DOKUME~1\TANTEK~1\LOKALE~1\Temp\uwldypow.sys  (Hidden registry entry, rootkit activity | File not found)
"Virtual Serial Bus Enumerator" (vsbus) - "ELTIMA Software" - C:\WINDOWS\System32\DRIVERS\vsb.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"Webcam Deluxe" (ovt530) - "OmniVision Technologies, Inc." - C:\WINDOWS\System32\Drivers\ov530vid.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\shellext.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} "Microsoft Browser Architecture" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "Shell Extensions for RealOne Player" - ? -  (File not found | COM-object registry key not found)
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{EE75AC21-B24F-11d3-BA80-00C0CA16AA37} "Siemens Device" - ? -  (File not found | COM-object registry key not found)
{EE75AC22-B24F-11d3-BA80-00C0CA16AA37} "Siemens Device ContextMenuHandler" - ? -  (File not found | COM-object registry key not found)
{EE75AC23-B24F-11d3-BA80-00C0CA16AA37} "Siemens Device PropertySheetHandlers" - ? -  (File not found | COM-object registry key not found)
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
DefragglerShellExtension "{4380C993-0C43-4E02-9A7A-0D40B6EA7590}" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{EF791A6B-FC12-4C68-99EF-FB9E207A39E6} "McFreeScan Class" - "McAfee, Inc." - C:\WINDOWS\McAfee.com\FreeScan\mcfscan.dll /
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} "MUWebControl Class" - "Microsoft Corporation" - C:\WINDOWS\system32\muweb.dll / hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1346857358843
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} "{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE}" - ? -  (File not found | COM-object registry key not found) /
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Programme\Spybot\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Programme\Spybot\SDHelper.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\TanteKaete\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"EMET Notifier" - "Microsoft Corporation" - C:\Programme\EMET\EMET_notifier.exe
"MSC" - "Microsoft Corporation" - "C:\Programme\Microsoft Security Client\msseces.exe" -hide -runkey

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Lexmark Network Port" - "Lexmark International, Inc." - C:\WINDOWS\system32\LEXLMPM.DLL
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"Adobe LM Service" (Adobe LM Service) - ? - "C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe"  (File not found)
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Intel NCS NetService" (NetSvc) - "Intel(R) Corporation" - C:\Programme\Intel\PROSetWired\NCS\Sync\NetSvc.exe
"LexBce Server" (LexBceS) - "Lexmark International, Inc." - C:\WINDOWS\system32\LEXBCES.EXE
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Programme\Microsoft Security Client\MsMpEng.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
aswMBR-Log:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-20 18:01:08
-----------------------------
18:01:08.734    OS Version: Windows 5.1.2600 Service Pack 3
18:01:08.734    Number of processors: 2 586 0x403
18:01:08.734    ComputerName: TANTE_KAETE  UserName: TanteKaete
18:01:09.062    Initialize success
18:02:45.919    AVAST engine defs: 12092000
18:03:38.153    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
18:03:38.153    Disk 0 Vendor: Maxtor_7L250S0 BACE1G10 Size: 238418MB BusType: 3
18:03:38.153    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
18:03:38.153    Disk 1 Vendor: SAMSUNG_HD501LJ CR100-10 Size: 476940MB BusType: 3
18:03:38.169    Disk 0 MBR read successfully
18:03:38.169    Disk 0 MBR scan
18:03:38.247    Disk 0 unknown MBR code
18:03:38.263    Disk 0 Partition 1 00    DE Dell Utility Dell 8.0      62 MB offset 63
18:03:38.309    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        29996 MB offset 128583
18:03:38.309    Disk 0 Partition - 00    0F Extended LBA            205275 MB offset 61561080
18:03:38.341    Disk 0 Partition 3 00    DB  CP/M / CTOS Dell 8.0    3074 MB offset 481966065
18:03:38.388    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      205275 MB offset 61561143
18:03:38.403    Disk 0 scanning sectors +488263545
18:03:38.638    Disk 0 scanning C:\WINDOWS\system32\drivers
18:04:26.388    Service scanning
18:04:32.153    Service MpKsl3bc7a413 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{4AB63EC9-362B-4414-B51E-3E85181780EB}\MpKsl3bc7a413.sys **LOCKED** 32
18:04:39.825    Modules scanning
18:05:14.372    Disk 0 trace - called modules:
18:05:14.419    ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
18:05:14.419    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8adc5ab8]
18:05:14.419    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8ae37d98]
18:05:14.731    AVAST engine scan C:\WINDOWS
18:05:32.856    AVAST engine scan C:\WINDOWS\system32
18:14:33.419    AVAST engine scan C:\WINDOWS\system32\drivers
18:15:33.559    AVAST engine scan C:\Dokumente und Einstellungen\TanteKaete
18:19:53.231    AVAST engine scan C:\Dokumente und Einstellungen\All Users
18:22:40.872    Scan finished successfully
18:22:52.325    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\MBR.dat"
18:22:52.325    The log file has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\aswMBR.txt"

Horst1980 25.09.2012 10:27
Hallo cosinus,

hast Du mich vergessen? :zzwhip:

:)

cosinus 25.09.2012 13:29
Nein ich vergesse nichts :blabla:
Nur übersehe ich bei diesem Andrang hin und wieder einen Strang :pfeiff:

Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Horst1980 27.09.2012 16:04
Da stresse ich erst rum und brauche dann selbst 2 Tage für einen einfachen Scan...

Hier der neue aswMBR-Log (AV-Scan: none)
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-27 16:44:51
-----------------------------
16:44:51.640    OS Version: Windows 5.1.2600 Service Pack 3
16:44:51.640    Number of processors: 2 586 0x403
16:44:51.640    ComputerName: TANTE_KAETE  UserName: TanteKaete
16:44:53.500    Initialize success
16:54:12.890    AVAST engine defs: 12092700
16:59:29.140    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
16:59:29.140    Disk 0 Vendor: Maxtor_7L250S0 BACE1G10 Size: 238418MB BusType: 3
16:59:29.140    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
16:59:29.140    Disk 1 Vendor: SAMSUNG_HD501LJ CR100-10 Size: 476940MB BusType: 3
16:59:29.140    Disk 0 MBR read successfully
16:59:29.140    Disk 0 MBR scan
16:59:29.187    Disk 0 unknown MBR code
16:59:29.187    Disk 0 Partition 1 00    DE Dell Utility Dell 8.0      62 MB offset 63
16:59:29.234    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        29996 MB offset 128583
16:59:29.234    Disk 0 Partition - 00    0F Extended LBA            205275 MB offset 61561080
16:59:29.265    Disk 0 Partition 3 00    DB  CP/M / CTOS Dell 8.0    3074 MB offset 481966065
16:59:29.296    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      205275 MB offset 61561143
16:59:29.296    Disk 0 scanning sectors +488263545
16:59:29.375    Disk 0 scanning C:\WINDOWS\system32\drivers
16:59:50.296    Service scanning
17:00:16.609    Modules scanning
17:00:20.828    Disk 0 trace - called modules:
17:00:20.843    ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:00:20.843    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8add5ab8]
17:00:20.843    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8adf1b00]
17:00:20.843    Scan finished successfully
17:01:30.937    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\MBR.dat"
17:01:30.937    The log file has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\aswMBR av scan none.txt"

cosinus 27.09.2012 16:36
Sry ich hab mich verklickt, eigentlich wollte ich das hier posten:

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Horst1980 27.09.2012 17:20
Hier der gewünschte Log nach dem MBR-Fix:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-27 18:03:20
-----------------------------
18:03:20.564    OS Version: Windows 5.1.2600 Service Pack 3
18:03:20.564    Number of processors: 2 586 0x403
18:03:20.564    ComputerName: TANTE_KAETE  UserName: TanteKaete
18:03:20.971    Initialize success
18:03:35.424    AVAST engine defs: 12092700
18:03:52.049    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
18:03:52.049    Disk 0 Vendor: Maxtor_7L250S0 BACE1G10 Size: 238418MB BusType: 3
18:03:52.049    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
18:03:52.049    Disk 1 Vendor: SAMSUNG_HD501LJ CR100-10 Size: 476940MB BusType: 3
18:03:52.049    Disk 0 MBR read successfully
18:03:52.049    Disk 0 MBR scan
18:03:52.080    Disk 0 Windows XP default MBR code
18:03:52.096    Disk 0 Partition 1 00    DE Dell Utility Dell 8.0      62 MB offset 63
18:03:52.111    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        29996 MB offset 128583
18:03:52.127    Disk 0 Partition - 00    0F Extended LBA            205275 MB offset 61561080
18:03:52.143    Disk 0 Partition 3 00    DB  CP/M / CTOS Dell 8.0    3074 MB offset 481966065
18:03:52.174    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      205275 MB offset 61561143
18:03:52.189    Disk 0 scanning sectors +488263545
18:03:52.252    Disk 0 scanning C:\WINDOWS\system32\drivers
18:04:14.064    Service scanning
18:04:27.189    Service MpKsl180d7c93 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{126F6CDE-6477-4E86-821A-4A55CF1833DF}\MpKsl180d7c93.sys **LOCKED** 32
18:04:41.611    Modules scanning
18:04:45.674    Disk 0 trace - called modules:
18:04:45.689    ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
18:04:45.689    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8add5ab8]
18:04:45.689    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8adf1b00]
18:04:45.971    AVAST engine scan C:\WINDOWS
18:04:54.533    AVAST engine scan C:\WINDOWS\system32
18:09:35.408    AVAST engine scan C:\WINDOWS\system32\drivers
18:10:01.689    AVAST engine scan C:\Dokumente und Einstellungen\TanteKaete
18:13:26.080    AVAST engine scan C:\Dokumente und Einstellungen\All Users
18:14:32.486    Scan finished successfully
18:17:51.814    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\MBR.dat"
18:17:51.814    The log file has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\aswMBR nach FixMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-27 18:25:51
-----------------------------
18:25:51.375    OS Version: Windows 5.1.2600 Service Pack 3
18:25:51.375    Number of processors: 2 586 0x403
18:25:51.375    ComputerName: TANTE_KAETE  UserName: TanteKaete
18:25:52.390    Initialize success
18:26:07.609    AVAST engine defs: 12092700
18:26:08.890    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
18:26:08.890    Disk 0 Vendor: Maxtor_7L250S0 BACE1G10 Size: 238418MB BusType: 3
18:26:08.890    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
18:26:08.890    Disk 1 Vendor: SAMSUNG_HD501LJ CR100-10 Size: 476940MB BusType: 3
18:26:08.906    Disk 0 MBR read successfully
18:26:08.906    Disk 0 MBR scan
18:26:08.921    Disk 0 Windows XP default MBR code
18:26:08.921    Disk 0 Partition 1 00    DE Dell Utility Dell 8.0      62 MB offset 63
18:26:08.937    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        29996 MB offset 128583
18:26:08.953    Disk 0 Partition - 00    0F Extended LBA            205275 MB offset 61561080
18:26:08.968    Disk 0 Partition 3 00    DB  CP/M / CTOS Dell 8.0    3074 MB offset 481966065
18:26:09.000    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      205275 MB offset 61561143
18:26:09.015    Disk 0 scanning sectors +488263545
18:26:09.078    Disk 0 scanning C:\WINDOWS\system32\drivers
18:26:32.906    Service scanning
18:26:46.031    Service MpKsl79c4a207 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{126F6CDE-6477-4E86-821A-4A55CF1833DF}\MpKsl79c4a207.sys **LOCKED** 32
18:27:00.546    Modules scanning
18:27:04.734    Disk 0 trace - called modules:
18:27:04.750    ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
18:27:04.750    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8adcaab8]
18:27:04.750    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8adccd98]
18:27:05.000    AVAST engine scan C:\WINDOWS
18:27:13.421    AVAST engine scan C:\WINDOWS\system32
18:31:53.625    AVAST engine scan C:\WINDOWS\system32\drivers
18:32:21.125    AVAST engine scan C:\Dokumente und Einstellungen\TanteKaete
18:35:39.203    AVAST engine scan C:\Dokumente und Einstellungen\All Users
18:36:37.062    Scan finished successfully
18:39:43.171    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\MBR.dat"
18:39:43.171    The log file has been saved successfully to "C:\Dokumente und Einstellungen\TanteKaete\Desktop\aswMBR nach FixMBR.txt"

cosinus 27.09.2012 20:20
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Horst1980 27.09.2012 23:52
Malwarebytes-Log:
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.27.10

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
TanteKaete :: TANTE_KAETE [Administrator]

27.09.2012 22:28:01
mbam-log-2012-09-27 (22-28-01).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 309954
Laufzeit: 1 Stunde(n), 4 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Superantispyware-Log:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/28/2012 at 00:41 AM

Application Version : 5.5.1022

Core Rules Database Version : 9305
Trace Rules Database Version: 7117

Scan type      : Complete Scan
Total Scan Time : 00:59:40

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 418
Memory threats detected  : 0
Registry items scanned    : 34254
Registry threats detected : 0
File items scanned        : 84183
File threats detected    : 11

Adware.Tracking Cookie
        s0.2mdn.net [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9F54KXM8 ]
        www.skyscanner.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.net [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ I:\SICHERUNGEN\TANTEKAETE\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\RR1DPEVA.DEFAULT\COOKIES.SQLITE ]
Die Cookies habe ich entfernen lassen.


Ansonsten läuft der Rechner ohne Probleme und auch Security-Center und Windows-Firewall funktionieren soweit wieder. :)

Nur die Fehlermeldung in der Windows Firewall ist noch da, hast Du dazu einen Vorschlag?
Zitat:
Bei der Windows Firewall erhalte ich unter dem Reiter "Erweitert" die Fehlermeldung: "Die Netzwerkverbindungseinstellungen wurden beschädigt. Klicken sie auf "Wiederherstellen", um das Problem zu beheben. Dadurch werden alle Windows-Firewalleinstellungen gelöscht und einige Programme funktioneren evtl. nicht mehr richtig."

Leider hilft das Klicken auf den Wiederherstellungsbutton garnix.

Jetzt aber ab ins Bett...
Gute Nacht.

cosinus 28.09.2012 12:57
Zitat:
Nur die Fehlermeldung in der Windows Firewall ist noch da, hast Du dazu einen Vorschlag?
Schau mal hier => Netzwerkverbindungseinstellungen Beschädigt - WinFuture-Forum.de

Sieht ansonsten alles ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Horst1980 01.10.2012 18:53
Guten Abend mal wieder,

WMI hatte ich bereits neu installiert, seitdem funktioniert die Firewall überhaupt erst wieder, aber eben nur mit der Fehlermeldung.
Naja, ich werde mich da mal demnächst wieder mit mehr Zeit dransetzen...


Ansonsten läuft der Rechner jetzt einwandfrei.


Die Tips werde ich demnächst abarbeiten.

cosinus 02.10.2012 13:42
Dann wären wir erstmal durch!

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Horst1980 02.10.2012 13:57
Alles klar!

Ich danke Dir vielmals für Deine Hilfe und generell Deinen Einsatz hier auf dem Trojaner-Board! :daumenhoc

Ich werde die die Tips beherzigen und hoffe, dass Du so schnell nichts mehr von mir hören wirst... :heilig:

Viele Grüße.


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:40 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58